662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
Size 73KB
Sample260509-e6qdlaax3y
SHA256 662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991
MD5 815a3dd62ea898f2d796f6969b73675b
SHA1 909b1a8c461519c023323b30f756eda1d44c7ba7
SHA512 945d275e64c9aaccaba892d44ea0db62b56d3730ff0354da31b7b32e51f0f1a526d14d07557d9de2992863de5c48044b255a3a4debf1a61ddb5cfcac640f7497
SSDEEP 1536:/fgLdQAQfcfymN3uuS2nnggOT/AH2pakpeOInUqUKSHaeK:/ftffjmN3uuLXUy2pJIOInUqU6F
TLSH
T196739E0A33D4C066F1220B34CDF5F76122BDBE619CA9961B76A8730E2EB1BC4E515327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
224	Logo1_.exe
3224	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Crashpad\attachments\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\edge_BITS_4504_2079550106\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\Views\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\attachments\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
File created	C:\Windows\Logo1_.exe	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5388	3224	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe
224	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 264	2900	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe	84
PID 2900 wrote to memory of 224	2900	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe	86
PID 224 wrote to memory of 4056	224	Logo1_.exe	87
PID 4056 wrote to memory of 5448	4056	net.exe	89
PID 264 wrote to memory of 3224	264	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
"C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6206.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
    "C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 680
      4⤵
      Program crash
      PID:5388
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3224 -ip 3224
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 e8f311c46e2bcc91041a475312e177e430e0bfa618476aab320c499ade2d516a
MD5 5902524d94ca3d6ec46dbc21218bd109
SHA1 0566ae45ad11d89a4b8619e839b6ccb2238612eb
SHA512 dbfae5e3876966aaf0a7a1da34168b3830a20ff6ee2f7cbe5e80dc96df1b3ce9cdf0a36f1c6e21e72bcfe392c39d63a0deeb05be1d907e172a5b90c8849b893d
SSDEEP 3072:mftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:eVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1B4C39D1376D08472E4B6593109A1EE718A3EFD620950DE6B33D41B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 aad0e5b6d155074e0c00984efc287586580894205a405aec0660104e011c5c8d
MD5 ae844596482d997932b4f7ddabbc4026
SHA1 479be39c67d59241d0f1907162689ddd057eaefa
SHA512 613c0e2524ee080b7dc85cc4e35085731b060f074b08275801906d9e79d847c13b2e6fe874d141bab1afb424dc45d37c278e1219a6f762b6799a9348ccaf8e86
SSDEEP 12288:V7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:V7o0Le5ji0hmxNrM
TLSH
T149C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a6206.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6206.bat
Size 722B
SHA256 b2bb49075d1a2b8f02ddfe03cbb1e287a6392410e29ea65a526a2350b73e4671
MD5 c014614fac26271f449d40f6fb6790a6
SHA1 ea6b31869127526a51da5dffd783b0ffd656d53a
SHA512 60cbff6de7978bbba6d6fd478a474164f159ce611c68b624119fb4dd63d496a8a8f52de12f38a21048ad06bf8912b3106676b66992b37a344e012da27fce4ecd
TLSH
T147019E93A48AE16F9E77D26B9E1145DBA0361C5ABE81373025A2E39A5180108E8F72D6
MD5 SHA1 SHA512 TLSH

Submit Download

662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe.exe
Size 47KB
SHA256 993d2b2fa72dadc7753c62b39d0d35ef1586f00f2eed60eb729057142ad76b4a
MD5 493b286f0c41fcc9a44cb2b6a94f6fef
SHA1 2e4a742f01acc2cee315e31a64b176d892ef0022
SHA512 9f74f38acdb47bc03642631252176f61464d9fbded6aa574af200ff5e436d7d56724548e27470413624842db11760464c376f19c76647388de7ead4c1c838167
SSDEEP 768:6euGX2eSP2UpKngb0l4vta6Tybq6LH21zaQVplk1OJRrInIfjqUKSL3baeK:DuuS2nnggOT/AH2pakpeOInUqUKSHaeK
TLSH
T1BE236E0A7795C066F2620B308DB8F66136BDBE619DA4970F769C730E1EB1BC4E520367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 fb0131eab8d4465a6b25b029683e5b656e2dc64fada85c9b82f8a755dd2549e2
MD5 007c15ee810811c5a6aa7b2b97c031ef
SHA1 b56db442604ba4e202dae87b85954570f4410ee5
SHA512 5811cd20d11801116331db2dd80677f3c523dbd32139a8510a8bb02512ae61590781ee7444c928f1e0c713bba51a28b6dff61d4e23584275877c4387cbd7e566
SSDEEP 768:kf61ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:/fgLdQAQfcfymN
TLSH
T160C2E07A12C81574D826597DDFD36702833D0F7A049F59AA39F1B97F22707A9100EB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-636600838-1632888396-3521553955-1000\_desktop.ini
Size 8B
SHA256 6e9be20748ee78b11d664f31b9547ee836b5e73f3d4ef05289327d7f1ba0eb14
MD5 40ceb2ed83210f4185f76feb1846e3d0
SHA1 e8b81c1d0babb9887ef3703b2804d6d1a2f31d63
SHA512 62538e5d4e898b44b402a6c1f2a32edd5945428b2891b38363935cf3d358a7638f88313b7be5209c29be487b899cca3ba7d53923a193cf06b722fec679357ef1
MD5 SHA1 SHA512

Submit Download

memory/224-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/224-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/224-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/224-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/224-41-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/224-45-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/224-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/224-1288-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2900-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2900-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download