2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe
Size 42KB
Sample260825-jfvb3syapd
SHA256 2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c
MD5 7e6ed9bde85efdef9f427edaca0bd494
SHA1 a0dd2510ca7b7e03aa4d75879d4e72a34e736436
SHA512 bd3a311decd2027d5701c3e9f24e5b926bcadb6f3b4cb48d2ffe64ba23797c5cf78554ee021f832bfba85189c9ae4a4058ac33ae6bf783c8184132e9e31c0d67
SSDEEP 768:neK1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoLqwKmTeMC7me:nesfgLdQAQfcfymNm8TetT
TLSH
T17713D0960AA524B1F91708B4D3F19B82CA3DB7A325DB507F76B5823A2F90B54120F53E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5572	Logo1_.exe
4384	2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\Locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Portable Devices\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\skins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\reports\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe
File created	C:\Windows\Logo1_.exe	2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5680	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe
5572	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 5680	1688	2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe	85
PID 1688 wrote to memory of 5572	1688	2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe	86
PID 5572 wrote to memory of 4040	5572	Logo1_.exe	88
PID 4040 wrote to memory of 5324	4040	net.exe	90
PID 5680 wrote to memory of 4384	5680	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe
"C:\Users\Admin\AppData\Local\Temp\2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEB3.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Users\Admin\AppData\Local\Temp\2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe
    "C:\Users\Admin\AppData\Local\Temp\2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe"
    3⤵
    - Executes dropped EXE
    PID:4384
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 53f6d1f5ca9aaed1115221c932d2b1d9dd247a2083b94f249e227a4ba46577c6
MD5 75a4a02b12eee351cbc515d04a3252ae
SHA1 fb2930fe1e0501b57529540741ede002a94128de
SHA512 6cbbd55f55495617c913e4a53732451d6bf77e56b136549e82c8e7fd7d783e947d93adf8098a6ddd8c525185a0722b98023d1c0b255d3368fbfe174faf3d9260
SSDEEP 3072:isftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:bVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1F3C39D1335D084B2E4B6593109A1EE718A3EFD620950DE7B33D51A3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 52e90f1f7f0a5bf15635612fb1ff57f83ab8babe962519e7e1367a3c9a15b997
MD5 fa607d23f9c472159579c77df284d025
SHA1 83e1e0aa1cfb71fb5fdceb7b73cbaf4afde4d4df
SHA512 81f84dbed2a5d185c212de0dfc7dda09a261776aa0dbd7a70d94d0523e86534de9d4a6320c323da596db61dbd0acfe02c9b911c430d22be0a8a70922d383c508
SSDEEP 12288:17+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:17o0Le5ji0hmxNrM
TLSH
T1D7C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aFEB3.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFEB3.bat
Size 722B
SHA256 826e8a971de3ac0c32f00b792ce7feac01979c721bfe2bdd3300266f3299e2d8
MD5 c8e8593f1d4b6588c6bfc712fde0d7e9
SHA1 e9d10580dbe29e59f78b3c2c193ca9a9ed0f91fd
SHA512 e791553b3868858e2975c86af48f3675df4acea1b944377727aa172d9006a70c726d618eaac12f5d3bcaf271e75f2b093212076d0998968664ea675154f56eb2
TLSH
T1A4018804818B7E6E4DF4001F05E3964FCA7A2C4DB6883E259A1683DC05D212EF2E2975
MD5 SHA1 SHA512 TLSH

Submit Download

2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2a15f61481c4c3f08718e5fc672349aca11d976abd72b304085721857644ed4c.exe.exe
Size 16KB
SHA256 79ad7f824ca1c29b5c30eba6b269542e4c06150911e78c118979006cdf5cd8af
MD5 1a2b88d7f6ccc334e2a0139dbffd447e
SHA1 11143a8192f868301ff5b2dd89cc6b1652d12e73
SHA512 894cccda63ba8e2cd8f7b488bf2792ca0073ff628f6fb60f93dad2790d28dc3f8bd97315f6da9cef402e3a1bb34c9988674d5aade8e610c6c944dc701c62ffcd
SSDEEP 192:2W7+vmg3FzkvMbLIKEfoknOee3U5nYe+PjPriT0fwnsuNa60:pM7kMbEKNknOee38nYPLr70sue
TLSH
T118725C820E3624C2F61748B1E3F5EB85DCB9BA937A92516FB6BC82052FC0B80175713D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 fece29ead615f8a7a4a13a36b8415c0fa517cc62954b77ca0c7dedb13a20a0d6
MD5 8922a4ac9c38bcb52124f9efe7e77593
SHA1 d3ed9dd3a8326e982d90926ced067b1a4bb5a663
SHA512 2e17a7c3247b5c38f89b8cb9b502bd92bbb50966662479e9fd476c207e2e1678d394fc3bb9fd3e06e2b83e9b05a83def8a0539fedeb1842f38f0cdcd01363c5c
SSDEEP 768:neK1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:nesfgLdQAQfcfymN
TLSH
T17BC2E17A25D81A74EC6A09BDDFE35702C33D837900AF647927B25D3B1260A29110EE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2370214745-1838013427-2987045292-1000\_desktop.ini
Size 9B
SHA256 1962ce70116500adabf0740e812e54bf58d48913f891249fc2b7c8e97bf58d22
MD5 774f23175963b3baec428d4996ba7050
SHA1 18dadf24eadb7a41ad3f29b5a48f8ef1262582a8
SHA512 9d47d8cda825163a0a3953310abedc8d9502a0d204558bf869b63d442dead36509281d31b55310d27124871a8ae937e31d93090ec61f0ff729104418e35e82a6
MD5 SHA1 SHA512

Submit Download

memory/1688-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1688-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5572-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5572-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5572-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5572-318-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5572-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5572-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5572-5094-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5572-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5572-5611-0x0000000000400000-0x0000000000434000-memory.dmp

Download