713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
Size 2.2MB
Sample260807-kn9bmstycv
SHA256 713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956
MD5 a0c9f04b132b240ca0585cd508ee8671
SHA1 c3e79a80b6c5a4f6e8e5d7f0c93c38eedc874b77
SHA512 4805748597e6a79489191f57a721a4d384aa3fd329036a242bcc0b3e1c6c046184a36100b170449c04550c09a1bc415a9da492c529a140df3dab6288aab6b1a1
SSDEEP 49152:j3obGj742J2oi88Pm99MtJvuaqjJnytkho9zf3T5R:di2yvZqjJni9n3
TLSH
T18EB59E12B951D132C11303B06E3FAB7CB62DBFA96E10854B73A85E4C4FF6B90A916357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2448	Logo1_.exe
4128	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Views\Utilities\Styling\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Microsoft.Support.SDK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\en-IN_female_TTS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
File created	C:\Windows\Logo1_.exe	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe
2448	Logo1_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4128	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1728	4912	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe	86
PID 4912 wrote to memory of 2448	4912	713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe	87
PID 2448 wrote to memory of 4316	2448	Logo1_.exe	88
PID 4316 wrote to memory of 1268	4316	net.exe	91
PID 1728 wrote to memory of 4128	1728	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
"C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC30.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe
    "C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4128
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 d5b9179e28acf8d78c58de77351bdb4d5c7c02ffb3c9c8232458dc90c6e18eab
MD5 86cdb726479bde6b521b645d3d733cde
SHA1 6e4cfd095e78fbf292bd96a2ebc1dc908deccd44
SHA512 62535e249f3770c00a228c79076db3cd405fc2ad3bcd99c1c04640d4085913878b8771a2d896fd4be248475c86041678aacee8e4ac5957597fc3ee7c4bf24c17
SSDEEP 3072:pikuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:huJtYCk3ET+Tu3fC0zB+JHv
TLSH
T100D39D1376D08472E5B2293108A1EDB1493FF9725D50DE6B37D42A3E0F316C2DE25A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 881c9eaa92511d71c5458e8f31d8f8aeba0dd876df8cfa9361d28524cbad6214
MD5 780a08571f24a188c08eaf8c6664827c
SHA1 4600cdcc35bf8ea5c2f7d187c31e8ba9274b07a2
SHA512 f4332dbc40cdb2529d909143ff403c2203e5d2bae58bda5d4849362d98522672b6827957210ae68b03c1634ce57bb0f97dda4e0853cdbadfe91ad2d1355dc15d
SSDEEP 6144:ouJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:KXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T192C40916F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 3f698febb38240205f90cc520c666f0fb45a19ab7b72c891cdb1ae5d82039b6a
MD5 6dd0bf3b535387918d789c39b2011fc5
SHA1 117d7d7a52eacc47e7a9d414a31f07891dc8c388
SHA512 be3d44dfd30e8a22ed76c3892c1866d852cd97afb1c63953df3c1edf78ab73b47382f0dc4df9627da18206cf93236b81e0361e3bff2c02d4c3856738cfc790e0
SSDEEP 6144:wcuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wuqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T19FB46E31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aC30.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aC30.bat
Size 721B
SHA256 6b6f9de542eed71645a3c9204755e4208287f693e284afa21d4dc9819915229b
MD5 4234967f51477b3de13b34328cbca0d0
SHA1 ca749a616cda86739895bd6966db3cd36b855966
SHA512 7632e5e95b1f74657dd20b719724df64036124ec80709aa84023a9fd69a3c425d9cef03c1211cb5714f0bf5576fccba8dede1611298877b5c58c2e06d06dddf8
TLSH
T19301B10A87DFA74E09605C5F5EF1F89CCCE614A83F502321E56A86C816D3C0EB9C5255
MD5 SHA1 SHA512 TLSH

Submit Download

713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\713227039273c5ab0085443a9c977730341301c8fe1dc2a8d5d4a4a1ef07b956.exe.exe
Size 2.1MB
SHA256 67b009520c8811bb40570bbf1dfe62aed8fb0baae4bc4a71bbf65f91ca4c298f
MD5 ce5b370da176528b23ee66cf60cb9382
SHA1 9876602605737abb01fd40b988c797b1baa109c2
SHA512 6efd1eb74ef7e74bd7df6782b777678dc9425a564b830727fc8d34b6fdd81315247b3de9816536c211fe3184f092ba5cc087a0019e71f03e2515a3da9a32e8a8
SSDEEP 49152:A3obGj742J2oi88Pm99MtJvuaqjJnytkho9zf3T5R:ui2yvZqjJni9n3
TLSH
T141A59E12B951D132C11303B06E3FAB7CB62DBFA96E10854B73A85E4C4FF6B90A916357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 88c72aa4ae4a8c7f1ae50d7f219cbaeb01e5babf4e5dd45949b907bf0574e973
MD5 74a953ddca4ff58f9f355a6a99a8aada
SHA1 e0645f4ea25cea8ffba4c0ec9bacbc9d3effe151
SHA512 84b721bd5b9d0e7d76eb16f5ebe3dc1c2b622f1fb3b176bfc57d8c1153651af23ba975ab2bd4e00dab0f0ff5c10e7958a08be1b9c818125f03bd6c89a2483b4c
SSDEEP 768:pOvK99A99j9999999xk9999999s9999999Q99999999991P99999999997Qwdwhy:pV99A99j9999999i9999999s99999994
TLSH
T113D2BE2862C85722D6A53AF028B32FBA4526B23DDC49F20E9D64BE5B1DA08C355617C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2370214745-1838013427-2987045292-1000\_desktop.ini
Size 8B
SHA256 cb7bedc97bdd2d63203eb6ba133a1f2298106db82404f9055a36ff6d137d0f86
MD5 cdafaf40f18f1b84f5c564f8618a53c5
SHA1 d6778fe9d23f3cb9ae7b983cbced89febe0167f6
SHA512 e2d158d9d6e18a5ec5b381dd92d092ba4eafd77ace54370c53ad151f7f78120a3a27846510bf5dee427adf6415eba744e277b7955cd3398430c6ed2053c542b0
MD5 SHA1 SHA512

Submit Download

memory/2448-1256-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2448-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2448-5625-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2448-5106-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2448-30-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2448-38-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2448-373-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2448-44-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2448-21-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4128-23-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/4128-19-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/4128-22-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/4912-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download