viking | 8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe
Size 66KB
Sample260417-jph1eaht6n
SHA256 8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac
MD5 a5b49d72c94edea3091242288a391bb0
SHA1 b3d05d224945604d1afacb0c1dd277aeb660ceda
SHA512 ad3d6e93230461b7a632e5949f3ee7b8e893114ca44972d283e78b40d14f2a8df2249e061743cc98fd60e1ad1b323ddcaba093eb3249b62948dec7e3f8c331fa
SSDEEP 1536:pgO3SHuJV9NBriw+d9bHrkT5gUHz7FxtJ:pgOkuJVLBrBkfkT5xHzD
TLSH
T11363BE9AA7E81CD1E47786B099E3562BC531FA429F51C7CF1364821A0F72380BE36727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery viking worm

Malware Config

Signatures

Family: Viking
Viking is a Windows worm written in Delphi.
worm viking

Detects Viking 14 IoCs

resource	yara_rule
behavioral2/memory/836-0-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/files/0x001a00000002b4a0-7.dat	family_viking
behavioral2/memory/836-11-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/memory/1176-8-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/memory/1176-20-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/memory/1176-27-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/memory/1176-33-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/memory/1176-37-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/files/0x000200000002a1be-43.dat	family_viking
behavioral2/memory/1176-675-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/memory/1176-1224-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/files/0x000100000001041b-4583.dat	family_viking
behavioral2/memory/1176-5005-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking
behavioral2/memory/1176-5508-0x0000000000400000-0x0000000000436000-memory.dmp	family_viking

Executes dropped EXE 2 IoCs

pid	Process
1176	Logo1_.exe
3600	8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\ms-my\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GamingApp_2021.427.138.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\node_modules\@microsoft\load-themed-styles\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe
1176	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2128	836	8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe	80
PID 836 wrote to memory of 1176	836	8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe	81
PID 1176 wrote to memory of 3912	1176	Logo1_.exe	82
PID 3912 wrote to memory of 4628	3912	net.exe	85
PID 2128 wrote to memory of 3600	2128	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe
"C:\Users\Admin\AppData\Local\Temp\8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3767.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe
    "C:\Users\Admin\AppData\Local\Temp\8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe"
    3⤵
    - Executes dropped EXE
    PID:3600
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 1a1e85277b64d2b253cafc369a7d300466feea91c6fc611a1f989c2b77af2530
MD5 b171ffd8db132316467af17744c72db3
SHA1 8497227aabec79a3eb26783bc909701fd01afab5
SHA512 f9a996f95c4a144946cca804f2226cfd4b380be33493c08d25e5a5f06a11ee25d941e6bb7590967f10611a1f1fd987fb55f00b609603bb31a762d5f7a97c0927
SSDEEP 3072:p+OkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:EruJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T1FFD39D1376D08472E5B2593108A1EE71893EFD624D50DE6B37D82B3E0F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 98ea255de4a3ad36d0efd32ed7f2e4524d08be01caaac265bbc5c3f50ef6a5af
MD5 c47cce1ead85e396b400857b568c834e
SHA1 de424501df05b693ed0946ca918179b920a2ca88
SHA512 868a1422c08fc2c62a42a02673f1a980fd9e9dc8686cc7da2a3829b60b272adcfddbdb99dc92471161618cc93cd29755dfd594a581ab51a27ba4c06d171799c4
SSDEEP 6144:SruJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82gF:GXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1DEC40916F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 145b05019248756bb55c20f5665f47f66f36a17b7a26d76fa59e522c9706b5d6
MD5 45268e665a2d4307baca16b4a08dcbf5
SHA1 2c9c0408fb4cef19db38fe4049422f34f38d7d0a
SHA512 c4204f5eeb30c16eecba0d4f6ff51e081d16375b28c2801f7e33a84ae0a9ad139a20bc951a0a53c715740cb8c966c36c782ec3724942bda0328580c7ff598cad
SSDEEP 6144:wuuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:w4qIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1A3B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a3767.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3767.bat
Size 722B
SHA256 140a34d3afd49a3e283e0b67160151f8246b7adfe9fb1ae76a07d28aaee1c5a9
MD5 24a6ee990742920e80658c30adb0617c
SHA1 11faaa679c8f4996b214ea18d51de23b52731173
SHA512 fe9cba10fb0bf20fdb8380e488828576d6ef99d571204a47a0985de8be98ae93d91a5f3cee8c57ec719ab7e0b44a187b7e72cb9d639b86b0d1eb28e2ca56e19e
TLSH
T10E014C03854747DE08005CAB07B9A8AECDE969493A0E1AAB4725811E7241E2DFE87193
MD5 SHA1 SHA512 TLSH

Submit Download

8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\8d2c73900c2022c58c3b6de19bf6ea76d78134a506914f285d4b73e4db6a57ac.exe.exe
Size 36KB
SHA256 8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41
MD5 9f498971cbe636662f3d210747d619e1
SHA1 44b8e2732fa1e2f204fc70eaa1cb406616250085
SHA512 b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93
SSDEEP 768:CNic1iTEpgSG9TJVQBWZrvW5TNDWfKgUkKtzYiguHAMxkEZ2e:mriw+d9bHrkT5gUHz7FxtJ
TLSH
T14D038D96A7A81CC5E42B8535DDE2912BD635FA462B50C7CF1360822A0F723C1BF36767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 67660811212ac4b7df8269485c00975cff46e9967ce6d0c344f767c49562b073
MD5 0604f91d96a3f341ac1f6075ef91beea
SHA1 17959fabf7ff54e69f5af37e69b1306a9fb96ab5
SHA512 806277bd8ed6b9cc0f8126c22787d740f73816326c9f0db2fd40eb5eef9276ec76f0eed1b00a3d4bf0631b5767fb2a7a6f755b44c1536f7ffa85b940b6197e44
SSDEEP 768:pZZZZZZZZZZZZZZkE16GVRu1yK9fMnJG2V9dHS8:pgO3SHuJV9N
TLSH
T1DED2D06EB3DC5E33E6B21BF048A34F5B4435FA50CC5F920F2D287A495CB65609571623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2122505878-652277452-2375749442-1000\_desktop.ini
Size 9B
SHA256 4ecdb3ab0629b2ff57d73171ba1956fd448f7a99fddfa39cd15bb955fb39e040
MD5 d48d945e971fd45a6e8e6560bc0574fe
SHA1 41aaf3cfe8dc2c4edcc06877de95cbce6723945a
SHA512 83a1e27a8ae698fa7a454979345e68cb55a6657044c435744c24daa42902db3218c33e8d13a823c46e79b02ca994eb3591616657e3576b496ae39e3013b237f1
MD5 SHA1 SHA512

Submit Download

memory/836-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/836-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1176-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1176-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1176-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1176-675-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1176-1224-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1176-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1176-5005-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1176-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1176-5508-0x0000000000400000-0x0000000000436000-memory.dmp

Download