27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
Size 387KB
Sample260528-ejtgqsgw91
SHA256 27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e
MD5 8c9a1a37fd5d2c8235527c6ae1c8b70f
SHA1 9e462de3174196602af587654a70ada3bf029dfa
SHA512 79b14e0e284b07644b78a244b2f923e44269297fa7e5c58a9f30515f659a0272ab0ad9c40b7d268c0071b7ad9ec9dc138d169d8e842024e12c9bd418ae78a5d7
SSDEEP 6144:DVfjmNgNwc33Evv+dfxafGu78vuz3INvBO+XTZTfuL7NdygtMdN4dhHBVO60m:Z7+1c3c76uz3sBO+XThuL5dtMdN8Bb0m
TLSH
T123847D117790DF31E66F05369A6897B45A6F7C208F2487DB23943E2DBE302C1A935B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2120	Logo1_.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\effects\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2021.2012.41.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\iadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.113.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Offline\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
File created	C:\Windows\Logo1_.exe	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe
2120	Logo1_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5340	AdobeARM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2308	1476	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe	81
PID 1476 wrote to memory of 2120	1476	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe	82
PID 2120 wrote to memory of 4980	2120	Logo1_.exe	83
PID 4980 wrote to memory of 5248	4980	net.exe	86
PID 2308 wrote to memory of 5220	2308	cmd.exe	87
PID 5220 wrote to memory of 5340	5220	27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe	88

C:\Users\Admin\AppData\Local\Temp\27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
"C:\Users\Admin\AppData\Local\Temp\27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4F5.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe
    "C:\Users\Admin\AppData\Local\Temp\27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5340
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 7c4b37785036002adc0eb61acb9c20365b5e622d85e13532ea9fbf24551a393c
MD5 3e0434bbea4e0204017d1147786e33b2
SHA1 e63e2d5c1a300789af9cddb99e3d30156f09754b
SHA512 a78d30c0b3a289d00eb3a89f3c82ad00ee0eb2b758707c882581d9d9b3b769cde049e42041dadbb4e325dde143494a41d8dcb4bc770057e6cf0381097d15cf71
SSDEEP 3072:aftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:aVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T121C38D1375D08472E4B2593109A1EE718A3EFE620950DE6B33D51B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 48f906dae45a463c9f62a8aa0a3945b92072453d90aeaddf247cca4f3405a171
MD5 952f85be7fc0322d49342f7f2493b163
SHA1 73231499a9d0e491749b99703c38e8099a370ed3
SHA512 6d02285af1b741bb75b98a0c6aeb7c44819a69d5e8a1a007e230c0bb368d0754879623769530cb2009174a5c9617c1eb64d2c706a47696a5eef1be15b53685a5
SSDEEP 12288:Z7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:Z7o0Le5ji0hmxNrM
TLSH
T178C40916F6748335D073C0B9C5D2A68AE972308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aA4F5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aA4F5.bat
Size 722B
SHA256 f576f95939f88afcf0707f9affb2ff2405284e274b7ca51ba71ed3ea95d6acb1
MD5 68c5d4355bfb0fd55cf3a41b7e4390dd
SHA1 158efd94cbb559bedb85ea0262d3af3b00e84e1c
SHA512 b9e88b6ab6c80f31df60a922aab67ba888cd44c878cbcf402cd0b67e943234783d7b9c4878fedc770e672f2421239ed0d709e614701af9700f347d4ee9faba45
TLSH
T187014044859F9AAE8808602F37ADA6CD88E70EDB76C63A010D30A5792342E0C579E342
MD5 SHA1 SHA512 TLSH

Submit Download

27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\27f897d54eb6673027b509469e02364445ede5a9002060c49e29d02976c9a89e.exe.exe
Size 361KB
SHA256 e6a0152862be4e18fb229fc32ad3e7a1f79f2fea01a8e22d8f03ac5f3c791669
MD5 22c3bb2557a43732f30d0135c10b3c04
SHA1 f90fa20ffe17916d898f77140aa44d90bdaae396
SHA512 65254e2f044a543d2ca4b767a77f937a60dae13c0919237dfc038561a85cd7eae07c00021ff7de0589d1119ddecac22b4a926947eedd650296d93e6c1765a784
SSDEEP 6144:kNwc33Evv+dfxafGu78vuz3INvBO+XTZTfuL7NdygtMdN4dhHBVO60m:5c3c76uz3sBO+XThuL5dtMdN8Bb0m
TLSH
T1E6746D117790DF31E6AF0536996897B45A6F7C209F2487DB23943E2DBE302C1A934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 2536caad7b8a2159b74a5ba5d8ee1dd4cfce5ae263cb42c85f5d707081dbc577
MD5 26ef96b6999d23663ee99c1fa3d86245
SHA1 c6aad5cd6cbda228fe40e8cc9c1e47fbc04d44a9
SHA512 fb708c1116d46dcdb9bb2cde22388a0fd3b53c5f45547912545204b749cd2e1db21111f0048a16e3eaa7f2b1cc3e1ae7ea9436c78b673f809f9adb9a41189926
SSDEEP 768:11ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:zfgLdQAQfcfymN
TLSH
T1D4C2F17912C82679EC254DBDEBE36741C33E477E449F6CAA25F2897A2250768200FB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1679180529-4058988202-686829476-1000\_desktop.ini
Size 9B
SHA256 eb495551880bcb8ea0e05d68913bbd05fe45b2a14f467ff78323860c4b9ae1aa
MD5 de4be486dbe6a6153d0a29adfb32ab0d
SHA1 3d3e3a4b5c706913a43014475f17179886b195f7
SHA512 b0f529d89c15aa298cdc30a7569cf38e6331038db82be75da53a53ec9b2cb345608d5732c85152fbac36ab8fe62def5600eff7fc8e9a1b0cb5c38801e9e43987
MD5 SHA1 SHA512

Submit Download

memory/1476-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1476-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2120-118-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2120-122-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2120-112-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2120-810-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2120-1309-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2120-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2120-5089-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2120-105-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2120-5596-0x0000000000400000-0x0000000000434000-memory.dmp

Download