3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe
Size 271KB
Sample260822-wpvenaaq3z
SHA256 3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97
MD5 372ef2c83aa2a9225b70466061959d23
SHA1 532561c0c47d50b1ae3b64992f10a3cfe3b2e214
SHA512 5e57b3c002e8bacc664089ba33cde9e2131ba1ac615fc3e9d4a1ba52aca0f3e5024c29be5544341f442accc87a643a26be3135f5b9abd3866bce706474f3b492
SSDEEP 3072:5ftffjmNfHk0Tg3gy8pPKI9mE9OvDadwHifxJkqo2ggHKpK3C1j40Z3pmiivobJQ:RVfjmNvk4xPceiHizBo+qpm440ZZ7
TLSH
T14B444B70B6858936C9332B388D4EE5D6D0A578301E386417B6F90F4CEAF35C2672979B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1332	Logo1_.exe
3312	3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe
File created	C:\Windows\Logo1_.exe	3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe
1332	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4984	4700	3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe	89
PID 4700 wrote to memory of 1332	4700	3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe	90
PID 1332 wrote to memory of 3464	1332	Logo1_.exe	91
PID 3464 wrote to memory of 3708	3464	net.exe	93
PID 4984 wrote to memory of 3312	4984	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe
"C:\Users\Admin\AppData\Local\Temp\3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFAA.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe
    "C:\Users\Admin\AppData\Local\Temp\3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe"
    3⤵
    - Executes dropped EXE
    PID:3312
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 edf79a2053643698b986b74316dd8b860a9879457b20d31e816471d34dc8230a
MD5 3a77b28944577b94bf2c06c06cff251b
SHA1 ea0f9f9da9cbb84531f658362145958930ba61fa
SHA512 01f9b66b84b9c84f25ee3d800f4f0880ddc6bec5a4ecf329094f51930e5a652133a151427c69f6d6099a07de75e0fa1cabca6b96c5a2a50df0a838a3b6eef9dc
SSDEEP 3072:LftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:LVfjmN2G7/fYfLvzB+QFyn
TLSH
T179C37C1375D08871E5B20C3449E1EA719A3FF9620B409EA7378466BE0F317D1DE26E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aEFAA.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aEFAA.bat
Size 722B
SHA256 98817e3db62c3db25072cfe5bab7d57bf1059569b257d87db467b7b424a4e825
MD5 1a3bcdbcc0be76aefc5806b4b602650a
SHA1 7d9370f14283d376971b0087995c9532bf806e5b
SHA512 ce48aff2802518395293d97bc0d71505b16755aed80e464219e70b34de41f501f90f6094c70e17784bb6432c0bdeca4cef7359cfef567df901aa6b966cf8a979
TLSH
T19001A250A26AAA7B8CF600E34E5DC4DED4760C3C7BDA2779CF7F9424248355ADACE201
MD5 SHA1 SHA512 TLSH

Submit Download

3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\3cd40ab4180aa6eeac0cf4627a5c65e7b2e9a1c7537ef96fdf691c18e48acb97.exe.exe
Size 245KB
SHA256 cc55952113722b1a9808600e61f59b90bd2bf71c1df770007b06d14dbba8ac41
MD5 df9aebe82215d6f976ea90185cb7e4a7
SHA1 c491c86551b0c6763a121bbb9699c299fc438634
SHA512 1e5e85135a2754114310fd65900f0f45b69a32db88674e1276d41b3f5afdec0c7f1c13d6ff8f1ab1a25915f3c9f7c5845b1809300541a92993b019694f995201
SSDEEP 3072:jHk0Tg3gy8pPKI9mE9OvDadwHifxJkqo2ggHKpK3C1j40Z3pmiivobJJls:rk4xPceiHizBo+qpm440ZZ7
TLSH
T15D342970F6858936C9332B388D4EE5D6D0A578301E386417B6F90F4CEAF25C2672979B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 00ca6261a23e857356d83b4c60cbefabb5d4d5b784748d86dbba0c02cfa15b55
MD5 486e2f1b58375c38c85e5cc8ac794e52
SHA1 69271c63102f5baa8903a55c60a6f1516855411c
SHA512 86bfa7e0a9c13847241bb9a11392b4ed37f49477072cc98fbfa8be3692503d5cf9cab1d6a8beb9a584c2cb0b0b17275b71c1359eab70266d467b21c9c51cf555
SSDEEP 768:C01ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:5fgLdQAQfcfymN
TLSH
T19BC2E17A36C81634DA2A0E7CDFD3272183FD4777105F582B26E245BA2291A28D04FD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2115213192-531537726-3295841909-1000\_desktop.ini
Size 9B
SHA256 d4d8f9f80b18a46f97a66d9f2276d6028cc30bdd0122ba5302395833bc4f3fd8
MD5 99ca47efae47d2362f276c374dddbf13
SHA1 728da071b74901391e1f7e8f2bd686388c3694e4
SHA512 6a6fe7d79b1ae030725f639ed96671f8b688b3857048a87a3be5c7aab8d374c868f9e459e7323b457649773726867b430c5e7ce0fa752befb772e4ebdd2410d5
MD5 SHA1 SHA512

Submit Download

memory/1332-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-107-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4700-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4700-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download