39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
Size 493KB
Sample260528-ld3lsaby5k
SHA256 39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3
MD5 a0218c8c6ff17488b6ca83c49ce1c59d
SHA1 42f568cd32b98b31d628f4a8277ac72e313c0372
SHA512 d1f1dee46d8e5c49658368bb591c9fde4916085c0578a34d66ebb20a4a204d6c65f317c93d2b5574ea812c55e7e9a965b8560b71d1c3428493f351a562f946dd
SSDEEP 3072:kftffjmNYSnjePsDg49MlXtPdqfcXwRSBDaFWbbV7Q1KVGP4HPZ2RGag1dTbnT9M:8VfjmN3ga1NJXQCObU
TLSH
T180B452887160AB98F1B957F815231860A7B520FD626EE3CE4CD234D32972F01EAD956F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4004	Logo1_.exe
1012	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\strings\en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1909.12456.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\KeywordSpotters\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
File created	C:\Windows\Logo1_.exe	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4388	1012	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe
4004	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4832	4160	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe	80
PID 4160 wrote to memory of 4004	4160	39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe	81
PID 4004 wrote to memory of 3048	4004	Logo1_.exe	83
PID 3048 wrote to memory of 4104	3048	net.exe	85
PID 4832 wrote to memory of 1012	4832	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
"C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1681.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe
    "C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 832
      4⤵
      Program crash
      PID:4388
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1012 -ip 1012
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 cb652686b8fd827d8fee7dbb834c0675f7da660011079d907c855c96e8dfeaf2
MD5 14a17600b530b57c8d351c0af4b1ba4e
SHA1 8e685c3b2ff20c91816f723acfebc93485f2d77f
SHA512 9659fbe412bc676419206a9bef46938f792d2146946084d61b61c9eb82693f74a6b35b90edf9d5f6bdf766cc2090cf4710c277e83f6ddedae6fdee6a1de78b0b
SSDEEP 3072:NftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:dVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T1E0C39D1376D08472E4B2593119A1EE718A3EFD620950DE6B33D41B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 3f2427ae2896585a2690fc4b8df5712c27038031a359f60f785b716d343f1139
MD5 26a0036c2428aa2b12bab1ce4a93be82
SHA1 e4d886211d58dacd431f9bdc9fa7a69bb97a0008
SHA512 38968202f63b6381fd94074079ae3a3c99057c6fffb47c957c73a400236caa63fa12361453874019a26b757f1aae57b1ea59112d486be873cdf96192f2169637
SSDEEP 12288:+7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:+7o0Le5ji0hmxNrM
TLSH
T103C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1681.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1681.bat
Size 722B
SHA256 d5976e533c9fb8c26dcbf57e368762ee3e481da985fd7c0a20aa88d6640d6fee
MD5 8239e00e7591b32aeefdffd11a6bb043
SHA1 ba5fa5f647a10306696cebbc8b3e4439c074903c
SHA512 282137f951cd08e957d8b5f358c2efb4ead519e4658f83ce32b1403caeb837f1c5c0fa638bd12e032137c84d11b155b4b7abe7d4d9509cf72532b85e8669180a
TLSH
T10C01714E87DF9A5E4E9C017702A1A59E81E32C093A5EE7419F29E61D13E040E97DDE02
MD5 SHA1 SHA512 TLSH

Submit Download

39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\39f3d3bd2d6a905dfb8fd547720941698f4b189955620658a4323abc5c16bec3.exe.exe
Size 467KB
SHA256 d4ec1c2d85e9524dbede618edf56aa85f28a9d3d42d7c211f4476d60dc4049ff
MD5 535a47c314366c44d2f968554bd9b36c
SHA1 32115343a3f97f36693a6e43c486500c0814c874
SHA512 6bc31d9087b002b6974563ccf70d789e3663ecbf3b81e2ff2a6311c9e7051a15ceac4589c7ca1c5b9f5a7c23184593cd66a5d1a56927ad6ae822d0ce04de0339
SSDEEP 3072:kSnjePsDg49MlXtPdqfcXwRSBDaFWbbV7Q1KVGP4HPZ2RGag1dTbnT9hV506Eu+7:zga1NJXQCObU
TLSH
T168A441887160AB98F1BD57F815231860A7B520FD626EE3CE4CD234D32972F01EAD956F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 35d1021b794bea3715cf8fde6d9226e011ee436a515675e815db389a7829917c
MD5 1f3e215a5e17b82f1fd01418b547cad5
SHA1 559e7902ca019975f9f0549226ea8025cf5c48cc
SHA512 3bf78ae597cd14825189bee007e7c6321625499817b76f135a11e1444ef4df0bfbceaba22d186c9e58f7f46ed84eb3f33d367eca58507f21a5b74e35ed5dcc88
SSDEEP 768:xw1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:kfgLdQAQfcfymN
TLSH
T136C2D0F617C81679DC12697DFBD26702837D0F79409F2C6539E2B93B2274A68500EE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2043432456-1617298091-2772621413-1000\_desktop.ini
Size 9B
SHA256 eb495551880bcb8ea0e05d68913bbd05fe45b2a14f467ff78323860c4b9ae1aa
MD5 de4be486dbe6a6153d0a29adfb32ab0d
SHA1 3d3e3a4b5c706913a43014475f17179886b195f7
SHA512 b0f529d89c15aa298cdc30a7569cf38e6331038db82be75da53a53ec9b2cb345608d5732c85152fbac36ab8fe62def5600eff7fc8e9a1b0cb5c38801e9e43987
MD5 SHA1 SHA512

Submit Download

memory/1012-19-0x0000000000310000-0x000000000038C000-memory.dmp

Download

memory/1012-21-0x0000000004E90000-0x0000000004F22000-memory.dmp

Download

memory/1012-20-0x0000000005440000-0x00000000059E6000-memory.dmp

Download

memory/4004-1227-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4004-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4004-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4004-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4004-550-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4004-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4004-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4004-5008-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4004-5511-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4160-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4160-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download