5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
Size 2.3MB
Sample260831-e16hmavcke
SHA256 5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2
MD5 67c407029946ecb6922768b8a0b241d3
SHA1 02303d15bfc64d63adb6bf38c6ac48309be6ecca
SHA512 3f3d9cce542df7ca67f821deb7a37e74c47cae3d76c276bead448a0e409ea443d9f31fe6b6fbe3c14f1b14bc7978140632a67003202618f253975cc7dd88e644
SSDEEP 49152:X7CGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:K4OEtwiICvYMpf
TLSH
T1D7B59D22BE8FC032D49611B1A67DBB1B841CA6767B35C4D7B2C00E69E9147E31A3D727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
884	Logo1_.exe
1744	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\PdfPreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\et-EE\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CoreEngine\Data\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
File created	C:\Windows\Logo1_.exe	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe
884	Logo1_.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1744	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
1744	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
1744	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
1744	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 976	4484	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe	86
PID 4484 wrote to memory of 884	4484	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe	87
PID 884 wrote to memory of 3772	884	Logo1_.exe	89
PID 3772 wrote to memory of 2084	3772	net.exe	91
PID 976 wrote to memory of 1744	976	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
"C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B07.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
    "C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1744
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 a7ce1c22f83c27931352adeaf03937ff2c297eb15aa43c0c8f22a5de63c1b30a
MD5 378fefdbcc66b62c4c7e4bf42407df25
SHA1 c3ac33839db905a5abdc2229e875d78fbd5eb407
SHA512 40e068ccff4182ced670c4aff1594a1f58a3d2aa6a17a442e3aad31bb795f32b82571b4f2e57e95d4d7728b1e559ce73c1cea7b36db1d231a0ae211f44a406f1
SSDEEP 3072:6ftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:6VfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1FEC39D1376D08472E4B2593109A1ED718A3EFE620950DE7B33D51B3E0F316D1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 6dc2c607c1dd668d1419b36d1c91d538bf99f0f77ce943014d2dbe55d846ea61
MD5 c27df216b4dbe4425d0c1e5575c30b45
SHA1 eebc4487bb58f4ad2c61c7347faaa4326738bc8e
SHA512 ded0a44947c6c889355c9c3c2dc3dfe96a1d2928f6fc58dd99716a05aca27e6764b18531bb5a033ec183a5c0339911691534d395b4b19a3a4c23d2e5dd12c376
SSDEEP 12288:X7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:X7o0Le5ji0hmxNrM
TLSH
T115C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a7B07.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7B07.bat
Size 722B
SHA256 dcdfca2474cc52222e0b47f2f04c42390df28b9f215bc4efaf56d51971e5b090
MD5 d7f7c8b9159d58bdc5b203967d073494
SHA1 5cc00c8a4b111b52a8eb63d76419edc528eb1113
SHA512 74fe982ba01cec81041651d8d2861299cb4aec4a6d0e4c59a7681b54981444b3ed28851a88868c145f209f76d53afef6305deca90cf0ebbeb7f4f45f55894385
TLSH
T11C014F0AD0C7C95DCC02A0470A52AEAEC1B3DE4F7AD876D22D26D95F24B2D6C96A3245
MD5 SHA1 SHA512 TLSH

Submit Download

5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe.exe
Size 2.3MB
SHA256 64e6d2d2218dd2e9b1a025c1f83f16ced7a5e43663407346767b77b254a2c5f4
MD5 0bac842257dec4dfbd83cb6dc9e5d83f
SHA1 529b4ad6fe1d9555ce9f575ea545aa0eb31fba5e
SHA512 509febd4bb73df2aabbd9562e1404605ee286a4854e2540e3e04579a1be2855f324d535c87ee9dd9d9f126510c9730bee8fdc8e9a478c75550ae0d4cd170fbf3
SSDEEP 49152:1GSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:J4OEtwiICvYMpf
TLSH
T1A7B59D22BE8FC032D49611B1A67DBB1B841CA6767B35C4D7B2C00E69E9147E31A3D727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 6771d3394c0d581ac7040f1e073d40fdf9e303bf019eb8099d03ee9aa69da6b5
MD5 ab1855f86a36d30038df3afdc6b2cb95
SHA1 79653f0ebc6db1cafad6c4c6bdc9149643b81370
SHA512 545016820cb97c509fca1b9a87a09c425e1f4889fe06d4153953ce20127f1bb5b13e1c1a247704a49b679f686e69319a5bceadb5ea51bd59d9762a7f413a1b5f
SSDEEP 768:DcK1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:AsfgLdQAQfcfymN
TLSH
T104C2E17526CC1674E866597DDFE36741833D077A04AF64662AB3CA7F2390778100FA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2370214745-1838013427-2987045292-1000\_desktop.ini
Size 9B
SHA256 48fc246849bbf8829b4f8949e19ffb9de4020b7e65df5ab0bdedfdbbdb956880
MD5 3e7714d68104ffa0b685f025be924834
SHA1 d91683bde0bea0d8cab7f8d6c29ee9bcf478c625
SHA512 2dad49b79fae347aac4e1bb7b8bd50dd7c3ad4c9fd2179f3a4fac7c6db24d46cd8d41b38a48f47a3e412cc29682522e22c6afb463c7bb6d14136a918e27f1f2d
MD5 SHA1 SHA512

Submit Download

memory/884-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/884-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/884-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/884-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/884-358-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/884-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/884-5094-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/884-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/884-5611-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4484-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4484-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download