60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe
Size 730KB
Sample261017-lbdvmseb62
SHA256 60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8
MD5 990f49a82412b711e71a3a113e0772cf
SHA1 ac093c6e2310551e85ca746a5eaeb656991a5a33
SHA512 f8616b24fe9da6648b4fe82176417264d4af00e111940fcef3c14c47b97caed568161977d098578d2fffc005978b7b9764bdd9df4a4b8d921141fa919e82ab73
SSDEEP 12288:g7+GOoB+yok7inNhx2YntXwdcBjhEgabDaYbIUjYf6S1Ig2kfZ:g7rOA+yPUNTgOnEgcDjbIUsf6+32g
TLSH
T1BAF4121327D90877F0F9673256F14A932A34BE946E38F35F6321A45E4C32780663A77A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4752	Logo1_.exe
548	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe
3016	setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"F:\\msdownld.tmp\\IXP000.TMP\\\""	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\A:	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe
File opened (read-only)	\??\E:	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\B:	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\attachments\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lo-LA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe
File created	C:\Windows\Logo1_.exe	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
780	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 780	1180	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe	86
PID 1180 wrote to memory of 4752	1180	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe	87
PID 4752 wrote to memory of 1152	4752	Logo1_.exe	89
PID 1152 wrote to memory of 1732	1152	net.exe	91
PID 780 wrote to memory of 548	780	cmd.exe	92
PID 548 wrote to memory of 3016	548	60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe	95

C:\Users\Admin\AppData\Local\Temp\60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe
"C:\Users\Admin\AppData\Local\Temp\60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1284.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Users\Admin\AppData\Local\Temp\60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe
    "C:\Users\Admin\AppData\Local\Temp\60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:548
  - - F:\msdownld.tmp\IXP000.TMP\setup.exe
      F:\msdownld.tmp\IXP000.TMP\setup.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3016
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe
Size 236KB
SHA256 edad922074e97367e11eceab3383b8a44fc73d9320fb6d101fb13a34129a6eaf
MD5 145ee008497f909ad69084f1e3e71aab
SHA1 469ef4b9bd278299d28535e37ae6acdb0b14a26f
SHA512 79d3b517240b212d395b543ea1565798f6fd1d35a6eef9096a00c3cf91ffe886cd5f770483e071a78c12ddbe93dac9ae924f6cac08a6f600b69f54a7cfadb8c4
SSDEEP 6144:6VfjmNr7gKNkhSR/5kHouyXnZhB+h8WH3:07+r7gKNkhm/JuyXnPB+h8WH3
TLSH
T1C734902233F84929F8F35E306C759F29993EBC359E35E72E1650219E2D35A41D922B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 660KB
SHA256 a33ff0fbf40f2a77a95b70ba499d0efe12131b471f27efe68509fbe2ba287a47
MD5 0d9c90532c6ddcc0db641042fe66e031
SHA1 3ef0d8fd2c2e44feef74ed8a24921ac1f8ea1d2c
SHA512 72c7861fa2c1d9fe388446ae88d6c38ff5a7ce15674b57674a48340b1116eeecbfa269cacce4070ba9010f0fe7573da9f470a6f6a64f7ac97d3ef61bca6d5975
SSDEEP 12288:Pp7+znMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:R7SMysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T1BDE49E3294604036E6F106B3B958A2347D7CE22867148DAEE3E8ED5D3EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1284.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1284.bat
Size 722B
SHA256 2629d2eeaefd88442831c7fdb1c3c59aa494d17c8fab2ce5415e3f81e3423f46
MD5 241912fe5a9be59bcb4d3178e0decaf5
SHA1 4032be3808d075a256ab2cf553433d0b8ef7f95a
SHA512 a3a4076d6c1f0c49c44446110ac4ecdd2f331b70c0f050c61c9e4c686b11c3c54a121aebec9a448228cd5341f896394b2d6048d3acd55532926330b897ac409e
TLSH
T1AE019653538B5D3A090178F32F256EDEE66159E83F6053731A11AB8D838980DBBC6B05
MD5 SHA1 SHA512 TLSH

