cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a

Analysis

max time kernel
150s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
Size 985KB
Sample260511-hsfh1sct71
SHA256 cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a
MD5 52ad7a6cbe0a9074b6cd3f7c46ad12ba
SHA1 2eeeb8e4aaeef27e846e8a06ecf08405b6fa2000
SHA512 35f755983c7c02114976696224c6d561a4ad9d02db34a6a864659bcd9ffdd79e20e093b5c727d6ff245ffa32bef6150968cfa4b58ea23181a09ab51134fd368a
SSDEEP 24576:i7agHc6sXnyLD0l5N3NfiqvD6B59xkMBkS1F:i7JcpnyLD0l5N9ffD6hxkOkS1F
TLSH
T1B725291275B45A3EE8B244BA497E156E011EBD20079D58D361CC3EFE38F16E27A32D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4848	Logo1_.exe
3536	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_split.scale-100_8wekyb3d8bbwe\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\node_modules\tslib\test\validateModuleExportsMatchCommonJS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\lt-lt\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_10.0.561.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\HoloTileAssets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
File created	C:\Windows\Logo1_.exe	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe
4848	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1564	5068	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe	80
PID 5068 wrote to memory of 4848	5068	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe	81
PID 4848 wrote to memory of 3532	4848	Logo1_.exe	83
PID 1564 wrote to memory of 3536	1564	cmd.exe	85
PID 3532 wrote to memory of 3936	3532	net.exe	86

C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
"C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC861.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
    "C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe"
    3⤵
    - Executes dropped EXE
    PID:3536
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 d57608334f6e113ded2a1878bd7e1c66e8aabe8282a15e22494181015aa55507
MD5 83a07d632c44801ab540e30e6cf9ed54
SHA1 67360155e902f5acf53565bc613224d838a69956
SHA512 385e375d263388695d8e0ff9ccd1baa73b884534317c82f0fde6a0650658e82dd0471405fe8fcfe8dd606a31e317038c2dfe5d07ab35927df60975763e332ebe
SSDEEP 3072:nftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:fVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T1A1C39C1375D0C4B2E4B2593109A1EE718A3EFD620950DE6B33D41A3E1F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 0b80ca3490d14e4752cc62f4bc513959c07289771701b9ef436afae55cb6033c
MD5 89b4678f21783ff9e02e549a9ba3c5b7
SHA1 ad0ff07278d29eb5c9d00eb01b7cff3b04081dcc
SHA512 012c94bf78fbe382196b5ec7aab88d01bb3e4f9b55f8a6e19050df25ee5c012d0fd96976423817d887a16766203ce2ab54fda0e849424dc6b0c1024183269a70
SSDEEP 12288:i7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:i7o0Le5ji0hmxNrM
TLSH
T123C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aC861.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aC861.bat
Size 722B
SHA256 25b48dfaacb40156eff6433130a787e50f7f312ca0a9ce67071bb6f0a9031185
MD5 e8abb89322f2b3bb015b3499674813d7
SHA1 ae09483e244c99acd9cb969ee0dce706263725a8
SHA512 d3759842a0b2e90c1e698190600369e35002d8e800e3e458341b8bac50750577180d44b5e899b9faf445acb004aade3e03f80b9d28b9e9ce20ba05c7392d4299
TLSH
T1D201220583076A0E4358C49BA5E6280ECCC67BE83FCD1215E200C08E329561EF7CA94E
MD5 SHA1 SHA512 TLSH

Submit Download

cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe.exe
Size 959KB
SHA256 ce5d02b0bb76a6dddf169259cac1c0aa47cca8c25c1a03f2c4a0e93eb0d9d310
MD5 23134da85d6fae6fd654f242410ad91b
SHA1 7533d80293d6a984d6c5d0c01068f3288c38f8a9
SHA512 df6220e73c482d57c9322c672c267305c01ed620e57bd23f185c8060f6bae569a07080dee59550b1c2232941570ff5ec622f6893144119b755b0072ba64f2ef9
SSDEEP 24576:1gHc6sXnyLD0l5N3NfiqvD6B59xkMBkS1F:WcpnyLD0l5N9ffD6hxkOkS1F
TLSH
T15225291275B45A3AE8B244BB497E156E011EBD20079D58D361CC3EFE38F16E27A32D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 704a2615076da95e4f8265c0f08c879ef0a7beb17f56ce8e4b32fa3f18fcd593
MD5 91b5b539bb26285dfacb2cead185af04
SHA1 2dfc77bbb5c12aeffbc397dbe54098bb562f0f42
SHA512 54e922c1fe8d0f8458150578a13bc501061947c713df97c3508b795d2f1c02d83df59f4660f5e36e56d49e38369e0339e07e5aebc5a62d6a434ca7f5ef29c5a0
SSDEEP 768:y31ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:ylfgLdQAQfcfymN
TLSH
T13EC2E1BA26CC5679E8664D7DDBE36701C33D077A405FA86A25B29D3E225066C100EE23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1383858298-2057492509-1726743289-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/4848-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4848-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4848-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4848-5524-0x0000000002070000-0x000000000212B000-memory.dmp

Download

memory/4848-32-0x0000000002070000-0x000000000212B000-memory.dmp

Download

memory/4848-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4848-43-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4848-22-0x0000000002070000-0x000000000212B000-memory.dmp

Download

memory/4848-593-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4848-1233-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4848-5521-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4848-5016-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5068-9-0x0000000002150000-0x000000000220B000-memory.dmp

Download

memory/5068-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5068-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download