4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
Size 209KB
Sample260808-l3ldssvbmg
SHA256 4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb
MD5 6f5ba5521f7a6b051781d868eb75ceb6
SHA1 2b140d8ffd7882292241e741f21fa8e7e080af3e
SHA512 484fda02c50693a762719170f7b779257a8fa06b8a739e48149df43bb64495bf274f95544802f500c181cbbd98fafe9ceee0079e30cfa55d736f94e7de98d1a7
SSDEEP 3072:kftffjmNbphwUmVBpsnrflbMfEBDsfcrlYTMP3+TOs9AHJD8mBR1jDOo5t5:8VfjmNb8Um5WVMMBDsfGgk3SUJ5Oo5t
TLSH
T148242813375806A9C0A6D1789BD18603F3B378145B39ABEF5B9586390F32EC1BC7BA15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4768	Logo1_.exe
4512	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\swidtag\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
File created	C:\Windows\Logo1_.exe	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1940	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe
4768	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1940	2676	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe	86
PID 2676 wrote to memory of 4768	2676	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe	87
PID 4768 wrote to memory of 3064	4768	Logo1_.exe	88
PID 3064 wrote to memory of 408	3064	net.exe	91
PID 1940 wrote to memory of 4512	1940	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
"C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66C4.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
    "C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe"
    3⤵
    - Executes dropped EXE
    PID:4512
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 0e54f673c60de09689a30db3ffd9a827f4cc64d69158ed59d783426bee1e5319
MD5 16d4e271c0ce5b50a0b63a48813dc6d0
SHA1 e51b5663e11e277cbcb903c5dccc3a102557f23a
SHA512 dfa29c01167cf0b056c9931f78372e8ca7632db41cbdef0961319645219cfd27947198a12327935ad0ccca1a5889611acfe85329fd5a4058b83e9b1478931175
SSDEEP 3072:YftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:oVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1A0C38C1336C08472E4B2593109A1ED719A3EFD620950DE6B33D95B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 fce87c7f343c35a089d92d795ca3ff5321311b7f109b771ec488d5f7fdd6b4b2
MD5 d758159bd5c0fa56617d43fcfae376b8
SHA1 9a8284eded8de7c06128db496ea5ea81105c8190
SHA512 e90f1f72adb66a6db392cc239c67be826a1a96e24c1fe3e6bff2b5b133e584a79bf63f7e43f5830fd92684efb381e5d63ddba1a73db7aea09b58b339aa7d893a
SSDEEP 12288:+7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:+7o0Le5ji0hmxNrM
TLSH
T1D8C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a66C4.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a66C4.bat
Size 722B
SHA256 a546b5e5787090501302e552a9e9b5a79d4e864445cf3b3227cbadadb01bb36e
MD5 ceda4f3d9f71b219fb7f68fd6bd18898
SHA1 2c9df754ae9e5024aa1ffeb5104d1a57f31cdd55
SHA512 2ced7e2fa471ec72f86d941c0be24bec5494858615a04fa1ce9551477db4390f8139457e1620628dd4a5e16fa66f91385cef39d80aed547c456559e0e745c987
TLSH
T1C2018890E3CBDE2E0D4C508F0691638F80326D6D3793736589579C5E18C2E1EA1A7BE5
MD5 SHA1 SHA512 TLSH

Submit Download

4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe.exe
Size 183KB
SHA256 9497e1ae746293e30401540bb31d8adacaaf88eb90c457f2a814c58811a1fd6c
MD5 eb94dbc9a7520e5cd3f27bcbd5815a5c
SHA1 d3bc16fbbf564a5343509d8c1cdc636f20a5b21c
SHA512 47a7a57b9285d6da57c341ff5b516a0fcdf20884ee7f3a46118bdbbe269e46003d2eadaf0f0be071659231dffcacfdb57c9ff629ec70d9660cb5e714a4076575
SSDEEP 3072:3phwUmVBpsnrflbMfEBDsfcrlYTMP3+TOs9AHJD8mBR1jDOo5t5:38Um5WVMMBDsfGgk3SUJ5Oo5t
TLSH
T133041813771806A9D0A6D1789BD18603F3B378045B39ABEF5B5586390F32EC1BCBBA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 4526b1ae72b6cbc292f36ff5eb6aa63700738db86ae19535ed99c0825ea09235
MD5 52e378b020d530fc5f9ac70168b047ef
SHA1 e45111855d0893fa140e506e751388c5db131a9d
SHA512 a928ec31b5b94fa0c77e821888f037bf535ef9c41a8b4792ba98f3a0b3006b978582e9977cb788098cdc09fb180fa49c6654aef1f1c7710197381a3cd988127d
SSDEEP 768:Cx1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:CnfgLdQAQfcfymN
TLSH
T1E4C2C07926C4233CEC155A7DEFD24B05C63A4F65418F28A9267BCB7E1211B2B140EF9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-668679576-120646659-2289335452-1000\_desktop.ini
Size 8B
SHA256 1d606682c3c73b22d9ee6de30be63c56537bbb5179c9016a02f36487fa915852
MD5 ef2a73bd88d8ae9f0bc87903b5672439
SHA1 a35895c65154dc024ecb558b84baf0b1e1f7b198
SHA512 dbd3a473bfec5c2bae236e2dade98bf2c64e97272d390518a26f99bf30944a42a746b7852c68f75fce59ee1356398c0603a04681cd212c288c9487120a130da7
MD5 SHA1 SHA512

Submit Download

memory/2676-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2676-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4768-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4768-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4768-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4768-358-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4768-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4768-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4768-5036-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4768-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4768-5551-0x0000000000400000-0x0000000000434000-memory.dmp

Download