f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
Size 1.3MB
Sample260814-etfcvsvbkc
SHA256 f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1
MD5 759ea5a943a0a4561ef55aa8ec34070d
SHA1 964db61e9ca47a68639da478b45ab8fcff2a22de
SHA512 c3cbf3d1574e375bf2205f711a9f206bc29fd3936e6eeff63debcd9183058f0d2bba6b033dbce396aefe308d9525b2dc045ecb1eb97246e2374e7dd1438e3413
SSDEEP 24576:C7bmurOuCMz0ydYJE/OGO4MF5gbJngG/xM:C7bmuK96OGONFTG/xM
TLSH
T1D6555B117792F132D36102309929DBBA6C7DBE341F6245CFE3983B3A59741C36A36E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4828	Logo1_.exe
3160	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
File created	C:\Windows\Logo1_.exe	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe
4828	Logo1_.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3160	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 1800	4644	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe	83
PID 4644 wrote to memory of 4828	4644	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe	84
PID 4828 wrote to memory of 740	4828	Logo1_.exe	85
PID 740 wrote to memory of 4564	740	net.exe	88
PID 1800 wrote to memory of 3160	1800	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
"C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF85A.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
    "C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3160
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 c36ff394347387502e1692dba8053352cdd359c7742ad6cb2dfd75e6d5497634
MD5 f5f1f8cef8467e83f0ed35d7013af7cb
SHA1 58b42da3567b645e0e5e0ca90282758a86ba7aef
SHA512 364191e5350164b5659c60044dbab973de365c7c7e3328e6cb779abe8a4b124d8a3df9ea579211378ec418b4033f4e26cfac1c64c566c95423cecb55f1b1a75c
SSDEEP 3072:JftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:hVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T113C39D1335D18472E4B6593109A1EDB18A3EFD620950DE7B33D42B3E0F316D1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockCheckpoint.exe

Path C:\Program Files\UnlockCheckpoint.exe
Size 140KB
SHA256 4162175d13ea4ba4de5d6b24720e99e355e8e145b66d7f984a1ef6e5f161edb6
MD5 225a62c47fdfb32ef31b047e9c71bd3b
SHA1 726ca898d74a8a611b937e36a345601c606c62d0
SHA512 4f5fcdde729d51567ce67eba398d6b026e465080d67e16184e338cb2c44be281509446f804025326053e02a7207ad0c465707d09205c7cc9b21ddc450fc22975
SSDEEP 3072:IftffjmNyl2LU39BvrPVqGPMJb+lWo8rGCUk3VPi0l47+Hj2O7M:YVfjmNyliUtxPYYWom9ni0mQj2wM
TLSH
T13AE312463BF49369EE53993E8F862680863D1C22506A447A427877BB51B79051FCBD0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aF85A.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aF85A.bat
Size 722B
SHA256 0227a031827dc47d2545dcaf5d9e3334ba198235d3a04c7df8e7d48b23144280
MD5 050e82fd8c397cab7b1737ffd62b95b5
SHA1 64727c7a58ef3dae0e3fe25e7226b42bf544d081
SHA512 53e8e84799575ef925f4c3ef9b104deb3c5d3d5fa39f54d353128f72ee07e28518b18ecf38cba9637247154e0b8a82635add3f5d8164a38e86a268e5c4b22b43
TLSH
T1DB01D829C1D95DEA3C2DB0374512AF9EDAB67E9C268F3E018B95910C06D184D72C7729
MD5 SHA1 SHA512 TLSH

Submit Download

f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe.exe
Size 1.2MB
SHA256 fda760d4edd51262418a9fdf05b2dec2666945b448fa00af8e5f2e6d3519dec0
MD5 4a98d67e10c69d8aa28bf6475878c2dd
SHA1 54c9c7009bfed30ebd5ab1fcea6ded1d4be7a6f5
SHA512 155d2adeaeabc80db2ba19744d57b1ba578bfe69ddb53d06ea685546a00c8918658b8d1a06bd1aeb0a390313e01b9f6b351c3828cadd42ea29904669669fe081
SSDEEP 12288:ZkCa5IQlBmdAL3u0M+xPhMoGiIzSaZlrl10XjSzMz0sFHwwYiGE/XDx6prG7q4if:cmurOuCMz0ydYJE/OGO4MF5gbJngG/xM
TLSH
T104555B117792F132D36102309929DBBA6C7DBE341F6245CFE3983B3A59741C36A36E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 ea49d9df3e33934abdac12276bf4d7c1bc462432656fe7cb7ac864cd1285f146
MD5 d90ad06929eacd771fc1f5d5a2e2d388
SHA1 c0993fa0b0e568c4667ffa48f6db5a5dd3745fe9
SHA512 c906d5eca31fd9afdc10a68d530977eae46c519f4c91286f0a6a9f909ef43f9fb829620630ce518e40aec8c852327ea0ce42fae804fab35fcf771de6748e731a
SSDEEP 768:O1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:IfgLdQAQfcfymN
TLSH
T1A3C2DF6B1AC95574FC1D097CDBE32B81C23A0F2900AF647625B17B7A2173629570EA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-540052884-2969440504-464782435-1000\_desktop.ini
Size 9B
SHA256 137a2336786405721f3ba28870250af8000e5ef527196716325fc80bf1dfe2f9
MD5 ab6b58b11690e61b5ded2286207b2fe7
SHA1 8da99152b11777b2ec8c085f54c58e50fd705985
SHA512 764f43afe7ab60044d8b3b3be97bbc4c1040c0b8c826876df3a9d1c3d5e884b4eeb66b66b821d21f1648751b4d6fcc32cde5045ad8ae595137ffaada37def5a1
MD5 SHA1 SHA512

Submit Download

memory/4644-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-357-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-5036-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4828-5549-0x0000000000400000-0x0000000000434000-memory.dmp

Download