cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
Size 985KB
Sample260511-hsfh1sct71
SHA256 cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a
MD5 52ad7a6cbe0a9074b6cd3f7c46ad12ba
SHA1 2eeeb8e4aaeef27e846e8a06ecf08405b6fa2000
SHA512 35f755983c7c02114976696224c6d561a4ad9d02db34a6a864659bcd9ffdd79e20e093b5c727d6ff245ffa32bef6150968cfa4b58ea23181a09ab51134fd368a
SSDEEP 24576:i7agHc6sXnyLD0l5N3NfiqvD6B59xkMBkS1F:i7JcpnyLD0l5N9ffD6hxkOkS1F
TLSH
T1B725291275B45A3EE8B244BA497E156E011EBD20079D58D361CC3EFE38F16E27A32D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5792	Logo1_.exe
1548	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\edge_BITS_4700_550251024\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MsEdgeCrashpad\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
File created	C:\Windows\Logo1_.exe	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe
5792	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 1604	5136	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe	84
PID 5136 wrote to memory of 5792	5136	cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe	85
PID 5792 wrote to memory of 1496	5792	Logo1_.exe	86
PID 1496 wrote to memory of 4208	1496	net.exe	89
PID 1604 wrote to memory of 1548	1604	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
"C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E6C.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe
    "C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe"
    3⤵
    - Executes dropped EXE
    PID:1548
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 9576d7997444b9be3134da0b3ce3a59479a79c6606a7b749cd0a1fbca1b50c37
MD5 7853203122211793ed9d70fad674be9f
SHA1 a5e590e6ed1a41515c525fcc1f8d130560c5e3da
SHA512 d606e764c6a7c30236970a96cfa8660a6bdead1cf522f0cb3cacb6589be37aafb26646e57498b5a75511266c1e9ac67ec1114a91b805da8adc46a6819aa4b474
SSDEEP 3072:nftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:fVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T164C39D1375D084B2E4B2593109A1ED718A3EFD620A50DE7B33D41A3E0F316C1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 0b80ca3490d14e4752cc62f4bc513959c07289771701b9ef436afae55cb6033c
MD5 89b4678f21783ff9e02e549a9ba3c5b7
SHA1 ad0ff07278d29eb5c9d00eb01b7cff3b04081dcc
SHA512 012c94bf78fbe382196b5ec7aab88d01bb3e4f9b55f8a6e19050df25ee5c012d0fd96976423817d887a16766203ce2ab54fda0e849424dc6b0c1024183269a70
SSDEEP 12288:i7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:i7o0Le5ji0hmxNrM
TLSH
T123C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a5E6C.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5E6C.bat
Size 722B
SHA256 6731784602abc75b2ff370cc1f0aa99cee3df5f03ac399842db85e919eea0521
MD5 0c826b69c324787869fa49ca3149ebd7
SHA1 d0f48461a481b8d27771f19f3c44e8d9da2a6834
SHA512 8199c6d0ca7aa199722e538975896679de478d3b388a1bec718a2dc1c9244a08e41cc0de3a8416d7b633ca99a85bfa1d0f75ce42e8d989407c2782bee2d44d7d
TLSH
T13601220583072A0E4358C49BA5E6280ECCC66BE83FCD1215E200C48E369561EF7CA94E
MD5 SHA1 SHA512 TLSH

Submit Download

cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\cc8b0f37ec7f7914a8cbc171376a6930e1a4f35ba6c28b36d117c8abf62c7a2a.exe.exe
Size 959KB
SHA256 ce5d02b0bb76a6dddf169259cac1c0aa47cca8c25c1a03f2c4a0e93eb0d9d310
MD5 23134da85d6fae6fd654f242410ad91b
SHA1 7533d80293d6a984d6c5d0c01068f3288c38f8a9
SHA512 df6220e73c482d57c9322c672c267305c01ed620e57bd23f185c8060f6bae569a07080dee59550b1c2232941570ff5ec622f6893144119b755b0072ba64f2ef9
SSDEEP 24576:1gHc6sXnyLD0l5N3NfiqvD6B59xkMBkS1F:WcpnyLD0l5N9ffD6hxkOkS1F
TLSH
T15225291275B45A3AE8B244BB497E156E011EBD20079D58D361CC3EFE38F16E27A32D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 26KB
SHA256 704a2615076da95e4f8265c0f08c879ef0a7beb17f56ce8e4b32fa3f18fcd593
MD5 91b5b539bb26285dfacb2cead185af04
SHA1 2dfc77bbb5c12aeffbc397dbe54098bb562f0f42
SHA512 54e922c1fe8d0f8458150578a13bc501061947c713df97c3508b795d2f1c02d83df59f4660f5e36e56d49e38369e0339e07e5aebc5a62d6a434ca7f5ef29c5a0
SSDEEP 768:y31ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:ylfgLdQAQfcfymN
TLSH
T13EC2E1BA26CC5679E8664D7DDBE36701C33D077A405FA86A25B29D3E225066C100EE23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-636600838-1632888396-3521553955-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/5136-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5136-10-0x00000000008D0000-0x00000000009F0000-memory.dmp

Download

memory/5136-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5792-22-0x0000000000800000-0x0000000000920000-memory.dmp

Download

memory/5792-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5792-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5792-43-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5792-49-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5792-55-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5792-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5792-1307-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5792-1310-0x0000000000800000-0x0000000000920000-memory.dmp

Download

memory/5792-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download