66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b

Analysis

max time kernel
150s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe
Size 1.1MB
Sample260601-laeqjsf15x
SHA256 66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b
MD5 bdffb2ac5dee92cccd60cb989dacd9cf
SHA1 16e647bba94d659ae080d2b026cc588ab5d1b62a
SHA512 e3f51a97ba60cfc579566c02a669d2b64568619ab1c7d135ea7f53891edf5739b98cee5f09c86d35566adcd1855b9303ffc4a87a4f924cbe6a9f991757866940
SSDEEP 24576:zf9AiKGpEoQpkN2C4McuKo0GTNJpyT5RGeQa0s:z+GtCi27mVHyT+a0s
TLSH
T10C359F5AA2A401FCD4ABD2B8CA574647E7B178061374DBCF12D087A62F53AE15F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4172	Logo1_.exe
908	66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\ComboBox\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2021.2101.27.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-100_8wekyb3d8bbwe\Images\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.29231.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\PhotosApp\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe
File created	C:\Windows\Logo1_.exe	66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe
4172	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4624	5108	66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe	80
PID 5108 wrote to memory of 4172	5108	66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe	81
PID 4172 wrote to memory of 3496	4172	Logo1_.exe	83
PID 3496 wrote to memory of 5100	3496	net.exe	85
PID 4624 wrote to memory of 908	4624	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe
"C:\Users\Admin\AppData\Local\Temp\66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52DE.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Users\Admin\AppData\Local\Temp\66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe
    "C:\Users\Admin\AppData\Local\Temp\66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe"
    3⤵
    - Executes dropped EXE
    PID:908
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 9b5fd113cd86330691fbf634d78f469e160c2368d78434db131082f72a459ec5
MD5 510e4b897c7769ef48f5cce7c8d05ca2
SHA1 9b90662cca27f8273f3bd71028f83c728fde1a8f
SHA512 d04c1e60822aa86da81b73b46aa1234eb7e75cb535fd941cb1806e331b8a66cf8e69af4a4cbbd3877a7fd1b5f8234b2c864656fe8967b1f1cedcaace8ccb5b28
SSDEEP 3072:pUkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:TuJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T123D38C13F6D08472E5B2593108A1EE71893EF962CD50DE6B37D41A3E0F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddOpen.exe

Path C:\Program Files\AddOpen.exe
Size 306KB
SHA256 664414dee98b1c53d22a65f67ed0a2e0df5663a1e237a8a1746916793cc99ee4
MD5 6118bf2ab6cdcc0ad6f7aa9e66341130
SHA1 11ab4aaf222de22cacdb429536f2b0354c73bbf2
SHA512 403a98e5c4184aa874e31e1379aaa900428c7e1deb3a2c26bc3a642e7dea7d66bd4a0d91fd6889eab7f9a73d519400cf050f843be4d3853b161971769f2ef8e7
SSDEEP 6144:huJjNAHJ830IClw2DrYMo8RMksV2wAmy/t1TgvCAFYN1:yNk8kIiKkZmy/gqAK1
TLSH
T1096423B8F1E0BCC3FA4A4E70ACFFA7125692D580D8E3858D7F0779620E86128EC59417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 86a8075fd0611b8c18eb5cae71e121c7e18a4f132975a3685b8ea2695d173524
MD5 da361918b6019ccee9c8b5b2f0e92f9b
SHA1 134c2103cf316262ef4fd5a0f51fc11391eb4ecf
SHA512 3363651c2819ba512a3c8aac8843899e530e64d7da625e38765d6a923c5c555ae3829de7ffb182b3db8fd3c8ee7d6014df98a800233b9ad0ab1a67d9113cfd8d
SSDEEP 6144:wOuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wYqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1E9B46D31E6A44037D6F106B3F915D6307E7DA218BB1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a52DE.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a52DE.bat
Size 722B
SHA256 51646aaa889b31c50d90990ca3a89d8aa22c57b5c06b3d9382db35d4bf2f1940
MD5 7194f8c6bf096a43c84bab1e77f9ac23
SHA1 07b7420ba2265cf86e42099aa47cb5fc69b662cc
SHA512 2e6dfd2a191c0a8aaa57a8cb3194727ea18433adca906d67959e040ba828fad11de8a59133b4405e453cee7222c8821e50808bce01e79cf55d8b7f2f736fa662
TLSH
T117015E4397FDC6AAA864B2EB0661D99D80225BE9BF0232158FBDA96900C600CF3C3185
MD5 SHA1 SHA512 TLSH

Submit Download

66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\66c5d7dbe700e08a68a030eb2211dbcb06c040608c9a83099b12377327e3100b.exe.exe
Size 1.1MB
SHA256 a36ef4c18a08ee8d8c0d10d96ab37a0c3ce22a8f328733af8c0451579e4edcb1
MD5 09239e688ff75cd636ac932100b243f9
SHA1 2a7964c81b9a34bb77c4e3676e7d31b7d2668297
SHA512 686708321d8756ddcfa2d1585ca7261be0ece33bd9d134888cdb4655b8484c727b34b4ac7f12d919184e85ab65088bc565549c262289cb64f9aeca0508290825
SSDEEP 24576:Rf9AiKGpEoQpkN2C4McuKo0GTNJpyT5RGeQa0s:R+GtCi27mVHyT+a0s
TLSH
T1EB358E5AA2A401FCD4ABD2B8CA574647E7B178061374DBCF12D086A62F53AF15F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 b7503458f0416150c4f77156c995e7813cb8cfadbd518e8644d3ee279dd454b5
MD5 6dbcc6474ee4b0779b60574f1ffd9864
SHA1 621c114f11975e9b1b0f0914d184e3f9031a8488
SHA512 857badf38659572ef716a59bde68bdfda7f95dcfa88f714e560170b6b91374ec0d13d1ff493e9eb6b758f8cd41d79640045dcdb544773a73f237d0d04ae01c1e
SSDEEP 384:Nbb1KDAFtU31Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnj:pVtM16GVRu1yK9fMnJG2V9dHS8
TLSH
T154D2D038F3FD1862F5E15EF014E75FBA4826F421CC4AB29E5EE49D0A1E83C44EA61507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1679180529-4058988202-686829476-1000\_desktop.ini
Size 8B
SHA256 f29189eb11965eb3f457dcfc9961541cf5820960ece28657e097c84d9236f547
MD5 b2a4afee50c0667bf313e9f999f7e893
SHA1 f29707b43162626674eb6eaffdd44a0afac806f2
SHA512 bf4c3ec1fad1dba2ad0771a56aa1b163902e87d76d0844bd1aeec557f42d264143ab6f53d0b005626b19ce42351515a728aea0203ee5305e4f6a264495adcf27
MD5 SHA1 SHA512

Submit Download

memory/4172-26-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4172-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4172-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4172-19-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4172-480-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4172-1224-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4172-5005-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4172-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4172-5508-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5108-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5108-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download