9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe
Size 103KB
Sample260531-l4pgvaet31
SHA256 9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3
MD5 824f06399eaa1529fcedd0cf52bf4654
SHA1 79f7d859695cec5c3b1d8f9609c2ce6aaf1f4b71
SHA512 90a3f15a1498a7d2b98a534839487284f1c7e3daed8a5e4aab7a8fd9375453b9e5706704a1ba444a049a69365e358791289108882c5816338dbd2b990159b54b
SSDEEP 3072:qftffhJCuUaXMvLDabqiHf/EvOvswKQ/:qVfhguKvL4fMvOvnKQ
TLSH
T114A38D073AB5C032D57091F04483E3A3C9BBE2B19D327EA365954A7F2E64A935D17C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4208	Logo1_.exe
5804	9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_10.0.561.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_neutral_~_cw5n1h2txyewy\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\Tented\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\dom\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe
File created	C:\Windows\Logo1_.exe	9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe
4208	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5444 wrote to memory of 3256	5444	9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe	80
PID 5444 wrote to memory of 4208	5444	9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe	81
PID 4208 wrote to memory of 2540	4208	Logo1_.exe	83
PID 2540 wrote to memory of 1048	2540	net.exe	85
PID 3256 wrote to memory of 5804	3256	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe
"C:\Users\Admin\AppData\Local\Temp\9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64EF.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe
    "C:\Users\Admin\AppData\Local\Temp\9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe"
    3⤵
    - Executes dropped EXE
    PID:5804
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 918340a6e1c88f9ea45d91540832d1a44f4c43c3b3a7b7c8dc5ea50afa393a01
MD5 e856dcbae153a438780f8da1cbac1070
SHA1 9973b61e1ae0dc97825babfae5d5bac8b4876b81
SHA512 feb7dee43eb9f2e64ccd97880dc5f013b331a22c4ed822d1f5e50a079841bf2c618155dd211b16e678d42bf0d9fa3610977d58845fee367ee3b3613466e5deb0
SSDEEP 3072:zftffhJCuUgYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:DVfhgu3YCk3ET+Tu3fCUzB+JHI
TLSH
T165C39D1376D0C472E4B2193109A5EA718A3EFD621D10DE6B33D51A3E0F316D1EE26A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupHide.exe

Path C:\Program Files\BackupHide.exe
Size 629KB
SHA256 f43d8d4ae0453676787b83c1bd28bc4705492482d039ba4664cf2da787b18e57
MD5 bb4740ef97c2a9fe646ee54e6f5ab632
SHA1 cc9c4c50d12cb2c859b498790d1aa08c219e49a7
SHA512 131c76fa9bb672fa6bd18d866c844cfe296b8681a2c11d5b8eee983cff735b16beb72d44f1d2a0798218e0184590855e1b1ba6bc48929637abb007119b1fdca1
SSDEEP 12288:kJguRDMBKHhzcyowWBJjAQtR8t9LndOR2AtCleVBVr1uGlclzc7:kJ/thfgBAqR8tbixRAY2zc7
TLSH
T1ADD4233C25822406D92F02F6DEE4B492CB2D849FC5879E491EE5FC9E11077B1AED9B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 61975168e81cca10a851d5ab360009e25b3ce0cf11d5d357fa709a418db85354
MD5 e4a3af2bcbb38195944f3167e6909804
SHA1 063ec129648c36b23d2952e6676485859c974bcf
SHA512 f21e6f17e3cb82a70fb2613e2baa76695bc15113eb809178f98017578b1f6578d9da2547558790a640b811b5919d10792b81f34bc5cb7694a4e2b16f1d72d630
SSDEEP 12288:2pJguCqIOkU8AMXE9B7PElZlP41N+4PUWfo:+JUBOkUhMXcBwc04nA
TLSH
T19FA46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a64EF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a64EF.bat
Size 722B
SHA256 c6e3be6814f73ae2351d6fe4a69d959cb83e4da735c1c3b1e97477e8f543fe5c
MD5 2a8ebdbb1c949ce6ddaf410d198ae000
SHA1 2ff9a5cb718840b7f3302ae1853ea1b094d5c62e
SHA512 1fdc5a6c63f10d0a2019869060539600da80e268f4758a9819bb48da8ccc34ced3d1f32fd5833b903e08298a0361d0cba592787079cd0983415b79966aee867b
TLSH
T1D80140D291DE9676098F6D272DA0C5DD807E19397F89B2019124D08A229644EDBE7353
MD5 SHA1 SHA512 TLSH

Submit Download

9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\9b04607d5b4972dc092b8c2b93fd96a10b8aeeb582aed0e619f8c979fc240ef3.exe.exe
Size 76KB
SHA256 5ca9f010680985f19ed8cb305018eae68d9a5cecf687c9b76211aa6bd6dbb63a
MD5 09109efb92f49b73a24976cecb9de8af
SHA1 5d87fa92edcc4ad3798d05d74a88c3ccc50f5522
SHA512 a48ff730895a548bf3fac27f901e57cb1087b5e2d9c2a8413501c5f1b4c39bed5cae451b02c3181dae944c4da850e017198745c4239705ae3a8117609af4b7a4
SSDEEP 1536:YXCqQgMQWD0UZDaPTsHiWccc/EvOvsUUjaXmLZl+/T:YXMvLDabqiHf/EvOvswKQ/
TLSH
T1F7734B072AB5C032D1B0D1F04483E267D9BBE2B19D327EA36695477F2E60A935D17C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 d10d92014b099f75953102341d6843691e5b2e705fe32984ffa12b6c913de427
MD5 056870a7d89920f27a9cd5f3cf8ffa4d
SHA1 c43e39356313cfbb25f1874a2cb42b0e86bdd77a
SHA512 f45127d4546fd7800041b9154d71ebd959a6731c478b432b2c1ff29cf2ef09847806360463fd70e6e048b97d0a8ba4c46714a0e7dcad2ef18f330cac0b54d473
SSDEEP 768:RKl1ODKAaDMG8H92RwZNQSw+IlJIJJREIOAEeF1:cDfgLdQAQfhJIJ0IO61
TLSH
T1F2C2E1DA3BC0B161D82917FCC7DB3753836CD524681F615B38D3A8BF40693E6289263A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2746394149-3500112804-1243524366-1000\_desktop.ini
Size 9B
SHA256 2be12913155581b44d95c9dc1f563a0406fec594790e97756f56f0004881b251
MD5 8d2a426d67caca9b51f4cc9b3b331fe3
SHA1 de00fc45c93cb5def7f78f5b8c98825f96e96d4c
SHA512 de3784e5d7b7dbbd1fafba983050368ebe336643e79c8da7f35045060bfe3cd3bedc8ec190e93b8a3bbbf2420b274e37b4744fd3e19105915e514e0470ddf9d4
MD5 SHA1 SHA512

Submit Download

memory/4208-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4208-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4208-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4208-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4208-684-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4208-1225-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4208-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4208-5006-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4208-5503-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5444-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5444-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download