bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4

Analysis

max time kernel
3s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
Size 5.7MB
Sample260925-httf9sbg35
SHA256 bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4
MD5 85e9db16f10e055510aba411a63a8c13
SHA1 1f8ee3cbac3fd64b8671f19fd3c6c9d8b5dd6372
SHA512 bc785e8b995f305156702c552ecacead7a0f9ac4326b67b3efe21833427e4d8b5d6971b89406c7feb99a98862f5082938734ea316f05a9fcbb5888303b0d8072
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLm:CjJI
TLSH
T11D56E08193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4296	Logo1_.exe
4716	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Logo1_.exe	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
File created	C:\Windows\Logo1_.exe	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
616	cmd.exe
892	cmd.exe
740	cmd.exe
4788	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	4296	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe
4296	Logo1_.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 892	4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe	86
PID 4820 wrote to memory of 4296	4820	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe	87
PID 4296 wrote to memory of 2600	4296	Logo1_.exe	90
PID 2600 wrote to memory of 1796	2600	net.exe	92
PID 892 wrote to memory of 4716	892	cmd.exe	93
PID 4716 wrote to memory of 616	4716	bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe	94

C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
"C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACA6.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADB0.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:616
    - - C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
        5⤵
        
        PID:1624
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4193.bat
        6⤵
        Executes a command shell one-liner
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
        7⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FF.bat
        8⤵
        Executes a command shell one-liner
        
        PID:4788
      - C:\Windows\Logo1_.exe
        
        C:\Windows\Logo1_.exe
        6⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Kingsoft AntiVirus Service"
        7⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        8⤵
        
        PID:4616
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 796
    3⤵
    - Program crash
    PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4296 -ip 4296
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a2FF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2FF.bat
Size 721B
SHA256 28963b5be094a47bf8395e380bc017e407bbe7f73d57bb8df14249b8b8b33b7b
MD5 6550fc8d5da1e9674202b5a1bb6b35f8
SHA1 ffc206c70ea460a41eb8c7ed3b4574a5aaf24f3e
SHA512 eb9ba9ae16c2bcf4cf801fb61f70113e71b94d794977a91485edd38a0079d493ebe1d5da5e5796f0eadd039fb76b45fadfd6497869b228bb961923a44e7f0f99
TLSH
T137018BD5C4A7A726CD49710B1EF2D1CDCD62ED7C668423AA5522CC7F3582A1CB5F3182
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4193.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4193.bat
Size 722B
SHA256 664899423fcc38ee57cfdf7dd880e5e31700334e74b3ea4ade4f686751f5c2d1
MD5 5aea8c280d97143d3d75a696cf985979
SHA1 77383d2f41c721f34f6c572538490cc966d43eeb
SHA512 03144c0ac5e7e494ddb69373ef6e35191b76b201090adf06c8e7113358283219610a54671b73af8b3caf364f32a378d82a6bd475f7b61171fc2b7bdfde3a2cc1
TLSH
T1640167D5C5A7A7268D49700B1EF2D1CDCD62ED7C658423AA55228C7F3582A1CB5F3182
MD5 SHA1 SHA512 TLSH

Submit Download

$$aACA6.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aACA6.bat
Size 722B
SHA256 9d225abbd83e65650336aff9fe142386b76027a891c3d7d137cbf69e16c736c6
MD5 c2b5a0abafee863eb5cb9520db6a5498
SHA1 9cf6dd1deec8071dbb755272ce2c051f246d0557
SHA512 2c460bfd0de9ae24c036bd4f185a942a63970938a94d73dcf419c19205fc9c4df22d2591d73c992bd27bfae532955d2b977b18aa466743151c74a8e0bc49b187
TLSH
T1AD018BD5C4A7A726CD49700B1EF2D1CDCD62ED3C658423AA5522CC7F3582A1CB5F3582
MD5 SHA1 SHA512 TLSH

Submit Download

$$aADB0.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aADB0.bat
Size 722B
SHA256 1c6ea154d7b226d4aa5729f37a3944ddc31736e8c9ef65779e8bd406a420f76d
MD5 b8ecd633fddeeef396dbc530b6f7ea9b
SHA1 21d7f2cf7023ebbc6c891051797419384aeb1051
SHA512 fbf25cd72a6411b5a02fff930edfadc223f4706000d960238f081cc002bd071c0c583dc2b02186205a86d5dc3272be89a781e756f57f6f51d935d852dedd0a44
TLSH
T117018BD5C4A7A72ACD49700B1EF2D1CDCD66ED7C658423AA5522CC7F3582A1CB5F3182
MD5 SHA1 SHA512 TLSH

