f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
Size 1.3MB
Sample260814-etfcvsvbkc
SHA256 f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1
MD5 759ea5a943a0a4561ef55aa8ec34070d
SHA1 964db61e9ca47a68639da478b45ab8fcff2a22de
SHA512 c3cbf3d1574e375bf2205f711a9f206bc29fd3936e6eeff63debcd9183058f0d2bba6b033dbce396aefe308d9525b2dc045ecb1eb97246e2374e7dd1438e3413
SSDEEP 24576:C7bmurOuCMz0ydYJE/OGO4MF5gbJngG/xM:C7bmuK96OGONFTG/xM
TLSH
T1D6555B117792F132D36102309929DBBA6C7DBE341F6245CFE3983B3A59741C36A36E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5508	Logo1_.exe
4956	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\identity_proxy\win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
File created	C:\Windows\Logo1_.exe	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4172	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe
5508	Logo1_.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4956	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4172	4108	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe	89
PID 4108 wrote to memory of 5508	4108	f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe	90
PID 5508 wrote to memory of 824	5508	Logo1_.exe	91
PID 824 wrote to memory of 1960	824	net.exe	94
PID 4172 wrote to memory of 4956	4172	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
"C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65E4.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe
    "C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4956
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 0d8aad54e90d3b458f1754eccd7453934da612db40bf2eed462cdcd35ba62830
MD5 f18d333184c325fafdb0e60fbd60efc7
SHA1 107db12d5c39ee8077e1783b855f3ee99ebd8db7
SHA512 43f1357215af6bababbdfeb7e49a0f0195af7820efb98a96f36dc6bf8ddd350e89587e80f77c35c92d6fefc1cca163bf2c794e44aa5c44357b10c02f8de7cd3f
SSDEEP 3072:JftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:hVfjmN2G7/fYfLvzB+QFyn
TLSH
T132C38D1371D08471E9B50C3449E1EAA19E3FFD620B509EA733C466BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a65E4.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a65E4.bat
Size 722B
SHA256 3567a1f2ac98d4f1bcfd63ffad4f222c1b10c2c7f09acd1829d4db2a8bb5b648
MD5 3bece89a4a874ba78585d56e56a1a005
SHA1 542e03c609d752cdcd9d5cd9d029c66c2edf6bb4
SHA512 25c17d3305255cae1444b5386067937e18663f4474e8e662d9ea974679e1cbc898a6d4293ff79e3d229e3c20b28f79dd303929ff1e543a3cee20f6531e8b6c37
TLSH
T1CE01D829C1D95DEA3C2DB03745126F9EDAB67E9C268F3E018B95910C06D184D72C7729
MD5 SHA1 SHA512 TLSH

Submit Download

f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\f799ba325d1ddf06d64f9212f5741a89ed5f58ceb5076b13a49bcf51859bfda1.exe.exe
Size 1.2MB
SHA256 fda760d4edd51262418a9fdf05b2dec2666945b448fa00af8e5f2e6d3519dec0
MD5 4a98d67e10c69d8aa28bf6475878c2dd
SHA1 54c9c7009bfed30ebd5ab1fcea6ded1d4be7a6f5
SHA512 155d2adeaeabc80db2ba19744d57b1ba578bfe69ddb53d06ea685546a00c8918658b8d1a06bd1aeb0a390313e01b9f6b351c3828cadd42ea29904669669fe081
SSDEEP 12288:ZkCa5IQlBmdAL3u0M+xPhMoGiIzSaZlrl10XjSzMz0sFHwwYiGE/XDx6prG7q4if:cmurOuCMz0ydYJE/OGO4MF5gbJngG/xM
TLSH
T104555B117792F132D36102309929DBBA6C7DBE341F6245CFE3983B3A59741C36A36E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 ea49d9df3e33934abdac12276bf4d7c1bc462432656fe7cb7ac864cd1285f146
MD5 d90ad06929eacd771fc1f5d5a2e2d388
SHA1 c0993fa0b0e568c4667ffa48f6db5a5dd3745fe9
SHA512 c906d5eca31fd9afdc10a68d530977eae46c519f4c91286f0a6a9f909ef43f9fb829620630ce518e40aec8c852327ea0ce42fae804fab35fcf771de6748e731a
SSDEEP 768:O1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:IfgLdQAQfcfymN
TLSH
T1A3C2DF6B1AC95574FC1D097CDBE32B81C23A0F2900AF647625B17B7A2173629570EA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2115213192-531537726-3295841909-1000\_desktop.ini
Size 9B
SHA256 137a2336786405721f3ba28870250af8000e5ef527196716325fc80bf1dfe2f9
MD5 ab6b58b11690e61b5ded2286207b2fe7
SHA1 8da99152b11777b2ec8c085f54c58e50fd705985
SHA512 764f43afe7ab60044d8b3b3be97bbc4c1040c0b8c826876df3a9d1c3d5e884b4eeb66b66b821d21f1648751b4d6fcc32cde5045ad8ae595137ffaada37def5a1
MD5 SHA1 SHA512

Submit Download

memory/4108-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-146-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-5044-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-5517-0x0000000000400000-0x0000000000434000-memory.dmp

Download