Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 09:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe
- Size 214KB
- Sample260810-lf94msen3v
- SHA256 f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b
- MD5 e569f3b29375c1b74cb058189b6277cb
- SHA1 b6596b245f103d4086ef36fa4bb21972a9e4a49a
- SHA512 3b7a0ea494c05632524cb985b7b1212850aa7b71715f0e490878682ae58f8f13a1fb975b761f589f9f8c93bfdf029627deef7ad150466f11dbae1e4964e7939f
- SSDEEP 6144:jVfhgujkLL2H8o8MMr/UljXCK6libptUy7xPI3HAL17/:5JguAX2co8MM7UljXelibpTI3HAL17/
- TLSH T1FF24BF512368C129C6AF0F71502676092F34E4A798A6DA5E3E9D2E9D9CD330307377EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4324 Logo1_.exe 2080 f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\8.0.15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ie\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_proxy\win11\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\identity_proxy\win11\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4688 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe 4324 Logo1_.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1264 wrote to memory of 4688 1264 f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe 88 PID 1264 wrote to memory of 4324 1264 f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe 91 PID 4324 wrote to memory of 3844 4324 Logo1_.exe 92 PID 3844 wrote to memory of 5672 3844 net.exe 94 PID 4688 wrote to memory of 2080 4688 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe"C:\Users\Admin\AppData\Local\Temp\f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a895A.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe"C:\Users\Admin\AppData\Local\Temp\f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2080
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5672
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
- Size 124KB
- SHA256 bebecde61c080ddf504d81c3d74bc2c8811fcc46ffe51a1c44a26e6a3319f893
- MD5 d6e1dff72e0718b98741916812edfc8b
- SHA1 06d9ec3731f8b5d98dc2cdf908f98a98c52abcb5
- SHA512 5bccd7778cd84e639517ff7c95371c4b89f1f1e289ef19546541bce3dcc59a6bf88a6c56beb0ac32e3a7adefd57425ae1430fd43a026bf61bc7d3a43675efc2e
- SSDEEP 3072:ZftffhJCuEmULhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:xVfhgujsG7/fYfLvzB+QFyn
- TLSH T126C39D1771D0C461E5B20D3049E0EA619E3FF9620B549EA733C467BE0F317D1DE26A6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 481KB
- SHA256 827a0e8827f3c1db2715fc7b2c5c5a92ac3deedd294f7b40622093cb92c328eb
- MD5 81aede730abb1e63bf33b30beac52b7b
- SHA1 4d333794a9892481914a804d837d4cbacf943416
- SHA512 0abf236adebfd10ad158acb6203f584e3384a89eedad16ef7cad224ad6d90fc525366affd43e6c006653b2f9eb903faa093112b465c78e3558896afb88588017
- SSDEEP 12288:/pJgurqIOkU8AMXE9B7PElZlP41N+4PUWfo:hJlBOkUhMXcBwc04nA
- TLSH T189A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a895A.bat
- Size 722B
- SHA256 ea97845f106f36f1da75054d3e7da12285354e98230ea27f8c15beec28e320c6
- MD5 c38a01dafc2a7758ff995abec0bbca21
- SHA1 ab6e4d0a41bce4246779a70a57248ec512907462
- SHA512 5688323ee1237cb338168b8ea05a27e83f60bf4cb2db739abfb014725921227474d7f29c5b9edd9b30de2f902a6a3c52442066a4c9be9e4f90ddaa18907c299e
- TLSH T13D01A701D587DE8BCAE3E0B65B25D84ED1723C8D363B9334A35044D46CE94BCB2D7A25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\f1d4a33aae21bf1c0dc7485319623ae647fbab7b6d8ae8fee151b367c197202b.exe.exe
- Size 188KB
- SHA256 73948ab19b118f20333fb0725d5faf97abbc33c54d7429c15ae94752045b324f
- MD5 e40732272c67ace2554d32ebc83cec93
- SHA1 6fa935f1cbcf232cdf9f6e3fee2bf91da19fc01c
- SHA512 d61f7c4339196c049b0611edb48ef79c65c92cca3dbbb7750e5f70ac33545a2054eba2dddeb000c01345da9021cb7f6f4995cc0154cbb65df6c655c592eacddd
- SSDEEP 3072:MtLhR2H8Dc8MMr6Mv52ljYMCK6lib6H4VbtSoDw/qJ7x/uMFI3H0PL17/ZI:OLL2H8o8MMr/UljXCK6libptUy7xPI3y
- TLSH T11414AE0123688129C6EF0F715426B6092F34E5A79892CA5E7E9D2EDD9CD230347377EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 26KB
- SHA256 2d64253fc304112c6b3a371cbaa6597133de21314b33240defb725ddbf2ab8d3
- MD5 989024fb9ab11a6733033257a295a28c
- SHA1 2a3e7472015a7fb21ea8cd4643eb88726d9f4d20
- SHA512 9cb164217808ce97e90acb6d88b4a3b2fb9093a0da6662d133742f5aa3a0f84a880322336a5c404a4c90cf45736d0504bfd1408d63e59ba5b26805f7ebb0fd3a
- SSDEEP 768:+C021ODKAaDMG8H92RwZNQSw+IlJIJJREIOABT6UYOn:+CPfgLdQAQfhJIJ0IOEmUYc
- TLSH T1A9C2DFBEB6C4E40DC41917BCC3DA32437E6845AC287D760B159B9B7A906B3D02A4F46F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\_desktop.ini
- Size 9B
- SHA256 a6a30469b07b10cfc3228a527f800194638f4d6c88b814a540b333c9371056f8
- MD5 809f47ced3507b857f0be4647cd218fe
- SHA1 fbdf780581ab4fd33bf33b14c662c16ca9d056c5
- SHA512 2705955b3b04d3e8bff5203d6797609799bd979a883244e0f5528b588b34efa751c9703151715153c72a073f037fb47da4ace7dc7bf30f8f418e4d375f8d8fd7
- MD5 SHA1 SHA512