9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe
Size 203KB
Sample260907-p4s2tavydv
SHA256 9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100
MD5 7d9b623554ea04278ff581840cc88a3e
SHA1 5d92de0320b490159a75aea6078d83b344f626aa
SHA512 5f8a7e7892c036f3f2a13f7e4b4ea71664670e48665263e9ee2cec3e3860c929153168c52e881517033ba8359efbcb68884a263b46892d663be0b6e644387af4
SSDEEP 3072:vftffjmNrZgxhlhGeJJrJsQ+qHcNL6LyZI6nQpL4jRXFiOkg3kLcm5LUlJ9t:XVfjmNefnCM9yZVnQpLuNEbLc0UL9t
TLSH
T139149C24BAD2C5B3C983183457E4D77A6A7AFA310765C1D3F7100F7A9E207D2A53A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1300	Logo1_.exe
4636	9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\Fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe
File created	C:\Windows\Logo1_.exe	9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2308	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe
1300	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2308	4876	9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe	88
PID 4876 wrote to memory of 1300	4876	9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe	89
PID 1300 wrote to memory of 5676	1300	Logo1_.exe	90
PID 5676 wrote to memory of 3988	5676	net.exe	92
PID 2308 wrote to memory of 4636	2308	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe
"C:\Users\Admin\AppData\Local\Temp\9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEEC.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe
    "C:\Users\Admin\AppData\Local\Temp\9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4636
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 78512c13f8246cb7eec6be7e435f69930926f17f969747b8b56d96ae6aff85de
MD5 ece73f3f96060737914fc707008f71c8
SHA1 e9ed6521c6880805010a1380fa94af54c98d3590
SHA512 5ad3df64dea99ce9a4ede06fb30df14cef797e4a53425ae3c219103c2d2428227c10a48ab34fc9be6580564a94395e535c01039f0707c7734f80e91f83437013
SSDEEP 3072:GftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:+VfjmN2G7/fYfLvzB+QFyn
TLSH
T12EC38D1371D08871E5B20C3449E1EA619E3FFD620B509EA737C466BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aDEEC.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aDEEC.bat
Size 722B
SHA256 a750d31ec16ea14451ed66d54049feaea864926c98b0bdb87d21a7c0addadd89
MD5 9ed7226feaf8a8de9fcf8b4620e7b006
SHA1 12e4a3830ef2d7ce6df0c89e06e08126c5249101
SHA512 787bbcb9fc41860695d4cb9d2e82ff9f771b8a13ae741dec8d3884d662cc02da22ce8d28bf50c3c77281f833ef543b3ff3a871135b681ebb9acaa299ed91638e
TLSH
T1E20184A14542875F4407E33F1AB2A94FE0E518287E0B3E1B9F75C94D14D2A0DB1EE35B
MD5 SHA1 SHA512 TLSH

Submit Download

9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\9485c11b969c6ef018b8b9b3b251a4263e74aa0964d7552dc9b8b412ebb4f100.exe.exe
Size 177KB
SHA256 8b8bfe9d542b109edd6418d5679187abc1074e0c0f090c7ada0c608ce868d353
MD5 38ced7c7dca88182d3d8e02aaa889338
SHA1 c702b28c7b267d6034cd06ebfc2e7b10b6700aa9
SHA512 473ccf1f9b3265c192384140a48bef06a65105ab1f7d63a274a0e06487aea477206514bce1258a3bd0b74329dd2b678c71028d6eee166a1a497dd42deaabf70d
SSDEEP 3072:PZgxhlhGeJJrJsQ+qHcNL6LyZI6nQpL4jRXFiOkg3kLcm5LUlJ9t:6fnCM9yZVnQpLuNEbLc0UL9t
TLSH
T1C6048C24BE92C5B3C983183553E4D77A697AFA310764C1D3F7140F799E207D2A63A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 5bd65dc09a4e74eac3859f68f95ba803dd02c9570f0279bd8bcf9377102b3429
MD5 d03637a2587cfae058a5b004a4320fc5
SHA1 ecf6e6b808035eeb106fa6e573914e9ff26bacbb
SHA512 e8ac047160e5974e01fa185615753037b2b874e00ca1378b887368d526ef7a0bac25fe6f535d4d9454a4bcc1bd7116e3e5954b439c99ead9a5e8f7b50ee6b238
SSDEEP 768:51ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:vfgLdQAQfcfymN
TLSH
T1F7C2E17623C85A34E81519BCDFE35741833D0F7904BFA86729B29D3F22A0769600FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1738198120-2966725515-3980530802-1000\_desktop.ini
Size 8B
SHA256 638fc448ae556caaeda91e57ebb39bde61a6d541ea6b0bb3904c6c1f62e6c6e8
MD5 51287df057872db7cb5dee6e94f2bf6a
SHA1 8934b869fc9b9694347d5b7a0a57c70e1161541f
SHA512 2261f7df8fcb3a8f13d05f1cc875d9056a8e732bbb024c7694a479a75d5c1216aeb195c0c8fce34b6efe60700826871ea90d16a2e8cc413b9ca89d65e471d2a6
MD5 SHA1 SHA512

Submit Download

memory/1300-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1300-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1300-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1300-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1300-135-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1300-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1300-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1300-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1300-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4876-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4876-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download