588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe
Size 575KB
Sample260804-pr95ka1aph
SHA256 588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8
MD5 670805897b718f186db47c7420980b9e
SHA1 4dfdcc3a12c443c2a53095bba75df6249a7e2cce
SHA512 f812e09c42d460c7f66e39321829deb12fbde30393819af7a250b1a083ee0be6d326e8d6411b6d9ee6fe58d8c3fd66cf786edd1decef68adaeb63801231b4130
SSDEEP 12288:Q7+CXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:Q7f0Le5ji0hmxNrM
TLSH
T12DC40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1692	Logo1_.exe
4248	588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe
File created	C:\Windows\Logo1_.exe	588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3400	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 3400	5668	588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe	89
PID 5668 wrote to memory of 1692	5668	588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe	90
PID 1692 wrote to memory of 5092	1692	Logo1_.exe	92
PID 5092 wrote to memory of 4808	5092	net.exe	94
PID 3400 wrote to memory of 4248	3400	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe
"C:\Users\Admin\AppData\Local\Temp\588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44C.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Users\Admin\AppData\Local\Temp\588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe
    "C:\Users\Admin\AppData\Local\Temp\588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe"
    3⤵
    - Executes dropped EXE
    PID:4248
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 caabac1cd0d22876f6a5ca08dc2efee3b7d001a6849ec8104f679eaafec81c73
MD5 c2ad05cd31b87863b8c44397ae398ab5
SHA1 5ca8b6291d84a3a2a25f40f78a087f273f783cdb
SHA512 736378295263a0f256fea3967175e303068e80cd085a805ecd5a2e4c35c222fed3836e8a7659e5a1651187f408ab0d94c66b87b17ea6556dcd5b63d38f1d0511
SSDEEP 3072:gftffjmNHhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:gVfjmNBG7/fYfLvzB+QFyn
TLSH
T1B0C38D1771D08861E9B20C3049E1EE619E3FFD620B449EA737C466BD0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 2345a6a6afd153a76f7e96e2a0096cd05f1eafa7329b6388bcfb2b6c740cb7d1
MD5 07017dc06e6c42a1d38809068381ada0
SHA1 8e2524fd660a875e3d5f42248ba86b0f37ef2385
SHA512 1a3ec939a18fb395b74f585cc40c18653ce417d0c1b9b0856085a421240b1e845a8423dc33a38c4e2007cb83e067b772e911acb653fc435dccc25dd563bcc1bf
SSDEEP 12288:cp7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:g7/BOkUhMXcBwc04nA
TLSH
T115A47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a44C.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a44C.bat
Size 721B
SHA256 14efce066281a7782b3338f5cfd08ebc8abf03bfa6a7dbddd983f97d49511763
MD5 61c6f1b6c2d36da111e95f7a02ea8c86
SHA1 2e4a429db3c6bbdb6e83166bc56cfea96ce2d5d4
SHA512 9830ba334b2f974a6024a24e91c29d8cdb9f60a2daf105cadd956419a1356b7635389a460b679f48dcd1ad73632e7e7603c929b30b230e937bcbe15845e52e67
TLSH
T18901400953A66EF98D0510121BBF504DD0B89EA5BE8B33A59B14790D21C3B2DF3CB520
MD5 SHA1 SHA512 TLSH

Submit Download

588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\588dd94c918a8858c7ffcdbe08e44b3593be8a57166d58ec00e0ba47da7347b8.exe.exe
Size 549KB
SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
MD5 0b24892597dcb0257cdb78b5ed165218
SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 85d8dfb36339a0302c137fa2a66f2fcbd7d5b7d10c4ae7cf8e352aa239c97c66
MD5 62560a62bf3c89e4c631bc860feab66c
SHA1 fd26cec2bcb05365c768da015397cbf235f9a215
SHA512 9ea9b501b6894136f2851125a5fa086b5625dd2f03d3536b288f360a3f337c54b46b0d76a36a95df780289aa61db7f3a55eab9e5fed5161b0d4a5e8eefcfccf2
SSDEEP 768:ruX1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:WfgLdQAQfcfymN
TLSH
T1E3C2D0A812CD3A6CEC565DBCCBD6D612023D0E79408E54B539A7E57E2121779200EFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\_desktop.ini
Size 8B
SHA256 5faf71987eb0e4eedba10fbde77dc0c4d900740a123d4afbd05c219220d6fe31
MD5 7acd53b75847779af460d8a79f0c22db
SHA1 abaf1bfa56e7a8d57966c4b87dfbe40ccaa70606
SHA512 b52c9dbaac1fa9d6feb7eb186b129891eda171425af372b801f97082c14bf4ea25da52ffefd905e680719d10a3045e68e166674f9f06e573982e9038e8349534
MD5 SHA1 SHA512

Submit Download

memory/1692-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-77-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-1249-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-5046-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1692-5519-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5668-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5668-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download