5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
Size 331KB
Sample260509-lvbvdset5s
SHA256 5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28
MD5 49cfcbc495dc2bb1f21eb34f980678f2
SHA1 99a25a233372f53ef5c02183f72352d8236a0c49
SHA512 3aabcbec848a5b10d05fa4bea1c829197be5c7789ac04ce28840386afc957405ba74385e13f0b84b89bde46901e53931199abc70e623f5b7fd67d2673aa8e160
SSDEEP 6144:vMuuJBPGYVUFKG91DfivuXTB6bzn1bbEFq4McDN7I7ti+6+WRl3:vMdUx1f2MTMbzn914Mcp7IJi+fWRN
TLSH
T16C748D316BD54836E1B20130A8F89774EA76BD305A22858FB3C07B1D2D75AD2AD34F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5204	Logo1_.exe
4528	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\PdfPreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\cs-CZ\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
File created	C:\Windows\Logo1_.exe	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe
5204	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4316	4424	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe	84
PID 4424 wrote to memory of 5204	4424	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe	85
PID 5204 wrote to memory of 3652	5204	Logo1_.exe	86
PID 3652 wrote to memory of 4536	3652	net.exe	89
PID 4316 wrote to memory of 4528	4316	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
"C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8BA.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
    "C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe"
    3⤵
    - Executes dropped EXE
    PID:4528
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 4d429531efe811503f895dd549470a67fac4d346305596ff2361ea3c1451b17f
MD5 09b01e1431f321685e33a7b9223c3df4
SHA1 27409d6fe2daa448458d466cc2230b4d8fd178f9
SHA512 09f861e9cf2129bf3d5a3d51198b91da81df5b813f98c7f0e437e0f95d58b49c9a0e2f2acb4b06a7b5f5d69e2c432295e329624ecde9ad296c259ad7e25529a9
SSDEEP 3072:piM5kuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:cMuuJtYCk3ET+Tu3fC0zB+JHv
TLSH
T158D39D1376D18472E5B2593108A1EE718A3FF9624D94CE6B33D42B3D0F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 48b6351df0a086e424470e34ae49d4a8a8ef66693a564394676f51c248b02a43
MD5 c8b0b34fe580a949ef1a105784818981
SHA1 08a04ec4408aba71624aeac8bf139ecc6f051969
SHA512 838588b9711a9e46eed08504e9e2275966fc2268bbb3258296c3102a79da0536281d8b2d627f06763614321ca1fb980de27d94f91c52afe3e0b19a6e24590bfb
SSDEEP 12288:vMQXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:vMw0Le5ji0hmxNrM
TLSH
T19CC40916F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 2cd1ea7b5bc267846e0fb1ef348ecef353627fc52d6591b6cba1ff16408e44c8
MD5 6098ea38ec05a4b6b3cfe01ae79052f0
SHA1 6957689ee3f65766a6b340aa4c88587cc38f69ea
SHA512 620e6772ffbf931af5039db5bad754ba62c1756ef050706ae13b0574b73f451aae363497169f01b23052c83eedb3a9b635f012367d0e0923562460ae494e6823
SSDEEP 6144:w7uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wNqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1DEB47D31E6A04037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aE8BA.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aE8BA.bat
Size 722B
SHA256 2d4350486f9fb79e82969ebab47f8b8db61fa33421e6413adc53dac1e4f44dda
MD5 333c425660b20d990d844e5bbd7d1008
SHA1 24366634ef60935bcb4d2eeb7a430d1cbc2ac2cb
SHA512 8724711619e058e839598d3c4a1e8653a698b9bda6a6be58fb7c2b4db1b374e6e86dc6c667fc3680a72bd89cfab5a3197f695155f5faba95be095caf5a3640c5
TLSH
T1E401A7524042728B950601375AA1994FC9A328BD3F971BD94E3198FF71C1A2FBBED242
MD5 SHA1 SHA512 TLSH

Submit Download

5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe.exe
Size 301KB
SHA256 9cade48819f36e06646c0d30ba7a7398c95d82648180b47f1bf61190a16d06c8
MD5 bae4c08e8269a721818f10b4b271c61e
SHA1 85700906213836488e12eb6294238b5a06b211e8
SHA512 88b2c5103b15066c9b6c147979a4d98de8473c5cad47f860fb5f9914527937b28e60eabc88ae2eeee9b0f6e33fd8d3a534244326daf8f333f9e95e597adf0976
SSDEEP 6144:aPGYVUFKG91DfivuXTB6bzn1bbEFq4McDN7I7ti+6+WRl3:uUx1f2MTMbzn914Mcp7IJi+fWRN
TLSH
T163647C317BD14836E1B20130A8F89774AA75BD305A22868FB3C07B5D2D75AD2AD34F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 e1ebfc27e46e7a0c7458db5219cbe55db66a3380d921762f3beb3614734f11e5
MD5 4487e350db548c661a450d333332cc43
SHA1 6107d1e97cbb05fa5500041808e977ad28d65a57
SHA512 e8a022c9483b247eb97f9244ecde7068a5340e1be6f8b182e26188247450b6a288e944cdfdf67a6809736d55f463c5b0274b6ad7d2a0b84bdbc6a70704b79fdb
SSDEEP 384:NbbO1EMj1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:plMj16GVRu1yK9fMnJG2V9dHS8
TLSH
T1A9D2D03767FE5A67E2A15FF068934F66C623B552CDCE820F1D14BA450E907009AE6633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-721190819-434563495-2007910846-1000\_desktop.ini
Size 8B
SHA256 6e9be20748ee78b11d664f31b9547ee836b5e73f3d4ef05289327d7f1ba0eb14
MD5 40ceb2ed83210f4185f76feb1846e3d0
SHA1 e8b81c1d0babb9887ef3703b2804d6d1a2f31d63
SHA512 62538e5d4e898b44b402a6c1f2a32edd5945428b2891b38363935cf3d358a7638f88313b7be5209c29be487b899cca3ba7d53923a193cf06b722fec679357ef1
MD5 SHA1 SHA512

Submit Download

memory/4424-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4424-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4424-13-0x0000000001F10000-0x0000000001FCF000-memory.dmp

Download

memory/5204-29-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5204-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5204-43-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5204-21-0x00000000005D0000-0x000000000068F000-memory.dmp

Download

memory/5204-534-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5204-1293-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5204-22-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5204-5084-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5204-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5204-5599-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5204-5602-0x00000000005D0000-0x000000000068F000-memory.dmp

Download