41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe
Size 764KB
Sample260511-kffpcsdv2y
SHA256 41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4
MD5 b91b90db4c6c97050f091ed32a43b468
SHA1 4a46b75ff661a015fc903cd3b49b3656a5e9ebdb
SHA512 95dae403bf40a65f9980b2918809cca8e0969e3b2664705107093132e2bdd2e0f3996a6225c0d51cf6328038ecb0e3b858ffe7d57b3378cedf4d78c0526d28ec
SSDEEP 12288:lmASQAGxU4Oco9rEgGV7mQNJp+qSGwbksRyso85WRMTk2qUgcZXx+qZl:IZQAGmqg9QNJp+JGyoYWMT7zgcZXx3l
TLSH
T115F49E23B5D2803AD1B31271ADBDBA1559FDBE310721C61B63D81E0D5EB25C0AA3B793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5244	Logo1_.exe
1308	41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\selection\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2021.2012.41.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\Fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\el-gr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\id-ID\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-140_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe
File created	C:\Windows\Logo1_.exe	41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe
5244	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 3896	3352	41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe	80
PID 3352 wrote to memory of 5244	3352	41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe	81
PID 5244 wrote to memory of 2512	5244	Logo1_.exe	83
PID 2512 wrote to memory of 4672	2512	net.exe	85
PID 3896 wrote to memory of 1308	3896	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe
"C:\Users\Admin\AppData\Local\Temp\41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE07.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Users\Admin\AppData\Local\Temp\41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe
    "C:\Users\Admin\AppData\Local\Temp\41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1308
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 56d3feceba1c210f079188eb86c670dbcaf2bbb48bc1e3b2420d3453e044ba1b
MD5 f83de6c0984a200f412216ae880120a9
SHA1 b74915789312c9bfc9a9f334b5d09740bbe05e3b
SHA512 a514cf57d48f997b29653fc35d496fdc1a49142ac19e08d6320edbee3c91584492df7902abf31cc082a778f7b9716e4d20e6e7686bef1896f33a89ec7c5811fd
SSDEEP 12288:lDXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:T0Le5ji0hmxNrM
TLSH
T1FFC40916F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 8a1893a74ec4ccdf52104250cd821b91958dccdfd56b76ea06d1822ab39f8e8f
MD5 23a05a0c17f72a64890ebc4e18b211da
SHA1 4f60b11f8b6fc6fd209048db17dabc1632a337e9
SHA512 a964227b86bb8084558e6b75410ef91293776a5d250905871d56eef4d039804674fdc2e690f9c6e16ea01b793b0d8956081bc0099a9a9b353a75cd20357354fc
SSDEEP 12288:wuhqIOkU8AMXE9B7PElZlP41N+4PUWfo:/BOkUhMXcBwc04nA
TLSH
T1F2B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aFE07.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFE07.bat
Size 722B
SHA256 db3dafacb05d1e95bbd20387c258af468c545a76ca3e08edfbb5af57c3aa018e
MD5 3f6121c58482f567ce699f8da3dea23f
SHA1 08bfc42f09ec1c9dfcfda6619959b48cab6ad3cb
SHA512 bf803cdd1a9f70ba94a9cfe6a07a8faadfd016a9332b48a1f59552f2505b237c4362e0b3a350b08c27ce482b09ed214958c415280400a7b4f57e810c8db0868e
TLSH
T16601A24865CBE76B8806940A1EF1A64EF4F66A28374B3711663B98AC20C3649F2C67C4
MD5 SHA1 SHA512 TLSH

Submit Download

41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\41041218c71743255c53b5e4680b96882d8153658d77a1ae8a02ab739fb911f4.exe.exe
Size 734KB
SHA256 8bab2c5de1dca54eb609a5093c1ad92b4396aa43fab87a5fef48f5df3283c26b
MD5 6d37412968a6e3242710255a8015f6e1
SHA1 ab5bb487d0879343cf8f4f409ed62a2c08ffe212
SHA512 3cfad0b80f2ff5049e3ec97d2ff9b66c24b4f464ab6d3c4450755c7c8cf617416e087608a52993aedbb1e3817b271df834a9b2da713d45fa68efbf8e130d815f
SSDEEP 12288:CASQAGxU4Oco9rEgGV7mQNJp+qSGwbksRyso85WRMTk2qUgcZXx+qZl:CZQAGmqg9QNJp+JGyoYWMT7zgcZXx3l
TLSH
T15BF49E23B5D2803AD1B31271ADBDBA1559FDBE310721C61B63D81E0D5EB25C0AA3B793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 965a0c80b473883edd0b8c7d7cbc74d6be80ad13d543be8042eda6173c9a2c56
MD5 a5f3bae2d4d284a2d056ec4d0aaac34b
SHA1 71be3c99c0d4a74336ee9b117764396bf0f89694
SHA512 236d2b5241a8e2ef692ad750d8c85df72dc5b61db2e647d898cd30e639991125b8eefda874c220af52c515d75a8fa69b3ad4f4a680b0ef8c3bbe6bff88cbeada
SSDEEP 384:NbbF00L831Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:paIQ16GVRu1yK9fMnJG2V9dHS8
TLSH
T1A7D2E16433DD6A63F2911FF058E34FA78926F420EC49C25F5E64A74FCCB05509AB2A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2122505878-652277452-2375749442-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/1308-19-0x0000000000E60000-0x0000000000EC4000-memory.dmp

Download

memory/3352-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3352-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5244-21-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5244-28-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5244-34-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5244-38-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5244-293-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5244-1225-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5244-5006-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5244-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5244-5509-0x0000000000400000-0x0000000000436000-memory.dmp

Download