713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
Size 2.2MB
Sample260807-kn9bmstycv
SHA256 713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956
MD5 a0c9f04b132b240ca0585cd508ee8671
SHA1 c3e79a80b6c5a4f6e8e5d7f0c93c38eedc874b77
SHA512 4805748597e6a79489191f57a721a4d384aa3fd329036a242bcc0b3e1c6c046184a36100b170449c04550c09a1bc415a9da492c529a140df3dab6288aab6b1a1
SSDEEP 49152:j3obGj742J2oi88Pm99MtJvuaqjJnytkho9zf3T5R:di2yvZqjJni9n3
TLSH
T18EB59E12B951D132C11303B06E3FAB7CB62DBFA96E10854B73A85E4C4FF6B90A916357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4296	Logo1_.exe
476	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Mutable\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
File created	C:\Windows\Logo1_.exe	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4116	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
476	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4116	3184	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe	89
PID 3184 wrote to memory of 4296	3184	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe	90
PID 4296 wrote to memory of 4064	4296	Logo1_.exe	91
PID 4064 wrote to memory of 4132	4064	net.exe	93
PID 4116 wrote to memory of 476	4116	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
"C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF4A.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
    "C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:476
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 127KB
SHA256 7ae6c4676e09fc323cb25e34ec3da79f9e3279ae143dbfdc6cf20e1e7ef28887
MD5 a8e055daa357f5e41d120ad89ab3ba67
SHA1 421c9ff70178c507e53887bc2aa2042ff3eadfbc
SHA512 20fa611ef8478f81cb7b03965837e726fdf2c60702783193081e262dd51c02906ab33ab02e14314a6200bd4c73f8ffc75f9c1b3199e04e7ffb1c2d322c8e7e69
SSDEEP 3072:pikuJVL3hUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:huJTG7/fYfLvzB+QFyn
TLSH
T1E0D38C1771D08461E5B11D3008A1EEB19D3FF9724F409EAB378476BE0F316D2DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 3f698febb38240205f90cc520c666f0fb45a19ab7b72c891cdb1ae5d82039b6a
MD5 6dd0bf3b535387918d789c39b2011fc5
SHA1 117d7d7a52eacc47e7a9d414a31f07891dc8c388
SHA512 be3d44dfd30e8a22ed76c3892c1866d852cd97afb1c63953df3c1edf78ab73b47382f0dc4df9627da18206cf93236b81e0361e3bff2c02d4c3856738cfc790e0
SSDEEP 6144:wcuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wuqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T19FB46E31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aFF4A.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFF4A.bat
Size 722B
SHA256 6200e4878afa46ab78ef9f93ace831e20ed3440c782d38a14d48186d90245524
MD5 15bebad9ad5756b2f2ad9327cc194af1
SHA1 00856e79975fa912d7ec926a3ea4e7d7af9f5ce0
SHA512 ed217d92ce816cd4f29993cedd64cd46d820df6443ff1ff9dd40ae3c0aa9a9c615bd292258726b1f73e1014d4a1ca8f51820cb1c8531fabf0d7654d1838d364c
TLSH
T11D01B10A87DFA74F09605C5F5EF1F89CCCE614A83F502321E56A86C816D3C0EB9C5295
MD5 SHA1 SHA512 TLSH

Submit Download

713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe.exe
Size 2.1MB
SHA256 67b009520c8811bb40570bbf1dfe62aed8fb0baae4bc4a71bbf65f91ca4c298f
MD5 ce5b370da176528b23ee66cf60cb9382
SHA1 9876602605737abb01fd40b988c797b1baa109c2
SHA512 6efd1eb74ef7e74bd7df6782b777678dc9425a564b830727fc8d34b6fdd81315247b3de9816536c211fe3184f092ba5cc087a0019e71f03e2515a3da9a32e8a8
SSDEEP 49152:A3obGj742J2oi88Pm99MtJvuaqjJnytkho9zf3T5R:ui2yvZqjJni9n3
TLSH
T141A59E12B951D132C11303B06E3FAB7CB62DBFA96E10854B73A85E4C4FF6B90A916357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 88c72aa4ae4a8c7f1ae50d7f219cbaeb01e5babf4e5dd45949b907bf0574e973
MD5 74a953ddca4ff58f9f355a6a99a8aada
SHA1 e0645f4ea25cea8ffba4c0ec9bacbc9d3effe151
SHA512 84b721bd5b9d0e7d76eb16f5ebe3dc1c2b622f1fb3b176bfc57d8c1153651af23ba975ab2bd4e00dab0f0ff5c10e7958a08be1b9c818125f03bd6c89a2483b4c
SSDEEP 768:pOvK99A99j9999999xk9999999s9999999Q99999999991P99999999997Qwdwhy:pV99A99j9999999i9999999s99999994
TLSH
T113D2BE2862C85722D6A53AF028B32FBA4526B23DDC49F20E9D64BE5B1DA08C355617C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1875162379-3804078649-638427191-1000\_desktop.ini
Size 8B
SHA256 cb7bedc97bdd2d63203eb6ba133a1f2298106db82404f9055a36ff6d137d0f86
MD5 cdafaf40f18f1b84f5c564f8618a53c5
SHA1 d6778fe9d23f3cb9ae7b983cbced89febe0167f6
SHA512 e2d158d9d6e18a5ec5b381dd92d092ba4eafd77ace54370c53ad151f7f78120a3a27846510bf5dee427adf6415eba744e277b7955cd3398430c6ed2053c542b0
MD5 SHA1 SHA512

Submit Download

memory/476-20-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/476-25-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/476-24-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/3184-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3184-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4296-42-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4296-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4296-48-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4296-80-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4296-1256-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4296-22-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4296-5055-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4296-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4296-5530-0x0000000000400000-0x0000000000436000-memory.dmp

Download