20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe
Size 568KB
Sample260808-l5bmdadm5s
SHA256 20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6
MD5 71d1b427336cfcec38cfff3de6c7898c
SHA1 7e62f1b42d8e8b3fb13a5dc15a313d79da067419
SHA512 a8dca4febda6fe0f5eb74e20c2b06bd66d649e1afd1782f626341283de6fa0d2e7d2ce4ac1f821a83137aa89fd60975dc57638fc9d1aa2dc5d019af098cb4d9c
SSDEEP 12288:67+6vP+BNSebhEFoUbElY7dx0Gyz1batvexl:67khiFoUbEwdngxl
TLSH
T150C4F825F5748332D073C0B9C5D2A69AEE7230865B308ACB1286D77C2F67AE6D536731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4964	Logo1_.exe
4488	20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe
File created	C:\Windows\Logo1_.exe	20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3152	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe
4964	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3152	3452	20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe	89
PID 3452 wrote to memory of 4964	3452	20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe	90
PID 4964 wrote to memory of 4960	4964	Logo1_.exe	91
PID 4960 wrote to memory of 3760	4960	net.exe	93
PID 3152 wrote to memory of 4488	3152	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe
"C:\Users\Admin\AppData\Local\Temp\20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62F6.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Users\Admin\AppData\Local\Temp\20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe
    "C:\Users\Admin\AppData\Local\Temp\20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe"
    3⤵
    - Executes dropped EXE
    PID:4488
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 6b57e749892ea7bfb20093cedb3c6d3e91ade040cdd5590ec3a31ca7e9168db7
MD5 deba25f7357961dbb464435218b30ee6
SHA1 7f7e90b448eb6f43083881c106a7dbace441776c
SHA512 4ded5b47cf3b621278a3e5645647ef7cae808dc60d782988b9739309ff792ad2868d50faa303d5befdc807f31600cd3cfa9499478296c1160d2b7eba6c236d92
SSDEEP 3072:gftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:gVfjmN2G7/fYfLvzB+QFyn
TLSH
T174C38C2371D08461E9B20C3449E4EA719E3FFD620B409EA737D4667E0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a62F6.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a62F6.bat
Size 722B
SHA256 0ae51c99de80036b43ffc2c48091b11fada27b46477e0f514a68f9d80c8748ec
MD5 9869fe7b577ed4e35acf1781d0008a60
SHA1 165a16c755e527a8c436633b9df51109bf6efbc1
SHA512 a257d02d65c11d5dbf00f28d371cb8bfe8a45f45d1b82faa32a47a4a4f7dfd08552c62a529ad69b3fe43717b083b53ddc2613b9c80e14b51861a504ffb1540d5
TLSH
T1F5014C18E18FB3960847D7876AF516CCF3D6B8792A9536939270EA0C108384DA7C7612
MD5 SHA1 SHA512 TLSH

Submit Download

20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\20d38c3917affebe6ea6e7871aa92e87ff36a8e94cd810a6b557a0169b7ba6f6.exe.exe
Size 542KB
SHA256 688f252fa4e4b97ba20a0f1d511be7755b472f8460f9806bb437a5a5cf90ebf8
MD5 1f3f974210652985fb23a3e7f619610b
SHA1 e56cea5002a3513de8a83c8a28422350c8b70e90
SHA512 8a020abc40b8d361be778d10e6d61125d514ada3e4cf850bc6479f61aabb12ff58e06213500ce3d24b2f9570a676a8fa73894fadf19295bba7a64c26394d0b7d
SSDEEP 12288:mvP+BNSebhEFoUbElY7dx0Gyz1batvexl:VhiFoUbEwdngxl
TLSH
T1F3C4E825F5748331D073C0BAC5D2A69AEE7230865B308ACB1286D77C2F67AE6D536731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 083fbbad90a55757446613120528e69237f9c01c5a2d1f02ce0a454bb5cea02d
MD5 c992672193a24d9ed499ba24b1e48912
SHA1 5cd964d61314ebdaba14c1d282643b7e33311646
SHA512 378daf63a9bf1586b4143634bef90de290e13eb19d31f741947081789867cb259cf6acd6a325f98a77b3be5d8c5e490b7456823dc27962f764c51a24e0dd0b4c
SSDEEP 768:4R1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:QfgLdQAQfcfymN
TLSH
T101C2CE7531C8053ADC12497CCAEE6631D3291F79039E24D59BF1B83AA9F0EA8100EB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\_desktop.ini
Size 8B
SHA256 1d606682c3c73b22d9ee6de30be63c56537bbb5179c9016a02f36487fa915852
MD5 ef2a73bd88d8ae9f0bc87903b5672439
SHA1 a35895c65154dc024ecb558b84baf0b1e1f7b198
SHA512 dbd3a473bfec5c2bae236e2dade98bf2c64e97272d390518a26f99bf30944a42a746b7852c68f75fce59ee1356398c0603a04681cd212c288c9487120a130da7
MD5 SHA1 SHA512

Submit Download

memory/3452-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3452-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-41-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download