132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
Size 686KB
Sample261014-hhlbhsfa35
SHA256 132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e
MD5 6b7930278c5d599a4a76cee92fcc6461
SHA1 4ddc5fb035dd331dc9b7ac042d20870dbb878213
SHA512 f32b81571e6c46599254202da39b6d5c0a31931785cb00b96e0878348f508e6806719422a76d8ca8edf3e9525a908e98723e2db851fb5d9b5db0df89cec076f9
SSDEEP 12288:H7+XsXkymf58uRg8vwcY6rtFT+mHHHUJBT93Ds9ZnAT3qDPdjEsEhHa3H9l34mM8:H738+upf+mHHHUJBT93Ds9ZnAT3qDPd5
TLSH
T1FEE48E0A775881F9E067C13AC99645A2F7B2F8075A319B8F13A1436F2F375A14F2E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3408	Logo1_.exe
384	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\el-GR\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\HoloTileAssets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Resource\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EBWebView\x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\el-GR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
File created	C:\Windows\Logo1_.exe	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4928	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe
3408	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4928	4176	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe	86
PID 4176 wrote to memory of 3408	4176	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe	87
PID 3408 wrote to memory of 4640	3408	Logo1_.exe	89
PID 4640 wrote to memory of 4408	4640	net.exe	91
PID 4928 wrote to memory of 384	4928	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
"C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA81.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
    "C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe"
    3⤵
    - Executes dropped EXE
    PID:384
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe
Size 236KB
SHA256 32caa5f0dd355f28191bba56bcdee72f3e5019a1ede5744276d21e0de9d1f7a6
MD5 a054dd299362052c63d9ca54ccdea805
SHA1 208bd0441a451ff6b90cde63325b533a29a6b968
SHA512 5251ae4db6c137bd7e5a214b36f61cf16dc149deac3e5b2cc9939c5c75017fad2d91babbf5f172f9dbcb47d264369670a60061e9cb18f864f1daef880a95e586
SSDEEP 6144:nVfjmNr7gKNkhSR/5kHouyXnZhB+h8WH3:V7+r7gKNkhm/JuyXnPB+h8WH3
TLSH
T15934912233F84929F8F35E306C759F29993EBC35AE35EB6E1640119D2D35A41D922B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 660KB
SHA256 a33ff0fbf40f2a77a95b70ba499d0efe12131b471f27efe68509fbe2ba287a47
MD5 0d9c90532c6ddcc0db641042fe66e031
SHA1 3ef0d8fd2c2e44feef74ed8a24921ac1f8ea1d2c
SHA512 72c7861fa2c1d9fe388446ae88d6c38ff5a7ce15674b57674a48340b1116eeecbfa269cacce4070ba9010f0fe7573da9f470a6f6a64f7ac97d3ef61bca6d5975
SSDEEP 12288:Pp7+znMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:R7SMysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T1BDE49E3294604036E6F106B3B958A2347D7CE22867148DAEE3E8ED5D3EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aBA81.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aBA81.bat
Size 722B
SHA256 971b36a41a4c655b3393a9844985135b27ee19a3cd0a4560349d65ab754a4e7b
MD5 d1da8d48ed137cb96c81efd0da981580
SHA1 1166102bd9338ed69d569950d83a9a68fd5ac6f5
SHA512 3479cfec25f667dc896c2636b405debfb8ee003b04c679f651ed0553e7511d96377236c2edf9fe7082e4dfbcf7859055af1f6f33f0a69f8c880cebe5d6c774a5
TLSH
T11601DD25C8A2D7598590603E0FB67E8C50B31C3BBB9B7F508D10482715C119EEAE7603
MD5 SHA1 SHA512 TLSH

Submit Download

132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe.exe
Size 659KB
SHA256 0ae8ab43ae299ba8e6ca1ee83596be49d0525b096d56512ffc2131bad516f241
MD5 ab05e5f477c35623ba1c74189a171d3f
SHA1 164f335b0cfe8877e87dee183e8021f7479516c8
SHA512 76f8e96b3de3846a751da5a4e6d62acf8f921d72a11a767d9a85f82897ef0fbd76bf4c53c3fd536a9294693a869467099f732f75e972ac1fef07d7e804ac5d39
SSDEEP 12288:TsXkymf58uRg8vwcY6rtFT+mHHHUJBT93Ds9ZnAT3qDPdjEsEhHa3H9l34mMHgVR:U8+upf+mHHHUJBT93Ds9ZnAT3qDPdZXv
TLSH
T13BE47D0A775881F9E067C13AC89685A2F7B2F8075A31978F53A1436F2F375A14F2E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 bb953dd3a09c6f84b34b954897457f8f8cd93fb1219f7ca907cfd95ffc253e12
MD5 5e7e06fbb6e21e6de73ca67cc4a63166
SHA1 0609802af5b07d9f1b794e4182f9d27ebc25c1bf
SHA512 561520e55562990019d205e26905183338988dea70008f394ec6159bc5c9c7885e8eae2881acdc01d50475610500ab2dac6c0f8a342cb98e0edb4a29fde904df
SSDEEP 768:j1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:5fgLdQAQfcfymN
TLSH
T107C2BE6926CF0B3DDC254B7CDBF23641827A46AAA07B5CAD35E1487ED652728110EA32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 10B
SHA256 3cc655fb77d8ee9d3bd8d6ef6851f203306a7e76fc6c88010f361a7375fe8836
MD5 01a508bbc8b4419759c87046449f0464
SHA1 4399fb76a2b61b7f95218c593bb16f250ab133d5
SHA512 5eb56c9a22b3127da090dac08f30b417adececd583fd8430e7f73e12225dd5a76bc50ec37bb680a4d07be7c1c1eb754d0cb2017a960d1e9f53cee35c91f9d908
MD5 SHA1 SHA512

Submit Download

memory/3408-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3408-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3408-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3408-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3408-419-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3408-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3408-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3408-5036-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3408-5553-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4176-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4176-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download