4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
Size 209KB
Sample260808-l3ldssvbmg
SHA256 4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb
MD5 6f5ba5521f7a6b051781d868eb75ceb6
SHA1 2b140d8ffd7882292241e741f21fa8e7e080af3e
SHA512 484fda02c50693a762719170f7b779257a8fa06b8a739e48149df43bb64495bf274f95544802f500c181cbbd98fafe9ceee0079e30cfa55d736f94e7de98d1a7
SSDEEP 3072:kftffjmNbphwUmVBpsnrflbMfEBDsfcrlYTMP3+TOs9AHJD8mBR1jDOo5t5:8VfjmNb8Um5WVMMBDsfGgk3SUJ5Oo5t
TLSH
T148242813375806A9C0A6D1789BD18603F3B378145B39ABEF5B9586390F32EC1BC7BA15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4772	Logo1_.exe
3896	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\edge_game_assist\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
File created	C:\Windows\Logo1_.exe	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4172	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe
4772	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4172	4652	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe	89
PID 4652 wrote to memory of 4772	4652	4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe	90
PID 4772 wrote to memory of 5652	4772	Logo1_.exe	91
PID 5652 wrote to memory of 3252	5652	net.exe	94
PID 4172 wrote to memory of 3896	4172	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
"C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6874.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe
    "C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe"
    3⤵
    - Executes dropped EXE
    PID:3896
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 f30ac0d5c49bc21275cd9448dbbfcacb2b3bc4f3b91e5595a62ca94a3a4cf897
MD5 56d312807dfaa58054bad570f17195fe
SHA1 a6f59b123c385a3439000f0eb82d28a455fcecb8
SHA512 f43775eac8452c865ee43dd0f166bfb20e1c6fc6d88500543b412c414f2223d3933b405c888e4d6b60d56955acb91f6ba8b53e709d33b6caf43d61fad8ed88eb
SSDEEP 3072:YftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:oVfjmN2G7/fYfLvzB+QFyn
TLSH
T1B3C38C2371D08471E9B20C3449E1EE619E3FFD620B449EA7378456BD0F317D2DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a6874.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6874.bat
Size 722B
SHA256 ec5dd9ba306031e7a132ee265d3177c46f12c6a6bd6690b6334b18963e6f528e
MD5 57bb0ec92ff54e5b8f3447e30d55d3ea
SHA1 386de60c507380eb28a1844bd14707b85960d46f
SHA512 a4b02003b23769ada4c3f44a338b3486133134a3d62bdced1aa745d6a17040611cf12173e0689e5b37f7cf54bb012e0756c297fb619f12223c56ddddccdaf833
TLSH
T1C0018890E3CBDE2E0D4C108F0691638F80326D6D3793736589579C5E18C2E1EA1A7BE5
MD5 SHA1 SHA512 TLSH

Submit Download

4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\4fdd9ef756920d7875b8fb8c525aea4c79b29b210f6b01198154dfb4f2ed74bb.exe.exe
Size 183KB
SHA256 9497e1ae746293e30401540bb31d8adacaaf88eb90c457f2a814c58811a1fd6c
MD5 eb94dbc9a7520e5cd3f27bcbd5815a5c
SHA1 d3bc16fbbf564a5343509d8c1cdc636f20a5b21c
SHA512 47a7a57b9285d6da57c341ff5b516a0fcdf20884ee7f3a46118bdbbe269e46003d2eadaf0f0be071659231dffcacfdb57c9ff629ec70d9660cb5e714a4076575
SSDEEP 3072:3phwUmVBpsnrflbMfEBDsfcrlYTMP3+TOs9AHJD8mBR1jDOo5t5:38Um5WVMMBDsfGgk3SUJ5Oo5t
TLSH
T133041813771806A9D0A6D1789BD18603F3B378045B39ABEF5B5586390F32EC1BCBBA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 4526b1ae72b6cbc292f36ff5eb6aa63700738db86ae19535ed99c0825ea09235
MD5 52e378b020d530fc5f9ac70168b047ef
SHA1 e45111855d0893fa140e506e751388c5db131a9d
SHA512 a928ec31b5b94fa0c77e821888f037bf535ef9c41a8b4792ba98f3a0b3006b978582e9977cb788098cdc09fb180fa49c6654aef1f1c7710197381a3cd988127d
SSDEEP 768:Cx1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:CnfgLdQAQfcfymN
TLSH
T1E4C2C07926C4233CEC155A7DEFD24B05C63A4F65418F28A9267BCB7E1211B2B140EF9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4046655672-1449839301-2197395821-1000\_desktop.ini
Size 8B
SHA256 1d606682c3c73b22d9ee6de30be63c56537bbb5179c9016a02f36487fa915852
MD5 ef2a73bd88d8ae9f0bc87903b5672439
SHA1 a35895c65154dc024ecb558b84baf0b1e1f7b198
SHA512 dbd3a473bfec5c2bae236e2dade98bf2c64e97272d390518a26f99bf30944a42a746b7852c68f75fce59ee1356398c0603a04681cd212c288c9487120a130da7
MD5 SHA1 SHA512

Submit Download

memory/4652-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4652-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-41-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download