5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe
Size 2.1MB
Sample260601-mhtecabt7n
SHA256 5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59
MD5 21e5a217dfa1d3e2a1b1e3e0edebe1c0
SHA1 ccb2339b8663fb7edaac8ebd93f1d0c820869973
SHA512 d193cb4c57c9779e3d9dce0ade696d360e0260b1ebd5712e1963592f654254fedac80634d1e6997389aff3f0ecc4537886ffdb135b389d8c6a29f38f728df1ba
SSDEEP 24576:Q718sxGGugpiusL62+t5zgCouaYYO2M+swYuiAAr4xx6CyA:Q7esoGuF+hYO2M+swY9AAN
TLSH
T158A50692F7C8C6A0F6320572C07598F7262E7C1AED54560F35C27E6B3873B8A4869E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5060	Logo1_.exe
3284	5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{98BD060E-1D1C-40BF-8DA9-CB787874DFC8}\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\KeywordSpotters\en-AU\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe
File created	C:\Windows\Logo1_.exe	5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe
5060	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 4392	3220	5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe	84
PID 3220 wrote to memory of 5060	3220	5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe	85
PID 5060 wrote to memory of 1992	5060	Logo1_.exe	87
PID 1992 wrote to memory of 4088	1992	net.exe	89
PID 4392 wrote to memory of 3284	4392	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe
"C:\Users\Admin\AppData\Local\Temp\5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4987.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe
    "C:\Users\Admin\AppData\Local\Temp\5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe"
    3⤵
    - Executes dropped EXE
    PID:3284
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 3054a6b360e81a279343b7320f7641389bd506eddcf735d5fb7364436fb0a4d1
MD5 aa7ad5b5c3c857ce36d6e89d0c815932
SHA1 9f09a4ba2cb4f519765a35d89585d2319f0efc96
SHA512 6c447ea6b0f00769f7ae258ff324a9449de5dfe62617f27c9383616af3bcf9a1200a4c3f927cef7a32dcd159f09437c98bce0f63cd41dacd34d5c98897289ef7
SSDEEP 3072:dftffjmNvYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:tVfjmNvYCk3ET+Tu3fCUzB+JHI
TLSH
T1BBC39D1375D0C472E4B2593109A0E9718A3EFD620950DE6B33D52B3E1F316D1EE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 a0de01f52243bc0130b1a2d340b5aff6cfdec03d6de47cb63346a5caf9249107
MD5 1ce191f1b4b2f8cba6231f4f6c2cb405
SHA1 825a38e3cc3fb651fbb61e14ac4ccc2b597ba984
SHA512 b2be38abb3c192af05f44c0788cad18700d7a8c14c925abac3174b4f41c7a51210a881074a21129ff9885f8cb98041b306057d460773a71e32463cd5efc619bc
SSDEEP 12288:Q7+CXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:Q7f0Le5ji0hmxNrM
TLSH
T1BAC40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 1f06570aa3d1064cd6e7bb1641c7660e9991de3dfe2f36dcf7168a7ca50f822e
MD5 f2f0fc2163d1d3b8943f7c8ce8652717
SHA1 aa16c31090c81095065f77f884f1a1be1c5bc858
SHA512 a839f70d5294d1971b0d36c98189ce41054837f70fffc9f5232b116103ba4e14c3470c4414b5cdfd25d4abe7cf5723d74671497021f12f095a2ea733ea15db22
SSDEEP 12288:vp7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:x7/BOkUhMXcBwc04nA
TLSH
T18CA47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4987.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4987.bat
Size 722B
SHA256 9a15f1d7b78c369aa096ef9619549f5c84da1f88617508a87b7bf29e0b96dcf1
MD5 84d1bef0c1c9f8012baab7a4537af8bd
SHA1 4b8b5b3b2892725583deb780d2a6a6f2d4dee988
SHA512 c589317ccf5d7da386e8d99c6d447b58f941ad84b2a4529bd7da30a5e0ea04955ffc064b4e2600a5703551a81f21b508fe3325386d4fde2d22518c54a5f10478
TLSH
T1FA017185878B6FBF9944367B3B10EC4E9172855EBD297F135631840712D480BBEE7580
MD5 SHA1 SHA512 TLSH

Submit Download

5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\5294c00967351286b8fd12400abdc08521076db7c2e70953bbb2232e81ee4e59.exe.exe
Size 2.0MB
SHA256 89f5c4d1a7765aec5a514d09b39f21eb8b6f5dc7e42db321d7f68b4f863915e1
MD5 1c1a56fd92e520c5b77086e5002cb05d
SHA1 85cf424fb630ba6fea3f558d2a57920d85273e39
SHA512 cac654b68666cb798f80a68072c87de472e4cd80eb674c1cb5cafe49aa20ea5efba44ce002d8edf6888cad7f837ef561725605aa615daa2860dfb94e1c6c5f4c
SSDEEP 24576:38sxGGugpiusL62+t5zgCouaYYO2M+swYuiAAr4xx6CyA:ssoGuF+hYO2M+swY9AAN
TLSH
T100A5F692F7C8C6A0F6320572C07598F7262E7C1AED54560F35C27E6B3873B8A4869E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 331dc28121c7cce93cc5f3f67697793620d00bafafdb1f227fd0aa13048b721e
MD5 90954a1505b4d3ee4504955505e382e2
SHA1 5963b8c34ab470bdb623be841ae5890d4deccde1
SHA512 19443a02f5c3d5520a1dfac8c6eda977ad429069715929eff748101e76b28d73238facf8653f3261428b331e71f1ff0ec1db021dee3f3722a1d8df5cec166be9
SSDEEP 768:M1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:WfgLdQAQfcfymN
TLSH
T1C7C2D0A921C96A34DC261DB8CBC5D603433D0E7B109E286675E2BFBB3171B74610EA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2654269261-3199571979-4291878722-1000\_desktop.ini
Size 8B
SHA256 f29189eb11965eb3f457dcfc9961541cf5820960ece28657e097c84d9236f547
MD5 b2a4afee50c0667bf313e9f999f7e893
SHA1 f29707b43162626674eb6eaffdd44a0afac806f2
SHA512 bf4c3ec1fad1dba2ad0771a56aa1b163902e87d76d0844bd1aeec557f42d264143ab6f53d0b005626b19ce42351515a728aea0203ee5305e4f6a264495adcf27
MD5 SHA1 SHA512

Submit Download

memory/3220-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3220-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-26-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-473-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-1223-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-19-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-5004-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5060-5507-0x0000000000400000-0x0000000000434000-memory.dmp

Download