be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe
Size 2.0MB
Sample260427-mp3llahv61
SHA256 be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909
MD5 92aa75f8d89eef56e12a3804321f2790
SHA1 68de60a2e307519822d8eccbe0d7a8ddd753a1fa
SHA512 09a02b61c9a9cdaeefcf2c69fb017ec6ea037ee3625687c9bb4d3d66242f721fd1e829c7508fc84735368eda911be4bf958c91f176e4b6032d5e796e2a0e7d85
SSDEEP 24576:O7pEL5LdP8RMxwnD2PTXoazmM9bHLLuXhBXQbu2VLsTbX7d+wiwYEr0XaREX64Nx:O7pELxdEazp9L2R+lkstTP42k
TLSH
T1C3A56D32F2918837D1732B38DC5B9798986DBE102E3869877BF53D4C5F396813928297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1144	Logo1_.exe
3644	be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\GroupedList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2021.427.1821.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\Tented\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe
File created	C:\Windows\Logo1_.exe	be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe
1144	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1992	1804	be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe	79
PID 1804 wrote to memory of 1144	1804	be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe	80
PID 1144 wrote to memory of 1200	1144	Logo1_.exe	81
PID 1200 wrote to memory of 2380	1200	net.exe	84
PID 1992 wrote to memory of 3644	1992	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe
"C:\Users\Admin\AppData\Local\Temp\be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe
    "C:\Users\Admin\AppData\Local\Temp\be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe"
    3⤵
    - Executes dropped EXE
    PID:3644
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 1088287fa768fd6450d52fafb99c4b998e9ad4edd01866252b0720521c2d8895
MD5 24d1d64dd7b34b653160328557b14882
SHA1 2d0843f99e997ff995b35313efe900592a191518
SHA512 ef972f75c4cae0399a30e4db2558bad93cb56f76422e0108407104c41987e732e16219f67cf8010aaf8c8850f570160bdf459188b024650501753074c5b8d040
SSDEEP 3072:aftffjmNoxiYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:aVfjmNZYCk3ET+Tu3fCUzB+JHI
TLSH
T192C39D1375D08472E4B2693109A1EE718A3EFD620D54DE6B33D41A3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 21a228570d246f613fb8a5b3ba6d7cfaad487500866427bf1da1e338274ea55c
MD5 2d8b7ae0d90c2b241a425ae62b0ebda3
SHA1 3bcf73b12eeec7f8b7acec231aafbb72910913ea
SHA512 5a1ff7a97fba4ae53e4b441b061fe61958bf95ea29f10d2cbf7b335e770b24d9a66ba6191d8d445f77ca9cdf272583fc0469bba31e59cbe6117f74f755b4bcfc
SSDEEP 12288:O7+EXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:O7F0Le5ji0hmxNrM
TLSH
T15AC41916F6748335D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 297984cb1c691abf3614c0c64ed3ed1b8cbf2e2f2efae02e5392e110a717394c
MD5 0c5536c6a3aefefb2d4cc1cfbb729119
SHA1 660b05e7c4543df8ec6d4e80d6c8f3c9d667bf8c
SHA512 9f833ca254c2e29c8fa9fe95ebeb6d62a686b99dd6597761ffb2797a0b50daa531a483f6047b8bbb059c2f15abe19aa030e67d2c1198624633146d76aebc7da8
SSDEEP 12288:Bp7+sqIOkU8AMXE9B7PElZlP41N+4PUWfo:H7RBOkUhMXcBwc04nA
TLSH
T104A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA85D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a59.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a59.bat
Size 720B
SHA256 924d371ee6b715b6e297e9cd7a7ee069039a7838d52b5f5533549f133464ca1b
MD5 2cb252fe87936ff8828f7134f7080035
SHA1 e942f00d54d6a5858306c7c4ee23124d83ea7c44
SHA512 5bea6777d5ee1b763167d70984dbcc9e01fe9d01762deea6df5394b5f72c11414668aa5e4d7e1e825d2c677c573eb4e38ac17678382ca4ce369dcd22eca57a72
TLSH
T16201AC5782CAAE5E19D482AF9770834DC8B33C99FF1A3A288965895E32D3A09B4C5D41
MD5 SHA1 SHA512 TLSH

Submit Download

be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\be27b4c7de802d05be63aea67e39fcdeeaf730a3251689c2f7682feb083a0909.exe.exe
Size 2.0MB
SHA256 b93c0be21d71e4f3be5a7374af864d43ee020a23ee280387e1f6636928e02813
MD5 f29bd07231cfdf6007b3c0801e54f87c
SHA1 b630d6e0cfa63d67d8676649a8a692ae9530cbea
SHA512 4c99bc6178f40b9184845d477be814ed3ffc1cc54b55e07d674a9f17f5e8c43e02be90d6a8d999c0389bcbc7e197e59d7a279777d68e3d7a15342244aeddb474
SSDEEP 24576:FEL5LdP8RMxwnD2PTXoazmM9bHLLuXhBXQbu2VLsTbX7d+wiwYEr0XaREX64NTPt:FELxdEazp9L2R+lkstTP42k
TLSH
T11BA56D32F2918837D1732B389C5B9798986DBE103E3869877BF53D4C5F396813928297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 86797b8253c2e98e80a4661f7d705d6abb4f115b05170ad8e7cd850ec611a8fe
MD5 022cc19eded4a8f78025305e57e76725
SHA1 f638c25d6462cda87de8b65fbec7f3cd32b4b11d
SHA512 919e6fa9d4f1f8b28eee5175647431520e1a88c723ce303803894e6c5051c4d1d0c097274b2a5bae16935e746196dede90fde3f7a17719320a122c0e04a9522a
SSDEEP 768:S1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:0fgLdQAQfcfymNG+Kx
TLSH
T174C2E07421C82E39F846BE7CCFC74721833C8AB6156E17A525F2847E1D60B79202EA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3119821332-640943685-2562343641-1000\_desktop.ini
Size 9B
SHA256 269dc3d27cf579ffd3ce12dd38c7363df12c3132e3e789b6c9243f7a3d535e49
MD5 ccd74aecbb22745244a531e9fe57733e
SHA1 20958f52e7e8c3145521f291f791c00f665bde75
SHA512 63202f6fbe6ee0cca0497f17246f6f4a6f6d2f904cb05dba1449ec6b296122644f8bc7c5df1830c6932f2ba331acad1bae4e13311d30dd1e869eea80ad53bff2
MD5 SHA1 SHA512

Submit Download

memory/1144-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1144-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1144-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1144-5523-0x0000000002050000-0x000000000210B000-memory.dmp

Download

memory/1144-31-0x0000000002050000-0x000000000210B000-memory.dmp

Download

memory/1144-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1144-42-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1144-21-0x0000000002050000-0x000000000210B000-memory.dmp

Download

memory/1144-418-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1144-1232-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1144-5520-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1144-5015-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1804-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1804-11-0x0000000002050000-0x000000000210B000-memory.dmp

Download

memory/1804-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download