01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 06:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe
Size 1003KB
Sample260701-hpkcssaw41
SHA256 01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f
MD5 8848a75079d4cda7bf11455bdd972fbf
SHA1 adc7016975f9a71333108faab063410f9adb970b
SHA512 bed3175c3ccee647b74cd928b7669ace0e827fb36399b813ab216eba1a5499155f5d45db8d11a6bd9d37ef8e96b39cddef97c1949c43420367b8bf0e5c83d1bd
SSDEEP 24576:N7MLgV83LzXYJLKSMech6ispJzc5YYmsRr6ylMwpbdgaocZT:N7MLgVLKRWTQ6Zs5DhgPm
TLSH
T17525AF13A3D50072EAB23930466FB3756D7E77210A78894D43941A7E5E72EC0AF2936F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4324	Logo1_.exe
4236	01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe
4324	Logo1_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4488	2400	01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe	84
PID 2400 wrote to memory of 4324	2400	01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe	85
PID 4324 wrote to memory of 4800	4324	Logo1_.exe	87
PID 4800 wrote to memory of 4412	4800	net.exe	89

C:\Users\Admin\AppData\Local\Temp\01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe
"C:\Users\Admin\AppData\Local\Temp\01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4784.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe
    "C:\Users\Admin\AppData\Local\Temp\01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe"
    3⤵
    - Executes dropped EXE
    PID:4236
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 143a400d5bff30f4c9780f90e58ea3816965069986210bc1efd4a4c5c2952e23
MD5 9820cecdd4b06d7db1a43b6af05eccef
SHA1 b9800c58b103ea2691eca3f5b02af1e4f1331aa4
SHA512 40a7d033bfbdf926a85d491971c8ffed0afb329fad26c7fa96f26e75fcb044512e3df05df6c22f4f15a408a283123cfeb23992680df2176f56222d69bc8e8857
SSDEEP 3072:RftffjmNox6YCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:ZVfjmNNYCk3ET+Tu3fC0zB+JHv
TLSH
T174C38C1335D08472E4B6593109A1ED71893EFD620A50DE6B33D52B3E0F317D1EE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 4d0ae402a274ea63eabef879833ddfc46c6a287b212c6c9ec953068fe23ee3af
MD5 03cdc6ec3c6157a40a42be5313bcdb7e
SHA1 c95e47d72d14f296cc9775cf26b1839678cc672e
SHA512 770f91a54f2d2f3dd0b842efb2a38704d56447633af18bba40175701ef1542ab50bdedd2f35d5a74ecce8456f571ae39a0a65657de6fa05d02b9b76be1dde38d
SSDEEP 12288:N7+EXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:N7F0Le5ji0hmxNrM
TLSH
T1E6C40916F6748335D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 297984cb1c691abf3614c0c64ed3ed1b8cbf2e2f2efae02e5392e110a717394c
MD5 0c5536c6a3aefefb2d4cc1cfbb729119
SHA1 660b05e7c4543df8ec6d4e80d6c8f3c9d667bf8c
SHA512 9f833ca254c2e29c8fa9fe95ebeb6d62a686b99dd6597761ffb2797a0b50daa531a483f6047b8bbb059c2f15abe19aa030e67d2c1198624633146d76aebc7da8
SSDEEP 12288:Bp7+sqIOkU8AMXE9B7PElZlP41N+4PUWfo:H7RBOkUhMXcBwc04nA
TLSH
T104A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA85D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4784.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4784.bat
Size 722B
SHA256 c1bc496c3e9e6ad7ce2acb885f4236b7e37cd4307b0c9b457aa106e090ae74f0
MD5 e3ec446b5090b5147024084ac89142aa
SHA1 b7d62702e5d9daafc487e54b314757b66aa12e3f
SHA512 7d899f5e0eeded192334086b4029e9e8cf58beaee883fe7414708bbc03bca110747b0ba64067c271741c4145b723c29baaab2d078b51d25716a108445c8e7a05
TLSH
T11601A751B062821FD645420B8B73D4ADCC9529BD67C73F7C7535CC69E6D061CD2FA182
MD5 SHA1 SHA512 TLSH

Submit Download

01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\01e3cbfda19c83ed4202369e1723d24ada80a026ef8c900a0a5c9ca6b77fad6f.exe.exe
Size 977KB
SHA256 bf8a9cc6a9774f7603cde0c988e8e4aae34cac0c23663dfdfbb8df8d719d41d2
MD5 a91ede8485de4f179527e94e6e6afc72
SHA1 846105578b87ef9a75333a71aca7a42e7f2e3609
SHA512 3780f36fe14a22b1411588df87a3bfeae463606164e6bcaf992adeeb4d4b29ba2b37eedfb632795650f27b83dd40f1cbd72ef8399ca0ccde76095437a285c4d4
SSDEEP 24576:4LgV83LzXYJLKSMech6ispJzc5YYmsRr6ylMwpbdgaocZT:4LgVLKRWTQ6Zs5DhgPm
TLSH
T15525AF13A3D50072EAB23930466FB3756DBE77210A78894D43541A7E5E72EC0AF2936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 5218711c28fe05f198450a813e9490fed8b7148e65898b3969cee2401959a13e
MD5 23cac9352d5d223ee86a5e97218a7151
SHA1 104b40de62d952b48fee965196644761638974b8
SHA512 0acb7d13367941ceaf36912d3ceb1ac33924b84911f9280fbfedc91fdef8c2b152551663846e3ffe4bb04e4ec137ed81a3ce23debe0a99e3f325d40d0384cbcf
SSDEEP 768:bN1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:bLfgLdQAQfcfymNG+Kx
TLSH
T1B2C2D0A932C5563DEC5D0A78CEC39A21862C5E761D5E5A2732F3BB7F0E70768240D923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-889581200-2041691093-2048517887-1000\_desktop.ini
Size 8B
SHA256 089caef252dd451f6474cb4a71db68e1e1f050b73538fffe20d8598c65c496b3
MD5 0c2b4a90bff350f25a3fcec9d23d7f7f
SHA1 8ea76cf1cbe0252a3d07f0ddec341bec69f27172
SHA512 da34008f0f75a253ad7cbc1ce91a2ba488d604f850ef17692bcb7fb5afae5cdeeefc534b404d82d8345e255b5db68ee5677fe3bba1f2b923f4110cdf7dabbb52
MD5 SHA1 SHA512

Submit Download

memory/2400-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2400-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-653-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-5035-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4324-5540-0x0000000000400000-0x0000000000434000-memory.dmp

Download