96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
Size 1.3MB
Sample260907-wvcf2aad53
SHA256 96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b
MD5 c36ebba52bd8c53946c2c7fc96daed1c
SHA1 14b6794fd948bd12616db70c1e261f2dc71cb8e8
SHA512 5b7a95db8a49f721005a4f6ff0a81e19280ce47b6c5c10526b7cda88705d6c82e9b1800037bf38f591ed2436247404827658c236f2cdb288d8bd02b17c04be7f
SSDEEP 24576:d7yi9hcFdkTZxblEUhoAOM08/85RkptVIJqpV:d7yEgkTZxbDOMjUfkptVxpV
TLSH
T15955BE16BCE6C130E4A351728DEAC21D6274E4AA833645EBF6CC911F9F645D28733F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2128	Logo1_.exe
1544	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
File created	C:\Windows\Logo1_.exe	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2464	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5780	1544	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe
2128	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2464	4920	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe	89
PID 4920 wrote to memory of 2128	4920	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe	90
PID 2128 wrote to memory of 4492	2128	Logo1_.exe	91
PID 4492 wrote to memory of 4516	4492	net.exe	93
PID 2464 wrote to memory of 1544	2464	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
"C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46A4.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
    "C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 692
      4⤵
      Program crash
      PID:5780
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1544 -ip 1544
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 c8ca4effde4cea28b114f6bd9898b0917fe95bf0e72ba3a298c9c2509654c72c
MD5 9602c51ee6e16c541f398cc1a0c37e40
SHA1 48f19d7f65bf60dab959e39c8b6a0be5ea3f8ece
SHA512 86efdc2224207ff4a447c986a9ffad61b05783c0f06d8e7dd6e45e319af45b4a3f01fdbb40447290c4a4bfd10851fb5941a22351d25c3014a2c57d4c8638227f
SSDEEP 3072:jftffjmNHhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:zVfjmNBG7/fYfLvzB+QFyn
TLSH
T1ABC38C1371D08861E9B60C3049E1EE619D3FFD620B449EA7378476BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 4e0e8265303111056f270a4544c0af9ba033c1f9f8637f2096eda55339a78664
MD5 838baec1eaf01d221bcf59207a83533d
SHA1 4e5be38574d8f3678ac125de048149a473426daf
SHA512 e757dab2f531b2d8d17008d70b52caae045bfa72587d7cb79f4f62a9726eec8f0e498853b478d2c86ac24be8cac7b3bf4810d5211636523aaeee1fb2815406a7
SSDEEP 12288:3p7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:Z7/BOkUhMXcBwc04nA
TLSH
T114A47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a46A4.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a46A4.bat
Size 722B
SHA256 792d51b4be9a4093b53a96f24a62d48612dda846fac1d4975a16138e8c922225
MD5 7da4fc54a6a4e035b4286be91367cfd9
SHA1 b36e48de6ce1d40f44014ee7914823209f7a876d
SHA512 ff6135ad63163e634d8d9ff11abfd46fefb6158bcfd3a7c9fe493d0197fd096e565db50688498e165ca64f1a4a21b5c6f779fdc8f3e7366e2583988ee101ed9b
TLSH
T11C01713DC599EFAA7D4C55024AE099CFC4520C56FA886B2AE218CC4DACE0C0EF7E3547
MD5 SHA1 SHA512 TLSH

Submit Download

96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe.exe
Size 1.3MB
SHA256 a64a62a0f9715e135587db55c491db94a526f534fe5e4495db3716e9ff1ed8e0
MD5 d54d97ce6c5a22379af62032c096af03
SHA1 23d38f446e4c751f46ea8d1cf5ba280de903def8
SHA512 7acff80e311876a64648deccbd5cdadd1536bb52425087745d1314de3c4f5d82bae3cee1f021e0b4905f9ea1ece6e68ad0a706021f79cadecd0257df193f68b6
SSDEEP 24576:Mi9hcFdkTZxblEUhoAOM08/85RkptVIJqpV:MEgkTZxbDOMjUfkptVxpV
TLSH
T16555BE16BCE6C130E4A351728DEAC21D6274E0AB833645EBF6CC911B9F655D28733F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 14bc78e8405e3e41cd2d507961f963e27b2a149de800e189df725f155416a19f
MD5 031b0b8ca7a2a0f17ef32e550d168eaa
SHA1 d879a7b4fe4bccc927da90b2b31d8c38650e4e15
SHA512 ce519695b9256a1471cdea5603ae6e859428b331e9b54666a8c5e418f2b5b65667194304817dd67fa267bd7083d413ec6809c140333f1080f2ddaa1e7e030fd5
SSDEEP 768:4L61ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:3fgLdQAQfcfymN
TLSH
T15DC2D0B922D97524DC1D0DBCDBD6BF02423D0E79208E683965B375BE2572778240EA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-189034102-168398478-1159367937-1000\_desktop.ini
Size 8B
SHA256 638fc448ae556caaeda91e57ebb39bde61a6d541ea6b0bb3904c6c1f62e6c6e8
MD5 51287df057872db7cb5dee6e94f2bf6a
SHA1 8934b869fc9b9694347d5b7a0a57c70e1161541f
SHA512 2261f7df8fcb3a8f13d05f1cc875d9056a8e732bbb024c7694a479a75d5c1216aeb195c0c8fce34b6efe60700826871ea90d16a2e8cc413b9ca89d65e471d2a6
MD5 SHA1 SHA512

Submit Download

memory/2128-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2128-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2128-44-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2128-48-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2128-52-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2128-1255-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2128-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2128-5052-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2128-5525-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4920-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download