99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431

Analysis

max time kernel
150s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe
Size 3.1MB
Sample260602-kap1vah18l
SHA256 99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431
MD5 5f51a264f9fd2eaab40e9e79f6c789c4
SHA1 c47707632ff27e5e1179e337fb30fa3954333f1b
SHA512 ed465530827768aae4e0c181c05978b4d8b4ca08b1174e2c1b6082420f26df2a0e8ca1dc48aad27ea8d023d9bdf9d98932c4a1c6c9336d16db3fff75f94497db
SSDEEP 49152:k7jfxcrbAjC8hMhwmCGsmzwaavduNBZ8XpVDE6B3yYgptP7cNZf/NOYqrZiAv:mfxUmCIMFavcNBZ8XpVxBgFcNH6
TLSH
T147E5BE12B3858072E4A702B16579ABBF493DFD311B7584D7A3C03E6E58326C23B3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3388	Logo1_.exe
1720	99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\lib\applet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Illustrations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\sk-SK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Projected\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win11\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe
File created	C:\Windows\Logo1_.exe	99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe
3388	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3252	1196	99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe	83
PID 1196 wrote to memory of 3388	1196	99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe	84
PID 3388 wrote to memory of 3324	3388	Logo1_.exe	85
PID 3324 wrote to memory of 1740	3324	net.exe	88
PID 3252 wrote to memory of 1720	3252	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe
"C:\Users\Admin\AppData\Local\Temp\99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C77.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Users\Admin\AppData\Local\Temp\99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe
    "C:\Users\Admin\AppData\Local\Temp\99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1720
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 2ff1e7ead1473f185bb358c86a3e4678ba383f83dbc47d673e93319b1313b01d
MD5 0c13a88810305b736a53e2f0d78013cb
SHA1 006f104d1883152a1bffb750ff655f806cb2bca8
SHA512 aabc2e9312c7488c3c0f7a029471650b6110f9792aa5d8319e5f2b366a7c899f7edc5f87d5ab49cd4a4e54dd01c7e31114851104a437e47c2eb45b0274f9f02e
SSDEEP 3072:GNftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:GdVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T11CC38D1375D08472E4B2593109A1EE718A3EFD620950DE6B33D42B3E1F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 8e68d7d22039fbc25e82c92c888ed185aa32cd1ce44600520c471760babe07cd
MD5 f78ce1b5e4e5908fc5519be55c64df78
SHA1 3b760bd7d373b9c1304d28db3c99da6ae076dd4c
SHA512 79ae09828331dac123b461fb4fa178a9c59c31c306ec08c35aa0ae3145f34533bf5b90b9ce2367afc7f5a559b0a245ceee996cc033a9b9656f92205e71fd1f8d
SSDEEP 12288:k7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:k7o0Le5ji0hmxNrM
TLSH
T144C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a3C77.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3C77.bat
Size 722B
SHA256 4f993ae0c37934f50ce56c55259dda19b197a866ecf33e8ef476a054a3d9f8cf
MD5 9bbb4867ba2c6002fdd549468df566f9
SHA1 14f79ab4d4fbc8ba9abdae9810401e5585054b0a
SHA512 6d0a4f501222ae59507b7af9893c411370d4593ad4d9ea4975c444ba33826d718fd0b27925af16d9423ae7314a96bad2a9732e0e143bb8be28a8a51f1501ae6a
TLSH
T1A2017185A1CB72D60C14205796269C8E81D2ED2E65241F783F7A941A33E2F0DF9F3550
MD5 SHA1 SHA512 TLSH

Submit Download

99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\99ff13d55d4d2f38091f62a398492028ba681674c37ee9aa1c8800c39f54f431.exe.exe
Size 3.0MB
SHA256 000869da47e788b89ed5355bcd379c6f75454f2e5025139fe58e2ff530c88332
MD5 7a84f68608b043e7c10ad54dee7ea01c
SHA1 6fbcbcf3f8bf1b6a256b034c3ee46546497ad3ef
SHA512 95e0af982ceed5ba729b18d5b82c6a3f4e25fbaa8728d54f5a64b4f96e9a913177ad8630fdb6edde5933f08a305272ae964e37c79d252ab7adb4e0914b30bf9d
SSDEEP 49152:SfxcrbAjC8hMhwmCGsmzwaavduNBZ8XpVDE6B3yYgptP7cNZf/NOYqrZiAv:SfxUmCIMFavcNBZ8XpVxBgFcNH6
TLSH
T161E5BD12B3858072E4A702B16579ABBF493DFD311B7584D7A3C03E6E58326C23B3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 9ce4f790a3ad9cb93ba0b875d0888db7e560fbbbceb022a1624252a26dde4db2
MD5 e7093a12cfd837f03fc2aa86eaa886ba
SHA1 bfeb2bd83d5d07adb9e0df6d23177660982f884d
SHA512 8ff9f31ff0e19431aec46a5ba04387ea145f42d4480911f5ea07deb9e8e48b6ce631d919746fa7446568a3a5e56c23a92f1e632379580cd286e7bdcc04350f55
SSDEEP 768:Uf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:UNfgLdQAQfcfymN
TLSH
T173C2D07A26C83578D826497CEBD39741833D0E7A055F586726F1BE7F2170B64500FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2824035265-2271499813-2042964211-1000\_desktop.ini
Size 8B
SHA256 e2216e9f68ad9e2b4808eebcb8f03d71f7490b447fa87bf0fc3a1d28d604dcf0
MD5 c0357037ecd5cfa2a23320e167485c30
SHA1 47a81f49348f372bdc7a75d54b7125bbe841a83b
SHA512 1aa212180981ed47c1a2cc8f1335e29613565fbcdbee4099d2c4d1e4f8e066656b283fa3db0a82d6a228b9471accdbd393279e59a5b296cc9848a33f5c4cf0e4
MD5 SHA1 SHA512

Submit Download

memory/1196-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1196-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3388-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3388-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3388-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3388-418-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3388-1224-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3388-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3388-5005-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3388-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3388-5502-0x0000000000400000-0x0000000000434000-memory.dmp

Download