fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056

Analysis

max time kernel
3s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
Size 5.9MB
Sample260909-jbrqdstyax
SHA256 fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056
MD5 b562edc0ba5685faac68906ea74374c0
SHA1 1b9390290a195b65b26017f24d325780902fb924
SHA512 f562a7d30efd690269233fbc4a609a2688609e8ae6693e6eb456392dcf9153add1e781d31b00cabc35e7d0286d0b22bf547a38e7d96b8fc62f7a51770a97b202
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLg:CjJa
TLSH
T15556E08193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3364	Logo1_.exe
4752	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
1168	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
File created	C:\Windows\Logo1_.exe	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Logo1_.exe	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\Logo1_.exe	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
448	cmd.exe
2600	cmd.exe
4880	cmd.exe
256	cmd.exe
4248	cmd.exe
1748	cmd.exe
4464	cmd.exe
1280	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4208	3364	WerFault.exe	89
5516	3364	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 256	4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe	88
PID 4796 wrote to memory of 3364	4796	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe	89
PID 3364 wrote to memory of 4840	3364	Logo1_.exe	91
PID 4840 wrote to memory of 3404	4840	net.exe	93
PID 256 wrote to memory of 4752	256	cmd.exe	94
PID 4752 wrote to memory of 4248	4752	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe	95
PID 4248 wrote to memory of 1168	4248	cmd.exe	97
PID 1168 wrote to memory of 1748	1168	fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe	98

C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
"C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE21.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
    "C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2D4.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1168
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA37.bat
        6⤵
        Executes a command shell one-liner
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe"
        7⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF052.bat
        8⤵
        Executes a command shell one-liner
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe"
        9⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7F3.bat
        10⤵
        Executes a command shell one-liner
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe"
        11⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC38.bat
        12⤵
        Executes a command shell one-liner
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe"
        13⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A5D.bat
        14⤵
        Executes a command shell one-liner
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe"
        15⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D61.bat
        16⤵
        Executes a command shell one-liner
        
        PID:4880
        
        C:\Windows\Logo1_.exe
        
        C:\Windows\Logo1_.exe
        14⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Kingsoft AntiVirus Service"
        15⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        16⤵
        
        PID:3448
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 964
    3⤵
    - Program crash
    PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 964
    3⤵
    - Program crash
    PID:5516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3364 -ip 3364
1⤵
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3364 -ip 3364
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a2A5D.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2A5D.bat
Size 722B
SHA256 e19c771446437480faca9fcb4369a5de1643a70afbd64f7cc03bffbba89a0927
MD5 14603fba49fee32f5b87fe9d6977b3f7
SHA1 bb04885c1d1a5dd879f751d3af844bddd701e38c
SHA512 e52308079acb28fd87fc708c7c64aa750c604ab35035e3e07f249d2a718240da86932b4831ecf21eb3df6dcdc0c89cdc5a6b1ba6721ea26d9361d41d93f826e6
TLSH
T1C1014421C0C5E5EB580C5067C6D57BCDE9B11C4DFE49FB942B16A90916E484CE6EE383
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4D61.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4D61.bat
Size 722B
SHA256 e74a5fc1ed5c5b3368a46a4c7dbd5ebced49e6a31a84a76527c9b664ef3b2996
MD5 d61eccc05cf1596c79bf2e9f60949f0c
SHA1 24322351eb180aaa566500337bd81f0c3a20298e
SHA512 088115b709595e574c9ad4f4eef170261c63f42bebe767a62fa7e251653143633e3d77d13f4803900bbc8f13d01c1ec03a77f16c5f4a9f9d61d6d96f8a683bf2
TLSH
T14A018421C0C5E5EB980C5067C2D57BCDE8B11C4DFE49FB842B16A80906E484CE6EE383
MD5 SHA1 SHA512 TLSH

Submit Download

$$aDE21.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aDE21.bat
Size 722B
SHA256 800bf483e82983ca8b89e0fcbc47bededee3f9011abd2bbaf86da2e338db50fd
MD5 b33920fcfd6c897fb59b2752c5dcb5b1
SHA1 8df4721ea8631daf76f0d5b36af53de61869f182
SHA512 78ae7e7336587983a33a094b5a77555e2670903bb45f0795fa20a429334796b4fc4792fd9afe33cd7c5f65846a9f6e6d3965643d9c9d7d94eacd9a8df9ed7a5b
TLSH
T1BF018421C0C5E5EB980C5067C2D57BCDE8B11C4DFE49FB842B16A80916E484CE6EE383
MD5 SHA1 SHA512 TLSH

