06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
Size 336KB
Sample260808-d5m2eazakh
SHA256 06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9
MD5 28687d15c89476cebb1eb7e7c98861c8
SHA1 84f264a077df4022c281654c474cbc16189da8fe
SHA512 f7194c6a8b4bde3956802b5376de07294d9ce26a58a2d2f6564225aa74b565d5e378663497a8b0bec486bdec46bac5e2bceb6cdda94311046256708fd01d4ce6
SSDEEP 6144:WdVfjmNtKk2lPQ23kvE6BVADkpIaCb10JOigh3gzcbVqLUqdM4mF5sAOj/dxCB3K:+7+tKVlPQ23kvE6BVAUIaCb10JOikwAy
TLSH
T18D74AF717684C836D852043069E4C7F6693DBE700FA18AD777882B6D6E302D36B39F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4840	Logo1_.exe
5980	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kab\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\identity_proxy\win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\EBWebView\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
File created	C:\Windows\Logo1_.exe	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe
4840	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3304	4132	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe	89
PID 4132 wrote to memory of 4840	4132	06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe	90
PID 4840 wrote to memory of 3444	4840	Logo1_.exe	92
PID 3444 wrote to memory of 5624	3444	net.exe	94
PID 3304 wrote to memory of 5980	3304	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
"C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe
    "C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe"
    3⤵
    - Executes dropped EXE
    PID:5980
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 72f3d1a36ba06b0e912ae8f70f3c047c6d5e8870d266f4872822ff8860f89ca2
MD5 2062ae0a454a5d8c42f21fdf6029a646
SHA1 da8a1b0722ec51cee9a7a80b210b2286c29aad29
SHA512 27d9c14306dac4ea2657da24cecdc75c61853edc4f8dfaaa691049d92a7c26fad58e2229ddb48a1ac00886218b30b030d02b60125d6b214ed24d2d331b375c11
SSDEEP 3072:GNftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:GdVfjmN2G7/fYfLvzB+QFyn
TLSH
T1B2C38D1375D08871E5B20C3449E1EA619E3FFD620B409EA737C466BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a93.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a93.bat
Size 720B
SHA256 ef640d1505ca7284dfda2380bce4fb651470027282ee6b8835ae715bc84fc0a7
MD5 c50c1d78e9bd5916a68e8a74edbc886a
SHA1 a8f49993ee45caa6a042a5777c1006c5619f0576
SHA512 33bf74b4a5aa907b128a12e918db52ef37f4216b65304a013239df1e751e4c1ee05c999a3e3df7b0ac8b08ed0bde02b7f1945fe7522e0efb375ad7326d9be637
TLSH
T1A8014CDA0F464A0B36EC0A276762530D8297345B36C46F43DBA3B68A39C592FD8C5241
MD5 SHA1 SHA512 TLSH

Submit Download

06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\06775f81cb8e66f32a94181841aa2668bbb581232b07d80726f5df37dce2c6c9.exe.exe
Size 310KB
SHA256 ea6d81f1924db2c2875c40399f2c50f6081258573e9efca9005e44553642a9df
MD5 6adc044210fa1053822cfd1b45f661c2
SHA1 051cd6cbc6aed12a9704d36310e949e9bda3041e
SHA512 c84ffb8570ec0d7e24dcfd05714e0d7e58f064261f39cc7198db7c5f2b5fa9b3caa4df6dcb8b28c866d37c99c329540b2caadfef31de07b23817277720d5d72b
SSDEEP 6144:hKk2lPQ23kvE6BVADkpIaCb10JOigh3gzcbVqLUqdM4mF5sAOj/dxCB3M29mbj:hKVlPQ23kvE6BVAUIaCb10JOikwAbvdo
TLSH
T1C5649E717684C832D852043069E8CBF6697DBE700FA18AD777881B6D5E302D36B39F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 047f0e5cd405822a0e53adfa3d29cc56914d67f6cf3a80cf95792306068555c8
MD5 6442b83cec12263de4226b8f395748df
SHA1 7be431f51fd0995684575a8b2208a9ad7d0decd8
SHA512 0f947deda93f1de12feee1d7e2d1c4f884be80f07f02244aac05edf92ee4279a797e1fde63a116235b3b1aa7198fe325fb652df231e4527c69b269954fa60cd7
SSDEEP 768:Wf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:WNfgLdQAQfcfymN
TLSH
T109C2D07A26C83578D825497CDBD35781833D0E7A085F596726F1BA7F2270B64100FA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3611646547-550105268-947503007-1000\_desktop.ini
Size 8B
SHA256 1d606682c3c73b22d9ee6de30be63c56537bbb5179c9016a02f36487fa915852
MD5 ef2a73bd88d8ae9f0bc87903b5672439
SHA1 a35895c65154dc024ecb558b84baf0b1e1f7b198
SHA512 dbd3a473bfec5c2bae236e2dade98bf2c64e97272d390518a26f99bf30944a42a746b7852c68f75fce59ee1356398c0603a04681cd212c288c9487120a130da7
MD5 SHA1 SHA512

Submit Download

memory/4132-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4132-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-93-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download