b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709

Analysis

max time kernel
149s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe
Size 393KB
Sample260502-ka8sysfv8r
SHA256 b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709
MD5 6b009dfa83b0e16b3f26a2fff381fd2f
SHA1 2b523a959db799b09fe4730d03de0e643421eaff
SHA512 66c097104e80b6a16de307a90396d5a0d517ff0e886d99d2c771e9800fa3bf3baf27e951e1d7de18557bdd2ed60f5293aeedd43195369596c79624f60529e1a9
SSDEEP 6144:ruJOnDXYQ/BWJjmpgtBZQZKQj8p3jyb7HREd4SZ1tzLbF:xDXYJmSTZwYp32bY4qtDF
TLSH
T1F3848E0762DC3DDAD4769278677787C6E73EFC0143A6C5CF02D0425A8A6E6837A36B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4816	Logo1_.exe
3456	b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\edge_BITS_4436_2063795478\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe
File created	C:\Windows\Logo1_.exe	b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe
4816	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4796	4900	b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe	85
PID 4900 wrote to memory of 4816	4900	b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe	86
PID 4816 wrote to memory of 1120	4816	Logo1_.exe	87
PID 1120 wrote to memory of 1756	1120	net.exe	90
PID 4796 wrote to memory of 3456	4796	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe
"C:\Users\Admin\AppData\Local\Temp\b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32F2.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Local\Temp\b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe
    "C:\Users\Admin\AppData\Local\Temp\b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe"
    3⤵
    - Executes dropped EXE
    PID:3456
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 11b8cccb4555fe2c51d99bc6d5ca50279a045365fef61025c038627ee71252a8
MD5 2682da117440338ae1be1844a2f009b1
SHA1 b531095f0e4a16a0fe8f33974258894d61b11ff3
SHA512 15cb21daffda9dc09a42ef6a53618eb1ca0ca77a2c735e0325b017ebf0e1982cb454555a8ba25043a52a06ec44028393ed2aab43f5e3c617338f380c564b4ab9
SSDEEP 3072:pEkuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:TuJtYCk3ET+Tu3fC0zB+JHv
TLSH
T159D38C1376D18472E5B2593108A1ED718A3FFD624D98CA6B33D42B3E0F316C1DE25E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 6484fa4da061931d28ec072edec6dd3b2b58f7f8073e50e917e62d6d36e2c709
MD5 6cac975687c9265bf843164358ad9c00
SHA1 c84014c0a2c22fe8ac670843a624110cd7ae839d
SHA512 66b62292c7ef05b6acf4d20f59be0197414bb2a6834bfe76145c72b9268175f85cf1cdf8bb79c8d55453b82f3ad380c6362d9cb5daa4af1c4d38a4051c8dd52e
SSDEEP 6144:ruJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:/XZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T157C40916F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 2cd1ea7b5bc267846e0fb1ef348ecef353627fc52d6591b6cba1ff16408e44c8
MD5 6098ea38ec05a4b6b3cfe01ae79052f0
SHA1 6957689ee3f65766a6b340aa4c88587cc38f69ea
SHA512 620e6772ffbf931af5039db5bad754ba62c1756ef050706ae13b0574b73f451aae363497169f01b23052c83eedb3a9b635f012367d0e0923562460ae494e6823
SSDEEP 6144:w7uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wNqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1DEB47D31E6A04037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a32F2.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a32F2.bat
Size 722B
SHA256 6356f8e10077e5ad8fc49fbb35b65d6b0b36f31d2fb34f54faf01c1935c7e6a2
MD5 8b817fb2f958ad99ce4163e0a9e5a92c
SHA1 d8ddcfa483b9aa0c4dcebdece056021576a81b68
SHA512 52becefc9a88151fce5db757043d977583bda787e1ffac45fb4d1d3aacbbcdd2e4d3fda831304d40cb1d0c11afa8b5c67c9d39c60e098be16399e936360184c6
TLSH
T14701F70A55E1C67E75567326279DBCCFA3E30DE43B142B214710A4AB82C440ED4E52A5
MD5 SHA1 SHA512 TLSH

Submit Download

b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\b8be2d824ea12033b884bda56edd89410676aa962a1337cb258ad16305569709.exe.exe
Size 364KB
SHA256 b309045509efc205eb35d6037d64640093fde6c54ec5934e329b447417005a50
MD5 213eeb5e8f54231f68e5b26a0fc81bd1
SHA1 1bc31a42536eacbb57d1cd92ec4b5524a82264d2
SHA512 ce35c5f453126c98329df141f821c55692f9252549c76921c231d8170df356cda1689e636758519c0b6898f11b5c836cdb4967d296b99f915e4d1980470a083b
SSDEEP 6144:BnDXYQ/BWJjmpgtBZQZKQj8p3jyb7HREd4SZ1tzLbF:BDXYJmSTZwYp32bY4qtDF
TLSH
T11C847C0762DC3DDAD4769278677787C6E73EFC064362C5CF02D0425A9A2E583BA36B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 942a5229f4387e7009f3799fd062c8f6bf3bb2cdc305fd63a631399c3b3ac5a7
MD5 3e364d2f47bc7b3553dfba3d76454179
SHA1 af39d36685e98b3dc2ba79e645636da370b8ddd4
SHA512 e0037bfa91fd27ba004ba6cda248dee9ebc975aee09b25ff48d0a8f3438b29626655fd50704dd28a09a5bc2f1dc517f61df7e3c0d1203e27bdc41033a9830d6a
SSDEEP 384:NbbnWn1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:py16GVRu1yK9fMnJG2V9dHS8
TLSH
T13CD2BE6322BB9D2AE2545BF05853CFAAC723BD52DCCD811F79A0774A1AF170049D1F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1609746302-1884177235-1125644204-1000\_desktop.ini
Size 8B
SHA256 f96da84c600d2ec4b481df6e73e913427defe167464ec595553f2a182b60c8e0
MD5 21448c09d362f72a5d97273c447d2f8a
SHA1 1bd2664b4a0682fec291649504a98837b78d299f
SHA512 d516219a988fdbcc656410c5e2356f492d7250d1e3fff3ffdbc7fae60a5f2e39796a5cc681cf33700c3a4e3098b57265d7d2a937fbd757195904c6146a860d62
MD5 SHA1 SHA512

Submit Download

memory/4816-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-461-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-1290-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-5079-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-5594-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4900-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4900-12-0x0000000000400000-0x0000000000436000-memory.dmp

Download