ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
Size 1.5MB
Sample260527-wr4fcahs4s
SHA256 ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea
MD5 5639bc0b11f9832cfde8f94661e842e4
SHA1 22ac5a83002cbd83a26ec27a56ad02c852403b72
SHA512 4e00179edb0844e3083a32675dffc15695478754d24ce6aa66ad8bcfabf5362ced47bc71d856cc7041b554c19f9dd343d24f6c09b1c315010799bf54c48633ba
SSDEEP 24576:y76mpHu4q7+uHbBSUldP0v7fE66tsgsQSURrvibas8PyC7mYV:y7TpO4q7rHbBSUldP0v7f8IUhabas4fr
TLSH
T19F75D53CADA842A6D472CA75C5A1A9CDEA2178127B041FCF21D2534E0D3FBD36D71E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4912	Logo1_.exe
4788	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ru-RU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
File created	C:\Windows\Logo1_.exe	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe
4912	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2216	3992	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe	86
PID 3992 wrote to memory of 4912	3992	ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe	87
PID 4912 wrote to memory of 4480	4912	Logo1_.exe	88
PID 4480 wrote to memory of 1576	4480	net.exe	91
PID 2216 wrote to memory of 4788	2216	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
"C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C25.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe
    "C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe"
    3⤵
    - Executes dropped EXE
    PID:4788
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 6f054d2810b61d545ad51ab385cace1af19de03a437f5d667ccee5e8d6aa188e
MD5 c75ca597b98c2343c243b34f7c0d6d6c
SHA1 a89b5d757494024e86b602ee0346d38649331446
SHA512 d8a1dfe243d100c131bc5cecf2f791a57b7ba85f6c1ce159ad49c9d6dedafca4580a68d2ed1940126b26b254af950ab16cfc7e0c137df7f158632dcf0986eab5
SSDEEP 3072:WftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:OVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1E4C39C1775D0C472E4B2583109A1EE719A3EFD620960DE6B33D51B3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 0f6eb939daeb883aa2fd7ccca323ea78e3a1af47b6bca8fc3fd7b6833ca9b4e2
MD5 309f7204bd387c44ac581686c6f1ee97
SHA1 f0bde379f9e69dc198f7c8b36e984a910083280c
SHA512 e5177021234af11ccbcbab629ade0086707849459433dda10330e65ed54c5f558f241c175917c09ba6a409ea377f18908922ddea8542e419d49eaddfdcdc7e8b
SSDEEP 12288:y7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:y7o0Le5ji0hmxNrM
TLSH
T196C40926F6748335D073C0B9C5D2A68AED71308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a5C25.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5C25.bat
Size 722B
SHA256 5e5575b7f7926e43b147716bfc722b9999b01a1ff931cf508760b5e771e2e08d
MD5 235e524c5fa3335eff0c8fad2be263ec
SHA1 5207906ed4e78cfc39c912a994f6f9b953a680cf
SHA512 a1682113a64f76aa85a5ac38f0ddfec7f1d15047f5d7e6b58a0ad9e6b7afd1dd84e3608f6caa74e00bd977a7d4024e98cf16d0333c4cf86ce55206b7614f00c3
TLSH
T18D014C82809B7A9E1D20649FEA306A4CE126BADC67C12B534B209978CF8540EF7C7695
MD5 SHA1 SHA512 TLSH

Submit Download

ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ef72628f36eeda7e6409dd028dac44f65f7a6bd8e47395b31810a5c6c57727ea.exe.exe
Size 1.5MB
SHA256 c58513d9d49cfc4a492b40ae3405cfefb9ef715d4df2ace2da64f586b12d50cc
MD5 d092dff555e92fa9d9528d6c454cab01
SHA1 73c4a87befd4c6a19c861ecc4e71ef2de9cd7668
SHA512 cbf522f28a9844fbe38340a7d02345b28a1174ca3f92d7759a5c916699f70cedc3915f8f1850a43337b635739a51ee5538fa10050ca72b16aabef64b84db07d0
SSDEEP 24576:RmpHu4q7+uHbBSUldP0v7fE66tsgsQSURrvibas8PyC7mYV:0pO4q7rHbBSUldP0v7f8IUhabas4f7mk
TLSH
T1A565D43CADA842A6D472CA75C5A1A9CDEA2178127B041FCF21D2534E0D3FBD36D71E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 bd08c3859fe65614f252874fc948ce66e889ccfc3fe0a56ca8432c165f419588
MD5 494b97bf4321ac9cb00f5497f326ddcc
SHA1 40f67c6b0d52c82ec521ac11e2ac9bcc74d5baff
SHA512 aaa1c49cd9129430533bb700036961d908dacbfaa3741741867a261b6a6c051ff42dd939f4c625f45dcbf4a007506426178a8baa1829fbddf515b69e0491178b
SSDEEP 768:OCax1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:OCanfgLdQAQfcfymN
TLSH
T1C3C2D07D62D8E53CD856187CDAD23701AA2C07ED04BF775E27AB4B7A1162624030FA5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-204488895-2999877624-296153668-1000\_desktop.ini
Size 9B
SHA256 90660789145a1e303418de25f012f2cba7ff1d4dc5994f0c5212b2ab04edd7fd
MD5 25028b7169d40ab30de68048e493cd12
SHA1 f5045e7771e266ce03273df7b06fc6100dfc36ba
SHA512 91c6bce3388caa8f881195ea7d2328f21be026f3f46a6a90770de94f802aaa20d8186551d293a77e211d28c042a9def309202a2c7dbe15a6fa2fda178589d0f2
MD5 SHA1 SHA512

Submit Download

memory/3992-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4788-28-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-23-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-19-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-25-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-26-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-22-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-29-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-27-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-21-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-20-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4788-24-0x0000021BCC100000-0x0000021BCC110000-memory.dmp

Download

memory/4912-45-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-49-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-352-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-1258-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-5047-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-5552-0x0000000000400000-0x0000000000434000-memory.dmp

Download