d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
Size 387KB
Sample260907-e5alracn4v
SHA256 d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f
MD5 26e390225f8e7e9cb4c12dc5523f93c4
SHA1 f3027e0419faf0d4891ba1dbdaec5d21f634181d
SHA512 87b2b22ea1b7dedc27c1edfda0209a19857309e26100293d0f29a461f2b43de49c40cce2a433be2d91cf864243d23d35b1c485a94ed94635d9e10e25bbbf10e1
SSDEEP 6144:7VfjmNpNwc33Evv+dfxafGu78vuz3INvBO+XTZTfuL7NdygtMdN4dhHBVO60m:R7+oc3c76uz3sBO+XThuL5dtMdN8Bb0m
TLSH
T16D847D117790DF31E66F05369A6897B45A6F7C209F2487DB23943E2DBE302C1A934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5716	Logo1_.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\PdfPreview\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
File created	C:\Windows\Logo1_.exe	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe
5716	Logo1_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2472	AdobeARM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 1272	4140	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe	88
PID 4140 wrote to memory of 5716	4140	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe	89
PID 5716 wrote to memory of 5056	5716	Logo1_.exe	92
PID 5056 wrote to memory of 2628	5056	net.exe	94
PID 1272 wrote to memory of 3180	1272	cmd.exe	95
PID 3180 wrote to memory of 2472	3180	d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe	96

C:\Users\Admin\AppData\Local\Temp\d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
"C:\Users\Admin\AppData\Local\Temp\d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80BF.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe
    "C:\Users\Admin\AppData\Local\Temp\d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2472
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 a9ca0120a7d0a3d0976791f631c60453f07e58b0b6cf496ed7b4e4a3d6a1d7ef
MD5 88e21aec2f65b3e50d9d58bf16be3284
SHA1 ab1103548e2e0d1e5f4792d6bc41ad70ab694c78
SHA512 c7852c44e8c8e1ab15a2276320db772d6200f6d7096f42ebe58fbb02b44b4fa1d5be560a1eca092b56097db4291e806044a6319a81fb03d9be912eb6801530e3
SSDEEP 3072:yftffjmNHhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:CVfjmNBG7/fYfLvzB+QFyn
TLSH
T110C38D1771D08871E9B24C3049E0EA619D3FF9620B449EA737C466BE0F317D1DE26E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 4e0e8265303111056f270a4544c0af9ba033c1f9f8637f2096eda55339a78664
MD5 838baec1eaf01d221bcf59207a83533d
SHA1 4e5be38574d8f3678ac125de048149a473426daf
SHA512 e757dab2f531b2d8d17008d70b52caae045bfa72587d7cb79f4f62a9726eec8f0e498853b478d2c86ac24be8cac7b3bf4810d5211636523aaeee1fb2815406a7
SSDEEP 12288:3p7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:Z7/BOkUhMXcBwc04nA
TLSH
T114A47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a80BF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a80BF.bat
Size 722B
SHA256 9632b72e81757c4172677a58a47cf5d827cca5ac28a5f1997e76056439c514ee
MD5 93fad7332f1d88a13ce26ab388838e3e
SHA1 a153440eb2bfc160511996a3fdc23730654effc0
SHA512 c400ac978aa9e1a37d6878037948dd1faad2ffef338f5b3c1e380bcd22d855dd580b5545b268fb672d18752ce97e55b27981343f2eddda4723cd4bb487a19646
TLSH
T1390175409591D92E08EC395305F158CDACAE0A5D375627A57F2AA0DC1BC183EDCD36E1
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\d365948340e20bcef61f747218fa220d48a4c63b9f5eaabb4751d3104815865f.exe.exe
Size 361KB
SHA256 e6a0152862be4e18fb229fc32ad3e7a1f79f2fea01a8e22d8f03ac5f3c791669
MD5 22c3bb2557a43732f30d0135c10b3c04
SHA1 f90fa20ffe17916d898f77140aa44d90bdaae396
SHA512 65254e2f044a543d2ca4b767a77f937a60dae13c0919237dfc038561a85cd7eae07c00021ff7de0589d1119ddecac22b4a926947eedd650296d93e6c1765a784
SSDEEP 6144:kNwc33Evv+dfxafGu78vuz3INvBO+XTZTfuL7NdygtMdN4dhHBVO60m:5c3c76uz3sBO+XThuL5dtMdN8Bb0m
TLSH
T1E6746D117790DF31E6AF0536996897B45A6F7C209F2487DB23943E2DBE302C1A934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 6548bb788bed553c5ec741ffe87279439d1a6303ce507b70ef9f0452e5946628
MD5 b577ad5e82a391466efea5d1f478fa75
SHA1 32ff50080ae454b30994df490ce494e93bf8cf80
SHA512 795ade642e11f5009a82ed0c5646fd5323ab0d93dcd668c737b62fcbb225d346c221a71caf00027dd320937c6afe6c52a5ed9bfc7843a50b0879b332b606f56b
SSDEEP 768:d1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:7fgLdQAQfcfymN
TLSH
T197C2E1B812C97A78EC124DFCDBD5A702422D4B7D50DF686535B2557A2211BB4304EF17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\_desktop.ini
Size 8B
SHA256 638fc448ae556caaeda91e57ebb39bde61a6d541ea6b0bb3904c6c1f62e6c6e8
MD5 51287df057872db7cb5dee6e94f2bf6a
SHA1 8934b869fc9b9694347d5b7a0a57c70e1161541f
SHA512 2261f7df8fcb3a8f13d05f1cc875d9056a8e732bbb024c7694a479a75d5c1216aeb195c0c8fce34b6efe60700826871ea90d16a2e8cc413b9ca89d65e471d2a6
MD5 SHA1 SHA512

Submit Download

memory/4140-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4140-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5716-108-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5716-116-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5716-121-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5716-125-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5716-258-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5716-1332-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5716-5126-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5716-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5716-5603-0x0000000000400000-0x0000000000434000-memory.dmp

Download