57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a

Analysis

max time kernel
150s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe
Size 957KB
Sample260601-mn68dshv2t
SHA256 57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a
MD5 5f58977db4b6787f513fb1c9df78c24f
SHA1 a3f2888bc2d25aae81db192ff6a3784f1b8e7e64
SHA512 d6656cabe7b27fce9d0676b51c86d0b931bda7250996d4747ec2adc9148d18469ef39634507ae9124f62898cbfef8047bf9a416e34dac2618fd1de2f3aa0269f
SSDEEP 12288:Wp7RKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:WpEBpDRmi78gkPXlyo0G/jr
TLSH
T1CB25E725F5788333D0B2D0BAC5D6AA99FE7234425B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3064	Logo1_.exe
1388	57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\hu-HU\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\SnippingTool\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\node_modules\tslib\modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe
File created	C:\Windows\Logo1_.exe	57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe
3064	Logo1_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1388	57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1388	57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe
Token: 35	1388	57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 1956	3656	57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe	80
PID 3656 wrote to memory of 3064	3656	57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe	81
PID 3064 wrote to memory of 4952	3064	Logo1_.exe	82
PID 4952 wrote to memory of 2520	4952	net.exe	85
PID 1956 wrote to memory of 1388	1956	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe
"C:\Users\Admin\AppData\Local\Temp\57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe
    "C:\Users\Admin\AppData\Local\Temp\57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 126KB
SHA256 b45f844c2e9ed7d8f08749a5bb2cc24cb165b9907cec14e9a80ea96d6b768331
MD5 a3ced31c8d56cf3f4ce05e6dc8aedb7c
SHA1 537a450add2d16a6268d89ffe832b3e81d8a82e8
SHA512 073ba05424e74f10d8e818eb25a36e17242c83dc9bd95727b2e2ce41667c8cf194307ee5d50566e1ec34f704e592f4bf7c80fc59cce199b88eacf561d1710215
SSDEEP 3072:0kF3pPYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:ZFpPYCk3ET+Tu3fCUzB+JHI
TLSH
T107C39D1375D1C4B2E4B1593108A5DE71897FF9620E50DE6B33D81A3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 576KB
SHA256 c1831e731729d758562d7ecb35db71101c926f8e8cc7514c69b2b07252d71eb4
MD5 63a3d68835e21e3435e9cd383fddcb2b
SHA1 a3bbe2de96a0cc20d27df16780972a7de877f8c0
SHA512 00e32596723ec879a42bebee06943c0bee0e9ada8d1e5274775955d0554fc9c9b0d2515dfd8d5d107e09aea4128b23a0970c480b063f4c9d42fc33bb2c3fc5f2
SSDEEP 12288:WpiXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:Wpm0Le5ji0hmxNrM
TLSH
T118C40916F6748331D073C0B9C5D2A69EE97130825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 482KB
SHA256 2c7657fe57ec426599ef848815689264720ffed5a0f9a5d33d07cafabeb43bf3
MD5 ef2faa6fbcf12b63da1cf3e9283ad1cf
SHA1 2032ddc0f6ed9560583f70a279ca858b1e746409
SHA512 46b169f4142d45197207d0015119145c12eb01150c6b742c5f3792b01d2e23bda9e25e181144f4b9963eefcff7ccb9d37fad4d27b044753325ceeaea330fa00b
SSDEEP 12288:LxpKqIOkU8AMXE9B7PElZlP41N+4PUWfo:FpKBOkUhMXcBwc04nA
TLSH
T10EB47D31A6A04037D6F106B3F915D2307E7DA2187B1194AB9394AE2D3EB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a68.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a68.bat
Size 720B
SHA256 7506412b83ffe03e4d6affdb03a134ef74de58172f809bf9791d4b496df93a6a
MD5 28c344a9821c0bed069f19c24a67efa4
SHA1 c0eebe0a874ebe19678911476f9e91cf79317a4e
SHA512 688415fd08c91365b0a30825d98c592be6cfe41794413b3a3cf47cdbf86967c0df0481087d3ee233b0a3ef6720b1db63d9452afd139a477bb0ee3e4eb597b873
TLSH
T1280168072182A48E0C1141471D30ECCFE0B39EFA7BE9335AD332E1AA50C9A8CDAC9D01
MD5 SHA1 SHA512 TLSH

Submit Download

57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\57b16ae852bed64840a2adb3e963293e794c140b6a21d8753093a38f53b67e2a.exe.exe
Size 930KB
SHA256 1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
MD5 30ac0b832d75598fb3ec37b6f2a8c86a
SHA1 6f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA512 505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
SSDEEP 12288:kRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:JBpDRmi78gkPXlyo0G/jr
TLSH
T1FE15D725F5788333D0B2D0BAC5D6AA99FE7234425B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 27KB
SHA256 d60a6db3e93876ebd80c086b59e9637b45b96be5fa3868ab0ff60c8ad1a891af
MD5 0472e17261e57b06e1c372c4f908247c
SHA1 722db7f67d4714ad8a0d14108a288beafa720c3e
SHA512 c8002255959b173453a9bd4ec4dfd911f0632e93e99fc4bb3016addc542fbde20ad6f102168812edd17dd79f5350fd93f7b5abf2b0470d603f8994a3812d54c2
SSDEEP 384:MQAgH51Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:jAq16GVRu1yK9fMFLKaTxsujCT7pZpY
TLSH
T169C2D1F017CA6791C04413F60CEB4B6A59F76261DFCD7A8F2B7C684A0DF090985A960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-226940941-599731907-2645636698-1000\_desktop.ini
Size 8B
SHA256 f29189eb11965eb3f457dcfc9961541cf5820960ece28657e097c84d9236f547
MD5 b2a4afee50c0667bf313e9f999f7e893
SHA1 f29707b43162626674eb6eaffdd44a0afac806f2
SHA512 bf4c3ec1fad1dba2ad0771a56aa1b163902e87d76d0844bd1aeec557f42d264143ab6f53d0b005626b19ce42351515a728aea0203ee5305e4f6a264495adcf27
MD5 SHA1 SHA512

Submit Download

memory/3064-27-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3064-33-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3064-37-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3064-20-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3064-807-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3064-1224-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3064-5005-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3064-10-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3064-5508-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3656-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3656-9-0x0000000000400000-0x0000000000435000-memory.dmp

Download