5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
Size 331KB
Sample260509-lvbvdset5s
SHA256 5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28
MD5 49cfcbc495dc2bb1f21eb34f980678f2
SHA1 99a25a233372f53ef5c02183f72352d8236a0c49
SHA512 3aabcbec848a5b10d05fa4bea1c829197be5c7789ac04ce28840386afc957405ba74385e13f0b84b89bde46901e53931199abc70e623f5b7fd67d2673aa8e160
SSDEEP 6144:vMuuJBPGYVUFKG91DfivuXTB6bzn1bbEFq4McDN7I7ti+6+WRl3:vMdUx1f2MTMbzn914Mcp7IJi+fWRN
TLSH
T16C748D316BD54836E1B20130A8F89774EA76BD305A22858FB3C07B1D2D75AD2AD34F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2556	Logo1_.exe
1764	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\PdfPreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GamingApp_2021.427.138.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.2012.21.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\LensSDK\Assets\ThirdPartyNotices\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\types\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
File created	C:\Windows\Logo1_.exe	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2688	3368	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe	80
PID 3368 wrote to memory of 2556	3368	5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe	81
PID 2556 wrote to memory of 860	2556	Logo1_.exe	82
PID 860 wrote to memory of 1568	860	net.exe	85
PID 2688 wrote to memory of 1764	2688	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
"C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D0.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe
    "C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe"
    3⤵
    - Executes dropped EXE
    PID:1764
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 fe0dafc0d819f58b03a2548e70148eba61fc6ad2425253dc1bd406f9564b3d0b
MD5 3a446efe7c198bebae3df266278d978b
SHA1 0fa759ba83663b71d04a5b34defdec860ba676b3
SHA512 a0c63da266dd9bdf8aa48b57bd999018c1f90e388001bbd87064b17531ad93c79a916e9796d23932df20dc74c5e6028e762ebfd3f821d83ea75ef42931aa66b2
SSDEEP 3072:piM5kuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:cMuuJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T12FD39C1376D18472E5B2593108A1DE718A3FF9624D94CE6B33D42B3D0F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 48b6351df0a086e424470e34ae49d4a8a8ef66693a564394676f51c248b02a43
MD5 c8b0b34fe580a949ef1a105784818981
SHA1 08a04ec4408aba71624aeac8bf139ecc6f051969
SHA512 838588b9711a9e46eed08504e9e2275966fc2268bbb3258296c3102a79da0536281d8b2d627f06763614321ca1fb980de27d94f91c52afe3e0b19a6e24590bfb
SSDEEP 12288:vMQXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:vMw0Le5ji0hmxNrM
TLSH
T19CC40916F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 2cd1ea7b5bc267846e0fb1ef348ecef353627fc52d6591b6cba1ff16408e44c8
MD5 6098ea38ec05a4b6b3cfe01ae79052f0
SHA1 6957689ee3f65766a6b340aa4c88587cc38f69ea
SHA512 620e6772ffbf931af5039db5bad754ba62c1756ef050706ae13b0574b73f451aae363497169f01b23052c83eedb3a9b635f012367d0e0923562460ae494e6823
SSDEEP 6144:w7uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wNqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1DEB47D31E6A04037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1D0.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1D0.bat
Size 721B
SHA256 e88c5c90aaa8874bb3ddb0d6b120e53edca800fb754debec718e544b16702656
MD5 b1a58c5ad0afe5ebbe3ae8dc23b602af
SHA1 f900c0473836905680815cada42ecdc5347537c7
SHA512 2e97ea7037bbdf4b3e00b285cdaef09c9696e89afd71619ba817a5ccc99a77c58ccd65686656766e375c666bf8fea8508f806b59d6143b8d7f80307ddd22458f
TLSH
T17401A7524042728B550601375BA1994FC9A328AE3F971BD94E3198FF71C1A2FBBED242
MD5 SHA1 SHA512 TLSH

Submit Download

5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\5be67638df0ab67c35b16491dff79448f417595a14065c7da5c5cff4016bdb28.exe.exe
Size 301KB
SHA256 9cade48819f36e06646c0d30ba7a7398c95d82648180b47f1bf61190a16d06c8
MD5 bae4c08e8269a721818f10b4b271c61e
SHA1 85700906213836488e12eb6294238b5a06b211e8
SHA512 88b2c5103b15066c9b6c147979a4d98de8473c5cad47f860fb5f9914527937b28e60eabc88ae2eeee9b0f6e33fd8d3a534244326daf8f333f9e95e597adf0976
SSDEEP 6144:aPGYVUFKG91DfivuXTB6bzn1bbEFq4McDN7I7ti+6+WRl3:uUx1f2MTMbzn914Mcp7IJi+fWRN
TLSH
T163647C317BD14836E1B20130A8F89774AA75BD305A22868FB3C07B5D2D75AD2AD34F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 e1ebfc27e46e7a0c7458db5219cbe55db66a3380d921762f3beb3614734f11e5
MD5 4487e350db548c661a450d333332cc43
SHA1 6107d1e97cbb05fa5500041808e977ad28d65a57
SHA512 e8a022c9483b247eb97f9244ecde7068a5340e1be6f8b182e26188247450b6a288e944cdfdf67a6809736d55f463c5b0274b6ad7d2a0b84bdbc6a70704b79fdb
SSDEEP 384:NbbO1EMj1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:plMj16GVRu1yK9fMnJG2V9dHS8
TLSH
T1A9D2D03767FE5A67E2A15FF068934F66C623B552CDCE820F1D14BA450E907009AE6633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3847269522-1618051987-1942096715-1000\_desktop.ini
Size 8B
SHA256 6e9be20748ee78b11d664f31b9547ee836b5e73f3d4ef05289327d7f1ba0eb14
MD5 40ceb2ed83210f4185f76feb1846e3d0
SHA1 e8b81c1d0babb9887ef3703b2804d6d1a2f31d63
SHA512 62538e5d4e898b44b402a6c1f2a32edd5945428b2891b38363935cf3d358a7638f88313b7be5209c29be487b899cca3ba7d53923a193cf06b722fec679357ef1
MD5 SHA1 SHA512

Submit Download

memory/2556-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2556-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2556-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2556-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2556-753-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2556-1224-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2556-5005-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2556-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2556-5502-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3368-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3368-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download