Submit Download

bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe

Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
Size 5.6MB
SHA256 d145734b92c1d92e639718958d0dbe078681c6b35328b3606e09b20f17c0c1a7
MD5 4fc41f9b06a334ab6009158b868faa81
SHA1 ba3827bbdadb74dc753a54bcb8e5408dd734390c
SHA512 dbea80d6cdfcb3fc79738352d57d89a57a4cc11b1668c8b53f6c676907f5a5eb95c77a9770774b11fc991612800830ff32e76d0b04a3d08cdadef04bc38e5dd7
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLC:0jJI
TLSH
T1D356E08193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe

Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
Size 5.6MB
SHA256 8f35c42f8029bb68e1f21306b6164d4783771f0e9ebb69ff76dd1533291492c6
MD5 50f34ff9d0c535f4c005ad9d0f86b49b
SHA1 2906c40c13d34c891adc8595f45b01e8dab794ed
SHA512 7810bcb092694ce4b52469b4e2617f58748627215131b2b0db2d9a95480bf43d41027068dcde84f8c3be2b7730801c019d293f5e52af6df86a4c0b3978730e44
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL2:CjJI
TLSH
T1AD46E08193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe

Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
Size 5.1MB
SHA256 a58fad5743b2262b26a6046f19287571b588ee155914cf11dee7ce3102cdeb71
MD5 5bc33d8405d563d931761dcf0323498f
SHA1 5070a3ac95e48a33582324bd9190b6aaae2e6c9a
SHA512 214f7c643bb3b06db08778d5b1c0cbadc9eed19d284598cc01a4716ec303e39a0cc17ed1163e08184f4e3874c24e1bfd759bc0970994c22d136b02c99c11ce96
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLu:H
TLSH
T18436E18193D9A879E5C3163451738FCBE76964A1F6118B0F90A402FDEDC02E5AF1AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
Size 4.4MB
SHA256 89ca7b24f008171bfcb935a48374ef7bbc22ba42ae82db856b7659fd25bd1418
MD5 4193706705a151f21a10f9d98243fa32
SHA1 ac4f5061030ac3bb1d6ab62d5b8c6961de11a64e
SHA512 bf1fd3d0dcd406f5db441141449654c660a77e6c787b87554fb537dce4e69334231d4cc2a0dc4fe6b92a8ef8983e76e4fcb530bc75552745d1c3a1bedd210948
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL3:a
TLSH
T1F426E18193D9A879E5C3163451738FCBE76964A1F6118B0F90A402FDEDC02E5AF1AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dll.dll

Path C:\Windows\Dll.dll
Size 68KB
SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
MD5 e1dbfd522e7f22b2f987af9f32d915d0
SHA1 fb8a8babc7d2447e4cbcf0973a168b9afb633b05
SHA512 e863a1f3503a94faf95c271464357b9536e7aa7b7b684c0720cf1ed4b8e798176798f798da010acfcac85872d21c0bbddd8d0b5980ca39a9d6655b84740cbace
SSDEEP 384:YJOXrq2Gds3sZnAQ4rQ0b8AKIZQlZkCYci2iCxXHHm3z5bzdnCS:DXrq/s3oAQyWIiSVpfC9HGj5bzdCS
TLSH
T16C633C52F5D1C471E06CCE7E4E0AC2ED993E39242D1C2622B1BF4E8EDFA92D1191D2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 32KB
SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
MD5 4f07b7c07db3deeaef154a2f2c9646b0
SHA1 6ada698575fd2ce3b8041f85d04dad5bd846a03f
SHA512 35d71140bddbe016fe55a1e9328b3d284b3c9d5ebe9225b062b994bff4c70555fdf81378a299ab70f1c4d37b60a18a5f8a411e63fe4562299863bb1378616a90
SSDEEP 768:bblN1dkT2ljlL5b+n8WF6mucTrVwp6NS3w0n:bJZ/j95b+n8wKcTI6
TLSH
T10CE2E18193D9A879E5C3163451738FCBE76964A1F6118B0F90A402FDEDC02E5AF1AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-240542094-4193773837-3211495583-1000\_desktop.ini
Size 9B
SHA256 1020704fe83c7e64802b1428d9e5641e37d7c7eef9077c5ed54d2d7974c3c891
MD5 a274b48f7af96d86b7d74581cb8e76fd
SHA1 96f3ceca2b2a8cb9f76c003a07e5c821f03ba2d1
SHA512 4188b612e6cc1c394570827e0711cd60046203122b955da3b0882a93fba20534fe59011279487a4cde76523d73837ac8a2daaa51b76b518a8583ac4127cd2b9a
MD5 SHA1 SHA512

Submit Download

memory/1624-965-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2416-974-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2416-973-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2416-975-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2416-963-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4296-952-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4296-8-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4716-19-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4736-983-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4820-9-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4820-0-0x0000000000400000-0x0000000000445000-memory.dmp

Download