39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
Size 493KB
Sample260528-ld3lsaby5k
SHA256 39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3
MD5 a0218c8c6ff17488b6ca83c49ce1c59d
SHA1 42f568cd32b98b31d628f4a8277ac72e313c0372
SHA512 d1f1dee46d8e5c49658368bb591c9fde4916085c0578a34d66ebb20a4a204d6c65f317c93d2b5574ea812c55e7e9a965b8560b71d1c3428493f351a562f946dd
SSDEEP 3072:kftffjmNYSnjePsDg49MlXtPdqfcXwRSBDaFWbbV7Q1KVGP4HPZ2RGag1dTbnT9M:8VfjmN3ga1NJXQCObU
TLSH
T180B452887160AB98F1B957F815231860A7B520FD626EE3CE4CD234D32972F01EAD956F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2376	Logo1_.exe
5936	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\edge_game_assist\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\edge_BITS_4336_1195043096\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files\edge_BITS_4328_2001466651\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
File created	C:\Windows\Logo1_.exe	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5100	5936	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe
2376	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 3984	5548	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe	87
PID 5548 wrote to memory of 2376	5548	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe	88
PID 2376 wrote to memory of 984	2376	Logo1_.exe	90
PID 984 wrote to memory of 2556	984	net.exe	92
PID 3984 wrote to memory of 5936	3984	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
"C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA00.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
    "C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 808
      4⤵
      Program crash
      PID:5100
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5936 -ip 5936
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 c752bab4d815c879cd3bb9eaab97937564ba3b2c4445aefcd66936292f23ab9a
MD5 5389199d273ea5c4a395aa7f8fc8deee
SHA1 66c6ba4f43c66323b8b13fef5b6d6425467bfa7a
SHA512 3ee46660e42decf737816aefa61c32058b0d8e33a13b1772db6d22cac5e4a0907e1d1749285ee71e3828a1e25cafcbcaba645f8cd70f165f0afbf75ad70aae7c
SSDEEP 3072:NftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:dVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T10AC39D1336D084B2E4B2593119A1ED719A3EFD620950DE7B33D51A3E0F316C1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 3f2427ae2896585a2690fc4b8df5712c27038031a359f60f785b716d343f1139
MD5 26a0036c2428aa2b12bab1ce4a93be82
SHA1 e4d886211d58dacd431f9bdc9fa7a69bb97a0008
SHA512 38968202f63b6381fd94074079ae3a3c99057c6fffb47c957c73a400236caa63fa12361453874019a26b757f1aae57b1ea59112d486be873cdf96192f2169637
SSDEEP 12288:+7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:+7o0Le5ji0hmxNrM
TLSH
T103C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aFA00.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFA00.bat
Size 722B
SHA256 c4e8f1d245d90657c823a2fc3526c0b3edd534d9833a6399ecf0f6e1981b7204
MD5 8aee78cd055ff8e8258414c7db9aa1c8
SHA1 b436632b1ccbc8f3f300cce5cb4bee83fcaf9555
SHA512 44fe0be8b234bb6b8d8e7fae085401e814a4981e28bbf76a944242a26caf036810bc49cd0d8c457762c04632b92be2499db5dff1d394c8b03c0988aa710dbf22
TLSH
T1DB01714E87DF9A5E4E9C017702A1A59E81E33C093A9EE7419F29E51D13D040E97DDE02
MD5 SHA1 SHA512 TLSH

Submit Download

39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe.exe
Size 467KB
SHA256 d4ec1c2d85e9524dbede618edf56aa85f28a9d3d42d7c211f4476d60dc4049ff
MD5 535a47c314366c44d2f968554bd9b36c
SHA1 32115343a3f97f36693a6e43c486500c0814c874
SHA512 6bc31d9087b002b6974563ccf70d789e3663ecbf3b81e2ff2a6311c9e7051a15ceac4589c7ca1c5b9f5a7c23184593cd66a5d1a56927ad6ae822d0ce04de0339
SSDEEP 3072:kSnjePsDg49MlXtPdqfcXwRSBDaFWbbV7Q1KVGP4HPZ2RGag1dTbnT9hV506Eu+7:zga1NJXQCObU
TLSH
T168A441887160AB98F1BD57F815231860A7B520FD626EE3CE4CD234D32972F01EAD956F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 35d1021b794bea3715cf8fde6d9226e011ee436a515675e815db389a7829917c
MD5 1f3e215a5e17b82f1fd01418b547cad5
SHA1 559e7902ca019975f9f0549226ea8025cf5c48cc
SHA512 3bf78ae597cd14825189bee007e7c6321625499817b76f135a11e1444ef4df0bfbceaba22d186c9e58f7f46ed84eb3f33d367eca58507f21a5b74e35ed5dcc88
SSDEEP 768:xw1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:kfgLdQAQfcfymN
TLSH
T136C2D0F617C81679DC12697DFBD26702837D0F79409F2C6539E2B93B2274A68500EE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3053180483-1881419501-3594244048-1000\_desktop.ini
Size 9B
SHA256 eb495551880bcb8ea0e05d68913bbd05fe45b2a14f467ff78323860c4b9ae1aa
MD5 de4be486dbe6a6153d0a29adfb32ab0d
SHA1 3d3e3a4b5c706913a43014475f17179886b195f7
SHA512 b0f529d89c15aa298cdc30a7569cf38e6331038db82be75da53a53ec9b2cb345608d5732c85152fbac36ab8fe62def5600eff7fc8e9a1b0cb5c38801e9e43987
MD5 SHA1 SHA512

Submit Download

memory/2376-1292-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-5594-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-735-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-5079-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5548-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5548-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5936-19-0x00000000054F0000-0x0000000005A94000-memory.dmp

Download

memory/5936-20-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Download

memory/5936-18-0x0000000000350000-0x00000000003CC000-memory.dmp

Download