d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe
Size 583KB
Sample260908-a8mchaxtes
SHA256 d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92
MD5 57f7ba0e886e2c95b1f58caa2507ce27
SHA1 444349e23835d35fc132731e63611cf11cbd66bb
SHA512 5fa6792a52b3c6d3f019c20621b1e2ba4c2f5c99c39130d864ba2e3a4e98df3ca093b06ca78b664eba3d1b23e4892d659cfb1f8c44738d4b9a9c828f628d5839
SSDEEP 6144:yVfjmNPAuW8Iio4wo+aLurwUJ+nHxeBi8eDVeBi8eDSeC+DeeAeBi8eDrpqQ:M7+tIigo+qw9
TLSH
T19FD41A6036F80C13F2F716767AB0A9440C76BB7A423CE14C68ED568E6967BC04567BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5408	Logo1_.exe
1420	d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\edge_game_assist\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5004	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe
5408	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 5004	1628	d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe	89
PID 1628 wrote to memory of 5408	1628	d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe	90
PID 5408 wrote to memory of 4080	5408	Logo1_.exe	91
PID 4080 wrote to memory of 4212	4080	net.exe	94
PID 5004 wrote to memory of 1420	5004	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe
"C:\Users\Admin\AppData\Local\Temp\d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1505.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe
    "C:\Users\Admin\AppData\Local\Temp\d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe"
    3⤵
    - Executes dropped EXE
    PID:1420
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 812d8c63a4f223ddbc6768e92321acf8616855dac6b145efef4b029861cb3b84
MD5 36cfaed10030ac90ae4b6db8a12c9dc2
SHA1 bcb1989029bf79ccfd41b0d478e1a3f12036da7b
SHA512 3b25e4819b96e41616493da3b6ebcbbf8352f04e157ef04739d39a0e3ec8c1f5255489e09d138e57ab24b9e79bc235704cc42fae82e19df730bf7a9831ca6804
SSDEEP 3072:WftffjmNHhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:OVfjmNBG7/fYfLvzB+QFyn
TLSH
T1C6C38D1371D08861E5B20C3449E1EA619D3FF9620B449EA733C46ABE1F317D1DE36B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 4e0e8265303111056f270a4544c0af9ba033c1f9f8637f2096eda55339a78664
MD5 838baec1eaf01d221bcf59207a83533d
SHA1 4e5be38574d8f3678ac125de048149a473426daf
SHA512 e757dab2f531b2d8d17008d70b52caae045bfa72587d7cb79f4f62a9726eec8f0e498853b478d2c86ac24be8cac7b3bf4810d5211636523aaeee1fb2815406a7
SSDEEP 12288:3p7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:Z7/BOkUhMXcBwc04nA
TLSH
T114A47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1505.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1505.bat
Size 722B
SHA256 e44d71705fa80b95badcaf559b9542e98da210978d97f103a34a0257eded89db
MD5 1481e332b0dc44681e572a20a7c6e1aa
SHA1 a105c8b4a35814dc9cdfecfe8f8aae19084018d4
SHA512 0f365abd7b6409710162ea3744453072cd65a7f92517419148e1b84dc1ba363b100a5ab4e75d8f79e457bda007f30a191bcfce3f1adc02b2b1885077a54a90c6
TLSH
T1500192028B8F5F96360021FB09A552DEC2F21B687EC07A958528A989A181C497DCFFA5
MD5 SHA1 SHA512 TLSH

Submit Download

d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\d4c784d23392e77674c87ae9d99cd35af56189e7d218be73035b334e5d625e92.exe.exe
Size 557KB
SHA256 956314ce4abf95cb91ff32bca737a615dc38bcb1fb349a96e4e4fa5fd64252ca
MD5 c766853e9158449855b5d9cc0925904b
SHA1 9cd986cbca432e46d2a34ea54ce69a7066fcb342
SHA512 06c5de1113f5ff7f718a11b927dfd59d0538c88807809d700a342f589bba274d233fd83c0fd86c588ae2ea54e7c0b45179ee0c0da1ddd85d9e430734fb6dc504
SSDEEP 6144:mAuW8Iio4wo+aLurwUJ+nHxeBi8eDVeBi8eDSeC+DeeAeBi8eDrpqQ:aIigo+qw9
TLSH
T1E7C40A6036F80C13F2F716767AB0A9440C76BB6A423CE14C68ED568E6967BC04567BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 fc9bf4cc9ec5284b8cab8ddab6a4f2d0ee67ae77a3c0179cd29c10c9e83289cf
MD5 530ca5bffe805dec40cae604ef92a113
SHA1 c57a5c4b7cb419be834edbaca42e550908fb6b96
SHA512 d3128e4636dc3d3e93f808b5a99c529c94d830c4a652fd2e9dc596119ca07df62254ea1e3a07537e0fa4378f031d4a137c283cffeccb82e139de52ab5c95b191
SSDEEP 768:w1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:ifgLdQAQfcfymN
TLSH
T1C0C2D0B812CD6934FC164EBCDBD7A702422D0E79509E66A535E28D7B3D11B74203EB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3989226554-2204910950-1522900112-1000\_desktop.ini
Size 8B
SHA256 9179d04e2c73a3f2dc2b81dbc27ec1eb04d5ff033e13e36d2437bb8396aaf876
MD5 c376a1cb41cf27cd248b09ca298bb9af
SHA1 eda60ca57465ff189852ea52b4c4e6805271190b
SHA512 946d81479e496cbd82a83c229d294441921de1809dfb2e67ec9a9297e7c2ba2a5ffee9b04b13bbb640825634b3fd2b18a507560125cc59092794ebaed6e54501
MD5 SHA1 SHA512

Submit Download

memory/1420-28-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp

Download

memory/1420-22-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp

Download

memory/1420-23-0x000002D3B05D0000-0x000002D3B065E000-memory.dmp

Download

memory/1420-21-0x00007FF8E343F000-0x00007FF8E3440000-memory.dmp

Download

memory/1628-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1628-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-41-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-45-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-177-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-1252-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-5049-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-26-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-5522-0x0000000000400000-0x0000000000434000-memory.dmp

Download