478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105

Analysis

max time kernel
150s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe
Size 922KB
Sample260511-ltd85aev3y
SHA256 478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105
MD5 9b80689287e4211916a6e2aff0bfb0f5
SHA1 43692ffb1a0f6c95041dde3ac5f54a6f2dc5a332
SHA512 b90101f37b1aa13ffbf56d2fb09ec8d35a4b9966b840be16153cbbe48d044c0cbb748c0d43bc2249b020565da9c482e76da5d2d03ad6b0990a9d37061e2bbda7
SSDEEP 6144:SuJ8spNjlsNUjD5cxLHdrqP7ysKmH+WuExwWUDDvxbJuP77+Wzmqs2qwaEm1CCCE:kcgUjD5cOP7y8H+nWUDDveP77+7qB3KJ
TLSH
T132152911BBC0E273E1AE4670D9B6D32D2B32EE917F92864B2B5533DC5D31310A93661B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4352	Logo1_.exe
1816	478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe

Loads dropped DLL 1 IoCs

pid	Process
1816	478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win11\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9079BCE8-3F51-4872-978D-8F0E542ADD76}\MicrosoftEdge_X64_139.0.3405.125.exe	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\Dropdown\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe
File created	C:\Windows\Logo1_.exe	478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe
4352	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1744	2644	478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe	79
PID 2644 wrote to memory of 4352	2644	478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe	80
PID 4352 wrote to memory of 4012	4352	Logo1_.exe	81
PID 4012 wrote to memory of 1344	4012	net.exe	84
PID 1744 wrote to memory of 1816	1744	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe
"C:\Users\Admin\AppData\Local\Temp\478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22E5.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe
    "C:\Users\Admin\AppData\Local\Temp\478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1816
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 fd39cea02d6f74c6886e5f4a3daa588559eded63a39ee29676af2693ccbc5d8e
MD5 0734883e560c69de74abb80f3df9ae4d
SHA1 e4336a760ed24cbc20b3e135a43710f01edaa856
SHA512 3346366a094c19ea240ec3e54815abd0fb4afe5be42a79a894b1d465f712475f5c48439917a644f57149b0837b04c2d0985d6578255fff11724d6c29b19d9d5a
SSDEEP 3072:p4kuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:TuJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T1EAD38C1376D084B2E5B2593108A1DE71893EFD625D50DE6B33D43B3E0F316C1DE2AA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 e53e7256d0a74b9e66f23175fe797af382da9b991808ee9c15ccb52a2896c85d
MD5 ea32d5b0b0d1386125262555053b1302
SHA1 6b2b34d0fbd0f5e2ddf3f36d4d00d048bb4e92c3
SHA512 925da908da953df34e14512d0ce7c1dd13149bcbb2fd32c295805284d96a8bc31b8b3dca4d23868b93b5600f62ccff53d28da0845067d61ed87b3b25874ce8aa
SSDEEP 6144:SuJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:sXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1F3C40916F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 51b30b0f87f0bcb5359f95ba255be2eb981688ab413f36125ddcc130c88c04aa
MD5 d34ee9564990bef9a6bc8d37b4db9165
SHA1 2c4ecbd56e31f35def6f094f97dd730d6849beca
SHA512 ba2437061f32b6b95ee787aefabcb1a0076f1e7c497f45ecf4d83d310d289ea4d0430f6513e34958c25db7a471c2e42018c9ed37519fc971d4cbca59ccb1b82c
SSDEEP 6144:wJuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wTqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T125B46D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D2EB8497A7F7203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a22E5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a22E5.bat
Size 722B
SHA256 11b71df01ae7a5109277c5ef866caf9b3f63225ee427184cd9ebe57c66487613
MD5 09309910154ab5d778b05073cd79aff6
SHA1 8ddc6a578597223e6da0e55fbc823b59a346a838
SHA512 c557cab100c1b64d156c0bfe2e9c4cf7c504b81ea3a2262a110bad9d63e97b504dab54a055533f5f7e766706ca183ead2365e5a11d34d7dfb17d09e9a9a868f3
TLSH
T1340184A44AC64ACB4E50F1F73F75BD8E80A228BA7E8327531619815920D6C3FEB8F141
MD5 SHA1 SHA512 TLSH

Submit Download

478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\478fcb24525cfbc0074f149387050550fb351742d94d81e022dde7a18c088105.exe.exe
Size 893KB
SHA256 ad603e26e6097bb464a792f0a92b200a2d1231f18cb7ffee6f8a89589b9a037d
MD5 dbe32a8ebd2c3a8cd4a0e93c1cc6c5d4
SHA1 07e12f66abf5117040e891137f6fd6bbf1ccb04d
SHA512 ec61c7feff3540fac6535e2976fd2e611453f0f42113f125a9732476a0ffbb4b16dd32c225058a77d931da6d6b255b80fbfb5124a3cf57450795f748db9752be
SSDEEP 6144:9spNjlsNUjD5cxLHdrqP7ysKmH+WuExwWUDDvxbJuP77+Wzmqs2qwaEm1CCCsCBe:9cgUjD5cOP7y8H+nWUDDveP77+7qB3KJ
TLSH
T1C9151811BBC1E273E1AE4630D9B6D32D2B32EE917F92864B2B5533DC5D31310A93661B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn24DA.tmp\System.dll
Size 11KB
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 fdfbbc7c89562a0289f88e61c6aa7e0b93d1fa4519625ed82975a81f60c3c1da
MD5 9123d54d05aec7784d073b1b9ed95b70
SHA1 58fbc76e94215756ac480b2c07a68a17749bc91e
SHA512 82d01f38b007bb8ebbdcad31cca759fe68e88e14c368a99cdc5eec67dfe22a27ad062b7d90ce967036c5d1e3478b081203b32510d7c6c3891cfa3f178bc81ace
SSDEEP 384:NbbOZ0oK7x1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:p6qJ16GVRu1yK9fMnJG2V9dHS8
TLSH
T128D2D060779D62F3FAB20BF024A34F578A36FD21EDCA920F6D28B7551CB15001539A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3119821332-640943685-2562343641-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/1816-24-0x0000000002340000-0x000000000277B000-memory.dmp

Download

memory/2644-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2644-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-43-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-39-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-683-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-1230-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-26-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-5011-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-5514-0x0000000000400000-0x0000000000436000-memory.dmp

Download