c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe
Size 1.5MB
Sample260831-e2jp9adk3z
SHA256 c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f
MD5 8c9f5f0eab572b76e39d4e385ddc0941
SHA1 c810cc749c83586f9e7e60472135128d6779e772
SHA512 d607d61fdd3733457ec1e4b3bfa81ee5a58c5f27213de3921e0e4155ea6611d2e250088720f288772ddf5a489664273017bf1302911541c65aa687df3cadb915
SSDEEP 24576:CpMmpHu4q7+uHbBSUldP0v7fE66tsgsQSURrvibas8PyC7mYV:apO4q7rHbBSUldP0v7f8IUhabas4f7mk
TLSH
T17075D53CADA842A6D472CA75C5A1A9CDEA2178127B041FCF21D2534E0D3FBD36D71E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4444	Logo1_.exe
1948	c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe
File created	C:\Windows\Logo1_.exe	c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4528	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe
4444	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4528	4296	c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe	84
PID 4296 wrote to memory of 4444	4296	c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe	85
PID 4444 wrote to memory of 864	4444	Logo1_.exe	87
PID 864 wrote to memory of 4720	864	net.exe	89
PID 4528 wrote to memory of 1948	4528	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe
"C:\Users\Admin\AppData\Local\Temp\c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a504E.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Users\Admin\AppData\Local\Temp\c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe
    "C:\Users\Admin\AppData\Local\Temp\c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe"
    3⤵
    - Executes dropped EXE
    PID:1948
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 126KB
SHA256 e81fb67b945f156f194b9628d9b772a5f1cad732bedcd9d7012c577bd96fdce0
MD5 67550609997f26c2dffe435f97625ad4
SHA1 c14915acb822c303c437a7c23af6fb2988f68dd8
SHA512 60837ceb931e118a6f0ad9175cc10614003a131aeb697ae2674c8216450676fe909c954a3296c80035eebc30de71ba0fd3e7589cc41f8e67743a0bf5ebe3c862
SSDEEP 3072:TkF3pzYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:IFpzYCk3ET+Tu3fC0zB+JHv
TLSH
T1FFC39D1376D184B2E4B1593208A5DD71897FFD620E50DE6B33D81A3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 576KB
SHA256 aab792014c7484107a7c2cbd17d7667fecff800c7be9f7acd7a9dc593f86eb49
MD5 65368c94d31a85895dddc703893d334e
SHA1 b21b60b6e0d88ec07faa6417ecc3ac65f3c7469b
SHA512 35c6c71fe7acab0216053f2c362aa1f6a6435b3b93660fc486303b08ff4598f32ac8b866677a5411823cf3d2449d83a9dc2e0f4e5c194799ef938f62afc48e76
SSDEEP 12288:CpiXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:Cpm0Le5ji0hmxNrM
TLSH
T1DFC40916F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 482KB
SHA256 2c7657fe57ec426599ef848815689264720ffed5a0f9a5d33d07cafabeb43bf3
MD5 ef2faa6fbcf12b63da1cf3e9283ad1cf
SHA1 2032ddc0f6ed9560583f70a279ca858b1e746409
SHA512 46b169f4142d45197207d0015119145c12eb01150c6b742c5f3792b01d2e23bda9e25e181144f4b9963eefcff7ccb9d37fad4d27b044753325ceeaea330fa00b
SSDEEP 12288:LxpKqIOkU8AMXE9B7PElZlP41N+4PUWfo:FpKBOkUhMXcBwc04nA
TLSH
T10EB47D31A6A04037D6F106B3F915D2307E7DA2187B1194AB9394AE2D3EB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a504E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a504E.bat
Size 722B
SHA256 d6448c288662579ffa9fd73862ea0e85acdf80a55d0f20f408bb80a1d65e585b
MD5 75ba038420882428d36d07677226c8e3
SHA1 ab821cab0ad83f27cf65f100cce56fab6de10701
SHA512 7b6646355ba5cdc437f04807943f9c7f36a819e092c9d35389a69d3e624e3885c8a8b9fcbf2465f3ba0d77e6dcf218b592e4034c875a4ee4f3003f531762772c
TLSH
T14C0121B044F142266D8FF05A057EEBBFB19AAD5C7EC0331586A8C8DA55D130A9DE3D41
MD5 SHA1 SHA512 TLSH

Submit Download

c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\c33cb309399b7d698bc054407a831aff7f10861ec399409b8f12ac89d5d9416f.exe.exe
Size 1.5MB
SHA256 c58513d9d49cfc4a492b40ae3405cfefb9ef715d4df2ace2da64f586b12d50cc
MD5 d092dff555e92fa9d9528d6c454cab01
SHA1 73c4a87befd4c6a19c861ecc4e71ef2de9cd7668
SHA512 cbf522f28a9844fbe38340a7d02345b28a1174ca3f92d7759a5c916699f70cedc3915f8f1850a43337b635739a51ee5538fa10050ca72b16aabef64b84db07d0
SSDEEP 24576:RmpHu4q7+uHbBSUldP0v7fE66tsgsQSURrvibas8PyC7mYV:0pO4q7rHbBSUldP0v7f8IUhabas4f7mk
TLSH
T1A565D43CADA842A6D472CA75C5A1A9CDEA2178127B041FCF21D2534E0D3FBD36D71E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 27KB
SHA256 a9617d9d615996072c1e04f0e3e5ace43a01fcede96839168d93543c1a1f428c
MD5 d94aed5911f67e32ff417cbbdc04013d
SHA1 a9d0ffb374c07fbb3f88194cb8f446d71ecbca9f
SHA512 c57d5fd98dda3bfcb0f699b4a61ac158ed3f611e42b0e52cf751954de71d04e2af2c571f1919b80c25710e8b17ff7a80d3c33785b84c5e08fcac85457b4184dd
SSDEEP 384:MlSrP1Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:dP16GVRu1yK9fMFLKaTxsujCT7pZpY
TLSH
T148C2C0B01E877691C08017F608DBC76746F6695B9EDF3A4E69B83C5B2CB0B05446EA0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2937465464-4167303362-2236413517-1000\_desktop.ini
Size 9B
SHA256 48fc246849bbf8829b4f8949e19ffb9de4020b7e65df5ab0bdedfdbbdb956880
MD5 3e7714d68104ffa0b685f025be924834
SHA1 d91683bde0bea0d8cab7f8d6c29ee9bcf478c625
SHA512 2dad49b79fae347aac4e1bb7b8bd50dd7c3ad4c9fd2179f3a4fac7c6db24d46cd8d41b38a48f47a3e412cc29682522e22c6afb463c7bb6d14136a918e27f1f2d
MD5 SHA1 SHA512

Submit Download

memory/1948-28-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-23-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-21-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-20-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-19-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-25-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-29-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-24-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-26-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-27-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/1948-22-0x000001A1229B0000-0x000001A1229C0000-memory.dmp

Download

memory/4296-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4296-13-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-31-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-33-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-40-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-45-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-49-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-401-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-1258-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-12-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-5047-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-5562-0x0000000000400000-0x0000000000435000-memory.dmp

Download