7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe
Size 92KB
Sample260928-ghbxeagg93
SHA256 7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61
MD5 e5fdef75647482bd0cc694fe02c1f46a
SHA1 200c4a5cdce8872ee6001a8537c057b159203828
SHA512 3a539738c5d15b8cef236ce9187aa6311294f82c69d165d19f31e5df36e08c4870b525895884fca34f5315fff348642d9dedb07f44542e433dce17d6d41b4574
SSDEEP 1536:pV3SHuJV9NvRgg2VkL9fukSaErDY1TpoL7Dx:pVkuJVLKg9xG/YToL
TLSH
T1D893AD12D6440862DE510AF0E8B3CA354635BF7DD847C64B2AD4BFDB3F71341EA518AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2812	Logo1_.exe
3952	7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
	\??\F:\	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\GameBarWidgetUI\Icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe
File created	C:\Windows\Logo1_.exe	7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4324	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe
2812	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4324	1788	7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe	85
PID 1788 wrote to memory of 2812	1788	7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe	86
PID 2812 wrote to memory of 1628	2812	Logo1_.exe	87
PID 1628 wrote to memory of 4232	1628	net.exe	91
PID 4324 wrote to memory of 3952	4324	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe
"C:\Users\Admin\AppData\Local\Temp\7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94AA.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe
    "C:\Users\Admin\AppData\Local\Temp\7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3952
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 2cd3352ece5fd6b5947fd5bfb48c101ea5e12b2026202314861f396e116d6330
MD5 bc59d0647a68e9ec0c0afbba8c4a51bf
SHA1 e0b4042cfd7f406c0522999b92da2576e5208910
SHA512 fc013b1b242b37e0b245836577e360d252b5e6a5a2bad41b5d71a31bf940581d3ebaefa6586bdbcfddcc0f78120a098a7d18f037b546027a2ca6f14674e9d51b
SSDEEP 3072:pZkuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:EuJtYCk3ET+Tu3fC0zB+JHv
TLSH
T12ED38C13F6D184B2E5B2193108A5EDB1493EF962CD50CA6B37D41A3E0F316C1DE26E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 7104336c16be1ca6668471043fe1c99633cb02fec50dc5670eada8b371b96e1d
MD5 1652d1dbb870d13c825249777628d3d2
SHA1 f9c33007be31a1b2e349bfe460ce4cf0a3ef3e94
SHA512 5fcf0b62b4ac47ec6d2ef1e9ed5061ae0b2339b1ebb9036a0fa252476d18276a29366dfd9f336423b9af7e7e3db2900d033c34751526bf4d679a9b0de6a51c60
SSDEEP 6144:guJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:SXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T15FC40916F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 e5858faf78b3467ddc26d6c8b1fd7d57e8ed609ba52a2efad45f09f6a6a0337b
MD5 d49e7b4c35899ed5e5addc4d22bd5358
SHA1 62f0e5484d6a4a513114753e0c2fca0bbe7a196e
SHA512 e026522e7125837628e698a9f381f203556c337098c918e6568fe4bd7faeaeae7c5cdedaa697c4e2d4a33c91d10ab7ca75f6da3b6ed9f4cd8602250f4b334b16
SSDEEP 6144:wPuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:w5qIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T18AB46D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a94AA.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a94AA.bat
Size 722B
SHA256 cb848ab03c6de282927781fa482799b83c90cb588d724dc7549d44ef1c7cd6ac
MD5 015ec15b84afe5fbff42d8053c355816
SHA1 6a08ad88e5a655e9dee70b13eed164caf0d41266
SHA512 9064b8b808a32c6e602ab9051496386933ad6149622a654cce951bbdd5e14b982f82d3ea14c9b7721e2f2aa94a3582b1e6443d2cae7577d797d7c598d302aea8
TLSH
T12E0120526696ADFF1D6310F307634B8FAF950C9B2595A7115234F09C13D211DB7F22D2
MD5 SHA1 SHA512 TLSH

Submit Download

7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\7e47cf13aae5423884243f1dfffeb4feffd3ebe070cf5287a8d157584df40a61.exe.exe
Size 62KB
SHA256 19e1697c34f03a0c66c024f6e5d9c0b515ff8af66bb6bf5130c6f9efadf5b8d3
MD5 b3f331cd7bd3c277e9579f73c221c3d7
SHA1 78b62918ac664619d1b07fc793a8abd6d106ba89
SHA512 7a246d93dc32c783ac5b4ee6d28f7bbd65e8fdddb05e1176067a77b70cf84cd83fda713b0430577bc51d492754dfda9ec6e64721abb720f42d27869358d6148c
SSDEEP 768:2XZTgg7qRrk7r2A91o6Vkp+SKYyN7vaBa0bFDRGLpTHypaoLYijAMxkE:MRgg2VkL9fukSaErDY1TpoL7Dx
TLSH
T1E2537C02DA401C61DE5149F0E9B2DA354675BF3E5943CA8723E8BFCB3B71382FA500A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 41be07d0ebc88689187ca9d075a86c13c2ddd797831239ac4121875209779582
MD5 b3832d9c497986de340084437381dfaa
SHA1 0722a7fde6bbb4e8b8fa331818a8af8560d21845
SHA512 d61a1c06cc1da82c0997903e75c243a5e5f613b502ac6039e93fcfa192791b525074b6f87fa36fc5c03fc5a561dd4c0ecc1598ac7e4612efd540e93bba4e234f
SSDEEP 384:Nbbmw3QU1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pqHU16GVRu1yK9fMnJG2V9dHS8
TLSH
T180D2D070F7FE5AE2D5910FF018DB4FA64822F585DC4D920F2E949B6A0EE19204E62E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2101206053-1414382737-268919432-1000\_desktop.ini
Size 9B
SHA256 918b1655c9319d78d9f5801608ae25b42e9cbb99cfe2671ee37ac122a938d764
MD5 25b29eb69d7ac2457267a905e7b88fa1
SHA1 8a81d8029e7f6deee055613006273ce257e21c39
SHA512 cc317bfd6113c458cfa64d16d9c36b56bf89ca5956ce98c5203693ddb6f8ed07e56f2ce642dc38da841e0a15424d6d20156be377f12f10bfd3a7551119808daa
MD5 SHA1 SHA512

Submit Download

memory/1788-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1788-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2812-30-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2812-22-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2812-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2812-41-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2812-154-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2812-1249-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2812-5038-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2812-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2812-5541-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3952-20-0x0000000000E30000-0x0000000000E44000-memory.dmp

Download

memory/3952-19-0x0000000000E30000-0x0000000000E44000-memory.dmp

Download