132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
Size 686KB
Sample261014-hhlbhsfa35
SHA256 132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e
MD5 6b7930278c5d599a4a76cee92fcc6461
SHA1 4ddc5fb035dd331dc9b7ac042d20870dbb878213
SHA512 f32b81571e6c46599254202da39b6d5c0a31931785cb00b96e0878348f508e6806719422a76d8ca8edf3e9525a908e98723e2db851fb5d9b5db0df89cec076f9
SSDEEP 12288:H7+XsXkymf58uRg8vwcY6rtFT+mHHHUJBT93Ds9ZnAT3qDPdjEsEhHa3H9l34mM8:H738+upf+mHHHUJBT93Ds9ZnAT3qDPd5
TLSH
T1FEE48E0A775881F9E067C13AC99645A2F7B2F8075A319B8F13A1436F2F375A14F2E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3364	Logo1_.exe
2784	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\swidtag\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2296	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe
3364	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 2296	3668	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe	90
PID 3668 wrote to memory of 3364	3668	132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe	91
PID 3364 wrote to memory of 2688	3364	Logo1_.exe	92
PID 2688 wrote to memory of 4528	2688	net.exe	94
PID 2296 wrote to memory of 2784	2296	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
"C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E7B.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe
    "C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe"
    3⤵
    - Executes dropped EXE
    PID:2784
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe
Size 228KB
SHA256 6a16b326544a0bbe52b8d24de640d9dcea2aaded3f7da635bc0bc743bbd7aa43
MD5 c4918287249d798058518e733ce2039c
SHA1 0019c84c13e5947d03534f5a8c60bf6f832853fe
SHA512 fc33bc1300b6ffa6d838a3086bc746a88951451d4974a477fde4028ed17aab0bbeddb1462c572e07e52bef5b1eabed4fae365b733874629f9c923f5dce2698e0
SSDEEP 3072:/ftffjmNq/rfzYT6X/D/24l/DFeodwgjf+FvC6C36lnWesuoB+ICTRK02Bd9Pqwk:nVfjmNWrZl/DFf3WC3as7B+WCR
TLSH
T16834811233F84928F8F39E316D398F26D93ABC31AE35E66E1684119D1D35A519D31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 660KB
SHA256 a33ff0fbf40f2a77a95b70ba499d0efe12131b471f27efe68509fbe2ba287a47
MD5 0d9c90532c6ddcc0db641042fe66e031
SHA1 3ef0d8fd2c2e44feef74ed8a24921ac1f8ea1d2c
SHA512 72c7861fa2c1d9fe388446ae88d6c38ff5a7ce15674b57674a48340b1116eeecbfa269cacce4070ba9010f0fe7573da9f470a6f6a64f7ac97d3ef61bca6d5975
SSDEEP 12288:Pp7+znMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:R7SMysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T1BDE49E3294604036E6F106B3B958A2347D7CE22867148DAEE3E8ED5D3EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a1E7B.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1E7B.bat
Size 722B
SHA256 068e046c2d3c14c7460452962b7fb41ff9af016e6de46b029af86184b37e12e0
MD5 a228ff80fe599616f180016c31c57273
SHA1 2c26988daed12a90594a339049c6c43296f5fc51
SHA512 59813d17e245903db2dab0d775b3c148cebae5bfb8de8f411a41280c8eda23ede3bbf00d72c61b79099ce2b4472047067cb50cba819aa5463c3f84974a866cae
TLSH
T1EF01D825C8A2E79A8590603E0FB63E8C90B31C3BBB9B7F508D10483715C119EEAE7603
MD5 SHA1 SHA512 TLSH

Submit Download

132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\132e29f0f34369a804823c9d714e1c0ccc2dd6a4df4f44e37bcbab95cfcbcd7e.exe.exe
Size 659KB
SHA256 0ae8ab43ae299ba8e6ca1ee83596be49d0525b096d56512ffc2131bad516f241
MD5 ab05e5f477c35623ba1c74189a171d3f
SHA1 164f335b0cfe8877e87dee183e8021f7479516c8
SHA512 76f8e96b3de3846a751da5a4e6d62acf8f921d72a11a767d9a85f82897ef0fbd76bf4c53c3fd536a9294693a869467099f732f75e972ac1fef07d7e804ac5d39
SSDEEP 12288:TsXkymf58uRg8vwcY6rtFT+mHHHUJBT93Ds9ZnAT3qDPdjEsEhHa3H9l34mMHgVR:U8+upf+mHHHUJBT93Ds9ZnAT3qDPdZXv
TLSH
T13BE47D0A775881F9E067C13AC89685A2F7B2F8075A31978F53A1436F2F375A14F2E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 bb953dd3a09c6f84b34b954897457f8f8cd93fb1219f7ca907cfd95ffc253e12
MD5 5e7e06fbb6e21e6de73ca67cc4a63166
SHA1 0609802af5b07d9f1b794e4182f9d27ebc25c1bf
SHA512 561520e55562990019d205e26905183338988dea70008f394ec6159bc5c9c7885e8eae2881acdc01d50475610500ab2dac6c0f8a342cb98e0edb4a29fde904df
SSDEEP 768:j1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:5fgLdQAQfcfymN
TLSH
T107C2BE6926CF0B3DDC254B7CDBF23641827A46AAA07B5CAD35E1487ED652728110EA32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 10B
SHA256 3cc655fb77d8ee9d3bd8d6ef6851f203306a7e76fc6c88010f361a7375fe8836
MD5 01a508bbc8b4419759c87046449f0464
SHA1 4399fb76a2b61b7f95218c593bb16f250ab133d5
SHA512 5eb56c9a22b3127da090dac08f30b417adececd583fd8430e7f73e12225dd5a76bc50ec37bb680a4d07be7c1c1eb754d0cb2017a960d1e9f53cee35c91f9d908
MD5 SHA1 SHA512

Submit Download

memory/3364-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-78-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-5044-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-5517-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3668-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3668-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download