5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe
Size 449KB
Sample261027-e66qkscf73
SHA256 5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6
MD5 ed26d5eff61b778faec5610cbb852455
SHA1 d6ca67d328294aa02263bb748811b2c4d418f921
SHA512 5e8874828286660216f59e8de4dc52afd0b0a478b4946c8846bc2c408d59a8402aec62d38f62d581b90ecb26329cd08a3b2a8a65f135bc42b9a317aa9f6bfad8
SSDEEP 12288:K7+U46jJ+OVQmLztrMMMM6MMMM7MMMID/:K7p/trMMMM6MMMM7MMMID/
TLSH
T18FA45A1077EA9008D4F506729C73C5905B79FE662980CA4E39D8721F1FB27E28B6376B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2860	Logo1_.exe
1312	5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe
File created	C:\Windows\Logo1_.exe	5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2552	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe
2860	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 2552	4360	5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe	84
PID 4360 wrote to memory of 2860	4360	5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe	85
PID 2860 wrote to memory of 4656	2860	Logo1_.exe	87
PID 4656 wrote to memory of 760	4656	net.exe	89
PID 2552 wrote to memory of 1312	2552	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe
"C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FAB.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe
    "C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe"
    3⤵
    - Executes dropped EXE
    PID:1312
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe
Size 236KB
SHA256 7813462ea7fa4b8e46ea6e7ef0842e5dd5afb3945dca23dbe4b5f71cca1f26cc
MD5 1908672edae408ed83168dad82efe3db
SHA1 939b5cdb9a02b40cb77dc89a9f6f1cbdd5a578c2
SHA512 65d815fec2fa2eb63619a3cd88ceb8ac6c7cc52b48c60dac04b76fffbd22c64d5ab8454bfc8d7df15f5abca1859fb2406150756eade553a4a83142090ba10abf
SSDEEP 6144:4VfjmN87gKNkhSR/5kHouyXnZhB+h8WH3:i7+87gKNkhm/JuyXnPB+h8WH3
TLSH
T10134A22233F85929F8F35E306C759F29993EBC35AE35E72E1A40219D2D34A51D921B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 660KB
SHA256 5f6c3a15c9358d4898cba695272af729888b23e0ee5a0f70a4c82cf6ec63cdbc
MD5 9d7d9051e142da86fd85e778ce7121fe
SHA1 9e94d9b92461363f9d6f8506c02e870587a33013
SHA512 f12f6d7010f645dc48ce1b7d369f1beede2032d8f9eb183407db2c9bf36cc85eae884908f055e2ea4913ad52a404cc3cad77682599c3f5a2c23c6c1b8e3e361f
SSDEEP 12288:Bp7+wnMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:H77MysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T1D9E49E3294614036E6F106B3B918A2347D7CE22867148DAEE3E8ED5D3EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a7FAB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7FAB.bat
Size 722B
SHA256 266c0bf3c7187e32ea54648ee9dce2c69cd0ef4ee8df90a1e1cc89b831b11dd8
MD5 85f78979ad0bbccd4973a0bc6e3cbb93
SHA1 b43faf977389d6466763e871308bd79b725433c3
SHA512 574d1e83957c562e12274026702324441911e5263183173764c142c9a438c2b971d7ebaebe171d0a9dc6910a9f986b146359a5c33cafd62134e40ef2406daace
TLSH
T1AB01864487CD9A1D9E0BB03F2A71D4DED4613A4A3F957E2661578F8818C300DBEEE345
MD5 SHA1 SHA512 TLSH

Submit Download

5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe

Path C:\Users\Admin\AppData\Local\Temp\5bc8e3313d94631b9034bd4e9a14b7f5aac4c1943e51baf9a5eca1b058beada6.exe
Size 423KB
SHA256 ea2509dbc993b75e2c66e4ab20716a27f7561591d952c4ea403a64a7f0cec07f
MD5 17824b5457e9d4519d1a6a1f58e109b4
SHA1 26d8fa49a5800c8205736127bed678c76a12012e
SHA512 71d2b0e5db1ab47ecc1782b3c6c34df4bf517bc2c4bb4936b67a92f89788e7a0fc4a084097a918f06eca3b1f8467877848d356eec7dc586940347787e7ef35ac
SSDEEP 6144:Dnx26mWJ+OZgudUJKyBStQ4Xtb9SzcTtrMMMM6MMMM7MMM96oM9+UfJnZNt:D46jJ+OVQmLztrMMMM6MMMM7MMMID/
TLSH
T1E2946B1077EA8008D4F506729C77C5905B79FE662980CA4E39D8721F1FB27E28B6376B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 fffa8d49ec12ac2d0e39b6476243891dc9f12e92e15f435f94cb860ee87376ad
MD5 d81e2c487cc0d53893cce2852430de76
SHA1 729ce409f531a0e67f9a1cebe4a33e146cf11cd7
SHA512 7639d5b6d71ca37831df521776648c28969eeaafc422b9e73a3b9d019046cd6db868f5f6e18684e5461eee60cb5285b8101a79f0a39ee0826b4dc612b5728058
SSDEEP 768:G1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:gfgLdQAQfcfymNG+Kx
TLSH
T174C2D06912E87739FC1B4ABCDFD75B01826C0BBA116E56292CF1C87E0560BB9100EE93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 10B
SHA256 429d13db37d4bb1357cb28a091ed6f6ce018fbc952452c34f11de1e40dcb3a59
MD5 110a11ae4d7bb9a6e9c5c9e2c8fcde6c
SHA1 c6ec8483b3628cdea8519f90023429191a4d8918
SHA512 514a94c9c2f76cbb621a856fd2f69e39dac4e977d1c95762eebfae279cabdf021bce4d87f48fa69e4a420106b1fd9440f18887159004df843aed26bfc6c2f41f
MD5 SHA1 SHA512

Submit Download

memory/1312-20-0x0000000000430000-0x000000000049A000-memory.dmp

Download

memory/2860-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2860-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2860-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2860-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2860-380-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2860-1249-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2860-5038-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2860-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2860-5553-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4360-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4360-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download