ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe
Size 149KB
Sample260908-eha9rscl9t
SHA256 ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b
MD5 f79d8f61aa9dd6b9db160b63edc9798f
SHA1 c1d6150738effa56d1ba5c03cd36190de3d7b46e
SHA512 e0799cc78588561a373b60618508eaa8ec199839233215e8ceefcbad62700917bf7139a1f31880e0e1e18e05b7dd857fa32be0089bc24703be90952b1c9721bd
SSDEEP 3072:sftffjmNJ15Ka7YkMoqMsu0yaML/J3ntvrzxiqCFBzRjq:0VfjmNJYdBMlaM9nJzktFBz0
TLSH
T1A5E37B57B2A430F9E43E8638C9A19A05E77278750765CBBF037442AA5F233D18D3AF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4828	Logo1_.exe
3240	ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\cs-CZ\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\locimages\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\swidtag\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\reports\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe
File created	C:\Windows\Logo1_.exe	ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2880	1828	ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe	85
PID 1828 wrote to memory of 4828	1828	ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe	86
PID 4828 wrote to memory of 4968	4828	Logo1_.exe	88
PID 4968 wrote to memory of 3084	4968	net.exe	90
PID 2880 wrote to memory of 3240	2880	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe
"C:\Users\Admin\AppData\Local\Temp\ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1652.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe
    "C:\Users\Admin\AppData\Local\Temp\ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe"
    3⤵
    - Executes dropped EXE
    PID:3240
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 eb6c0babd5422cd28ab46d0ba60838f261b4d19e5848fb92f11ed767a9f7a010
MD5 c7d783efcea2901cbfd8c24d94bbbfc1
SHA1 afab716466994ea28a1a878ec72821997f17b705
SHA512 92e2bf970a59718b9087849f7013221885aeaebc27bb1b1598bade85888f1c284bcf0b427d7d8b414ba3924cf4e853180353c8507b27a7c7a3f53b67a70b3abe
SSDEEP 3072:AftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:AVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T104C38D1335D08471E4BE593109A1EE61893EFD621950DE7B33E51A3E0F316C1DE2AA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 560e90cd5f05c883eec9918784c439b059189117dcfce05471d09d525cd8e498
MD5 7b83ab8b7748169ee924ec89a86e8995
SHA1 02be53a255d8b2d79e204d8daf76cbcd80fe4f82
SHA512 6d38c416b39332ab6a2788e621bba006b9b8173b78dde3dca6f8c20c2578f690654b29fb1186910c169bf45107645f8ff3c227a7406f38574d1b33bed870e359
SSDEEP 12288:27+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:27o0Le5ji0hmxNrM
TLSH
T1C1C40916F6748331D073C0B9C5D2A68AE97130865B308ACB4296D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1652.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1652.bat
Size 722B
SHA256 021b5879db257399e2e99548d5d071ff3a3e6d58245d54567d8eb1878f734c80
MD5 e49465f68d453c3e9c9df4fb6b5648f4
SHA1 cc0893814dd11c7da115b5509c5725694230aff4
SHA512 ebd92dafdb9be121c542b425644c58f9b57e7acd22a587796d27553b4d8e678f574aa45f63759a29c99be7e514f9d2253ff2a946d22c44261174def6a29c30fd
TLSH
T17F01D437C185F75F0D44B41A5295EDAE96E30ABC3EC1231E4E3A589D3D4030EB5A2322
MD5 SHA1 SHA512 TLSH

Submit Download

ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ccf3fda087359e969711378d31edf89e55023fa32fe7bfda28420926baf5431b.exe.exe
Size 123KB
SHA256 0e7d56c83e15ae6c4f9a6e5e04259cbf30ec1b0d304b134143ce350f4890b412
MD5 553cd8089ca43fa1fdfc659b3c25226b
SHA1 a2a24901bf04a03ab74448d50ca304db84060a1f
SHA512 5372bc3c5ad81f9a56c71102e665763cc085fcdbd8e636d1fde6115b57dffbb03fae4182a00d58adfd1ec08c2ec8ff70e091a2a1b6df12db41a3938dd30f680d
SSDEEP 3072:115Ka7YkMoqMsu0yaML/J3ntvrzxiqCFBzRjq:tYdBMlaM9nJzktFBz0
TLSH
T1A5C36B57B3A431F9E4778638C8619909E772B8710B61CBEF035842AA5F673D18D3AF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 8811a675b39c090a9c33ed6b6773391ca9a5438ef6ba906294a10578ee967ecb
MD5 d8aabf9ec8a59d7d7651519c2f979a40
SHA1 c98e0f729dff0ecd48f229abb2164b733dd3506b
SHA512 1a1d2b21680443d1d2e820732d515bb066a0cced450e97343dcfbfb68e2a3acdcf970bd77926618f358371c739cc0d1efeca8795038472e210f0ba01c00bac4a
SSDEEP 768:K1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:sfgLdQAQfcfymN
TLSH
T1FDC2CF7922C81974D81D4A7DCBD35B0182394A6E689FEC7627F34E3F63606161C0EA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1074038928-2032447174-945360078-1000\_desktop.ini
Size 8B
SHA256 9179d04e2c73a3f2dc2b81dbc27ec1eb04d5ff033e13e36d2437bb8396aaf876
MD5 c376a1cb41cf27cd248b09ca298bb9af
SHA1 eda60ca57465ff189852ea52b4c4e6805271190b
SHA512 946d81479e496cbd82a83c229d294441921de1809dfb2e67ec9a9297e7c2ba2a5ffee9b04b13bbb640825634b3fd2b18a507560125cc59092794ebaed6e54501
MD5 SHA1 SHA512

Submit Download

memory/1828-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1828-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-418-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-5035-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-5550-0x0000000000400000-0x0000000000434000-memory.dmp

Download