5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
Size 2.3MB
Sample260831-e16hmavcke
SHA256 5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2
MD5 67c407029946ecb6922768b8a0b241d3
SHA1 02303d15bfc64d63adb6bf38c6ac48309be6ecca
SHA512 3f3d9cce542df7ca67f821deb7a37e74c47cae3d76c276bead448a0e409ea443d9f31fe6b6fbe3c14f1b14bc7978140632a67003202618f253975cc7dd88e644
SSDEEP 49152:X7CGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:K4OEtwiICvYMpf
TLSH
T1D7B59D22BE8FC032D49611B1A67DBB1B841CA6767B35C4D7B2C00E69E9147E31A3D727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2804	Logo1_.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\identity_proxy\win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
File created	C:\Windows\Logo1_.exe	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe
2804	Logo1_.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
2536	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4784	4932	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe	89
PID 4932 wrote to memory of 2804	4932	5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe	90
PID 2804 wrote to memory of 4272	2804	Logo1_.exe	91
PID 4272 wrote to memory of 5016	4272	net.exe	93
PID 4784 wrote to memory of 2536	4784	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
"C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2418.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe
    "C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2536
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 5e00492c608ba8f8d3367e512721fc352ccfc0b2037a1057d16c9442ba680502
MD5 7fefec096ee19e37b01b29e863b591e9
SHA1 a153486315e5d123babde147a0f49328d1fd1f96
SHA512 c7ffd9b65676c5b898b7116c69ec1a1d4ae45e3c2a60eb7e13ce1fd263756798886b51763b53825e923746d512602967c1452a3ca6086cea707c6b9f2a9a6be0
SSDEEP 3072:6ftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:6VfjmN2G7/fYfLvzB+QFyn
TLSH
T1CEC38D1371D08871E5B20C3449E1EE619E3FF9620B449EA737C466BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2418.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2418.bat
Size 722B
SHA256 b11a10c7ca3983b38168e320ca238d2635f02902261e0474efbefb727607d9ea
MD5 73879534e41c09dd736d74e86d75d776
SHA1 969d481621a5027af6fabe011ad5d37811e17a21
SHA512 606884070e0423c54dd316f7beb38e4c5113effb6ebbdee678db66e24618ebbbfff727721cc5b20742d7604b828a60301e71b39cdeb95d41d89cf4b3ce9c3bed
TLSH
T10D01A20AD0C7C94DCC02A0070B52AEAFC0B3DE8F7AD876D22D26D84F24B1D6C96A3205
MD5 SHA1 SHA512 TLSH

Submit Download

5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\5fe315ac802885f9189103cf2e2b85086b71bd9ae5455c17bf083175ca622fc2.exe.exe
Size 2.3MB
SHA256 64e6d2d2218dd2e9b1a025c1f83f16ced7a5e43663407346767b77b254a2c5f4
MD5 0bac842257dec4dfbd83cb6dc9e5d83f
SHA1 529b4ad6fe1d9555ce9f575ea545aa0eb31fba5e
SHA512 509febd4bb73df2aabbd9562e1404605ee286a4854e2540e3e04579a1be2855f324d535c87ee9dd9d9f126510c9730bee8fdc8e9a478c75550ae0d4cd170fbf3
SSDEEP 49152:1GSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:J4OEtwiICvYMpf
TLSH
T1A7B59D22BE8FC032D49611B1A67DBB1B841CA6767B35C4D7B2C00E69E9147E31A3D727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 6771d3394c0d581ac7040f1e073d40fdf9e303bf019eb8099d03ee9aa69da6b5
MD5 ab1855f86a36d30038df3afdc6b2cb95
SHA1 79653f0ebc6db1cafad6c4c6bdc9149643b81370
SHA512 545016820cb97c509fca1b9a87a09c425e1f4889fe06d4153953ce20127f1bb5b13e1c1a247704a49b679f686e69319a5bceadb5ea51bd59d9762a7f413a1b5f
SSDEEP 768:DcK1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:AsfgLdQAQfcfymN
TLSH
T104C2E17526CC1674E866597DDFE36741833D077A04AF64662AB3CA7F2390778100FA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3986082593-3624157295-3514260330-1000\_desktop.ini
Size 9B
SHA256 48fc246849bbf8829b4f8949e19ffb9de4020b7e65df5ab0bdedfdbbdb956880
MD5 3e7714d68104ffa0b685f025be924834
SHA1 d91683bde0bea0d8cab7f8d6c29ee9bcf478c625
SHA512 2dad49b79fae347aac4e1bb7b8bd50dd7c3ad4c9fd2179f3a4fac7c6db24d46cd8d41b38a48f47a3e412cc29682522e22c6afb463c7bb6d14136a918e27f1f2d
MD5 SHA1 SHA512

Submit Download

memory/2804-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2804-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2804-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2804-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2804-177-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2804-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2804-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2804-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2804-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4932-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4932-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download