Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 08:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
- Target c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe
- Size 53KB
- Sample240404-jxt3msae34
- SHA256 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e
- MD5 1f0e037e881769c8195ca60af855f79b
- SHA1 ea04cd66a41eb7b9b0eb390825fc2a5ca8af90c7
- SHA512 d31950c1f2f7de8d43c3587fc8d05d24c8ccb14965fab0298f159159bd76329dabfbdb21f649e05f793a9b2d6a24f628228dfe952c0e761f29f0012e0ee96824
- SSDEEP 1536:JGqF5j95b+n8wKcTDKDVmAmX5CNt70oIkNlKwPWNj:JVF5j95S4cTGJml5kt7BIBdt
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 1 IoCs
pid Process 116 Logo1_.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Media Player\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe 116 Logo1_.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4000 wrote to memory of 824 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 95 PID 4000 wrote to memory of 824 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 95 PID 4000 wrote to memory of 824 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 95 PID 4000 wrote to memory of 116 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 97 PID 4000 wrote to memory of 116 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 97 PID 4000 wrote to memory of 116 4000 c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe 97 PID 116 wrote to memory of 4584 116 Logo1_.exe 98 PID 116 wrote to memory of 4584 116 Logo1_.exe 98 PID 116 wrote to memory of 4584 116 Logo1_.exe 98 PID 4584 wrote to memory of 1808 4584 net.exe 100 PID 4584 wrote to memory of 1808 4584 net.exe 100 PID 4584 wrote to memory of 1808 4584 net.exe 100 PID 116 wrote to memory of 3468 116 Logo1_.exe 57 PID 116 wrote to memory of 3468 116 Logo1_.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe"C:\Users\Admin\AppData\Local\Temp\c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7157.bat3⤵PID:824
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1808
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3164 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:81⤵PID:5460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
- Size 4.3MB
- SHA256 e9a52d64e52afd8f4ee8f2f63d90c4b106da95b2e0a0e2beebe60393264bef2c
- MD5 3367477f96da521e3b0c6680accd77e6
- SHA1 2d534153b197fe7ee127ebe8162fcaa96871b891
- SHA512 112b5eabeb8c36fdce0903ed857d3b9eafcdb41363c095ff9acba49b62f24ca9cd1797ffaf9ae7098c1b4b4bcbd2eb32a2f42277280cbcc38d19286c2682e13c
- SSDEEP 49152:Ksj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDgiIerM1R6Zk:KXrZ4K5M+XDgiIewG+x6xZ14J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a7157.bat
- Size 722B
- SHA256 f4e185043c57ba600c6b576f8ef26e9fc9eb226b1b5d60015b0d04bc2ba222e1
- MD5 284f1b4675a91ede032eaaac402c6be9
- SHA1 0ce731e4b4fb20ef1fac9f31f5aa4dad1b762bc7
- SHA512 7d756b791c7c57b3571169e70a65fbe376c0b0ed04f8a4a66d2293e7b63718936aea246e1167ff91e8cf5fb6253d8e10aa91de302888760eda4e15b5be2a9af9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\c91c93bfb4af19aff408262ead8044abb4710a74ed66ad3a4e99e6fa3d87c42e.exe.exe
- Size 21KB
- SHA256 ba414e4c21cd7884d1f26bf15b95599a4f0e8f39ad02d551a52c49a42749954d
- MD5 a09c83435cb8362138ff9967c537843c
- SHA1 1001b4f5f684aaca984aa4f4a211842fdb187a4b
- SHA512 2e2eacdf583f45aa6e57bb8c5ce2d2aa1199014937201c9694db8a6616715c73a5611fbe77a2ca88bb16c38d0113a1ec194f4e1095e92522428054b007cf1296
- SSDEEP 384:c4PaaLeVeceBedeVeNe3efe7eeJeue7eyLgDCIwpxIedq5sfiVlYLCcY6xbx4Jrj:c7aiAncYAoOmyeUdyIgGIkxIylKvYL3M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 32KB
- SHA256 73bc52350ede34cdbf4f39b1fbdf64db6b3aeeb453a0f10d6b14b5be4da98b29
- MD5 4c03b2b7d60b1910548e44cb58a82c46
- SHA1 ac271a4dee996d327293b120a6196a57c9e0c5c5
- SHA512 20ed0e1175b58f4aaeeb091da5cc04c64578d398fc1dc53f46eb57ec220cc8424d12f473524fa3ce9661b70b31bb38f8032992b2691b3ef0b8ac33f941118950
- SSDEEP 768:JGqww6T2ljlL5b+n8WF6mucTqDf2KDVX2AmXtzCNt:JGqF5j95b+n8wKcTDKDVmAmX5CNt
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-817259280-2658881748-983986378-1000\_desktop.ini
- Size 8B
- SHA256 2c4780d85c5b5a8e5649f017df0ea62961728eba75f44e3cd2d127028824a01e
- MD5 9e2656d84f0c5f5dc40206b039423304
- SHA1 98b1f6994979c8f74f33ab995ff76b8daa8057ae
- SHA512 8d4db7bce3b7f45cb20e4bd278d5fa5e3ce6d1694e72a8d4fa456bc943f042cea4bade75f4eb3a2f6c78af14bb987a9c0599ada8a5144eac5d7e915699f1af18
- MD5 SHA1 SHA512