3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3

Analysis

max time kernel
149s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe
Size 1.1MB
Sample260708-kdaqbsds8y
SHA256 3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3
MD5 b6243123cc6c7c4318307159ba10d058
SHA1 f821803d26e2d00aea5a25c763ee56efa33f84bb
SHA512 88aa24d494c2740c00ce4ba332f3a06939815b2112b4896365cd4688acdd181c7d16f23898a80c22c4a6bd3f99a4b623910dfe1e00413565256a4da491db0748
SSDEEP 24576:v7ilwX4FNExPn03X+8ZKzTz0pIW2+lMdEo3rL4uHxMND22d7Wbl:v7ilzNsnj8ZiTo+W2+ll4JHSND2e7Kl
TLSH
T12D458E47B3B901ECD45B8278CA16570BE7B274051324ABDB56E0865A6F33EF21E7A334
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4896	Logo1_.exe
5848	3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\edge_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe
File created	C:\Windows\Logo1_.exe	3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe
4896	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 3592	4156	3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe	88
PID 4156 wrote to memory of 4896	4156	3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe	89
PID 4896 wrote to memory of 3336	4896	Logo1_.exe	91
PID 3336 wrote to memory of 4656	3336	net.exe	93
PID 3592 wrote to memory of 5848	3592	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe
"C:\Users\Admin\AppData\Local\Temp\3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5589.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Users\Admin\AppData\Local\Temp\3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe
    "C:\Users\Admin\AppData\Local\Temp\3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe"
    3⤵
    - Executes dropped EXE
    PID:5848
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 74bda96f780e148c17afdf6bc0510a8c5b1b280d6249924635db3bf07b935b2c
MD5 afc2f556b3d3b0f4baba375f4dd3fa53
SHA1 67b370fc1f26926ea78e5f56ddb55a3ccfb513ca
SHA512 3ebba7dd932ecf6d236eae2b99b4b34df697a37d4d7423252fdb3b0379d6c5745f47ba5ca9ea23be15f3cfdcf88c86911969c33ee40f1e2522c9f55225775b38
SSDEEP 3072:vdiftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:IVfjmN2G7/fYfLvzB+QFyn
TLSH
T191C38D1375D08871E5B20C3449E1EA619E3FF9720B409EA737C466BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a5589.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5589.bat
Size 722B
SHA256 6b610179edb0aeb454dfdac9f4133be22354f380b5fd09da9f5ab2fb65f880f5
MD5 3564167e22a5906e108812e6957ffe02
SHA1 552a5384a43a40b632894f17e3df3156fc582abc
SHA512 4ccf6704f1bdf34507d5d68864c0e7e57f22395c53d4c58a9165ca0bfb7d86791fa38fdaa01e23660bed949587f3727aca7757ff6f53d4cef0ea03aa00e0f80f
TLSH
T1680147A2C483A1EE26285166176C899CE0E40DDCF949123A47AC843731F752D7EF52C7
MD5 SHA1 SHA512 TLSH

Submit Download

3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\3de45f723b9383730a504f53f460133a0a34f4d6b93040eaca16c6684d47afc3.exe.exe
Size 1.1MB
SHA256 6c4dd5d980101c0457e03b685e8215de18a5bbe05bf5052552b1a293ff3a47ff
MD5 4d7866a297fc09fe970bad80268b9d5c
SHA1 d3d0efeaeaf93ac43e4de0e99d093361036956a8
SHA512 9d307c14697782ef22d73668ff17872f66f8868fbef21b84336a9b0fd7f7f8932cd1c3681b19a19b00a0d7b6530656b5ce5010c6e05c8ea85959234f02ca0070
SSDEEP 24576:HlwX4FNExPn03X+8ZKzTz0pIW2+lMdEo3rL4uHxMND22d7Wbl:HlzNsnj8ZiTo+W2+ll4JHSND2e7Kl
TLSH
T14C457E47B3B901ECD45B8278CA16570BE7B274051324ABDB56E0865A6F33EF21E7A334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 5463789cb09289e91f3f3f37784c05b1d6ca8d66292dda9a834c499aa337dfc6
MD5 e6fab69e73e9f825cdf8443db0271126
SHA1 e2a9fbcefee704d429e55a600e7b76a4680ad26f
SHA512 526de67f250ead5abacc116f4784eb5653af671895083069708dd0a610b1dcb5084e974fc3a6529f1e0b2b563567384c4fef4fe1c084ff67a0446b585dea517b
SSDEEP 768:49lLw1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:adifgLdQAQfcfymN
TLSH
T1E5C2E1752BCC1639E85609BCDFE36705C33C477A409F99AD2DF2997E22A062C100EB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-515251955-468707340-1782030364-1000\_desktop.ini
Size 8B
SHA256 f2d2cf0c992b9fe521af1cba2f911d62494882e796a4cda4da2dba61b4d669d5
MD5 7ab5029d7f5c322ad04162b760b22eb3
SHA1 d98fd41f697f31766fe7bb680b6626b274b5622e
SHA512 af61fa934dfc9442ccf4e9560e13597e7d9ac056c0d9cff10df8a5d769eab97e87c659c434616b4afdd2e059a4042c65fbf8dde35ab5e4cfa6fd0a9ed27d52cf
MD5 SHA1 SHA512

Submit Download

memory/4156-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4156-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4896-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4896-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4896-41-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4896-79-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4896-1248-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4896-24-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4896-5045-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4896-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4896-5518-0x0000000000400000-0x0000000000434000-memory.dmp

Download