96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
Size 1.3MB
Sample260907-wvcf2aad53
SHA256 96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b
MD5 c36ebba52bd8c53946c2c7fc96daed1c
SHA1 14b6794fd948bd12616db70c1e261f2dc71cb8e8
SHA512 5b7a95db8a49f721005a4f6ff0a81e19280ce47b6c5c10526b7cda88705d6c82e9b1800037bf38f591ed2436247404827658c236f2cdb288d8bd02b17c04be7f
SSDEEP 24576:d7yi9hcFdkTZxblEUhoAOM08/85RkptVIJqpV:d7yEgkTZxbDOMjUfkptVxpV
TLSH
T15955BE16BCE6C130E4A351728DEAC21D6274E4AA833645EBF6CC911F9F645D28733F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3044	Logo1_.exe
4528	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Oracle\Java\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-latn-cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Retail\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pt-PT\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\pages\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\win11\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\EBWebView\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
File created	C:\Windows\Logo1_.exe	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5248	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3792	4528	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe
3044	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 5248	4728	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe	85
PID 4728 wrote to memory of 3044	4728	96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe	86
PID 3044 wrote to memory of 6016	3044	Logo1_.exe	88
PID 6016 wrote to memory of 3372	6016	net.exe	90
PID 5248 wrote to memory of 4528	5248	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
"C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A95.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe
    "C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 628
      4⤵
      Program crash
      PID:3792
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4528 -ip 4528
1⤵
PID:5280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 4e95f36d87cfe970b1de2fbc0f9f62696eb0540f195d645ebeb00a1cdd8194c4
MD5 e31b1b3a3a6a92717ce42e6e3c80af6a
SHA1 a920ce9aa4162207baeb86f9919d74d18bf108b6
SHA512 d6ec015a057c034fe05a7d51bb78e0693db1abf58a805a8e8f7df743b31b4ddc9538c152d8bdec171f4ce5c7714fef6ee1a66583ad67d1772a42016665632218
SSDEEP 3072:jftffjmNTYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:zVfjmNTYCk3ET+Tu3fC0zB+JHv
TLSH
T125C38C1376D08472E8B6593109A0ED71893EFD620950DE7B33D53A3E0F316D1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 50a5747e31dcade21f102c254fe2feb0497d5d58b645755a1f99e926ae7bc572
MD5 8730637085567e395749dd17194f829b
SHA1 0e358a234cd5af2853703cfda774e3195b9bcf0c
SHA512 8c8750b14c2db23e4fadb0b2225652865290f0d5eb1caa14050a9e930a642d88d2b5e66d91c8f21ec1d8956fc5b6a706a6ab72c1f43c1545e3cd7cfd11903123
SSDEEP 12288:d7+CXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:d7f0Le5ji0hmxNrM
TLSH
T12EC41916F6748335D073C0B9C5D2A68EE972348657308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 4e0e8265303111056f270a4544c0af9ba033c1f9f8637f2096eda55339a78664
MD5 838baec1eaf01d221bcf59207a83533d
SHA1 4e5be38574d8f3678ac125de048149a473426daf
SHA512 e757dab2f531b2d8d17008d70b52caae045bfa72587d7cb79f4f62a9726eec8f0e498853b478d2c86ac24be8cac7b3bf4810d5211636523aaeee1fb2815406a7
SSDEEP 12288:3p7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:Z7/BOkUhMXcBwc04nA
TLSH
T114A47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2A95.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2A95.bat
Size 722B
SHA256 2604cb8aacd5f95b719340355917a505c8df1afa1aefea108180062cb9a1bfc2
MD5 734005c9071571cec59e8e7111f2c9da
SHA1 74c7f6de809cb94f1835bf8238d6e20d3169b3d2
SHA512 f688892bc24a0231aeec08f8bc5390a886f3418f31dad06a8f6d7ee4662d504fbfa70ade7df0f0aab3d3dafff5007a352a5af8f1b7f29fa8489249dc495a4147
TLSH
T1DD01713DC599EFAA7D4C59024AE099CFC4520C56FA846B2AE218CC4D9CD0C0EF7E3547
MD5 SHA1 SHA512 TLSH

Submit Download

96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\96345fc26b87fcab151cd43b889b3984d3a426c9aebcb5e6fbb1c2d330c87c6b.exe.exe
Size 1.3MB
SHA256 a64a62a0f9715e135587db55c491db94a526f534fe5e4495db3716e9ff1ed8e0
MD5 d54d97ce6c5a22379af62032c096af03
SHA1 23d38f446e4c751f46ea8d1cf5ba280de903def8
SHA512 7acff80e311876a64648deccbd5cdadd1536bb52425087745d1314de3c4f5d82bae3cee1f021e0b4905f9ea1ece6e68ad0a706021f79cadecd0257df193f68b6
SSDEEP 24576:Mi9hcFdkTZxblEUhoAOM08/85RkptVIJqpV:MEgkTZxbDOMjUfkptVxpV
TLSH
T16555BE16BCE6C130E4A351728DEAC21D6274E0AB833645EBF6CC911B9F655D28733F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 14bc78e8405e3e41cd2d507961f963e27b2a149de800e189df725f155416a19f
MD5 031b0b8ca7a2a0f17ef32e550d168eaa
SHA1 d879a7b4fe4bccc927da90b2b31d8c38650e4e15
SHA512 ce519695b9256a1471cdea5603ae6e859428b331e9b54666a8c5e418f2b5b65667194304817dd67fa267bd7083d413ec6809c140333f1080f2ddaa1e7e030fd5
SSDEEP 768:4L61ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:3fgLdQAQfcfymN
TLSH
T15DC2D0B922D97524DC1D0DBCDBD6BF02423D0E79208E683965B375BE2572778240EA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3053180483-1881419501-3594244048-1000\_desktop.ini
Size 8B
SHA256 638fc448ae556caaeda91e57ebb39bde61a6d541ea6b0bb3904c6c1f62e6c6e8
MD5 51287df057872db7cb5dee6e94f2bf6a
SHA1 8934b869fc9b9694347d5b7a0a57c70e1161541f
SHA512 2261f7df8fcb3a8f13d05f1cc875d9056a8e732bbb024c7694a479a75d5c1216aeb195c0c8fce34b6efe60700826871ea90d16a2e8cc413b9ca89d65e471d2a6
MD5 SHA1 SHA512

Submit Download

memory/3044-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3044-42-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3044-46-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3044-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3044-283-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3044-1299-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3044-5086-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3044-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3044-5601-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4728-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4728-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download