51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe
Size 205KB
Sample260527-v2aeksgt31
SHA256 51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a
MD5 a0a9a9b7c73bf77e3f01201cf32eaffb
SHA1 624786f714b1e000fca97d224322b29eb021e873
SHA512 e91745722faea219ec12ca2ddfbbbeb24ee4550ddedcfcafabf390f69021be31643da3a601f6bdd978d1d87232e154150fa0ff75e5b533ef47375d1821ecc435
SSDEEP 3072:PNftffhJCuUVZkBCO1UCgXyC9rzfBgA4hcbKcfgCvIypoBJJfHYTom:PdVfhgu6OCO1U9t9vfLJvW5gT
TLSH
T12C248E403A4C7CC9E1E2DB38ECA24F60722FBD74C634495B7116726CDE76AC18EB5962
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
440	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\applet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\dom\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Shaders\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-commonjs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\Dropdown\utilities\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe
File created	C:\Windows\Logo1_.exe	51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe
440	Logo1_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3256	2040	51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe	80
PID 2040 wrote to memory of 440	2040	51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe	81
PID 440 wrote to memory of 4604	440	Logo1_.exe	82
PID 4604 wrote to memory of 2076	4604	net.exe	85

C:\Users\Admin\AppData\Local\Temp\51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe
"C:\Users\Admin\AppData\Local\Temp\51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23DF.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3256
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 5ff6ca2900c45375a5be6a85f1988c934bc348ea7151ba47bb104bf1a9493b4b
MD5 df5e3ae25a145e6d84106bd1e487c91a
SHA1 c96d4e9ff3202957710cb642c5b51091ffc6f6f0
SHA512 2e0a129b735faabdea532ac513e32ec287d862fd87287dabaed4be7173ddbb04d6e7619791e6ef300a52dee01993ef175c57ac9b46010ed9723be8aa2028302a
SSDEEP 3072:xNftffhJCuUgYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:xdVfhgu3YCk3ET+Tu3fCUzB+JHI
TLSH
T1C8C39D1376D0C472E472193109A5EAB18A3EFD621D10DE6B33C52A7E0F316D1DE26A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 ffde78e04af09c44835ca582a72ccb1aa5297669684f10e8026dcdc518c47c52
MD5 b9569c0e2a6081dfa980b1c839165960
SHA1 8508bf4eb35203e606aed7bf5acab2c310567e65
SHA512 75aa3de831614052cf98f799e0168596f3a595ba2e9ac2f2b19c4b5280a628acb4e78344d474c1bab002f5a4cae58dd32ece4d87d5ead675c666ab11ccfba8df
SSDEEP 12288:TJgu6XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:TJ80Le5ji0hmxNrM
TLSH
T1A0C41916F6748335D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 61975168e81cca10a851d5ab360009e25b3ce0cf11d5d357fa709a418db85354
MD5 e4a3af2bcbb38195944f3167e6909804
SHA1 063ec129648c36b23d2952e6676485859c974bcf
SHA512 f21e6f17e3cb82a70fb2613e2baa76695bc15113eb809178f98017578b1f6578d9da2547558790a640b811b5919d10792b81f34bc5cb7694a4e2b16f1d72d630
SSDEEP 12288:2pJguCqIOkU8AMXE9B7PElZlP41N+4PUWfo:+JUBOkUhMXcBwc04nA
TLSH
T19FA46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a23DF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a23DF.bat
Size 722B
SHA256 6e74e55335f29d2e96e938775e5b904068b92f3106fa88a635575c67027154dd
MD5 41fd15af1f34b99400aab5772846d237
SHA1 f7ed042b7efc50d0953a5fbb5d344dffc822d17f
SHA512 96e7468d7ea38464f98280995fcae48cd27337541377fcc4479f332f3415bf595e69ce6b5e2e4b60068a16f4daa8e8c02e8b8f6558c3986029b4c298b90556c1
TLSH
T10F01DD9671FB62CD0C44A86B1DF1E56CD5E178C87AEC2736033E50483155E26F2CF185
MD5 SHA1 SHA512 TLSH

Submit Download

51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\51ba391ec16cb80b4a38945ab10e53963f754e4e61378f686df3263fc682223a.exe.exe
Size 178KB
SHA256 ebc4c06b7d95e74e315419ee7e88e1d0f71e9e9477538c00a93a9ff8c66a6cfc
MD5 f4935e39cd1008b6677ecaff658b51d4
SHA1 c88f99bb82cbbf96992c36b61f6c614a15abc9d6
SHA512 b69050b1ee3a201d52a88742d7f441e5ea1cf5213729cccc634577807a1579c13f24d5ff28567d7dfa09633b21ffc51af7b44c0dbd82c0f5dd477aad72246906
SSDEEP 3072:HZkBCO1UCgXyC9rzfBgA4hcbKcfgCvIypoBJJfHYTom:HOCO1U9t9vfLJvW5gT
TLSH
T1F5047E403A4C7CC9E1E2DB38EC624F60722FBDB4C634495A7117726CDE76AC18EB5962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 e56d093676d33c61f069e338a20e52151e92e9b4133f07e9924342667034126d
MD5 a377c65eade7f19ab9dfa4a74a9e87de
SHA1 af82f1e48659bf20786fc83200f025403794e11e
SHA512 fcbb661a23840f66a66c5785d46e025948a9c20491795755070f2c1cb276a9ab5d57463d1242c57a2cd86e9cbfcb987a0dc2d1433b5f81321f1d2389092ee4b8
SSDEEP 768:Pf1ODKAaDMG8H92RwZNQSw+IlJIJJREIOAEeF1:PNfgLdQAQfhJIJ0IO61
TLSH
T1EFC2E19A3BC0B058C82913F8D3D767E3833C9C35681F555B24D2B9BF51793E6284217A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2409539145-3342400454-2096821238-1000\_desktop.ini
Size 9B
SHA256 90660789145a1e303418de25f012f2cba7ff1d4dc5994f0c5212b2ab04edd7fd
MD5 25028b7169d40ab30de68048e493cd12
SHA1 f5045e7771e266ce03273df7b06fc6100dfc36ba
SHA512 91c6bce3388caa8f881195ea7d2328f21be026f3f46a6a90770de94f802aaa20d8186551d293a77e211d28c042a9def309202a2c7dbe15a6fa2fda178589d0f2
MD5 SHA1 SHA512

Submit Download

memory/440-25-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/440-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/440-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/440-18-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/440-448-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/440-1222-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/440-5003-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/440-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/440-5506-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2040-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2040-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download