523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe
Size 3.8MB
Sample260908-km899aec69
SHA256 523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a
MD5 4125a61291af73cfaaaf081642af9724
SHA1 7352e2b3126d3717322a73deeb90095ff72c85d3
SHA512 93e1e67eee5bd23180a03ead37d9b64e174b154082dd75f55c425d8b3b8c0d7ae1c68de6a0b2cb41c24a61fe30aa3d05cf720b4df0e6ad70f423543f7c27a43a
SSDEEP 49152:k7TBh/6gr+48AYs9pavbNmCrhJFNIvOL5Ifn0sP5pP/j5mzV0DkgNp+eTFMUiTry:kr+40F0oFWsg2D3gn
TLSH
T1C6067C5BA2E603ECE176D238CB965903F2B638054731AADB11509E790F77BF14EB9B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4552	Logo1_.exe
4124	523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Notifications\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe
File created	C:\Windows\Logo1_.exe	523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe
4552	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 6016	4328	523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe	89
PID 4328 wrote to memory of 4552	4328	523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe	90
PID 4552 wrote to memory of 3164	4552	Logo1_.exe	91
PID 3164 wrote to memory of 4836	3164	net.exe	93
PID 6016 wrote to memory of 4124	6016	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe
"C:\Users\Admin\AppData\Local\Temp\523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7814.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Users\Admin\AppData\Local\Temp\523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe
    "C:\Users\Admin\AppData\Local\Temp\523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe"
    3⤵
    - Executes dropped EXE
    PID:4124
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 0e25d907916c551d1b3dfe219e250f8e1a6f99f839de0e32e9a88ad07c0f5b70
MD5 cad2ac3b2efc3a159df626882fe08397
SHA1 c8fb6b90d823ec5657ed9cc261669a7e65809168
SHA512 82d29902730c0e03329fc96cb067c63d742824ebd8f579bf2527fe9b69b3e8c53dbc5d914f96cfef25c98d11cace3c5c9572e6dd6ef08a40b06387670ae89f2f
SSDEEP 3072:2ftffjmNoxYhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:uVfjmNzG7/fYfLvzB+QFyn
TLSH
T172C38C1371D08871E5B20C3449E1EA719E3FF9620B549EA733C466BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 297984cb1c691abf3614c0c64ed3ed1b8cbf2e2f2efae02e5392e110a717394c
MD5 0c5536c6a3aefefb2d4cc1cfbb729119
SHA1 660b05e7c4543df8ec6d4e80d6c8f3c9d667bf8c
SHA512 9f833ca254c2e29c8fa9fe95ebeb6d62a686b99dd6597761ffb2797a0b50daa531a483f6047b8bbb059c2f15abe19aa030e67d2c1198624633146d76aebc7da8
SSDEEP 12288:Bp7+sqIOkU8AMXE9B7PElZlP41N+4PUWfo:H7RBOkUhMXcBwc04nA
TLSH
T104A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA85D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a7814.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7814.bat
Size 722B
SHA256 334ee90bcd682758576081fe188a2abbc20a98ac5473147a397936b7fca581b5
MD5 34bafb02e218397952dfad1d9943f51f
SHA1 99dba54d410521de8d95399f14b7d67d3c44c4e0
SHA512 289f263ec2209ffe4506835c464cc4c14b13368af79e3f33c1899db5cf59d5c7e7d7018ea8ca7709927547130e3eefeaba39d1c75e2b81b5be22f9d2bf7c8215
TLSH
T17D01674B43CF7A690C1A54525E70D8CEC8AB5DD92B563AF0E93DC90A139640EEBE7603
MD5 SHA1 SHA512 TLSH

Submit Download

523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\523bea88cfb271edb47b895fb4dbc704f006fe567803a06e7103c32be5def65a.exe.exe
Size 3.7MB
SHA256 0ee984596e80929f2a847fba6e7af82cc00c96c8d0a96c1045cceb840074e6a9
MD5 6eeb1f4c58c21be188b28ed78063b502
SHA1 43dde16f44d90694f7d219f7ff4b19421cb227fa
SHA512 1c1b3fce814ebc32fb5b41a58ad270c891c4bb60990b086a496721eef734fce7a5fcf2656708c32f47823faea85127542236fd7ac34247fc1c8a1c1cbe70305e
SSDEEP 49152:PBh/6gr+48AYs9pavbNmCrhJFNIvOL5Ifn0sP5pP/j5mzV0DkgNp+eTFMUiTrgNp:tr+40F0oFWsg2D3gn
TLSH
T15F067C5BA2E603ECE176D238CB965903F2B638054731AADB11509E790F77BF14EB9B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 d47256aa519d4f40e1d5f6078fe6b4377001192ef9825fe6303e2dfe045d6ef3
MD5 ebdb33119706335bb4d0f23edc19d112
SHA1 07a250702e598ae23419b04e093c4980eb681cb0
SHA512 f5daba79f1f7675732602444662028c425d211d31ba035b90eb58fd291bdb60d3c3dec2da55b932f632e9c083c3ca8f472dcb079e0239fe3aabc899be7959d8e
SSDEEP 768:41ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:qfgLdQAQfcfymNG+Kx
TLSH
T15DC2E06921C5673DEC1A5A7CDFC79B22832C0BB6146E253931F299BF1960B7C200E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 8B
SHA256 9179d04e2c73a3f2dc2b81dbc27ec1eb04d5ff033e13e36d2437bb8396aaf876
MD5 c376a1cb41cf27cd248b09ca298bb9af
SHA1 eda60ca57465ff189852ea52b4c4e6805271190b
SHA512 946d81479e496cbd82a83c229d294441921de1809dfb2e67ec9a9297e7c2ba2a5ffee9b04b13bbb640825634b3fd2b18a507560125cc59092794ebaed6e54501
MD5 SHA1 SHA512

Submit Download

memory/4328-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4328-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-41-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-5044-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4552-5517-0x0000000000400000-0x0000000000434000-memory.dmp

Download