ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe
Size 228KB
Sample260711-jb4d7ady4m
SHA256 ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471
MD5 89d47cd4e61f3f833f979daea0938d86
SHA1 eaea7c54027270da82411736f5af47e967af1820
SHA512 cbbc22d40fc1cc0d2e6f80baa8bc95df2682469f353684346d34181e686c3c9946c2dcbd4c6a74892ca7d981bd0022d00564dc585c9d4206f6655ffd2d650183
SSDEEP 3072:UNftffjmNi3+BaOaaFoFims/PZYuIrEME0FgH6ERKf3/9K/Rw2Yi3/j9p:UdVfjmNJBaOBoKEEMKH6ERK0w2YiL
TLSH
T1D3349D1E77A920A9E162913D8191824AE7B2BC31171257EF12D0F63E5F336D8BE39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5724	Logo1_.exe
3296	ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\identity_proxy\win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\PdfPreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe
File created	C:\Windows\Logo1_.exe	ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4616	3296	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe
5724	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4820	3464	ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe	87
PID 3464 wrote to memory of 5724	3464	ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe	88
PID 5724 wrote to memory of 1168	5724	Logo1_.exe	90
PID 1168 wrote to memory of 904	1168	net.exe	92
PID 4820 wrote to memory of 3296	4820	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe
"C:\Users\Admin\AppData\Local\Temp\ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a528B.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Users\Admin\AppData\Local\Temp\ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe
    "C:\Users\Admin\AppData\Local\Temp\ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe"
    3⤵
    - Executes dropped EXE
    PID:3296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 232
      4⤵
      Program crash
      PID:4616
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3296 -ip 3296
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 72f3d1a36ba06b0e912ae8f70f3c047c6d5e8870d266f4872822ff8860f89ca2
MD5 2062ae0a454a5d8c42f21fdf6029a646
SHA1 da8a1b0722ec51cee9a7a80b210b2286c29aad29
SHA512 27d9c14306dac4ea2657da24cecdc75c61853edc4f8dfaaa691049d92a7c26fad58e2229ddb48a1ac00886218b30b030d02b60125d6b214ed24d2d331b375c11
SSDEEP 3072:GNftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:GdVfjmN2G7/fYfLvzB+QFyn
TLSH
T1B2C38D1375D08871E5B20C3449E1EA619E3FFD620B409EA737C466BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a528B.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a528B.bat
Size 722B
SHA256 6c8994ced13a75c212bd1b32ab8f67d8eeea156118fed446232fc5927c5b0981
MD5 c067b4c2d3dd8040808c9b520051485a
SHA1 4ea3ac648edc9de87936546c5cc05146ed9eb403
SHA512 eb21affb9ae01a83ffec2716b20958bc166a7c3102942d9ac25f24c2d426ba8869b358659c4e2630e5359ec3f02c58c8e4b166185734e38ee78cb2779f559f0c
TLSH
T1D701280882DF814B0D5058334554E59EC1274AAA2F49365FEF62E5CF12F962CF2F7302
MD5 SHA1 SHA512 TLSH

Submit Download

ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ac06eb9cb1fa846d167510d1457d9e49c01f7033ae1086b98397b11d676b2471.exe.exe
Size 202KB
SHA256 dbbfa810205df3e9cab9607a54218921b82742e7b7616bb19ff729d805bf861e
MD5 b8f7fc421a2f0631a566c6cc0eb9a71a
SHA1 f9b61f047ff2b6bc466fd909c7f9b8f2910a2de6
SHA512 c0fc48a62af8c782ec76cbf394a12b2cd09e1b29efee1062c6c8eb2b30bfc7c46238fb74e5d1e3f5d86b2e24f34eee456c7efb61f095347ab1056390c381327f
SSDEEP 3072:G3+BaOaaFoFims/PZYuIrEME0FgH6ERKf3/9K/Rw2Yi3/j9p:9BaOBoKEEMKH6ERK0w2YiL
TLSH
T166147C1E77A92099E162913D8191824AE7B2BC31171257EF16D0F27E5F33AD8BE39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 9ce4f790a3ad9cb93ba0b875d0888db7e560fbbbceb022a1624252a26dde4db2
MD5 e7093a12cfd837f03fc2aa86eaa886ba
SHA1 bfeb2bd83d5d07adb9e0df6d23177660982f884d
SHA512 8ff9f31ff0e19431aec46a5ba04387ea145f42d4480911f5ea07deb9e8e48b6ce631d919746fa7446568a3a5e56c23a92f1e632379580cd286e7bdcc04350f55
SSDEEP 768:Uf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:UNfgLdQAQfcfymN
TLSH
T173C2D07A26C83578D826497CEBD39741833D0E7A055F586726F1BE7F2170B64500FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2115213192-531537726-3295841909-1000\_desktop.ini
Size 9B
SHA256 c00295c49917f392f25a1f866f6e7b115409a25cd79b1da8c9b68a73a8b85521
MD5 3b1f1aa8df5c5daef0e687b36983905f
SHA1 1539340108f825b4ecd3db2bb67187e41eec69ac
SHA512 ceea10d5480fbd83b7d7ba04d53eef1572c33d7a8f515587c25f88a525a1d9788e234e4465bfbab41d7beef38c154b53a813bf5beb88d1f0d5f1804e76ed9598
MD5 SHA1 SHA512

Submit Download

memory/3296-21-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3296-22-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3464-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3464-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5724-24-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5724-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5724-42-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5724-372-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5724-1249-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5724-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5724-5046-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5724-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5724-5519-0x0000000000400000-0x0000000000434000-memory.dmp

Download