4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe
Size 173KB
Sample260731-eayp4avzdx
SHA256 4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e
MD5 2b7bd864bda07d4746a74f6f3373cfc7
SHA1 ed0b024843de39e1ec0233ce34df60707e201a4c
SHA512 b429f8a34071adb71a8598bdefceaaba6557bff1cec02be44649ba58e4575ba0d6a92a36c20208eef16f6ffab4ec2dfdc8a7eac214c0b5c5e627715714e428f5
SSDEEP 3072:pk9kuJVLwNaCYfrbwgDO8Wwi81SUHFJV7VDgTMagiuy8F+01:fuJSdY/wgq55cSWFJVlC9gP
TLSH
T108046C01B6E0C1A5E5EE167000B61BBA1E34FD250B3992FBAF51D93A4D326909D39F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2804	Logo1_.exe
4480	4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe
File created	C:\Windows\Logo1_.exe	4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1468	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 1468	5684	4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe	88
PID 5684 wrote to memory of 2804	5684	4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe	89
PID 2804 wrote to memory of 4828	2804	Logo1_.exe	91
PID 4828 wrote to memory of 4808	4828	net.exe	93
PID 1468 wrote to memory of 4480	1468	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe
"C:\Users\Admin\AppData\Local\Temp\4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5569.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Users\Admin\AppData\Local\Temp\4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe
    "C:\Users\Admin\AppData\Local\Temp\4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4480
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 127KB
SHA256 e403091045f4b4b9e9c72caec57b89a33cf18fd71a725f5eb2fab8f30bc2e492
MD5 361940f5a790c4e7d90e85009a0a1b53
SHA1 a67748df9a5be0c26d0dbaddde359f3bc13f26a8
SHA512 e86fb3d05a731bb1cbfeb7409606d2826e8cdb1b1c1c226249aed344f8131211882c8bf90f83112f9953579d3f31a719676293324618b568c533e786211393a1
SSDEEP 3072:pU9kuJVL3hUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:ruJTG7/fYfLvzB+QFyn
TLSH
T1B2D38D1376D0C461E9B10D3049A1EEB15D3FF9620B409EAB3784A6BD0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 832932890d13fa91519d86972e0d5223a82e2d6d35a15b9967199dd44bffefd8
MD5 d84ebbe0264ccf7995b4fb01b184a616
SHA1 9167dbadc9948af3a84945724259ac07f6639188
SHA512 c468870a507057e88698dec7728eb7853d0820246cf883cebf35cf52f5b552b95525ecee075beb7420a533b7f64c59cabc1204e573c97bfff3004d3a3766d99a
SSDEEP 6144:wguJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:waqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T18AB46D31E6A04037D6F106B3F915D6307E7DA2187B1184AB9394AE2D2EB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a5569.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5569.bat
Size 722B
SHA256 e1fa675fbe76da9bbaa5507732feb7a14da327b317fc153f387a4ef4005e5894
MD5 cdde3c7fafd39e68ac5a6f5ed86eb9d6
SHA1 723be5c86c8e79c67b02e30ab416cee8bbd9d433
SHA512 51f0084931acc6cf201cde8b47f9fa302ccc0ccc43cdae50513b4f856cbe1fd98d46ff63a2ff9e952b756642aa6700794048a1daee8c470205822550378d8c23
TLSH
T14501F7E2745ED5A6059010A29672DCCDD2F10C19BA69AB1CCF24C2FD52D380CF9F578A
MD5 SHA1 SHA512 TLSH

Submit Download

4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\4234172a48406e7c6d731956934025f6864ac2a6153bfa97747ee26395db524e.exe.exe
Size 144KB
SHA256 f94a13004dfa3f2980095ac88a861f7cd17d37dd7bdfbc20518699dc1bf0330e
MD5 279e971d1049b132f2d3e53398f5a3b2
SHA1 446bccf9f7dbc86c368ebaba0181b7ca968c5af9
SHA512 dd0dba8847a599674a1482694056ecad16af0a3079319a2ba49a5dc440046120812353b5dc38aa5f89b3b0ea3b08de579bc752c1589597a061b2453cd42e7dea
SSDEEP 3072:ZNaCYfrbwgDO8Wwi81SUHFJV7VDgTMagiuy8F+01:ZdY/wgq55cSWFJVlC9gP
TLSH
T1E5E34A01B6E0C1E5E5EE263004B51BBA2E34ED25073992FB9F51D83A59325909D3AF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 2e839ec9596a5cff7bffb2fcbda4bf5c776bdc6a48f06df4f846065d5f26d5a8
MD5 61f9f0b200522176113f94d783c16ba9
SHA1 4f6378756e40128b5c10e5f4d97b8f451476de0f
SHA512 30e8fd9adaf31a9519a19b0cebb199b89a9598c8218d886c2e416f16f0385084057944ac59cb283e7eb303a4bd6e22241e6027847cac7a7101bd55858283ddf2
SSDEEP 384:NbbIEg1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pkv16GVRu1yK9fMnJG2V9dHS8
TLSH
T176D2CF307F9CC572DFB00BB0D1934FED0819A9A1EA0A6D4F3DA0E79A0C31B0895A5A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1875162379-3804078649-638427191-1000\_desktop.ini
Size 9B
SHA256 996ad9b60efeb5dca4d8f6c323dc89c19991d156aa1111e9ebae9e0591ba4753
MD5 0346498f67c65a2d83a0cabfdcd02af9
SHA1 785cfa6c8bb5ad7d644d17fa99aa1cd4d424c415
SHA512 c539f06aa88d1d7c9e069f110cadb10f72036b455ec76cafd5ed6b904809733e9bffa9034a054508c8a177a0c6c5bf2c8bb898d9a9ca59e05193a4061ec29ca5
MD5 SHA1 SHA512

Submit Download

memory/2804-70-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2804-62-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2804-75-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2804-79-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2804-141-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2804-1286-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2804-5083-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2804-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2804-5556-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5684-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5684-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download