b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe
Size 38KB
Sample260508-edxbfacy6x
SHA256 b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8
MD5 88eb19034cea56897f18b4d72165ccbc
SHA1 2fcbd4b2d013f33d2d92a8344a2672869ecc7806
SHA512 fd3c1f3f4809e54ce4e1c3c000fb86313bff0b32c028184861b198337490b0eaab3df52a00d19f9077829bd46de9b8e2707938715b740ada12d09042ff597ec5
SSDEEP 768:SWB1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoLVHJcD4xNQ+:SWXfgLdQAQfcfymNs07Q
TLSH
T1E703BF2125C77D36F46978F8C5EF87768333DE65585E447ECBA1B9AA1030378202AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1812	Logo1_.exe
1952	b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\edge_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EBWebView\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\node_modules\@microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\PaintApp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\FeedbackHub.Core\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe
File created	C:\Windows\Logo1_.exe	b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe
1812	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 1344	4700	b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe	79
PID 4700 wrote to memory of 1812	4700	b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe	80
PID 1812 wrote to memory of 3508	1812	Logo1_.exe	81
PID 3508 wrote to memory of 4948	3508	net.exe	84
PID 1344 wrote to memory of 1952	1344	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe
"C:\Users\Admin\AppData\Local\Temp\b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29E9.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Users\Admin\AppData\Local\Temp\b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe
    "C:\Users\Admin\AppData\Local\Temp\b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1952
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 378a607b2409b56d2ed1e2757e401c39493ae330724e7d25f55dd42ff467d2be
MD5 338acf85d65ffb4395d1dbd9be5b5969
SHA1 5549f499a3fc34922835e76bb669e9ed8bb19b24
SHA512 7cbca0ea163b2936721f5a4965db7fb5635e9db56fc4b648999a4219957b29cab10261953e8ea8f13dd50f91400bd7db98aec0e7de53497dad8471f4ee1f894e
SSDEEP 3072:NftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:dVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T19BC39D1335D08872E4B6683109A4E9718A3EFD621954DE7B33D41B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 eb6b00bd8329cf287114cc38e671cbcdbf221f661fafe55e059812f1b8c3fb39
MD5 327a17f194f29a0103406a5316169de7
SHA1 3715b94000995470b8b2c15cebfb7bfb249eba37
SHA512 04155830b06f646dceb5461468f44e8e84fccc97ef2ec62fccde62598fbd53f0dd94a8b29e7d92502fb672c4c1b629e30a54e8b601c5528f06460fc43e71a94e
SSDEEP 12288:p7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:p7o0Le5ji0hmxNrM
TLSH
T1FDC41916F6748335D073C0B9C5D2A69EE972308657308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a29E9.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a29E9.bat
Size 722B
SHA256 cc4b936f34ca365629d056e74843b51750298902b7fb15551d7059fac3a51690
MD5 6c5eea80164764028b5e9ec108ed8bad
SHA1 64b21353a8378092731a35ec4975f2782f7c0ea5
SHA512 10704999ccb85b30a70da5974177881b7352c627f0c2f61a999c56043b9cf4f520b698f0c649aea068d02354f17c2f282787a01bc77136a8cb0a21316a4167d9
TLSH
T1CA01564041864AADBD4B5C1726EAE19DB2311DAC3AC33A2C0775DA9D1EA7015F9C35D4
MD5 SHA1 SHA512 TLSH

Submit Download

b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\b69b5d644d7be6040f3c057247af19cda332f0100929c8e4d41791c894fc98c8.exe.exe
Size 12KB
SHA256 cfb6b16c6c7ee64111fe96a82c4619db26ea4bac0e39c5cb29d1181b8c065f34
MD5 897cc6ed17649490dec8e20e9dd7ffd6
SHA1 cb3a77d8dd7edf46de54545ca7b0c5b201f85917
SHA512 b719f7b95f723d0563b270f1260d086168b118189ca74f2aef37e90ad55d66f5c261ecfb15f77e80af6a551587b966bf48818a6421350f8e86b8a5f59acbc2ca
SSDEEP 192:yoHHa9iugQ7yAuoZSMZJ/BZln2Hy3tuSH40oSeQYHfasz:FHaaoph/BZbuSH40oNQY1z
TLSH
T11B42FA22DA03BD76E52664F484FF4BBB9A33F5224D22887ECF60F8C44522360745AE65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 309aa5b8da87a67fb823c26994df45c3b6fbf725af48a9ab94b206376a1de0e9
MD5 aad883847edcebde965b4624d4520e81
SHA1 9d556abe2ed44d8e0d7f0fad23b2f4a3e2d7d899
SHA512 e6ae7a6b42248fc110b64f0d1f8542b2566e01d59ffbd3799d999830e13cb3f31685664019efe44a5ede7858e7ada321b1a30acc073bee040d9746679e326ca3
SSDEEP 768:SWB1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:SWXfgLdQAQfcfymN
TLSH
T163C2C06521C93E39F4AD787CDADBD67083398EAD649E14A231A27A3F217037D1039B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3119821332-640943685-2562343641-1000\_desktop.ini
Size 8B
SHA256 e56fb91641ab7469399888efdbf398d62f11726a428f5a55482efc687f18f046
MD5 ec9bd2e54b823cbbe6a4a4f168222618
SHA1 55860a23d0164ddff5a079a1a877c1656cb29673
SHA512 0913aa8cd4a6912737f9991890677a656e257b3062ee0fa15ed019fd394e7b8a9f951ca1f28e7500cbb4d42580a9191df7f82c127839a778e81565694d43e8ff
MD5 SHA1 SHA512

Submit Download

memory/1812-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1812-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1812-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1812-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1812-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1812-820-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1812-1225-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1812-5006-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1812-5509-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1952-19-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4700-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4700-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download