10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe
Size 464KB
Sample260710-mbdejsat8s
SHA256 10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a
MD5 fd2e0c46003c023f7c5bd19f9b9555ca
SHA1 7a734e1bd678ccb6ccfc6bb18a0fa27cb72f1bc0
SHA512 cb46d039d79e22ff1252654dd024fef709338614beecde54d6bbc198c80fcacd0e741a6c2c7137fdad9c0c32e2068e1ff50c971e1c4701f96e279294d945075e
SSDEEP 6144:nCuJlkaiw/3Ye70B3v3UKSDdBgXkt+cXicmyEKzVRbdWKghJKraIlKgP62/y/M:GaSBf3U7WhcXiNKnbdWLKWQy2EM
TLSH
T189A46C16B6B3803BC8721A7B5CD79AF1946A7E112D24184627E01EEC1FF77C138762A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5444	Logo1_.exe
4152	10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\PdfPreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MpDefenderCoreService.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\edge_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe
File created	C:\Windows\Logo1_.exe	10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe
5444	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 5180	2668	10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe	88
PID 2668 wrote to memory of 5444	2668	10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe	89
PID 5444 wrote to memory of 5032	5444	Logo1_.exe	91
PID 5032 wrote to memory of 4204	5032	net.exe	93
PID 5180 wrote to memory of 4152	5180	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe
"C:\Users\Admin\AppData\Local\Temp\10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a623B.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Users\Admin\AppData\Local\Temp\10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe
    "C:\Users\Admin\AppData\Local\Temp\10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4152
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 127KB
SHA256 4a077c236b42f2462872ee9ae7c6956e1426d62ba79f3ca598bc3fee0c69d953
MD5 f1bf6dfb77bea5ef08b361c65d263251
SHA1 94ba0837e31d343204e22168f0bc6fc1a7312ada
SHA512 d5406c22638b052fa1a54b927ebe36b65c2fad0cae5e49fc88b64b5e8db8ad696007650ab9dd9f185a1fac2b89c1f738db46de5f71dea569d4505514c0a7a599
SSDEEP 3072:phFkuJVL3hUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:HCuJTG7/fYfLvzB+QFyn
TLSH
T138D37D1371D088A1E5B10D3048A1EEB19D3FFD624F509EAB378467BD0F316D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 7c14b30092e8e4566d7e6d4bbca011dcbbe58eae3a181427162d853ad9017722
MD5 4981b880da0987ffdc81f909b03f83cc
SHA1 26c39f20e2e8d185a9af12a4e332a4d3c95a0f7f
SHA512 2edda6268a30f808808aab351d13e2b7f6ade6c09af6b8167c7496ce28bf43310d5cb1193ce3a9900d5a69d848e3c956ffc143267136c29e67e88920b863d4a9
SSDEEP 6144:w9uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wvqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1FDB46D31E6A44037D6F106B3F915D6307E7DA2187B1184AB9394AE2D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a623B.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a623B.bat
Size 722B
SHA256 dae64f06d3cdabd8fd83f65a371b1e12e65aefb288e650407c91b930cdf5490c
MD5 82fcb25ddb0b4362307d2e5d1a980140
SHA1 693b363230154b598713ba523c14fbd26e3d4731
SHA512 651859cdabb9ebdceed8c91fac9d23fa4c404fea68302ffdd3925d1452a58fdabdac3885082552c441a382982366ad3abfe30a771db05bc30b95bf860bbb6dde
TLSH
T10201F705D34A97AF4B5963130691FDBCD0A7484837F9F716E511A0850580AC8FEC7702
MD5 SHA1 SHA512 TLSH

Submit Download

10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\10b6af56908e28bbab4298ecc0e62b872fb8feb36de0bd229d6a848c19803e1a.exe.exe
Size 435KB
SHA256 91ab870e0fa3ba8d11fbbeecbe9f1ddcea0206f60f34e7c4a337946f5da5ed00
MD5 2db9286a799c833a165dd5241eb1ad31
SHA1 a9f414efce2152018aadc9197d6f6c0955f48396
SHA512 08422f243a64952b1dbb925c2d6f13a1754ba6d99c79605e9fc1fb6be39ee2d566ba8ae26e7fc3a8651a23b8f83e29e2e4f948247da994a3d4ab6efd3b20d387
SSDEEP 6144:akaiw/3Ye70B3v3UKSDdBgXkt+cXicmyEKzVRbdWKghJKraIlKgP62/y/M:NaSBf3U7WhcXiNKnbdWLKWQy2EM
TLSH
T113945B16B6B3803BC872167B5CD79AF1A46A7E112D24184627E01EEC1FF77C138762A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 86e01bf027125e5370957e8e62ac5d051f377a0253a6ba4a8136de461f0c2ac0
MD5 9906b437bb33a9e8cb8e7f264db89da0
SHA1 efd59a1f4c987844f7c265964db3352ff5f854dd
SHA512 d451a4730f44475742bf163aff7355825cb9210e9deb9e2c9ec758ca52427abd8fe4c642c79aa9ea6f11dec0adac17ef262263c89013112032a8070a89f8ffb9
SSDEEP 384:Nbbpbwi1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pFX16GVRu1yK9fMnJG2V9dHS8
TLSH
T158D2C06173EC6997E1711FF458D3CFB94829BD24DC69822F6E787B4E5CB05009961B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\_desktop.ini
Size 9B
SHA256 690d816ba2ffec761cc3d6b8c2f93f6a489833e63dc85f82ec6e2223db5262ac
MD5 1e7071931f7a23a7d3bf8dfc6cedaa1a
SHA1 19bcf5b1415c13ecab19c359a5b83f6b023f3aae
SHA512 6b1eb5ffb51ff29212903b2060fb763adadd669066c3142a10230c78ffa2846f4937ed1ce759af9dafa68c1fea57dd6aeba642b53e1007c10a61def466c6e748
MD5 SHA1 SHA512

Submit Download

memory/2668-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2668-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4152-27-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/4152-26-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4152-22-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/4152-21-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/5444-24-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5444-34-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5444-42-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5444-48-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5444-491-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5444-1258-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5444-5057-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5444-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5444-5532-0x0000000000400000-0x0000000000436000-memory.dmp

Download