06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
Size 336KB
Sample260808-d5m2eazakh
SHA256 06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9
MD5 28687d15c89476cebb1eb7e7c98861c8
SHA1 84f264a077df4022c281654c474cbc16189da8fe
SHA512 f7194c6a8b4bde3956802b5376de07294d9ce26a58a2d2f6564225aa74b565d5e378663497a8b0bec486bdec46bac5e2bceb6cdda94311046256708fd01d4ce6
SSDEEP 6144:WdVfjmNtKk2lPQ23kvE6BVADkpIaCb10JOigh3gzcbVqLUqdM4mF5sAOj/dxCB3K:+7+tKVlPQ23kvE6BVAUIaCb10JOikwAy
TLSH
T18D74AF717684C836D852043069E4C7F6693DBE700FA18AD777882B6D6E302D36B39F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3472	Logo1_.exe
404	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\vi-VN\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Offline\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\EBWebView\x86\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNative\Tracing\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-standard\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
File created	C:\Windows\Logo1_.exe	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe
3472	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 5092	1332	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe	85
PID 1332 wrote to memory of 3472	1332	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe	86
PID 3472 wrote to memory of 1184	3472	Logo1_.exe	87
PID 1184 wrote to memory of 4580	1184	net.exe	89
PID 5092 wrote to memory of 404	5092	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
"C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36AB.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
    "C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe"
    3⤵
    - Executes dropped EXE
    PID:404
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 1b97503920be6acb1cff4e9b39dfc612e819ae6e5eea3a59537d894214935edf
MD5 c75db9a2975af44b314b4e378bb3bebf
SHA1 fe83b8cd23b11e54e4f213ee1eef398e0da807bd
SHA512 bfc60fe549be48448cd3ac620a6d5f50d04e8d27583d63bdd1b38efd8d0ab43382118f6225ac12c3c7a0c77dd7843505c949ba7ac143313544082f896adb410c
SSDEEP 3072:GNftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:GdVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1EEC39D1335D08472E4B2593109A1EDB18A3EFD620950DE7B33D52B3E0F316D1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 ec3fb836bbb80087df07db21c9b20e96e164ab0937bfb4631f28f587cff86bfb
MD5 cea0b3cb174200eeab9268e6d3e19e78
SHA1 29f0109987cf7968575cc103366f03d5ad6f376d
SHA512 2c79b74a0d76da3b0a3401795f94bef30003caf35d779c51d34f99266b800ccec5feff848d8d50e40b1870fd0dffdbc34551c7362a99d4ee29036ad3a182ba81
SSDEEP 12288:+7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:+7o0Le5ji0hmxNrM
TLSH
T1E4C40916F6748335D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a36AB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a36AB.bat
Size 722B
SHA256 29d93b8efed0bf99b0d2f5c02dc030b16fcb094837e8ddd432f4df47e5c5b54f
MD5 b4c512a7a6a37df68ddf0dfb3a3c1373
SHA1 9d69f94a05b0e3b86facadf99f152a6c38a0485d
SHA512 7dfd0a29d310df6ed180774df439f46ba8f2d847cc92f3f145cf5846347ead65d19d57d379cdc7225626eced91afbac61265bf34d5ae5babb9b415e287ecf935
TLSH
T1C1014CDA4F464A0B36EC0A276762530E8297345B36C46F43DBA3B68A39C592FD8C5241
MD5 SHA1 SHA512 TLSH

Submit Download

06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe.exe
Size 310KB
SHA256 ea6d81f1924db2c2875c40399f2c50f6081258573e9efca9005e44553642a9df
MD5 6adc044210fa1053822cfd1b45f661c2
SHA1 051cd6cbc6aed12a9704d36310e949e9bda3041e
SHA512 c84ffb8570ec0d7e24dcfd05714e0d7e58f064261f39cc7198db7c5f2b5fa9b3caa4df6dcb8b28c866d37c99c329540b2caadfef31de07b23817277720d5d72b
SSDEEP 6144:hKk2lPQ23kvE6BVADkpIaCb10JOigh3gzcbVqLUqdM4mF5sAOj/dxCB3M29mbj:hKVlPQ23kvE6BVAUIaCb10JOikwAbvdo
TLSH
T1C5649E717684C832D852043069E8CBF6697DBE700FA18AD777881B6D5E302D36B39F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 047f0e5cd405822a0e53adfa3d29cc56914d67f6cf3a80cf95792306068555c8
MD5 6442b83cec12263de4226b8f395748df
SHA1 7be431f51fd0995684575a8b2208a9ad7d0decd8
SHA512 0f947deda93f1de12feee1d7e2d1c4f884be80f07f02244aac05edf92ee4279a797e1fde63a116235b3b1aa7198fe325fb652df231e4527c69b269954fa60cd7
SSDEEP 768:Wf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:WNfgLdQAQfcfymN
TLSH
T109C2D07A26C83578D825497CDBD35781833D0E7A085F596726F1BA7F2270B64100FA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2370214745-1838013427-2987045292-1000\_desktop.ini
Size 8B
SHA256 1d606682c3c73b22d9ee6de30be63c56537bbb5179c9016a02f36487fa915852
MD5 ef2a73bd88d8ae9f0bc87903b5672439
SHA1 a35895c65154dc024ecb558b84baf0b1e1f7b198
SHA512 dbd3a473bfec5c2bae236e2dade98bf2c64e97272d390518a26f99bf30944a42a746b7852c68f75fce59ee1356398c0603a04681cd212c288c9487120a130da7
MD5 SHA1 SHA512

Submit Download

memory/1332-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3472-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3472-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3472-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3472-325-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3472-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3472-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3472-5095-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3472-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3472-5612-0x0000000000400000-0x0000000000434000-memory.dmp

Download