0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe
Size 336KB
Sample260707-ld38baex2x
SHA256 0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1
MD5 4fdc681161229d7d702a783f369e47c3
SHA1 420c4d61b211d2a3e6b256dc7feed931993aaaa6
SHA512 ae322138a678b7507f0df2bf74264b92f2f722e591f710cac5484b1fbd94019920d785fb22d116633c6f3eb2dc52b94b42dc53de587090e0e38d1526caf9717d
SSDEEP 6144:yVfjmNtKk2lPQ23kvE6BVADkpIaCb10JOigh3gzcbVqLUqdM4mF5sAOj/dxCB3MH:M7+tKVlPQ23kvE6BVAUIaCb10JOikwAy
TLSH
T1F874AE717684C832D852043069E4C7B6697DBE700FA18AD777882B6D6E302D36B39F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2836	Logo1_.exe
3196	0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\it-IT\View3d\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe
2836	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1816	2272	0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe	85
PID 2272 wrote to memory of 2836	2272	0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe	86
PID 2836 wrote to memory of 4328	2836	Logo1_.exe	87
PID 4328 wrote to memory of 4992	4328	net.exe	90
PID 1816 wrote to memory of 3196	1816	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe
"C:\Users\Admin\AppData\Local\Temp\0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A64.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe
    "C:\Users\Admin\AppData\Local\Temp\0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe"
    3⤵
    - Executes dropped EXE
    PID:3196
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 c31c2df663c643c50096988bb8b0b48e5a989ec875b2d9e3db67ddf226854ce4
MD5 7e3d2fc2386906faa3af850da8474bdf
SHA1 2ba9a98adf5c68148c1962eb36e36b2d1471e86f
SHA512 dba07bab51186b3c37b5f93264d0b836add2dec94a565710c79b6546c74a94635b8745ccbc54a4e3cf4ba885dafa1cae454872ca21427d6e2a8d034b1d58b190
SSDEEP 3072:fftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:HVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1ACC39D1336D08472E4B2593109A1ED718A3EFD621A50DE7B33D51B3E0F316D1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 f33af1dcba17c01863f7152042d20894c509c014a70f590dd011d5dab935e467
MD5 9bff68ed1e1bd803d57b23a5a3de5700
SHA1 961ff8f33345718da3598ae7d5c708a181d83b5e
SHA512 8cc01c8adf42cedbfe9c39c14d165905211c932f92ab0fcb390138ca32165fce45f5be30f33802022f5ede7b9df128d0cca43122c6217cc61f4002668a2681eb
SSDEEP 12288:M7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:M7o0Le5ji0hmxNrM
TLSH
T1A9C40916F6748335D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a3A64.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3A64.bat
Size 722B
SHA256 2101840dd2aba307f3873787811d23de34f376da0143c5716c5e76226babb314
MD5 10026f2a63c1a01d00a8c21ac59026c0
SHA1 49da91bb2660b4897fe61c71e349a644cadf5d70
SHA512 d0589e98b6015414c4bfbb11ab3ffc54c86b6c8dda813c401a0e242c5ff93de476af92e5e523557f8512c748e871a751517eac694c4cdfd404f60e38086639fe
TLSH
T15E01F186C3C64D1E1CC8221F97A5D78F815108C4BB6D5338FB6281A6616B97BBECF1C6
MD5 SHA1 SHA512 TLSH

Submit Download

0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\0474e4fa24f50deebca9147c330e81deda69859630968f62d007f1156512c3d1.exe.exe
Size 310KB
SHA256 ea6d81f1924db2c2875c40399f2c50f6081258573e9efca9005e44553642a9df
MD5 6adc044210fa1053822cfd1b45f661c2
SHA1 051cd6cbc6aed12a9704d36310e949e9bda3041e
SHA512 c84ffb8570ec0d7e24dcfd05714e0d7e58f064261f39cc7198db7c5f2b5fa9b3caa4df6dcb8b28c866d37c99c329540b2caadfef31de07b23817277720d5d72b
SSDEEP 6144:hKk2lPQ23kvE6BVADkpIaCb10JOigh3gzcbVqLUqdM4mF5sAOj/dxCB3M29mbj:hKVlPQ23kvE6BVAUIaCb10JOikwAbvdo
TLSH
T1C5649E717684C832D852043069E8CBF6697DBE700FA18AD777881B6D5E302D36B39F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 c5ce1b74a9cc40a71a0c08c133b17a05bf0fd0176c1fa5a07c1aa2e0ebc6a93f
MD5 5a51240452673e1444fa9c3c12ca5c32
SHA1 7974cd759d3c3f7f411e0f9f4385b87ce8ade171
SHA512 dd30a4ebf0b7152ba0bda82a55ad19b1fcf61e424c76757d63e0328e298b97a973b8a2c2bd4878fbde5bb81446605a419a47ab769bf5248209047d868c218a2f
SSDEEP 768:cHvHl51ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:cHvHlvfgLdQAQfcfymN
TLSH
T1FCC2E07636C81974DC15093CCFE36741833D0F6A599F69A726E2BA7F2170B68110FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1788976790-1541110888-1636651838-1000\_desktop.ini
Size 8B
SHA256 894c4ef1591e999fc1fe6ae52f8e51b043102061d3aa461f1c53520627c3bc3b
MD5 0e1de672ade64d7722b67001ddf3ca48
SHA1 ed6aab4a4af6f5cd82c25d69424801f7d54d0f95
SHA512 355790d6460f07ce794333e17638b1d308e27dc213234776ef7d72ab6266a232a6eab13516a3203bb5ecc519b52c657dbcff57d5cf47be85bb00b8b892b6f7ab
MD5 SHA1 SHA512

Submit Download

memory/2272-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2272-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2836-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2836-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2836-487-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2836-1245-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2836-26-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2836-5034-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2836-19-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2836-5537-0x0000000000400000-0x0000000000434000-memory.dmp

Download