d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe
Size 70KB
Sample260429-ll38aaes4p
SHA256 d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2
MD5 75a6ba4152394cefd18f8083bbe101b8
SHA1 8c61b3aa99f5266dd9d6d5fb9695f43f50555492
SHA512 9b0c075d8a68a8312754149df88b0d972e9d3e86b58dac8be178532d0072871c7953ae2021bdfcb7f19ff5add72aabcb0ec483a450427ae469dc4b07d616ed00
SSDEEP 1536:pG3SHuJV9NdEToa9D4ZQKbgZi1dst7x9PxQ:pGkuJVLtlZQKbgZi1St7xQ
TLSH
T14C639E136BAD0CD9E1A696705493CA22E737BD116BDAC2CF1721731A1F313C1ADB2366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4340	Logo1_.exe
2120	d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\edge_BITS_2524_1484906902\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\edge_BITS_4480_1015772459\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe
4340	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4320	2420	d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe	84
PID 2420 wrote to memory of 4340	2420	d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe	85
PID 4340 wrote to memory of 4476	4340	Logo1_.exe	86
PID 4476 wrote to memory of 5024	4476	net.exe	89
PID 4320 wrote to memory of 2120	4320	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe
"C:\Users\Admin\AppData\Local\Temp\d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1400.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Users\Admin\AppData\Local\Temp\d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe
    "C:\Users\Admin\AppData\Local\Temp\d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe"
    3⤵
    - Executes dropped EXE
    PID:2120
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 44b52ea97222be0abee77fe3cdba2f227ddbf2a51ecf4a02c10f300243b4634b
MD5 bf8ca79e6687c9d3cd04c6abecc8da58
SHA1 1dea698bc661fe3d1c0331e282fb8a08b694cab6
SHA512 c300bbbc43d4f2319d0d67087fe8b1d27df9483fcfe579e0967b34849449ee5c34f1390cb3d1108f61c9f42c253d8f2fb0b87daffd516b2eac6a4ffbe6d00a08
SSDEEP 6144:BuJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:VXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T111C40916F6748735D073C0B9C5D2A68EE97230825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 2cd1ea7b5bc267846e0fb1ef348ecef353627fc52d6591b6cba1ff16408e44c8
MD5 6098ea38ec05a4b6b3cfe01ae79052f0
SHA1 6957689ee3f65766a6b340aa4c88587cc38f69ea
SHA512 620e6772ffbf931af5039db5bad754ba62c1756ef050706ae13b0574b73f451aae363497169f01b23052c83eedb3a9b635f012367d0e0923562460ae494e6823
SSDEEP 6144:w7uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wNqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1DEB47D31E6A04037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1400.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1400.bat
Size 722B
SHA256 d860eca6339817d740589fe7a678ad35a9cc6d2caa672db806ad30d25cd9e015
MD5 418a0f58b4757379bb091e532d6eecf4
SHA1 70ba4effd8a5278b0cef29c8d31dc3efc02f207d
SHA512 c5c239e53aec6d16022f0e9c4144fe32ff69a2ca52a4fa90f50581ca42311a17dfb420c2956790588bff9991efbf899955ac62a24789cb97d12d1bdf0270199d
TLSH
T12F01FCC2C2DAEF7ACCC8118EDFB3554CC5A35629BB847265C6724A7612C350B76991C2
MD5 SHA1 SHA512 TLSH

Submit Download

d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\d9453b3fd09df03932271453d427e67598aa2fb5b0299d9062261e0b8ad0baa2.exe.exe
Size 41KB
SHA256 cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f
MD5 977e405c109268909fd24a94cc23d4f0
SHA1 af5d032c2b6caa2164cf298e95b09060665c4188
SHA512 12b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5
SSDEEP 768:w3V/q1Boa9cUlxLcbdVOm4KbwFIKZi1dstYiI09/yOPxWETQN:SEToa9D4ZQKbgZi1dst7x9PxQ
TLSH
T1EB138E12676808D5E13BD238A4E34922FA35B9241BA1D7CF1351432A0F367C1FE7639B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 f11df294c2a865145da129c59a96aff37e707715a8eaee367cb16121b5f5c472
MD5 1877bc8b7f0ee8948eac974d153e807d
SHA1 75e2d46cd5ed06738f5a60c434d862348d65c314
SHA512 9cdbbb718c2c0c00961c30ad97a749c7065e8785f9a63a063075677f7d07cc73602d671f954135f671a5f62cd5d7633bd7284814def66becbccf7883e0bdf04d
SSDEEP 384:NbbQ1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pc16GVRu1yK9fMnJG2V9dHS8
TLSH
T11AD29D276EBE1D2AE1D19AF05493DF66C727AD52F8CF420F1A24B605FE7070059D2632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-721190819-434563495-2007910846-1000\_desktop.ini
Size 9B
SHA256 0654a8c5043775b345fbf35a533eb0646e38914f0b232809b1c282957503d5ed
MD5 12654503628146afb5364be876fdba18
SHA1 bea47224e750e6942dcd144d0e010d9dd47961bf
SHA512 5099177df4b2a6fe6a66ac124b7c2130b8f5dcbeb10bd3770534e4e9a3d229ea7193f51db5e864dd742f4ba0f619f6118c609c08570f4f1d8aa3d22ec0f0c7c4
MD5 SHA1 SHA512

Submit Download

memory/2420-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2420-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4340-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4340-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4340-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4340-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4340-649-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4340-1282-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4340-5071-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4340-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4340-5584-0x0000000000400000-0x0000000000436000-memory.dmp

Download