707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe
Size 364KB
Sample260531-k3kltsdw4s
SHA256 707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142
MD5 4bf5ce17c3262cf800a2031c0f16061c
SHA1 1f12be532946f2a4a03a5ad38c5faf2acc567860
SHA512 28a615bed6e5970b8e52233041e35a5150326eefd06d38d1b5ad160ffc884d908387545e7eb8cfa6223f1972ee62121248f65909af0bdbc43ee31e4c930a4206
SSDEEP 6144:tHuJPzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:tgU66b5zhVymA/XSRh
TLSH
T1C0844C46F2A404D4D13AE17FA5969347F2B2BC144721ABCB1364E26D6F336C1AA3F361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3876	Logo1_.exe
3060	707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.1.2.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleAppAssets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\bg-BG\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe
File created	C:\Windows\Logo1_.exe	707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe
3876	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4032	3680	707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe	81
PID 3680 wrote to memory of 3876	3680	707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe	82
PID 3876 wrote to memory of 488	3876	Logo1_.exe	83
PID 488 wrote to memory of 3020	488	net.exe	86
PID 4032 wrote to memory of 3060	4032	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe
"C:\Users\Admin\AppData\Local\Temp\707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3285.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe
    "C:\Users\Admin\AppData\Local\Temp\707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe"
    3⤵
    - Executes dropped EXE
    PID:3060
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 829973374079cdfb6f24e86619c47e61844316dd0f7a872066348f5f2bc5aa74
MD5 6c9f57eb65abc58702b626415757863f
SHA1 a6b00ba9ffaea74afe84bb2426a61a41f6b9a516
SHA512 568bc2dc90973fb4eab7f22b47939427f436502038caa6e96f429e31e7be85e113ddc23f6abed314b6c21b9d8c60d8f9e2b84b64dc128ab33116290494a24abc
SSDEEP 3072:pbCkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:1HuJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T1A5D39C1376D084B2E5B2193108A1EEB1893EFD625D50CE6B37D41B3E4F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 c7c8e14891bff9a0fad52a64cff6fbd8f97635f243153b7edc2fd3a7d235469c
MD5 f89969396f0e81adb2ae28807bcb8ad4
SHA1 09219530bced5110bf696acb3f0029a3d1730f4f
SHA512 68bde73ca368161d581289a6f44348d58a54d523d4c05aca05a74360c69f8ac578a5b3a3c3a62323fa65ee3825539a31d47f8f2bd63f01d8e93c84346e520155
SSDEEP 12288:tDXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:70Le5ji0hmxNrM
TLSH
T1A1C40916F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 8a1893a74ec4ccdf52104250cd821b91958dccdfd56b76ea06d1822ab39f8e8f
MD5 23a05a0c17f72a64890ebc4e18b211da
SHA1 4f60b11f8b6fc6fd209048db17dabc1632a337e9
SHA512 a964227b86bb8084558e6b75410ef91293776a5d250905871d56eef4d039804674fdc2e690f9c6e16ea01b793b0d8956081bc0099a9a9b353a75cd20357354fc
SSDEEP 12288:wuhqIOkU8AMXE9B7PElZlP41N+4PUWfo:/BOkUhMXcBwc04nA
TLSH
T1F2B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a3285.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3285.bat
Size 722B
SHA256 23ebbc5c539c99dfa18b462e5addd0f53526ec0587b5f7c5985211869c013a40
MD5 8534856217b57091eb45834a7c08f8ac
SHA1 1a355094c851966a175982667532f9634e468ea1
SHA512 b1a3ca1ed863f643ee8c81c63395ac746ecab45d9267a198ec8a0244127c055d492652a3aa61172a5dd910129c2675940d3004a4515d66943f27d3e0d200b64a
TLSH
T12E01F5138283F63E485C53270AE0D4CC90A2686C3F7D7B9E4E2099A83B97C2E5FCE545
MD5 SHA1 SHA512 TLSH

Submit Download

707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\707519a14bf8610348609367b65480931efc5864d1b9273149e2227f2160b142.exe.exe
Size 335KB
SHA256 482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
MD5 40ac62c087648ccc2c58dae066d34c98
SHA1 0e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA512 0c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
SSDEEP 6144:EzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:MU66b5zhVymA/XSRh
TLSH
T134742C46E2B404D4D13AE13FA5969347F2B2BC144361ABCB1364E26D6F336C6A93F361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 7e26b153faa355720bf478e6f8cff1a161c8e08b62e7b9d8932c5ff75325a5b5
MD5 44fef5736d5028c2ce6b77dafbcf4766
SHA1 f5903fe1e776895a4785bc6ee1c7dc6967b9bc58
SHA512 7124a1d15d6b6785b438691ee9cf3c458133f8f2e6c4a56b68ce8f68dca4b92d99e5afc9a17f662aa8e5f9adb9916a589f337803e7ba72de928e7242affdcee9
SSDEEP 384:Nbbd00L831Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pCIQ16GVRu1yK9fMnJG2V9dHS8
TLSH
T1D2D2E16473DDA567E6A11FF058E3CFA64426FC10EC4A824F3E54AB4FCCB05109DA2A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-125073035-2952146151-721812867-1000\_desktop.ini
Size 9B
SHA256 2be12913155581b44d95c9dc1f563a0406fec594790e97756f56f0004881b251
MD5 8d2a426d67caca9b51f4cc9b3b331fe3
SHA1 de00fc45c93cb5def7f78f5b8c98825f96e96d4c
SHA512 de3784e5d7b7dbbd1fafba983050368ebe336643e79c8da7f35045060bfe3cd3bedc8ec190e93b8a3bbbf2420b274e37b4744fd3e19105915e514e0470ddf9d4
MD5 SHA1 SHA512

Submit Download

memory/3680-12-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3680-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3876-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3876-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3876-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3876-503-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3876-1224-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3876-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3876-5005-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3876-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3876-5496-0x0000000000400000-0x0000000000436000-memory.dmp

Download