9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe
Size 297KB
Sample260511-lppjaset6s
SHA256 9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4
MD5 4fabda01d819cd9c585bce1658b1062d
SHA1 939672b0f4860928ed9feee48bf680e4b5b1a92a
SHA512 b8f510a7b02ff602ec5a78c6eb9f3bcb5a4812f0e23cf94db61f257ea1a133c5e46262bc22902e5a4fbb2dd016310c558b63c9fdb55ef36cfe6d13c975de70ae
SSDEEP 3072:pWCkuJVLlN7tZUgyOORkOJJQcuBgEccBWdO0Q2Knvd3nL4xB8mWdO0NWdO0Bdnn8:0HuJBUBoOJCclcB6BQVnhLbm6BN6Brg
TLSH
T150546BC0B744D465FC534B30547B9FB447ABFF16ACA222032695BB5B9E73782D82242B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4564	Logo1_.exe
1128	9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe
File created	C:\Windows\Logo1_.exe	9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe
4564	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2884	3440	9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe	80
PID 3440 wrote to memory of 4564	3440	9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe	81
PID 2884 wrote to memory of 1128	2884	cmd.exe	83
PID 4564 wrote to memory of 1100	4564	Logo1_.exe	84
PID 1100 wrote to memory of 3444	1100	net.exe	86

C:\Users\Admin\AppData\Local\Temp\9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe
"C:\Users\Admin\AppData\Local\Temp\9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4169.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe
    "C:\Users\Admin\AppData\Local\Temp\9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe"
    3⤵
    - Executes dropped EXE
    PID:1128
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 8b15fe80ce4a06c1b56d57a5de3fe469d92ba86967b09136dd6540a1cdf065b2
MD5 aa62caa0553d6c92e05ae224d59eb283
SHA1 93c38e47ef1668f9c7a7a8de924a67503be2be8d
SHA512 99591e1bc67df7512b69cb1e513254048672c8b028ec9128d864d32c04bdbae0e87fd617bb4ef07e38209257ed5f81457f4b385b80e7a15f2de17ec3c8d51faa
SSDEEP 3072:p8CkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:2HuJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T174D38C1376D0C472E5B25A3108A1DE71893EFD624D50CE6B37D42A3E4F31AC1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 50ee306a57d3b139d44ddacb16f309f8d821309fcd450425a77cce48de3e53e0
MD5 1ad8c75b98ba7bfd667780560ebc2869
SHA1 6b36cb8a5da40264a980e987729dc687e56f54e1
SHA512 b65f099dd28d0c92640df2b893532f1081a38e421d0d5e4921346f116c58d85a287dd18a5e429a5518abb059915e3124936e0db82e38825989899ea987b5ba0b
SSDEEP 12288:0DXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:G0Le5ji0hmxNrM
TLSH
T1A7C40916F6748335D073C0B9C5D2A68EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 8a1893a74ec4ccdf52104250cd821b91958dccdfd56b76ea06d1822ab39f8e8f
MD5 23a05a0c17f72a64890ebc4e18b211da
SHA1 4f60b11f8b6fc6fd209048db17dabc1632a337e9
SHA512 a964227b86bb8084558e6b75410ef91293776a5d250905871d56eef4d039804674fdc2e690f9c6e16ea01b793b0d8956081bc0099a9a9b353a75cd20357354fc
SSDEEP 12288:wuhqIOkU8AMXE9B7PElZlP41N+4PUWfo:/BOkUhMXcBwc04nA
TLSH
T1F2B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4169.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4169.bat
Size 722B
SHA256 1b95218ea37bcf45150350411fb9bd3988d72fda4acaf526780496da9e1ac1da
MD5 f8abc608c404ee1c63b6a6f66ec433aa
SHA1 9641c02e4f422abd33cdf1c81e5bfaa7fcf968b7
SHA512 12a61315eec72889d5dd5b570d4fc3d185350fb0ec49b33f84c72608b314f5f158683c610365ce3a0108b045c449ee918ed348ff692955c9778a3aef2ea81ea0
TLSH
T18201A786C1D2A72A2D1C600B9677E0CF99D30C6DAECC536B8226B45836C2C0DA8FA244
MD5 SHA1 SHA512 TLSH

Submit Download

9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\9555ad266c818afa93a2caf66a2f1dde4724286df228f8bcc4b8db6862968ea4.exe.exe
Size 268KB
SHA256 2201d0c7cead566900947cf0a75346fecabb8d7da11a61d18d5bef268c34eddd
MD5 fc3396b88f31636817d31f592a0da848
SHA1 e409b5a3bfe22a2e2a0fe3364591b3506d41702c
SHA512 fef2e21bcb371ee5c8fdb705bfc60916c34d98442fcfd07b56647148883f8a92024eaba468e673d127fa759e5eb63265a986592d3f29e038f117138a69272e4a
SSDEEP 3072:QN7tZUgyOORkOJJQcuBgEccBWdO0Q2Knvd3nL4xB8mWdO0NWdO0Bdnnt1g:6UBoOJCclcB6BQVnhLbm6BN6Brg
TLSH
T157445BC0B740D4A5FC534A30553B9FB457ABFF166D6222032295BB5B9F736C2E82242B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 5d92b986cedfac0bd4daaaa03d8f136afdb20b8acea96f3edc17bf715617b2fe
MD5 2958c2e7a0a4725d6f4eea123a0c9280
SHA1 4a411ba1a3a232b7f1046eec7629cf78b2036ab1
SHA512 e8aeed96e015bc6d70b755215de3c9e876fbfcdcf58f009b42c0a00c28a07134476706489032496cd06bb38ad9a3adf3eae6fd966f6606814a44b1c7cc7d8f52
SSDEEP 384:NbbqL831Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pWQ16GVRu1yK9fMnJG2V9dHS8
TLSH
T1DCD2DFA063DDD927F6A35BF054F34F5A4826EE02DC8A820ECF14B98DCDB4F0055A5A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2122505878-652277452-2375749442-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/3440-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3440-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-28-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-412-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-1224-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-21-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-5005-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-5508-0x0000000000400000-0x0000000000436000-memory.dmp

Download