b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
Size 506KB
Sample260809-ld1r7aysct
SHA256 b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8
MD5 6876f073086f1b781f22f67c733ea0b5
SHA1 94fe53aa395e905869e62e229d7ef71d6d79d9db
SHA512 815eb010650ec6f3dbb501ee28568cd8650dfc68349b211813d116203e36f9dc0a3fe673a67acab82f18396c7d6f192c2acf3b2237f76298464a725ec47f1f60
SSDEEP 12288:bji05ji05ji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5o:iLLeuTewuIjmH8j4J4oi
TLSH
T1EFB49E10FBD5C136EAA3273558F487AE5A7ABC649B30DACBA354071E9C707C1E835326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4948	Logo1_.exe
4572	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
2860	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
3828	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kab\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\58248C09-15BE-4337-AB1C-49385175A673\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Internet Explorer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\_desktop.ini	Logo1_.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
File created	C:\Windows\Logo1_.exe	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Logo1_.exe	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
File created	C:\Windows\Logo1_.exe	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4880	cmd.exe
4548	cmd.exe
2580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe
4948	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 4880	5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe	88
PID 5316 wrote to memory of 4948	5316	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe	89
PID 4948 wrote to memory of 4312	4948	Logo1_.exe	90
PID 4312 wrote to memory of 5340	4312	net.exe	93
PID 4880 wrote to memory of 4572	4880	cmd.exe	95
PID 4572 wrote to memory of 4548	4572	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe	96
PID 4548 wrote to memory of 2860	4548	cmd.exe	98
PID 2860 wrote to memory of 2580	2860	b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe	99
PID 2580 wrote to memory of 3828	2580	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
"C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46A4.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
    "C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B67.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2860
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C22.bat
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3828
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a46A4.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a46A4.bat
Size 722B
SHA256 6fa646c72dd71737da6c7faa0a867e02fafa1837cb5989e12aa7c483a65879be
MD5 05386d7f96c85829e8777853eb2dac59
SHA1 df5797a11f6ff540918767b22b7bbfaf1103a27c
SHA512 d6a50f09898116533e08b8beab45d3d9ccb04f4ef7b21748582c79abe7b8948eb723b3ff5acf8d0f929f08d69c0a0f9cb9e40c9fc40734ac9d39e3920a12adf1
TLSH
T1F8019C93881E7AF82C43018F813054ECE782AFBCB74432069D314E0C00D5629F3C594A
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4B67.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4B67.bat
Size 722B
SHA256 ed9d3d5734674246c2487b327d0854361a7a45a30b466078fe84914a08ae8ea4
MD5 3b8b6b6f34cb91130dc8876445eae6c6
SHA1 1b1c0a0dfcf334f8b33b648f3a6e71b70dadb903
SHA512 62cb2dca98830ad35ec8a701e2e4c5a838f6656e4c64e841a692d46c09bee80e8ffa96dd89d1e17d05fc96f77db916a4fad0158eff16043f90bb1647d51ad473
TLSH
T123019C53881E7AF82C47018F813154ECE792AFBCB7443206AD314E0C00D5628F3C598A
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4C22.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4C22.bat
Size 722B
SHA256 43f41008cce7b5659430f4a9095949ce05fca39bd54e0036e23bba09c3003077
MD5 e5139a7d931a29a8589bdcb3bacc3d86
SHA1 ac5522527059e800a1e3232bdef758e581f314f0
SHA512 a5bfe209de9c1592b94673d9523fcbf71e5aaa2491329093eff798328a2efdb7e61d95bf4932e2823f461bbe96ebf1d82970df1d8557da1b44f1d80a8a0dc8c9
TLSH
T1B7019C93881E7AF82C4301CF813054ECE782AFBCB75432069D314E0C00D5628F3C598A
MD5 SHA1 SHA512 TLSH

Submit Download

b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe.exe
Size 440KB
SHA256 22c509710ad5cf1aacc6be9883d570c8ba5c14c9a8a5be9769f59c5386e81877
MD5 d1f52ace3e7f694f371ed661c3e9a0f5
SHA1 73a1ba92b1acba545acea641a64017c13be37110
SHA512 8c2e78da7e176031ab6b7f2e1d95c17827d5f66cbaf10abb3826385c439d725dbcd3139c689f9e5a95d2172c06d7f48d91b069742a43510672bde16ced3437b2
SSDEEP 12288:bji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5o:ieuTewuIjmH8j4J4oi
TLSH
T1A2A49E10FBD5C136EAA7273548F487AE5A7ABC649B30DACB6354071E9C707C2E835326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe.exe
Size 473KB
SHA256 4ead075acd4c2dc349c57aec80c90ae5a92bf02baf805f152aaff483a0f6680d
MD5 1f98ce83fc90e1c430ecb62a4bb8dac9
SHA1 328b19c91886c16648790faf3ffc909766ac83e6
SHA512 317a5dbfe31423b9fb136008c23d7b9374b4eab674327ff0267e959b79af1ae86a142e01040732ceb9980c8e97f3bde3fb7a585188080499edfc6dff7709dc3c
SSDEEP 12288:bji05ji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5o:iLeuTewuIjmH8j4J4oi
TLSH
T1DDA49E10FBD5C136EAA3273558F487AE5A7ABC649B30DACB6354071E9C707C2E835326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\b775cf7bf2336b9b13665c979ca603e1ae3e1272ec3719a5d4876dd11229dcf8.exe.exe
Size 408KB
SHA256 386b26735ce9afef569df511043e8a43dfb0109c50a77b70d7aff69b9e085642
MD5 23d528bff518a8a181f8c5546965ecbf
SHA1 dc657d9dda9a7ed4b47d566abf4e3f8291d42fff
SHA512 48a377d4e16d55e12d2ec9bd470c41533f35ab6efa4945be33005ffaedded834a08057ea8fda59d6a57e3935820aaf13dd829586b383898a274e67e5d7def1f3
SSDEEP 12288:Tu++ewurRujFy1HLhyKyVkKB0HaOKTcF5o:TuTewuIjmH8j4J4oi
TLSH
T162948D10FBD5C136EAA7273658F487AE597ABC645B30DACB63440B1E9C707C2E835326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 32KB
SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
MD5 4f07b7c07db3deeaef154a2f2c9646b0
SHA1 6ada698575fd2ce3b8041f85d04dad5bd846a03f
SHA512 35d71140bddbe016fe55a1e9328b3d284b3c9d5ebe9225b062b994bff4c70555fdf81378a299ab70f1c4d37b60a18a5f8a411e63fe4562299863bb1378616a90
SSDEEP 768:bblN1dkT2ljlL5b+n8WF6mucTrVwp6NS3w0n:bJZ/j95b+n8wKcTI6
TLSH
T10CE2E18193D9A879E5C3163451738FCBE76964A1F6118B0F90A402FDEDC02E5AF1AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\_desktop.ini
Size 8B
SHA256 9665de4083439d021866163b21bda2a5f96fd16cd7572fbd2966e90951743829
MD5 fbd4d05c754ca8e6e9927860714ab856
SHA1 70f0865f40fc4cede69e788e26ed14ba0a05a242
SHA512 cab7618c5a9e453f59e89acf2cdfde870b9c226cbfdeaa200be64076935cf258481018f241f15ab258d2dc85534ce3edfc3f3a27a7f035cd4c3a16fb03a88b57
MD5 SHA1 SHA512

Submit Download

memory/2860-28-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2860-33-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4572-24-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4948-11-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4948-1742-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4948-1743-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5316-10-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5316-0-0x0000000000400000-0x0000000000445000-memory.dmp

Download