Submit Download

$$aE2D4.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aE2D4.bat
Size 722B
SHA256 89a30c61112fbd136d16cf5e17d63204a508dfade72f0d7d6f2133d119318b8c
MD5 a1e9e6c6bd4ee607f09beea66449f199
SHA1 b3b6f4dfbf8e94702ab1d72d5ee52893397af9ac
SHA512 5026343ccda00bef50ab2637203b2726a8d560ba52de40b59194c4be00a0c363ea6f92096bc2e6bdb76ea77c1926323c814bbc82329187cc866f71b4b001afc2
TLSH
T17B014421C0C5E5EB580C5067C6D57BCDE9B11C4DFE49FB842B16A90916E484CE6EE393
MD5 SHA1 SHA512 TLSH

Submit Download

$$aEA37.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aEA37.bat
Size 722B
SHA256 6950065b6b0987fca22539e5041228cff78659d65e822c8e751f5ff4c3054a2c
MD5 cd300794d60a5a442cd7c8c06889b2a9
SHA1 54c342c333fbf3da0a071958952b90f6fee24844
SHA512 db92ecdb9804d6276bbf33b842d521a2aa0fcc8a14df751f45964d6306c4a6dfe94c4cd2a01b743afd88700478e42b22f86b06fe6aae96fff442a992319a894b
TLSH
T16B014421C0C5E5EB580C5067C6D57BCDE9B11C4DFE49FB842B16A90916E584CE6EE383
MD5 SHA1 SHA512 TLSH

Submit Download

$$aF052.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aF052.bat
Size 722B
SHA256 4663ea0e72d79cec413801311d2b851ccbc91a516d8bc76823584ac6c8618c0c
MD5 0bc72b7a587fa73f339f4621f57a6b0b
SHA1 c3d58635d800907ec022bfeb6732b4df958b6531
SHA512 4987b9ad35020be74a2a77fb68ad92bebf83199f7a52fa960ee2f3cecf7261b8525510e2a1c1216153996bdd78db1d5ca420678cfb9e7561dd8dd305c94a2eb3
TLSH
T154014421C0C5E5EB580C5067C6D57BCDE9B11C4DFE49FB852B16A90916E484CE6EE383
MD5 SHA1 SHA512 TLSH

Submit Download

$$aF7F3.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aF7F3.bat
Size 722B
SHA256 41070462ccbf6c57ec5a45a9d29b93b38ce4653e7c9b2e864e20f1165acc4ae6
MD5 1cf01eaffbd58ec20af9077a8455f5fa
SHA1 7dc276c4060b39ba212cd7a038ee91e6313f16a5
SHA512 081c245d0ea2c4dfba17ee4d040bfc1ca8eff31795bd2416bee007e785cca89d057769716cc5793e7bb9ae41ea87743573e7fe25611116f6b6ffc3a56377bb4a
TLSH
T19C014421C0C5E5EB980C5067C6D57BCDE9B11C4DFE49FB842B16A90916E484CE6EE383
MD5 SHA1 SHA512 TLSH

Submit Download

$$aFC38.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFC38.bat
Size 722B
SHA256 0fbbbc031c02ff7196a67cfb0e28cc06d84db8c2f2a0518c213fe7657d9ae206
MD5 ab457eb961ccba4f61ad8464dfc9f040
SHA1 2307b2f2c7a69a90fe88f9806ea0f2a9d328fa22
SHA512 fd2d417385b44545d14cd8c4e1bb67604997b194929a95fea70cd36cfbb863dd358d324d3652d2a91379c6e8fcdfcd48076f398cf18e47f548894d142a30a382
TLSH
T1BE018421C0C5E5EB580C5067C2D57BCDE9B11C4DFE49FB842B16A80906E484CE6EE383
MD5 SHA1 SHA512 TLSH

Submit Download

fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe

Path C:\Users\Admin\AppData\Local\Temp\fd620f077a3077771dd28d50eae2ccd02a7e3a36f9cd2bd7b9e632aac95dc056.exe
Size 4.0MB
SHA256 a906c773a8ad4719e82772560806848b81a45c0eb1b50ddf59978d90af7e735f
MD5 615f352b9486c450b3a4d13e9de6a4e8
SHA1 6a7a22748983d1be92547418b38e7eef465a77b2
SHA512 c883ada485cce2867351f335bac4b63d8ac0d16d82682dea8f63d5b6f3c9c8f74a2541ee921a0afd9a9ae60a7ffa2feaee17f416f4e1cb312e791e1df470de01
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL0:b
TLSH
T13216E18193D9A879E5C3163451738FCBE76964A1F6118B0F90A402FDEDC02E5AF1AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download