c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe
Size 470KB
Sample260831-ebphtavaka
SHA256 c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd
MD5 5fd3fb63d45c4fa3ab75d1fa0fb7cbce
SHA1 7a17aeb8f29316571fba6749bf36502229fca3ec
SHA512 239daaeb9e1f0ce41b7b8f0f8477f145861258e24cbe70605d382dfdba391db5d2dfcb68d94e3f8455af157d06bf145923ae56fca3c382c6b5a59310bcf80380
SSDEEP 6144:jVfjmNezyiL7nVDcmdCI6BHAlSpFG/+Ls3ze30xLs+bz0YTirzhafYyf7Pvm7M8R:57+6DnVDcmd/6JAB/6N30xQWhRvm7MY
TLSH
T1DEA4392133F98208C87B1B70EC39564126767EE6AD91C6FE19643B6D4D727438322FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6124	Logo1_.exe
4548	c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Offline\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe
File created	C:\Windows\Logo1_.exe	c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3028	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4744	4548	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe
6124	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 3028	1132	c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe	89
PID 1132 wrote to memory of 6124	1132	c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe	90
PID 6124 wrote to memory of 2568	6124	Logo1_.exe	91
PID 2568 wrote to memory of 1508	2568	net.exe	93
PID 3028 wrote to memory of 4548	3028	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe
"C:\Users\Admin\AppData\Local\Temp\c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a960C.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe
    "C:\Users\Admin\AppData\Local\Temp\c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 964
      4⤵
      Program crash
      PID:4744
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4548 -ip 4548
1⤵
PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 d4908106e8c2df158ee267e387b7dd386a415ce080de42c82754408473a1bfac
MD5 50ba637046bab8f6657fcdb67a490962
SHA1 5067259da27095a7892b7c4d14ec6c6f943ead72
SHA512 b43d41744a21687f97016e6f3cb3fa7b6759106388503e2e98cf86329bfdb207f2974029be40ac82ef71236593269a5ff5e790e7f07dc83ad199457caaf68f25
SSDEEP 3072:KftffjmNoxYhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:KVfjmNzG7/fYfLvzB+QFyn
TLSH
T1BFC38C1371D18471E9B10C308DA5EA619D3FFDA20B409EA733C46A7E0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 297984cb1c691abf3614c0c64ed3ed1b8cbf2e2f2efae02e5392e110a717394c
MD5 0c5536c6a3aefefb2d4cc1cfbb729119
SHA1 660b05e7c4543df8ec6d4e80d6c8f3c9d667bf8c
SHA512 9f833ca254c2e29c8fa9fe95ebeb6d62a686b99dd6597761ffb2797a0b50daa531a483f6047b8bbb059c2f15abe19aa030e67d2c1198624633146d76aebc7da8
SSDEEP 12288:Bp7+sqIOkU8AMXE9B7PElZlP41N+4PUWfo:H7RBOkUhMXcBwc04nA
TLSH
T104A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA85D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a960C.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a960C.bat
Size 722B
SHA256 91f5e0acda5366b1a473b412c4bb6daa66bcf6dffaeb01d198d6076f16740b96
MD5 4263665ccbe9174e763735c5fcf92a43
SHA1 3754552e63917a3930e95d61195843283a2dbddd
SHA512 253a83118bccfded6e8858a75258cfb9d3632b0bd6d972b4299c55bd5622e2cceb04962aaa303cf423e2244d980fc2e3bdd8425642d6009edf3d2b59b8d375f5
TLSH
T13F012B0D8382D14F185783275B70D94FC152466836C9270D8FAAE8AE107B50DD7E7EA1
MD5 SHA1 SHA512 TLSH

Submit Download

c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\c808881ff5b90f918e791f24eacecf5278b02f186aa10afb6aa5315b1a24d0bd.exe.exe
Size 444KB
SHA256 ffb1c650555d4c824ef148d9e90837b152dd263ff2530e5e1684bc34d41fc348
MD5 9240ce992a328cfa4f01ef089b0fc117
SHA1 c872be5c956dd443c766021a0cf8099440987a8b
SHA512 336a65034e9336e3f08d771d53105799c03fb6250c913b7867b848f616668b60fb6a3fc8f7fd5d9885cca56386c36397deadfbc89e2995b286603308e39f4208
SSDEEP 6144:VzyiL7nVDcmdCI6BHAlSpFG/+Ls3ze30xLs+bz0YTirzhafYyf7Pvm7M80i:pDnVDcmd/6JAB/6N30xQWhRvm7MY
TLSH
T1E7A43A2133F98208C87B1B70EC39564126767EE6AD91C6FE19643B6D4D727438322FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 26KB
SHA256 713bebff013734bc6977b4afb46304c4cdb322ab778939ddb9f9682c986e6b9b
MD5 eda60360f2c4bf3280a7205c20ace886
SHA1 d34abf5f7b3865c8c0e81fba2cb52670ba0f01c8
SHA512 50bb3c23f2e6074aa3548c1e5f34ed8b507c8f7536ceea13eb805cafbac362f66d39efb1aa1ad1d2b2661804ce413d85448171768de66e4e33cc58f749736cc0
SSDEEP 768:V1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:TfgLdQAQfcfymNG+Kx
TLSH
T1D4C2BE6421D75638EC06197CCEDF9B01A2595FE6086F59FA22F2BF7A0870778110EE23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2246396966-3025826688-3847171515-1000\_desktop.ini
Size 9B
SHA256 eeb5cbb517450cca90ea5cd91b38720ad371cd8bc31bde7b09707adedcb5455c
MD5 7082634aa0f0eb04604e644640c87f99
SHA1 71ebb583c6252c07649d6bb3ec225f258d3826bc
SHA512 309844082fbc87f08732083ddcd57bd648e15013103ba5e6fa9dc6cd5807da13f729e5b1025105c265109d6131fa4e1a110a4cf1faa5117ec0709536905c81ac
MD5 SHA1 SHA512

Submit Download

memory/1132-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1132-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4548-21-0x0000000074122000-0x0000000074123000-memory.dmp

Download

memory/4548-22-0x00000000008B0000-0x0000000000924000-memory.dmp

Download

memory/4548-23-0x0000000005A30000-0x0000000005FEA000-memory.dmp

Download

memory/4548-24-0x0000000005370000-0x0000000005402000-memory.dmp

Download

memory/6124-26-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6124-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6124-45-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6124-75-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6124-1251-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6124-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6124-5048-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6124-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6124-5521-0x0000000000400000-0x0000000000434000-memory.dmp

Download