d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe
Size 3.5MB
Sample260601-mpymmsbv6n
SHA256 d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39
MD5 64eac409d4b0371675ac930052ec4959
SHA1 12ef8b68159d3da66a3fca1f36318c0087f29273
SHA512 1f2394b6e9e3d55d7b86e04aa14ebb1492581e2dc84e9f163a833d20422a0c43417c25d8cb8e777ab5f726e61f7e6715cbb726c1eff1ad6eb74340cff2ae24c9
SSDEEP 49152:W5tzuM0S2S5mLFEuVebedv9uNBb8AftK9qrO1LS9RhSq15vTNuHv/QXd9CQxM4kA:WCFk/fUqrOiOc5z
TLSH
T1B1F54B2E735881D9D266D5BD8A42C506E371F801CB3166DF26A4475E2FBBBE34E3A340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4496	Logo1_.exe
3972	d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2020.812.2125.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2020.812.2125.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe
File created	C:\Windows\Logo1_.exe	d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe
4496	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 4832	1248	d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe	80
PID 1248 wrote to memory of 4496	1248	d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe	81
PID 4496 wrote to memory of 1696	4496	Logo1_.exe	82
PID 1696 wrote to memory of 1240	1696	net.exe	85
PID 4832 wrote to memory of 3972	4832	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe
"C:\Users\Admin\AppData\Local\Temp\d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AA7.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Users\Admin\AppData\Local\Temp\d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe
    "C:\Users\Admin\AppData\Local\Temp\d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe"
    3⤵
    - Executes dropped EXE
    PID:3972
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 126KB
SHA256 b45f844c2e9ed7d8f08749a5bb2cc24cb165b9907cec14e9a80ea96d6b768331
MD5 a3ced31c8d56cf3f4ce05e6dc8aedb7c
SHA1 537a450add2d16a6268d89ffe832b3e81d8a82e8
SHA512 073ba05424e74f10d8e818eb25a36e17242c83dc9bd95727b2e2ce41667c8cf194307ee5d50566e1ec34f704e592f4bf7c80fc59cce199b88eacf561d1710215
SSDEEP 3072:0kF3pPYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:ZFpPYCk3ET+Tu3fCUzB+JHI
TLSH
T107C39D1375D1C4B2E4B1593108A5DE71897FF9620E50DE6B33D81A3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 576KB
SHA256 c1831e731729d758562d7ecb35db71101c926f8e8cc7514c69b2b07252d71eb4
MD5 63a3d68835e21e3435e9cd383fddcb2b
SHA1 a3bbe2de96a0cc20d27df16780972a7de877f8c0
SHA512 00e32596723ec879a42bebee06943c0bee0e9ada8d1e5274775955d0554fc9c9b0d2515dfd8d5d107e09aea4128b23a0970c480b063f4c9d42fc33bb2c3fc5f2
SSDEEP 12288:WpiXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:Wpm0Le5ji0hmxNrM
TLSH
T118C40916F6748331D073C0B9C5D2A69EE97130825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 482KB
SHA256 2c7657fe57ec426599ef848815689264720ffed5a0f9a5d33d07cafabeb43bf3
MD5 ef2faa6fbcf12b63da1cf3e9283ad1cf
SHA1 2032ddc0f6ed9560583f70a279ca858b1e746409
SHA512 46b169f4142d45197207d0015119145c12eb01150c6b742c5f3792b01d2e23bda9e25e181144f4b9963eefcff7ccb9d37fad4d27b044753325ceeaea330fa00b
SSDEEP 12288:LxpKqIOkU8AMXE9B7PElZlP41N+4PUWfo:FpKBOkUhMXcBwc04nA
TLSH
T10EB47D31A6A04037D6F106B3F915D2307E7DA2187B1194AB9394AE2D3EB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a8AA7.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8AA7.bat
Size 722B
SHA256 0ccaf203e4c969088abd373857c2bb9032edb9513a457f90721ac8847675a7c7
MD5 4feffc7e3cb940a7a38ccd5527ed5b5f
SHA1 d19572f992b88ba0b9f6047713f0bb82228a6d57
SHA512 761676b7dd878023b51fece423693ec4591befb1c76f1d8299cb710e684ffce9c946387dda7e9f7f11d52e0deb78096e524531504dc8cb57b7f68baf3fa640c6
TLSH
T1E301D60743C6476B08E53D332A55F6DEC4D90904AADB1B67D739C85522C3648ABDD202
MD5 SHA1 SHA512 TLSH

Submit Download

d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\d9067b00e4cc1a6e092541ab535bfaa3195cad9b13ef92bf4fcef275ca982f39.exe.exe
Size 3.4MB
SHA256 2b2538d62a3d95caa1eaaf402dda55e9b0dc66e5a0b8f6c8fd3042550e48d56d
MD5 cd53c61345139dd549495633c7195a9d
SHA1 2f2ea5f17f724e08f2d965e591b61e0daf310487
SHA512 006ea7fc9f7cb6b7312c4431ba631a528654bc5c111561cb884b165176dc70dccbb7d72e132b38ce599156df6ffa31476b69fe6dd095a3fef2f93b7ef5208124
SSDEEP 49152:k5tzuM0S2S5mLFEuVebedv9uNBb8AftK9qrO1LS9RhSq15vTNuHv/QXd9CQxM4kA:kCFk/fUqrOiOc5z
TLSH
T1B5F54B2E735881D9D266D5BD8A42C506E371F801CB3166DF26A4475E2FBBBE34E3A340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 27KB
SHA256 d60a6db3e93876ebd80c086b59e9637b45b96be5fa3868ab0ff60c8ad1a891af
MD5 0472e17261e57b06e1c372c4f908247c
SHA1 722db7f67d4714ad8a0d14108a288beafa720c3e
SHA512 c8002255959b173453a9bd4ec4dfd911f0632e93e99fc4bb3016addc542fbde20ad6f102168812edd17dd79f5350fd93f7b5abf2b0470d603f8994a3812d54c2
SSDEEP 384:MQAgH51Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9p5Cs:jAq16GVRu1yK9fMFLKaTxsujCT7pZpY
TLSH
T169C2D1F017CA6791C04413F60CEB4B6A59F76261DFCD7A8F2B7C684A0DF090985A960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2043432456-1617298091-2772621413-1000\_desktop.ini
Size 8B
SHA256 f29189eb11965eb3f457dcfc9961541cf5820960ece28657e097c84d9236f547
MD5 b2a4afee50c0667bf313e9f999f7e893
SHA1 f29707b43162626674eb6eaffdd44a0afac806f2
SHA512 bf4c3ec1fad1dba2ad0771a56aa1b163902e87d76d0844bd1aeec557f42d264143ab6f53d0b005626b19ce42351515a728aea0203ee5305e4f6a264495adcf27
MD5 SHA1 SHA512

Submit Download

memory/1248-13-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1248-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4496-27-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4496-37-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4496-33-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4496-707-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4496-1224-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4496-20-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4496-5005-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4496-8-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4496-5508-0x0000000000400000-0x0000000000435000-memory.dmp

Download