36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe
Size 246KB
Sample260804-d5gjma1ele
SHA256 36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693
MD5 1843c14e54c47f91f2ac87af4adb842d
SHA1 2749e5281316344295c2bc921a99ca24c513ed65
SHA512 4365f78de17cddc237373e533fc430155447037d6fc8bc76f733b5f7e33700a38d41d690494b090bce872031151fc4d23d3d35b70454851285a9b1c8f2741c85
SSDEEP 3072:bjftffjmNya5JxItQ2tvWFBXfYW5TLeHhn8WjehhogKQk+5a3uJo+AvBJT:bzVfjmNX5JedtQXfYWohjjeKQnwB
TLSH
T1FE349D2236D1CCB3C2B751714ED2DB7AB7B6FA150B338A4767908B1E7C325A2463B251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2072	Logo1_.exe
4936	36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sk-SK\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\messaging\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe
File created	C:\Windows\Logo1_.exe	36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3256	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe
2072	Logo1_.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4936	36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe
4936	36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3256	2288	36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe	85
PID 2288 wrote to memory of 2072	2288	36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe	86
PID 2072 wrote to memory of 4468	2072	Logo1_.exe	88
PID 4468 wrote to memory of 2632	4468	net.exe	90
PID 3256 wrote to memory of 4936	3256	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe
"C:\Users\Admin\AppData\Local\Temp\36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82A8.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe
    "C:\Users\Admin\AppData\Local\Temp\36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4936
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 e0fb444df10bcbdb993ee4cd0c17f3ef72136e6b0783b70551cc6657dec82ed3
MD5 a894aca28ca89165aec04e2f21f7b634
SHA1 eb6a5b803f784e75a53146bd854ba6c0ce9f4bf5
SHA512 65dc23925af5481e8177b227af2dd135c23fbe27a4cb388c8e6b955c16ebf79e60d67b312f7aad96beaa140aa18d8e57f801e9389f6cc88e27635634bfeb240c
SSDEEP 3072:RjftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:RzVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1AEC39D1335D08472E4B2593109A1ED718A3EFD621A50DEAB33D41A3E1F316D1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressSplit.exe

Path C:\Program Files\CompressSplit.exe
Size 820KB
SHA256 0b7a205c3e7abecce4016ec6fb567743f10afdf33fbd4f6d7c6e2727ada65bb5
MD5 d3efd8ec053242a54710a136aa97bf82
SHA1 229f611792ee3a6f3b63ec04c2d6970303d23e7d
SHA512 1b6497c2281dcf6aea89d1f756724966add7a1e2f1a177872ddc6607dc8e2062e7616db950b316efb449efbef885f503f6acab7611a71abd3e8bea9170181a88
SSDEEP 12288:bJ7+JPnpRf6GVQAni0E8xQLkP/SDE/M5oTjR3A2ze9mAMS3FbHnTSzl7kP4OYa54:l7oRyGpi2akyLIbe9GwFbHn2uG
TLSH
T1F40523BB8A50CE4DF5C097B09A48C5138138D1F825AE3FCF5F89A96E1520E3B754B726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a82A8.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a82A8.bat
Size 722B
SHA256 ebf51fb5e5905f30c359e0c2d5829670824c722303ff5b06ed9c005ec554d6b0
MD5 4d62b1911230ecb8d5bf17f23412c0c0
SHA1 9be90f0fc2e25b020e5b3e4e60fbe1aef02121da
SHA512 285344e59dff439508d6be855e253a7cf4d9da14885a286ad2863a5ec58b91019a3723bb146c741e379e9bf38ac5fb9d95505a507912ec5a8a06261f2628990f
TLSH
T12E01D873C8CBF7DF2846602B047A94CED49A29BD3B5067589724C4CD61D0B1EEAD2909
MD5 SHA1 SHA512 TLSH

Submit Download

36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\36870f64010d15c68f64033bb85f3bbf7605c25005cc744de431b66b8d795693.exe.exe
Size 220KB
SHA256 c4c3950f5098f933677bc6cf8e0f35154fcb5349ab7cefef3473afd30be14cab
MD5 50e5d5f647476757870a4e1b769e5a10
SHA1 a6c37f914555abc64445c294848d77d42db94126
SHA512 6b02d3a05acbed7ae98ef47b46928bce647b76113f5d52862d186a25a029fced9ac360378278b3e87e55bd5edc3382a64d058c1e5c5f6c587618590566eb8a3a
SSDEEP 3072:Wa5JxItQ2tvWFBXfYW5TLeHhn8WjehhogKQk+5a3uJo+AvBJT:L5JedtQXfYWohjjeKQnwB
TLSH
T19F248D2276D1CCB3C2B751714ED6DB7AB7B6FA150B338A4767808B1D7C324A24A3B251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 0c99d5a3c46492d7d714b07eaec544c3cc5ae302e77bc90304b66a5aed551239
MD5 4505720d65968f5f71906462b43082e6
SHA1 897ad66ec2bfe71d1e39221ae73407708514d732
SHA512 ef3ad30379a1279c2b3c37d3172f0f49bce7b2b43faae6691d4277c8f5a7baa2a018f8f9f439737eee07de96db86e10c7c7784ac93a909cadec132678c62372f
SSDEEP 768:bF1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:bjfgLdQAQfcfymN
TLSH
T1BDC2D07922C85A79F8361D7CCAD36B40433A4BA955DE54992AE16D7F2160728100FB3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-668679576-120646659-2289335452-1000\_desktop.ini
Size 8B
SHA256 5faf71987eb0e4eedba10fbde77dc0c4d900740a123d4afbd05c219220d6fe31
MD5 7acd53b75847779af460d8a79f0c22db
SHA1 abaf1bfa56e7a8d57966c4b87dfbe40ccaa70606
SHA512 b52c9dbaac1fa9d6feb7eb186b129891eda171425af372b801f97082c14bf4ea25da52ffefd905e680719d10a3045e68e166674f9f06e573982e9038e8349534
MD5 SHA1 SHA512

Submit Download

memory/2072-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2072-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2072-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2072-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2072-347-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2072-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2072-5036-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2072-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2072-5551-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2288-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2288-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download