dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9

Analysis

max time kernel
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe
Size 364KB
Sample260531-jv2ppscy2x
SHA256 dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9
MD5 ac5de7b58502af558d5fb773541cf2a5
SHA1 8d6514a5ae71254f7047fb91299f56c98a0098ac
SHA512 92f96100561c3518ea42f5a573e5575bee82ba7a1675e68aa33de31ddfc4fc08918929b9bff0417279e8572ab78beee8f90a71edc5006c0083dabb2ad9a1ebb7
SSDEEP 6144:/uJPzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:YU66b5zhVymA/XSRh
TLSH
T1FB844C46E2B404D4D13AE17FA5969347F2B2BC044761ABCB1364E26D6F336C1AA3F361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4648	Logo1_.exe
4780	dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\sk-SK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2021.2104.2.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kab\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\tslib\test\validateModuleExportsMatchCommonJS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win11\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe
File created	C:\Windows\Logo1_.exe	dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe
4648	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4160	3212	dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe	80
PID 3212 wrote to memory of 4648	3212	dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe	81
PID 4648 wrote to memory of 4832	4648	Logo1_.exe	83
PID 4832 wrote to memory of 3288	4832	net.exe	85
PID 4160 wrote to memory of 4780	4160	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe
"C:\Users\Admin\AppData\Local\Temp\dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a392C.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Users\Admin\AppData\Local\Temp\dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe
    "C:\Users\Admin\AppData\Local\Temp\dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe"
    3⤵
    - Executes dropped EXE
    PID:4780
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 2c0461d7f935d6b65de38965b58082ba2c462eb2881e625a30dfc15ffe486ba5
MD5 de7635797b7d673443a28fc9035d6a98
SHA1 fbf0c7e3f87b8f34314c5663ded62e3fef5b65b5
SHA512 b8e19dd30ac4782f030eaa19f74d0c8f14e2fa8a2813c0d9c1093bf646d3e0ce86b29be74d9800ab329a43704b729124e41c52b6050973582e5aa336d56b2b1e
SSDEEP 3072:pEkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:/uJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T109D39C1376D184B2E5B2193108A1EE71893EFD624E50DE6B37D41B3E0F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 a200eb52401ab5c77632533e61dcd86c0ccfac2e5644200bfad4766aefef4535
MD5 1eb541df2a8de3167840c19a46cf1c5c
SHA1 e34f4e15d80be07a2d8c2e6a52ddb8af0ea312b7
SHA512 6009cd5b6238d7278e4a56863fc3b2a3fe73f2b363082cf836d93cf0393705ac9d2c3ba6363fe3ab896d723780e9c78a5e362ac27cf8553e5d7a74322ee61817
SSDEEP 6144:/uJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:rXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1B9C40916F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 62fb7842e5d9bd703c75fe1d30252f02ff8e0e89b9b7880d720635dea2f7c1ad
MD5 a686236a18004d3ea82f9e5118152a3e
SHA1 0237c0d9a6be99b51cdefeda2165d12440a7790c
SHA512 dbae41b35ccda8683c13384d93aa1c37e1b22869eb34e7b571e0c501e0afb2a069a39d3ae6dd1a4c811c49f67dc29d52cf0f932842ea3275e3e7590c9de8e12c
SSDEEP 6144:wzuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:w1qIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1CAB47D31E6A04037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a392C.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a392C.bat
Size 722B
SHA256 33cff8c4e3343be25bceaa4847c1b71d2b0d9c838ea2e0468b6613439acae6d3
MD5 24a1357af6a051069e91dca9b05b329f
SHA1 029e601095e51806f20a7d21bb509d6be0684055
SHA512 4b52c3b38d4e7dc0ef61e6f284a19f9e71121afbfae2cbee0a808ce8d4002764d3936c1568309696a3b12c4fd2e04a9bd3b305713021c12ae84691f768ff2342
TLSH
T12901D84E8E86FFBA5C9A8217093993DFC06194AC65F42B98C6A4C8E54CC970AF4CE311
MD5 SHA1 SHA512 TLSH

Submit Download

dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\dee107ae0fdf03fd3a9800f2752dcf51914855427cd059194f255254790578c9.exe.exe
Size 335KB
SHA256 482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
MD5 40ac62c087648ccc2c58dae066d34c98
SHA1 0e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA512 0c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
SSDEEP 6144:EzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:MU66b5zhVymA/XSRh
TLSH
T134742C46E2B404D4D13AE13FA5969347F2B2BC144361ABCB1364E26D6F336C6A93F361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 f5cef8b5ef88588572292e69845259efc19c6223d16dbeaad9425ada5c95ff26
MD5 1b664e381489e186ee9d910529d40765
SHA1 be15c3e36b5845b941222d0078fbb9357c59693c
SHA512 a42236bae4188e341c3976a064b61c86b950c6d60b522baa26804a3ae14394b34a7a485aa65d4f88927066138a71c2b9275bd1d86b1af5beb670b8e2365647a4
SSDEEP 384:NbbBvhvXRw1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:prq16GVRu1yK9fMnJG2V9dHS8
TLSH
T155D2E164F7FE66A3E6A01FF004B34F7788B5FD10E94ADA6F0E24F6890C60A405E21167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2746394149-3500112804-1243524366-1000\_desktop.ini
Size 9B
SHA256 2be12913155581b44d95c9dc1f563a0406fec594790e97756f56f0004881b251
MD5 8d2a426d67caca9b51f4cc9b3b331fe3
SHA1 de00fc45c93cb5def7f78f5b8c98825f96e96d4c
SHA512 de3784e5d7b7dbbd1fafba983050368ebe336643e79c8da7f35045060bfe3cd3bedc8ec190e93b8a3bbbf2420b274e37b4744fd3e19105915e514e0470ddf9d4
MD5 SHA1 SHA512

Submit Download

memory/3212-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3212-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4648-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4648-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4648-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4648-687-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4648-1224-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4648-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4648-5005-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4648-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4648-5502-0x0000000000400000-0x0000000000436000-memory.dmp

Download