fa7ae3efe04d7d3d429c0f008d820aa0dd0fd7be01e2f891433c0f51c93d0097

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 445KB
Sample261110-e7y25ayzft
SHA256 fa7ae3efe04d7d3d429c0f008d820aa0dd0fd7be01e2f891433c0f51c93d0097
MD5 f6c2197a2d2e65b9ada05c0105069c46
SHA1 af0fc96ce874b27f737ef138b58b00c4bdb00317
SHA512 bd75eeb5d2b26fd8dfe325a574105a6720d3ee7449b5527a95cd29ecde54142bebd79cf9643b032bcafa26b5cd506e4f4fe4d3992c7a6638f10e1b038fb003cc
SSDEEP 6144:dVfjmNEbXNXHBV7SoULakIzOrgiLQsUaF8oQ4fJXnIZRob:77+EbXNxV7SoUukIzOzLQsUain4ivob
TLSH
T1F4A42A10165F0CABDC93F53D8A618E4BD5F27C110B66C6AB66A02D5A7FB328369353C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3216	Logo1_.exe
5488	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\identity_proxy\win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2436	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe
3216	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2436	1592	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	88
PID 1592 wrote to memory of 3216	1592	2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 3216 wrote to memory of 4644	3216	Logo1_.exe	91
PID 4644 wrote to memory of 1880	4644	net.exe	93
PID 2436 wrote to memory of 5488	2436	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7853.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:5488
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe
Size 228KB
SHA256 e25f2f86066d0472368bbf2c18018a72561d6782c2ab6ffd340347b3dfd87e2b
MD5 c10b71a8e55ad6993aadcb4340cc8d32
SHA1 9f8036068463184bdf55833eb30b18402a3f9e3c
SHA512 6825d2825f2d89be35ce56997aeedade6c0c2227687a0c713fa1263b20300106879ab47eaad538fa57b53bae60deb76530b2049d2a64be506bc2eaccd00864cf
SSDEEP 3072:HftffjmNV/rfzYT6X/D/24l/DFeodwgjf+FvC6C36lnWesuoB+ICTRK02Bd9Pqwk:/VfjmNPrZl/DFf3WC3as7B+WCR
TLSH
T18934811233F84929F8F39E316C398F26D93ABC31AE34E66E1644119E1D35A51AD31B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 660KB
SHA256 1f5273390ccaab3a0cf6930b6413e8e67a5069ac8fbbc8b9b85edb7b679ce1f3
MD5 96b8792e80ab0fe18763663ce9e14422
SHA1 11ca6fef21184a7c2d9c7dc760ac6e932b80589a
SHA512 c192db426ec1147647b4e91028631794cf8677d4c618924ed0afc073b6bad15eb99253639551ea5e541858ed17b98d5c97959320065f0db3533a75b2cb0d8181
SSDEEP 12288:vp7+inMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:x7JMysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T14FE49E3294614032E6F106B3A958E2347D7CE22867148DAEE3E8ED5D3EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a7853.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7853.bat
Size 944B
SHA256 e1705588b5eb97150bc199a8137cfa84c07237557298851e126e47b892db186c
MD5 0a550c62548e02929b0961b7d7bba9a6
SHA1 ee6d639afcf65b9ecf891ddeb834e7501586ddb7
SHA512 5a26339649db2f36f24a1851d6c50a28a8d5bef090a29057b4cad57e76b85226235452556e0d3e43e801b31d455b832961edf209be020be25b77e5a2e5dc386f
TLSH
T11D1136C1CAA7CBB50A81A0470DB998FFC911599B2F0937C463DCCF3E10D826C15BA356
MD5 SHA1 SHA512 TLSH

Submit Download

2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-11-10_f6c2197a2d2e65b9ada05c0105069c46_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar.exe.exe
Size 418KB
SHA256 9b59fa708eef8e6c1ed698e83efed9ad66e70665694d18591d89ed6ac15d666d
MD5 c511e4f260ee30fc1f5f45b366c1e936
SHA1 ff4ffe173128d9982a8c30ced3eef6f144efa760
SHA512 cc48273fe33c95f23156e3d296bf246fa036a812d5a5dbecf23641d289318f2e4d77c448d505ebcc8514a1a908f3a278520f2f0cf185621e3dbb75bf5c5751b6
SSDEEP 6144:3bXNXHBV7SoULakIzOrgiLQsUaF8oQ4fJXnIZRob:3bXNxV7SoUukIzOzLQsUain4ivob
TLSH
T193941A10165F0CABDC93F53D8A618E4BD5F27C110B26C6AB66A16D1A7FB328369353C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 cdc84c3a4626eeb254f4bc98aa4d982ebac2c838f4e44473cdb9c9caea07bd05
MD5 f32a38d29c3ec4a3189ee059f978bd68
SHA1 44f671b1bbcb11da17466686bef74421497c9424
SHA512 7b4e5e387f9badb79d0acbc54c5fd79fe7babc9351d7a367c9d47663d86053d1283bfa2c5f8808875e57c930542d0677d1b352ef97716761e9326f6c84b8c509
SSDEEP 768:f1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:NfgLdQAQfcfymN
TLSH
T160C2D0B422C439A4DC224E7DEBC55722A33D4638A0ED1075A0B156FB2732AB4604DF6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 10B
SHA256 6a98726a74c3faf830f855996a54c2fef58caa784785e9c949352918d0b6d578
MD5 252c40ea19fba6ef24af8605afe33595
SHA1 f297f377a42e449ab69691ae96fdc885a905e988
SHA512 dc913d6296d95ac28bf8427703f8e309fd54a69e58903bf01e882c5685e8655f8034e44deee4dd83a10984dcadbc1a29017952d8600874dc7281696c223631d8
MD5 SHA1 SHA512

Submit Download

memory/1592-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1592-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-145-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-5044-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-5517-0x0000000000400000-0x0000000000434000-memory.dmp

Download