4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe
Size 99KB
Sample260511-let12aes3w
SHA256 4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473
MD5 4b3ca5dd6c15ea9279a0d9308ccaf0b2
SHA1 883d98bc62aa65d25275ccd80408360420db9858
SHA512 59d221d18a56bdb94a9c1d60f2fa17f2f51191a8e665a7efbd4dfacba83489b60a173ac246a946abfdda9790cb5ba687c78e124b48c1c0e4ce7a7e246f8897e4
SSDEEP 3072:DftffjmN7Dpv5tFA25ZA1J6Ho87kO/HdqQ5:TVfjmN/pvrlA1r81/93
TLSH
T1AEA3AE1A73C058F9D84B8234CDD2AAA1E331B81A17B9438F172486AB4F333B15D3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4636	Logo1_.exe
5248	4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-standard\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\edge_BITS_4272_861837181\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win11\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe
File created	C:\Windows\Logo1_.exe	4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe
4636	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4676	4728	4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe	85
PID 4728 wrote to memory of 4636	4728	4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe	86
PID 4636 wrote to memory of 4792	4636	Logo1_.exe	87
PID 4792 wrote to memory of 3696	4792	net.exe	90
PID 4676 wrote to memory of 5248	4676	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe
"C:\Users\Admin\AppData\Local\Temp\4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B70.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Users\Admin\AppData\Local\Temp\4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe
    "C:\Users\Admin\AppData\Local\Temp\4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe"
    3⤵
    - Executes dropped EXE
    PID:5248
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 0b391966bd150818a8cfb86fefc33a5e8d1183e649787a1ebdf4778f72f3ea1a
MD5 24efa4517902b371289a4f1b8a73e873
SHA1 f24407ba88e12d148a49b6d6a3c21f7ab694b050
SHA512 59f8f02b27c070254a2666b8a32fec3a2fd3d54979c56429552104dc24c505e3e90273ae4ee459d1106fcc3250f0075ebd129ae2bae087e4b49055c22c3b3636
SSDEEP 3072:NftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:dVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T18EC39C1335C09872E4B6683109A4E9718A3EFD621954DE7B33D41B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetClose.exe

Path C:\Program Files\GetClose.exe
Size 279KB
SHA256 65a9a5976dc912de9f7f9da66b86e6fb7624e93df9fc0f4abe4bdc58dbabb540
MD5 2df1de4e781300fe91726c69de0e2ded
SHA1 5b6cdbf3309a713c069c85f345c01e8bcca40628
SHA512 ad1ba1a5fe7e6363144f92eb6259d452e51a2d0ff5c57aa679d9c1c11e40a92e7b725e1d082558fc5fb8c17f7b0d9738a2acf22746b154ca9edd9c1a2d599b08
SSDEEP 6144:TVfjmNG/A3H/SMs6b+tQsmIWmrc6UIXdBJGrt/iFb0jN81z0TDAeV1d:p7+N3H/SMs++ismIWmr3UINT08QVv
TLSH
T1FD542326198DBD46E4DCDA75CAC67E32991AC945676A0F5231F0723F2230CFB361A3B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2B70.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2B70.bat
Size 722B
SHA256 99a5763d24cf8fbab9c3bf1f2e2d7d16c3c732589ca4c71dc1582c08941fb1c5
MD5 655d5f9c18aba9a976568a510eb640dc
SHA1 b7b6c375066fdea16a83d8caa3622bb9b458cb4a
SHA512 fa68cda89af3384ef70965c2dae52d8849a575d40589336ed4ae214b9723b6be6637005c2e184a5c4b28b7ff4b0095c2a52ee616e58581b0cb1044f5768cd5f6
TLSH
T1AF01F73D66CEC736CD40905B2BFA948F81695829BE6067405538C6E443C68CCE8FB70B
MD5 SHA1 SHA512 TLSH

Submit Download

4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\4b6a762c5a5566c01fe4c14059ee7a908dc0f6b20ce2dd3ebe351ca7fdd70473.exe.exe
Size 73KB
SHA256 28b001bb9a72ae7a24242bfab248d767a1ac5dec981c672a3944f7a072375e9a
MD5 d2778164ef643ba8f44cc202ec7ef157
SHA1 31eee7114eed6b0d2fb77c9f3605057639050786
SHA512 cb2a5a2aeba9d6f6bfc4a3a4576961244c109aafb59f02134b03ebac4d16602ee7f141cc4adc519f15030c20e7e7d6585778870706b2ea4c74c1161729101635
SSDEEP 1536:PnDpvQm1Gk/NAIL5ZFR+Emf1rFX6YczDo87h2nO/Hda5QO6F:PDpv5tFA25ZA1J6Ho87kO/HdqQ5
TLSH
T182738D5AB39084F9C84B8275CCD16A95F372B41A0775838F072886A74F333B1AD3E366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 309aa5b8da87a67fb823c26994df45c3b6fbf725af48a9ab94b206376a1de0e9
MD5 aad883847edcebde965b4624d4520e81
SHA1 9d556abe2ed44d8e0d7f0fad23b2f4a3e2d7d899
SHA512 e6ae7a6b42248fc110b64f0d1f8542b2566e01d59ffbd3799d999830e13cb3f31685664019efe44a5ede7858e7ada321b1a30acc073bee040d9746679e326ca3
SSDEEP 768:SWB1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:SWXfgLdQAQfcfymN
TLSH
T163C2C06521C93E39F4AD787CDADBD67083398EAD649E14A231A27A3F217037D1039B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-914486190-3969805341-592249730-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/4636-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-22-0x0000000000630000-0x0000000000655000-memory.dmp

Download

memory/4636-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-43-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-555-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-1294-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-5085-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-5600-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4728-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4728-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4728-9-0x0000000000640000-0x0000000000665000-memory.dmp

Download