c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
Size 59KB
Sample260511-lmw6cset4t
SHA256 c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709
MD5 d0381e6e73c46b7c8ddadac0c3acc2bc
SHA1 873a4ec74d9c15c29582f26252817a6a1598a913
SHA512 58bacdcaf7c9def10c75586b2f70ed1b0cc9ddfba866bc159c4513f65d23b3ed42b7a871760342071061e4c6b40456b835ddba18838a0402a2ea3a68e21a6189
SSDEEP 1536:TRfgLdQAQfcfymNF/d6LClOD34Y4YkqGWHaeB:TRftffjmNbLOD34YtkqGX2
TLSH
T10753CF0277DCC119E8671E35E4E7DB02A33EEB6009D5921A36A4EF2EDD737831826617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4432	Logo1_.exe
4576	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Views\Utilities\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\Views\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Views\Utilities\Styling\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
File created	C:\Windows\Logo1_.exe	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe
4432	Logo1_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4412	4184	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe	84
PID 4184 wrote to memory of 4432	4184	c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe	85
PID 4432 wrote to memory of 4444	4432	Logo1_.exe	86
PID 4444 wrote to memory of 4396	4444	net.exe	89

C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
"C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1846.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe
    "C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe"
    3⤵
    - Executes dropped EXE
    PID:4576
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 d0acb4c6e9ff684e1ff50abbeb6e12b0f232208d22ad81a44919096cf81cb9b0
MD5 fffda165a4212e7b33297a203ec14234
SHA1 4553a414a5d8a10adaf7ee6d820f8cbd80fc23fe
SHA512 35beb4220d2146e9ea1723f36fffdb1020930ed3d1cd08ea111a4bdb3fb998dd2263441958e84258c6c46d36f805eb8f247b355e9be6bc45df4f2a2da40d4654
SSDEEP 3072:lRftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:lZVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T168C39D1376D08472E4B2593149A1EE718A3EFD620950DE7B33D51B3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 4101809b9f6572bc76370d8ab7f77d3091537fb56da0e107e4cf686e85ce0681
MD5 2b63571432407b1d90a4e25f6c9a0a2e
SHA1 6de2a205f1a73340f0febbd4dc0e5d8ae9c5742f
SHA512 c6d0bc334c71f85ec105601fa30ddd91a44cc860cad864aca49a3a3ef2896d9cf1dea899004ef0801d6bceb65dd6ce1b34c98979b805c3bc928163230661b286
SSDEEP 12288:77+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:77o0Le5ji0hmxNrM
TLSH
T156C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1846.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1846.bat
Size 722B
SHA256 82d76123c57d2a4cbc108b202c782d0701ff899ff03838cb9c2629c21d3ee744
MD5 d5492abf959260daea7877b8896c1789
SHA1 6d00968643b1e55590917b5207770742ad1a94c3
SHA512 b8835b04009ee6e5594d430d8d3a929acdb17d4458959b097101d0647eee3e58283ac6c630bbfea9342d256a7619bdf5d40fc46ee2817f2fbbc352adb1d8e301
TLSH
T13701D4C8D2C1C5DF1C5158660A7998AFC2EB1CEE3B465F210E6198C516C14CEACBF785
MD5 SHA1 SHA512 TLSH

Submit Download

c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\c85f5f91471990ee95e535dee7fda0a3d8ed8376a47112bbd6699f143930b709.exe.exe
Size 33KB
SHA256 9068036302cc58f8fc317121e24681b594cf6751ff4e7cc4e07dadc16eb15bf7
MD5 dd93aff7bda90548a75714ddea8c3fec
SHA1 61a9895aa488b3972d694551fc6807d72e6ff5a7
SHA512 40ce6fd41463ec63887fe88835bb99b2f5057cf909cb41ab3dab1845863c4fadad51906d69350d1b52d34fd66e8b8d46269d71200fcba17fa5a37359ad51b2ca
SSDEEP 768:J/Zyr7F86LClO1J30gqotvngnYkquRWL3baeB:J/d6LClOD34Y4YkqGWHaeB
TLSH
T171E27D02F7ACC149E4671E31A4ABDA16A77EFB500DD0931A36A8EB5D9C733C35932217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 5ee2407ac18d7f22878542018b09d887af1e07d190f5e7788cffbf518f2f2438
MD5 1584504065271c39954059dc727b1788
SHA1 e7ac7f54e22b0fcb9e8eae9fec5fdef31c75b2dd
SHA512 e9490d228c01ebcc3a56ae95546824a7f074404d45fa65a511f102b6b92b695bc0d6fce42d7064c09712335ea8c9a83f72c8f0d1defbf0aafbedee5205b8548f
SSDEEP 768:Tb1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:TRfgLdQAQfcfymN
TLSH
T11CC2E1BA23C8DA78E815097CDBD75701C33D073A049F59AA2AF24D7FE260A25100EA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1609746302-1884177235-1125644204-1000\_desktop.ini
Size 9B
SHA256 19944e3d79dbaa55528729df082eccbb0b32b6eb8f9e657c445f9a044a342a86
MD5 6fafb008947daa1d3538f70fcc12a422
SHA1 5a7f63b8786d78eb3f2981fc8591f7a6799eef45
SHA512 201cabbb00c3951fb230ff60da29f6475bdc4b8c06946e8d27ace821e512b11a2538555b7e54623cfe11a857a61d0b9d39ba74119a549fea58ca54b2648152b0
MD5 SHA1 SHA512

Submit Download

memory/4184-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4184-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-489-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-1288-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-5077-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-5592-0x0000000000400000-0x0000000000434000-memory.dmp

Download