4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe
Size 172KB
Sample260601-lnwk8aav6p
SHA256 4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5
MD5 a35aecb8cbf3bf4ea9fbb0b707b0f754
SHA1 5859bea8ced7b182eb367f621304d91fcbc76b87
SHA512 2b5aa42d1ca7f9ec88aa9556a4b4029315000b9787ca6f113b86e62d7104e7debfa0a15cb4b55e94cb8ee6aec6149bdce281ad546e1014a971e8cd9f2a8895a9
SSDEEP 3072:0ftffjmNoxxqeXA/4yIg9vkNPNu6H6xCYOixUE2652J:MVfjmNAvgvkNFNaxmVEWJ
TLSH
T1C2045C07A2A851BDF1B6D679CD924D41FB7278598B71A6CF03504EB60E62BD0AE3D302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2220	Logo1_.exe
3500	4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\x86\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\node_modules\@microsoft\load-themed-styles\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\componentAs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\warn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\ro-RO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe
File created	C:\Windows\Logo1_.exe	4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe
2220	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 1572	3972	4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe	82
PID 3972 wrote to memory of 2220	3972	4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe	83
PID 2220 wrote to memory of 3484	2220	Logo1_.exe	85
PID 3484 wrote to memory of 2172	3484	net.exe	87
PID 1572 wrote to memory of 3500	1572	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe
"C:\Users\Admin\AppData\Local\Temp\4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22E.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Users\Admin\AppData\Local\Temp\4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe
    "C:\Users\Admin\AppData\Local\Temp\4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe"
    3⤵
    - Executes dropped EXE
    PID:3500
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 9bbdad669361164d2d96928615f9f1e38d53f2136c5463ac8429d1bf31cd9f22
MD5 009e66a62b62f57bded66f6ee101a835
SHA1 ba786cfcf68c3a988c5215960c466db805b8157c
SHA512 f0c0d7f81b20da73673be639d1c05fdefdca62b94902e12e80ab16afb9eb7fd771d074bb976be28514a4003854b37eb71fe4b012fffcb17cd7bc2e71e219bd11
SSDEEP 3072:eftffjmNoxiYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:GVfjmNZYCk3ET+Tu3fCUzB+JHI
TLSH
T18EC38C1735D0C4B6F4B2593219A1D971897EFDA20910CEAB33D51A3D0F31BC1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 00303d5f32cc178909c2e637c7ee47cd078b6b0793431ba4ce0b2c5556ad43ad
MD5 07027b5e624dc9051c56507f0eedad4c
SHA1 5eb65b1bcc50e2bdeb037e07f04ba64f454f9d63
SHA512 2b561a8efae81b057b3677bd67da2dda3cce6a03b92f8752101a386495a5d5242f3cd30e7e0e91b74bd2ed99b2cab26e6661f8f39eba308082fcf15eb1c9489a
SSDEEP 12288:O7+EXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:O7F0Le5ji0hmxNrM
TLSH
T17EC41916F6748335D073C0B9C5D2A69EE972308257308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 297984cb1c691abf3614c0c64ed3ed1b8cbf2e2f2efae02e5392e110a717394c
MD5 0c5536c6a3aefefb2d4cc1cfbb729119
SHA1 660b05e7c4543df8ec6d4e80d6c8f3c9d667bf8c
SHA512 9f833ca254c2e29c8fa9fe95ebeb6d62a686b99dd6597761ffb2797a0b50daa531a483f6047b8bbb059c2f15abe19aa030e67d2c1198624633146d76aebc7da8
SSDEEP 12288:Bp7+sqIOkU8AMXE9B7PElZlP41N+4PUWfo:H7RBOkUhMXcBwc04nA
TLSH
T104A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA85D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a22E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a22E.bat
Size 721B
SHA256 405b709ab2ada3937dd187d56d71fb941998c1798df8a89a8704b88fabdecfe1
MD5 d4b79e8435c2816d0c5f56347bfbf084
SHA1 b063ff303bc5d4e60191d2b44d1f5240260cec3d
SHA512 0a3cb04da04360642f2b3842b9c591aceccaeb28eaf63c415e04edfc20897cf9d2e4e5bd6636b5792ca1d135a09f4d2a441407d349e0ff641bd9bee0bbc17f86
TLSH
T18F014C63D296BE0F0CD0686F1FE9C69DE7A004C53B637E060A3CD2DE658A98DE1C3145
MD5 SHA1 SHA512 TLSH

Submit Download

4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\4823a67dde2b384b2a8c444e71310a0b4e2ad44dadc06ab7b32d3db1facd49a5.exe.exe
Size 146KB
SHA256 10a8b72157ed0bec91b6f6034e95b9afd7fd75902c6fc29f8291532de503c908
MD5 d0c52b1e70a2f613e37c62ebdb6aebd9
SHA1 133e519773db1096b4174052f129cccc95fdb917
SHA512 f49bcf3dfb25ea18cf6e30a83e1a0faa949da3e6d2aab5368dec7798b8949d1c010c594410a32d3a6ae4cc044a4ff34d9af5fd76feda9790aeeb97197a744b5b
SSDEEP 3072:tqeXA/4yIg9vkNPNu6H6xCYOixUE2652J:tvgvkNFNaxmVEWJ
TLSH
T189E33B07A6A851BDE1B6D679CD924C41FB7378598B71A7CF03504AB60E63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 24e98d9749b84150f0824850a4b8e5efb17dd208083008b224e3d42541ddab7b
MD5 99bdef518bf76bb3f924f8cc7d642d9f
SHA1 01e96d6e05fc1385999a35b943b5b0ab12983294
SHA512 3ae78e16eabfdab12865165674c8db9c3e332d1d0f73952b5de9ee51eac7bb0077439d420598efcc554cc5a29ea9346eb678f9dc6e57a184043c5d0d934a6718
SSDEEP 768:S1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:0fgLdQAQfcfymNG+Kx
TLSH
T145C28C6C3189F2FCFC1569BFFB935633C2DC0AF5015A55E553A2AC2909D0FA8142EA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1679180529-4058988202-686829476-1000\_desktop.ini
Size 8B
SHA256 f29189eb11965eb3f457dcfc9961541cf5820960ece28657e097c84d9236f547
MD5 b2a4afee50c0667bf313e9f999f7e893
SHA1 f29707b43162626674eb6eaffdd44a0afac806f2
SHA512 bf4c3ec1fad1dba2ad0771a56aa1b163902e87d76d0844bd1aeec557f42d264143ab6f53d0b005626b19ce42351515a728aea0203ee5305e4f6a264495adcf27
MD5 SHA1 SHA512

Submit Download

memory/2220-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2220-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2220-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2220-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2220-607-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2220-1224-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2220-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2220-5005-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2220-5508-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3972-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3972-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download