24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe
Size 144KB
Sample260831-daa4cswwct
SHA256 24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13
MD5 93fbcd6796cc9594255ecc3a87f749c1
SHA1 7e5643ed1c1bcaf89139f30766a42de92b2fa494
SHA512 0d6df318fa7bc29ea250c54c9977645c47c8c5703488f32a8aa2ce432daf60f4e951cf8792b80bb7bceab535a7711a78e97616222d05361a1852ffd6dd3fd265
SSDEEP 3072:x87ftffjmNhSiTdht6TfqDlVa6zI5k+FheqZM:cVfjmNFEfq06+FRm
TLSH
T1D3E38D82B7C404B0FA725F716CB84A548BBEBE211D51ED67A384354F0678BD1CA38E76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4644	Logo1_.exe
4428	24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{78329DD2-943A-47BA-B763-81DEA89FE76C}\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe
File created	C:\Windows\Logo1_.exe	24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe
4644	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4596	2880	24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe	89
PID 2880 wrote to memory of 4644	2880	24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe	90
PID 4644 wrote to memory of 5660	4644	Logo1_.exe	91
PID 5660 wrote to memory of 5836	5660	net.exe	93
PID 4596 wrote to memory of 4428	4596	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe
"C:\Users\Admin\AppData\Local\Temp\24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1FC.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe
    "C:\Users\Admin\AppData\Local\Temp\24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe"
    3⤵
    - Executes dropped EXE
    PID:4428
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 36006e9a0a0dec6735e823e8086b8fe3df16ec1d241ff0265bae18155667f189
MD5 4390b37e26b65dc7f375d6fc1d7620cf
SHA1 fa03025be3a35be6dedab09e71c6c1f94efe9756
SHA512 2bc723e18a2ae78ee9ba69e7d030cdc5f599fec5b7b981867ef33f431be2322875c6e18ad406b892769b7256dc09af9522509dd5ec77ea22e482d48ca585c941
SSDEEP 3072:j87ftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:WVfjmN2G7/fYfLvzB+QFyn
TLSH
T1B4C38D1371D08871E5B20C3449E1EA619E3FF9620B449EA737C466BE0F317D1DE26E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aF1FC.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aF1FC.bat
Size 722B
SHA256 e2b2b49d9f178a98be4f1cbc33fa70159c2ca296d0c220a6ea831c510f08b308
MD5 9f4a0a1365989dfe020e464c9e2803e1
SHA1 f6647ea9bfce6a6f72b73de479fe16eb8fd804cd
SHA512 bd707e4207c98e82b214c9ff507c4e2a1ee4c4e2a26830a29daa9c8a4ad87a6b4a2fe3abe0c0c46fbdcf9666e6a099c4e99ca896e9b13306f5e6844328a3abc8
TLSH
T1D701F003B14DD62B0CECB60FE8720CCFC96118EDAAAB2B3A4651C9D5934241ED9F2670
MD5 SHA1 SHA512 TLSH

Submit Download

24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\24eb72a7ffcb4cfd6dfd071241575b06ee1d310c698699b8345eff62cb822a13.exe.exe
Size 118KB
SHA256 964fb65cf8e60fec052af783158e30c9fa1b5dc1aeaf61d73b567c21d929c931
MD5 472581ecd74c7d3f229221db4ec51810
SHA1 b2f13914eec6375b0077c3ce8ef0e6324cdd35d0
SHA512 13c6d56cd02f2c5ef467505ef25f03126c5297bf884f7f63a979dce5f98a5fcc14c9f2234a354fcca7e0830914d5397bed6eef9ec720189ad4cba486b334e3ce
SSDEEP 1536:ZmESGNTdkNGMnt3fJj8DpvVoW5MzR8ya/wcu2Dh+s8nBsx+s8nBs3s8nBsXs8nB2:9SiTdht6TfqDlVa6zI5k+FheqZM
TLSH
T127C35C81B7D404B0FA725F712C788A548BBEFE212D51ED67A384314F4678AD1CA38E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 8df1abbea5fd0a34cb00b1a29cb4da20940c32844155f21b9a17df46c39d2870
MD5 a0c99c4d8cc7d3fdc6ac8cbe195c94eb
SHA1 b614701705d88552134afb18b37689cc7dfe7c4f
SHA512 1be4f5011bd54ce7429ce3a408f080684217ecef6b30d7e4a38df292aa0cc0978da5898328a1f11d4225cafb33e1a551a1f153004db5dd40da457afc651facac
SSDEEP 768:i38zn9Tid1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:xZi7fgLdQAQfcfymN
TLSH
T164C2E17916C81678E826497CDFE35701C33D077E109F6CB62AF2897F22A0B69100FA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 9B
SHA256 48fc246849bbf8829b4f8949e19ffb9de4020b7e65df5ab0bdedfdbbdb956880
MD5 3e7714d68104ffa0b685f025be924834
SHA1 d91683bde0bea0d8cab7f8d6c29ee9bcf478c625
SHA512 2dad49b79fae347aac4e1bb7b8bd50dd7c3ad4c9fd2179f3a4fac7c6db24d46cd8d41b38a48f47a3e412cc29682522e22c6afb463c7bb6d14136a918e27f1f2d
MD5 SHA1 SHA512

Submit Download

memory/2880-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2880-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-153-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download