Submit Download

60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\60dc6ebe3d465a29f050ae0822fdb9eb61edd83830545dc7deadbd796b2772f8.exe.exe
Size 704KB
SHA256 e29ebbbe915d3d5fbfb18134612ff3fbdb38565864cb4ece2c61b3d7bc3663f3
MD5 df123f2eae4a718c531ed836d377c97f
SHA1 83421c44e9296658a58bad9d4a5d746e27e2cf31
SHA512 169c9926b686322de730e0ca0a36e3951ba316607c7f6a39a281283f607aaa688930daacee134c4988ae559a3e796ae4453fde8421e5e0311d05865d64b5a350
SSDEEP 12288:COoB+yok7inNhx2YntXwdcBjhEgabDaYbIUjYf6S1Ig2kfZ:COA+yPUNTgOnEgcDjbIUsf6+32g
TLSH
T16EE4121327D90877F0F5677216F54A932A34BE94AE38F39F6311A44E4C32780663A77A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 b744163cbfc26f2372a9a0230d84ea5a1027e22cfab04ab762708aa99345cd5f
MD5 22c0ef9db4bce05496ca57b268977e86
SHA1 f729ef4eabc787124d3f268fd666a48730eb07c1
SHA512 b3a7002dcb86512d47909c5bf6111538ee00ab707d718816c05c951e83383f86c551b93db156c46c5cda4d202dc04b7c6a9c7c42bfa6f99b2e73149c9513f660
SSDEEP 768:Zsl1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:ZsDfgLdQAQfcfymN
TLSH
T175C2D06612C81675D82E497CCAE3570143BC4F69449F6D762AB1B93F22307282C0E76F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 10B
SHA256 63e88b8d19d69b081af987c4000305aa56469cdb3211e8600d1b196ed0479546
MD5 19def2b371aeb938aeb0fb119e67d9de
SHA1 198667f2eb459c5f311923aeb8f9032069a5a0cc
SHA512 7414f4e9abd1b48a4f18d1835ff6c8eefa50fc9d7c2b8c6b73b6572bc2dad12f9ac41af5be3048e65f63cc410954fc96100cf5903177f71791eaa1f0b8c10ea4
MD5 SHA1 SHA512

Submit Download

setup.exe

Path F:\msdownld.tmp\IXP000.TMP\setup.exe
Size 16KB
SHA256 76fcca6a4b50f58c2c2e0b2095e181b2bf8a8d54e08a420e33eaf764c4a8139b
MD5 4e1b17e8d52bb25b5cdbfa3411f7813b
SHA1 1c37be4321dbb41c68a18d6160e7b65ced48a920
SHA512 fb680353a88a212bab219316f7da6e08c385325319f1dfbedfd301dbb73f6184594b1af86d52578fe2a74d935a6dd2f3175e2dea7c4e9148d91254f743287579
SSDEEP 192:K66vRfq121aJ3eG7hAWmtncrznLO1ZcZFgIanJGzP8IM38OlYQGmtbAQiusXULJL:EZ6SilASTwcj8IM37rhAVU9m91z
TLSH
T1EB723A4FE885D772C0A54A3400BAAFAE99BB19721BF341D3C5C25C7E1C715E0A93C796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.ini

Path F:\msdownld.tmp\IXP000.TMP\setup.ini
Size 2KB
SHA256 3591c4c388fdb703eb8e0cc36499fe51db06d46c8404ab273bcfc8667a59de70
MD5 f1fee12c11f1574e8dc9647b7bf75132
SHA1 41ac54ab554c61358b4363aad0545c0d13ec37cf
SHA512 09fe1b1d8f631f8bfcb037e7a09a1b385b7c1323d06dc7f07ac4bb6e2138e36d948a204d8cee2d50f0726817b9780f1c361fb9414e865392c7efc2919d2ac19c
TLSH
T12851EC1B11302A1C74E204CB730E3BF251A126271770E2A9C7CE1D067D179B3F1AB6AB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1180-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1180-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-143-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-149-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-154-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-498-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-1365-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-136-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-5154-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-5657-0x0000000000400000-0x0000000000434000-memory.dmp

Download