a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe
Size 575KB
Sample260809-mbbkysyzev
SHA256 a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e
MD5 f0d04681fc35eb966c9c5a6900bb4948
SHA1 0881cfe039d1ff42c8c0164591700e8e1041d2be
SHA512 24d5192413ce5da884b32fb6d6edb01a24897404cc34fe0a6212a453d334bd93727fb6b219f82eda0cce26211759e4333878c51a296ebf13258138b315afd6bf
SSDEEP 12288:Pp7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:R7o0Le5ji0hmxNrM
TLSH
T1D2C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4424	Logo1_.exe
5620	a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Shaders\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Mutable\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\Bundle\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\reports\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\edge_BITS_4124_181321177\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pl-PL\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_139.0.3405.125_neutral__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe
File created	C:\Windows\Logo1_.exe	a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe
4424	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4980	2584	a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe	86
PID 2584 wrote to memory of 4424	2584	a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe	87
PID 4424 wrote to memory of 4496	4424	Logo1_.exe	89
PID 4496 wrote to memory of 2164	4496	net.exe	91
PID 4980 wrote to memory of 5620	4980	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe
"C:\Users\Admin\AppData\Local\Temp\a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6107.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe
    "C:\Users\Admin\AppData\Local\Temp\a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe"
    3⤵
    - Executes dropped EXE
    PID:5620
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 2cb7721de790281cc6502397afc837b80e4c78913da645c31f246827795bbf62
MD5 602ce2cde9418a976f6042c4cfc94042
SHA1 9b17544b4df63b869be0cdef0ac91569c1f99ab3
SHA512 7a3aeb04d89618521c31a268b155a456060cd576f2b392526b8f893ff44e3bcc1b2d9a8f87722d562b3ae402aafa3dc6ad57aee51db2e3b1a9b42252b5fd0c19
SSDEEP 3072:3DftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:3TVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1D8C39D13B5D084B1E4B2593109E1ED718A3EFD624950DE7B33D41A3E0F31AD1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e
MD5 f0d04681fc35eb966c9c5a6900bb4948
SHA1 0881cfe039d1ff42c8c0164591700e8e1041d2be
SHA512 24d5192413ce5da884b32fb6d6edb01a24897404cc34fe0a6212a453d334bd93727fb6b219f82eda0cce26211759e4333878c51a296ebf13258138b315afd6bf
SSDEEP 12288:Pp7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:R7o0Le5ji0hmxNrM
TLSH
T1D2C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a6107.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6107.bat
Size 722B
SHA256 4c9eed5b4cacdc615a31f6321d4c55826776efd1976243f55a7e61e9a5f2442a
MD5 1e1a575df0f00de670ff0b5c84ba82ae
SHA1 00e82bd579ffe7ade0c6e2a925e7caf2a1efb35e
SHA512 374c981c765b0fa875ab74843e8364ccf5c2a93c02ebdee37e77e4ff61da344ec2af7bf3629eb1ccc573a792b91d7a925ff2d1c0c4634997fede174a1de999b8
TLSH
T1C6018481DD835DAA0D9038AB0991C3CE91E21EAE3AF5266F2D75C72632A744DB592343
MD5 SHA1 SHA512 TLSH

Submit Download

a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\a1748e948584e65a3c60a11059747834846b8464f97fbddf4bd4ed6e739ca04e.exe.exe
Size 549KB
SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
MD5 0b24892597dcb0257cdb78b5ed165218
SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 acca897ac28f597801df59bd1343785f7bea8c1013821c44d2f1878ee5ef1488
MD5 aaffa63d279b442bf6447d8e27477be7
SHA1 ce128e98423d5e0dd1b35c0e8e8eb854d5599a0f
SHA512 b8521588339c507b10c473aaa8aca314598962588da0014b00f413f9874a425534eb20260ed39484728bd4466fb3d7f516b6cfccc56d51e026f5365030b81c26
SSDEEP 768:PJT1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:PDfgLdQAQfcfymN
TLSH
T199C2D036D6D80978D8E5887CCBD71601423CDB6BC09F79B926E15C3F1A22EB9900E61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3053180483-1881419501-3594244048-1000\_desktop.ini
Size 8B
SHA256 9665de4083439d021866163b21bda2a5f96fd16cd7572fbd2966e90951743829
MD5 fbd4d05c754ca8e6e9927860714ab856
SHA1 70f0865f40fc4cede69e788e26ed14ba0a05a242
SHA512 cab7618c5a9e453f59e89acf2cdfde870b9c226cbfdeaa200be64076935cf258481018f241f15ab258d2dc85534ce3edfc3f3a27a7f035cd4c3a16fb03a88b57
MD5 SHA1 SHA512

Submit Download

memory/2584-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2584-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-237-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-1292-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-5079-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-5594-0x0000000000400000-0x0000000000434000-memory.dmp

Download