0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe
Size 308KB
Sample260831-cdgvmsec98
SHA256 0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d
MD5 76b3cf774c80c1409be06e08093e8157
SHA1 86076094e04e3144cd29d63f0a384d71d3a410dd
SHA512 2fadd1358fccc480dd963ebf7633b5f29c868d5f64b7eb444f74d8af2a284171453b194471200973170c64e2bfc29b8542d403d9b137d3fbecf9b39fbac0fe43
SSDEEP 6144:6VfjmNW0VPUgjnRtnNlW4+WD8TbVC2arZ:07+9TjkWIw2y
TLSH
T1F464C51927FC4954F5F7B23989B18655DAB3B8915B32C3CF1290823D0E73AE4AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
860	Logo1_.exe
3556	0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Views\Utilities\Styling\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\7-Zip\Lang\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kk-KZ\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\jscripts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe
File created	C:\Windows\Logo1_.exe	0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe
860	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4720	2320	0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe	84
PID 2320 wrote to memory of 860	2320	0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe	85
PID 860 wrote to memory of 1576	860	Logo1_.exe	86
PID 1576 wrote to memory of 4520	1576	net.exe	89
PID 4720 wrote to memory of 3556	4720	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe
"C:\Users\Admin\AppData\Local\Temp\0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D76.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe
    "C:\Users\Admin\AppData\Local\Temp\0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe"
    3⤵
    - Executes dropped EXE
    PID:3556
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 25e21eb100db118b5aac95b58e49241828653429ab5eae354c2b93642dd7cdda
MD5 23bcb584a890d24522ed58eaba60741c
SHA1 9316b3c8a3b918c05f362fb82b4d5ecd8e831e02
SHA512 11f7218451ef78072cca1d051739164994eedd8479178f45d1c6c9698268ad8932be255d59797c8909f7deb337de6255858eec76148614a629e5b0b9be159c66
SSDEEP 3072:NTftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:VVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1B0C39D1375D084B2E4B2593109A1ED718A3EFD620A50DE7B33D51A3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 73798a0314d5da3649917a517210b6f63dfe61e03bf7c61c95d32620c947490f
MD5 51f6d1346546b3814e967f76e745facf
SHA1 a2f38267ebddf43ae27f4b43ff2029d8c439b8d4
SHA512 a90232e257de7ef01c4716af2094577fe53e36a404e7951868510fa072c72e94acba6d94febca93d4a91fb3fa5b6879a8291921d6065b69b03865ed745bbd8aa
SSDEEP 12288:07+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:07o0Le5ji0hmxNrM
TLSH
T11BC40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1D76.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1D76.bat
Size 722B
SHA256 9ffa0511810c9e22991579c5b524d087919dbf983211db24e780c2fb379cbec7
MD5 d32416006dcccdeb124b4a19e306ce90
SHA1 a6c9c6e0162de3eeddf98de6c984206b5f1795d8
SHA512 cb54fbf99f65874d255a95dd2a254cc5e5d025e268a8d9a0cb410f03fb407ab2c0f6f19476d82a37a094ac5494bb2a1240c633d3bb6b3ff165dce48568700e35
TLSH
T186012880D1D7656FACD05167AEA3508CC6F209A62EE9E72C0244C60C9443BAD7ACE1AD
MD5 SHA1 SHA512 TLSH

Submit Download

0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\0228a43ec8a36218d738a347a519ac98c7aa6e61d5db13282453aa1a713a805d.exe.exe
Size 282KB
SHA256 9f4475b0636618155a1e6cd38d10400154e23e9820dfe7a52e6b541b0f373bd9
MD5 41a889d74cba938c938df538810afd91
SHA1 5b29c7185f7db34200a157fe30b92d1dcd489153
SHA512 fe1e81ca27e97e6704924fb63ad311af23f841e6cc2031172982dd8b6e545788bc344cd949946128e84102b6e7b50db07146948a5fb217745c3cb3c78eb3066a
SSDEEP 3072:a5VvsVPUSHmEk6vQWW8mw7T33RtvgdURr7RW1i4MPhEej1D8TboZwC2IMktEXwVd:y0VPUgjnRtnNlW4+WD8TbVC2arZ
TLSH
T1F354A30927FC4954F5F7B23589B18655DAB3B8919B32C3CF1290823D0E73AE5AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 4cba02b04ffc71c2f61167bc3f7addb9f9b89bdf12f4e0ba1c9ff11993edc5bc
MD5 adee68ac00fe69eb423c352b7b2da469
SHA1 824c526e222550a0e8e7b853a66343287bdeeaaa
SHA512 1a497dff20d3198be807708f27b4a3cd71cad7fab71d00e5695f86ae2422f9ad6778fb19a2048d5cffe860d345bea0772c1bae229985296b3c2be3029d8577bc
SSDEEP 768:Il31ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:ITfgLdQAQfcfymN
TLSH
T12FC2E1FA26CC167AEC660E7CDBE31711833D073B45AF58A525F28D7F2250768110EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1788976790-1541110888-1636651838-1000\_desktop.ini
Size 9B
SHA256 48fc246849bbf8829b4f8949e19ffb9de4020b7e65df5ab0bdedfdbbdb956880
MD5 3e7714d68104ffa0b685f025be924834
SHA1 d91683bde0bea0d8cab7f8d6c29ee9bcf478c625
SHA512 2dad49b79fae347aac4e1bb7b8bd50dd7c3ad4c9fd2179f3a4fac7c6db24d46cd8d41b38a48f47a3e412cc29682522e22c6afb463c7bb6d14136a918e27f1f2d
MD5 SHA1 SHA512

Submit Download

memory/860-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-494-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-5035-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-5538-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2320-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2320-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download