52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe
Size 2.6MB
Sample261017-echfwswvgx
SHA256 52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b
MD5 c656c86b8bd0d15bfd302cb005a8088f
SHA1 b81bdd0e6115fff5252a839d191731fd521c49ce
SHA512 f39cb956eb721cf1d2f5645f7d8453a3dc629fb4a28b32ea0a9789429f9e01677515f8ccf647e93ce0dd37dbb9e2434ea33cd70ebdf874f858723d02e5e75f0c
SSDEEP 49152:R7OQgPPHEmBZ31u05BSrKsa9eRmcnUdfGe:OTMs9ecaUdfB
TLSH
T15CC55B5B636242F1D4A9C37DC946CE52E672B01143226EFB1A27CA9A5F733D20F7D290
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3996	Logo1_.exe
2104	52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\edge_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\PdfPreview\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe
File created	C:\Windows\Logo1_.exe	52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1320	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe
3996	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 1320	3164	52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe	90
PID 3164 wrote to memory of 3996	3164	52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe	91
PID 3996 wrote to memory of 4320	3996	Logo1_.exe	92
PID 4320 wrote to memory of 3840	4320	net.exe	94
PID 1320 wrote to memory of 2104	1320	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe
"C:\Users\Admin\AppData\Local\Temp\52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E00.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Users\Admin\AppData\Local\Temp\52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe
    "C:\Users\Admin\AppData\Local\Temp\52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe"
    3⤵
    - Executes dropped EXE
    PID:2104
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe
Size 228KB
SHA256 1f6f6cfc71a57979762aaef5fb177aa0a013b9d07605dedcb83402610a503d24
MD5 c4355326d46e749c0d8eaef1fc65e534
SHA1 9ed52cbb8cd415bb7d2cea0b3c11c47959e102cc
SHA512 791d4463ba22a48e4b77ccbed1f4282608acc3b25b06c12c014316531deaf4c2e6ce8b4a7e48205adaa9c682657d45288d621e4d96a47f0648271080adce8c89
SSDEEP 3072:LftffjmNq/rfzYT6X/D/24l/DFeodwgjf+FvC6C36lnWesuoB+ICTRK02Bd9Pqwk:LVfjmNWrZl/DFf3WC3as7B+WCR
TLSH
T1FB34811233F84929F8F39E316C398F26D93ABC31AE35E66E1644119E1D35A51AD31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 660KB
SHA256 a33ff0fbf40f2a77a95b70ba499d0efe12131b471f27efe68509fbe2ba287a47
MD5 0d9c90532c6ddcc0db641042fe66e031
SHA1 3ef0d8fd2c2e44feef74ed8a24921ac1f8ea1d2c
SHA512 72c7861fa2c1d9fe388446ae88d6c38ff5a7ce15674b57674a48340b1116eeecbfa269cacce4070ba9010f0fe7573da9f470a6f6a64f7ac97d3ef61bca6d5975
SSDEEP 12288:Pp7+znMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:R7SMysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T1BDE49E3294604036E6F106B3B958A2347D7CE22867148DAEE3E8ED5D3EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a9E00.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9E00.bat
Size 722B
SHA256 97ae5338e06cf7cad6b1694aba7b70c4c74fd6f6afef75d17e5c1045ac27d36f
MD5 7659d37f48267de4124d302a965cfde7
SHA1 661fc748d603eda818474e60c6db1d0ebc8cb335
SHA512 421623d36446acbcedac473358c3dd2cea295305fd7cd92ca84fa3a6838bf369b4babb88378e954c2101f85606f36c53c3e8309986eb3da5e3594fae6d598288
TLSH
T18001F7108045EA570969D06F342EEFCFE6B2380C26D6366D4E18BE5D1B4240E76AB111
MD5 SHA1 SHA512 TLSH

Submit Download

52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\52c9b3c27d769525b5fd0c1d5562d0764b1bc23ddc17a490182f306e4988c71b.exe.exe
Size 2.5MB
SHA256 0e7c8fd7ea6e25989e611ffa93cd7671b830643a60481659a4b37741614fe536
MD5 4a1fd24a63b39d6bd42d0724e0dcf97a
SHA1 1a1cbbef6f14ae5298c38c22f6b621749c3fb668
SHA512 1d1e7a2aa32f74bc268ffa37002047435e115d35f98c996d1170c378b67587275820c2b9bbba429d95f92251b5d34c94828dda43899e43e03d859ff0f395fcc9
SSDEEP 24576:HIKQgIiPHEq9dTYcqOlumZ3dQ8u9XRk5BSQqZc7pdeiiUeQux9aVMdQzpe+P9gqr:dQgPPHEmBZ31u05BSrKsa9eRmcnUdfGe
TLSH
T12BC55B5B636242F1D4A9C37DC946CE52E671B01143226EFB1A2BCA9A5F733D20F7D290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 80cfae296b7782e87e8be390e3bedf70997ecc6d90f51e638ee70224dad05bc4
MD5 d42ff33329303d87aa5a1e69bdc7866e
SHA1 a48fa26ae720b06014ed237d9faf1cc4b43aa23d
SHA512 cee998cefa8dfe6639f32b798ae21b02b2ebb6d74c9093d2658e571877e6738a9d477e1810aa4487e5a9ab7a7334016a9d670a69ea83b598c3cb2af32ccb1ddd
SSDEEP 768:cX01ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:7fgLdQAQfcfymN
TLSH
T132C2E07921C81939EC655A7DCFE35B02833D4B2E449F5CAA2AB18D7E26D177C100EA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 10B
SHA256 63e88b8d19d69b081af987c4000305aa56469cdb3211e8600d1b196ed0479546
MD5 19def2b371aeb938aeb0fb119e67d9de
SHA1 198667f2eb459c5f311923aeb8f9032069a5a0cc
SHA512 7414f4e9abd1b48a4f18d1835ff6c8eefa50fc9d7c2b8c6b73b6572bc2dad12f9ac41af5be3048e65f63cc410954fc96100cf5903177f71791eaa1f0b8c10ea4
MD5 SHA1 SHA512

Submit Download

memory/3164-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3164-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-120-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-5042-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-5515-0x0000000000400000-0x0000000000434000-memory.dmp

Download