Analysis
- max time kernel
149s - max time network
110s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
02/07/2025, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe
- Size 440KB
- Sample250702-ejr9nssm16
- SHA256 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2
- MD5 38f19804b8fa02ef761c0ec699780da4
- SHA1 7a34e8504d2285ac68f9339e5f8b1962150d5ab5
- SHA512 14171265268f29fc5a9a0f1c5152b6644dfdbfefc5dd6a281c3f2fbe9dde702bba018fcb2441eed79dedf0c28415f41eb424ae695927537b91d397c8f3305326
- SSDEEP 12288:bji0Bu++ewurRujFy1HLhyKyVkKB0HaOKTcF5Z:ieuTewuIjmH8j4J4oL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 228 Logo1_.exe 2556 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Extensions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\EBWebView\x64\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\EBWebView\x86\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe File created C:\Windows\Logo1_.exe bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe 228 Logo1_.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1252 wrote to memory of 3172 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 78 PID 1252 wrote to memory of 3172 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 78 PID 1252 wrote to memory of 3172 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 78 PID 1252 wrote to memory of 228 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 79 PID 1252 wrote to memory of 228 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 79 PID 1252 wrote to memory of 228 1252 bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe 79 PID 228 wrote to memory of 2412 228 Logo1_.exe 81 PID 228 wrote to memory of 2412 228 Logo1_.exe 81 PID 228 wrote to memory of 2412 228 Logo1_.exe 81 PID 2412 wrote to memory of 1212 2412 net.exe 83 PID 2412 wrote to memory of 1212 2412 net.exe 83 PID 2412 wrote to memory of 1212 2412 net.exe 83 PID 3172 wrote to memory of 2556 3172 cmd.exe 84 PID 3172 wrote to memory of 2556 3172 cmd.exe 84 PID 3172 wrote to memory of 2556 3172 cmd.exe 84 PID 228 wrote to memory of 3308 228 Logo1_.exe 53 PID 228 wrote to memory of 3308 228 Logo1_.exe 53
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe"C:\Users\Admin\AppData\Local\Temp\bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99CF.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe"C:\Users\Admin\AppData\Local\Temp\bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:1212
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe
- Size 6.1MB
- SHA256 113ee02ef6438e8c641c9f44042eaeb57a1a158d634a4c35f190860111520899
- MD5 6a41e5c29931e7ee886169ff7db1df2d
- SHA1 934e7bdc844ca409ec297c1bfc75430f3103fc1c
- SHA512 0d0fb2c6e749024a792b7c5bf9ab52ba766f3e8bd6ca7809d5612ca0b05d373144bd0cef5dddfeab2ba3298014fce4f1b52dd5bffc2a786e554b4e8daea76ec6
- SSDEEP 49152:i0TEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZD7H4mYwrjDDSNdihLuZykH8mYh:icut4LcLBbPl7H8SUY/P5h9n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a99CF.bat
- Size 722B
- SHA256 ab855d506d959c6413bdae27b6a54d14f56b6d285a8d00a1c47156d0bf6a7f64
- MD5 ec7765432f229058a2bf68d74aca6f72
- SHA1 7726551bfd9075a839f22a07246c210854daddc8
- SHA512 ead296d89bb4179a48ede3cf463e976c6b361fc8ea15117b764f70f8d66076f9552568e333e651e253754329c84c043a4a3785652d36758c108d577c3ec0f874
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\bf95db9beb6eca54c5f231260a618a4206a385d4faf5a413e0f858e732a1f0f2.exe.exe
- Size 407KB
- SHA256 a07c8879086b710ef21cb21f5cabdb4740c48dfd3200a3f64dd8dd226bb8c003
- MD5 6a80111a36e148d0225e216ed065e9f7
- SHA1 3f07829f16e72879bdc16dcadd2f07029ae9cefd
- SHA512 01a90edf2e244d132d9e2dea4756758102193b4e5f3dcb474c30c0b750b621a04b4419e14a05f46594fad8a6f52c13c0e503376476ed2131c72e472b25ce9b6d
- SSDEEP 12288:Tu++ewurRujFy1HLhyKyVkKB0HaOKTcF5Z:TuTewuIjmH8j4J4oL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 32KB
- SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
- MD5 4f07b7c07db3deeaef154a2f2c9646b0
- SHA1 6ada698575fd2ce3b8041f85d04dad5bd846a03f
- SHA512 35d71140bddbe016fe55a1e9328b3d284b3c9d5ebe9225b062b994bff4c70555fdf81378a299ab70f1c4d37b60a18a5f8a411e63fe4562299863bb1378616a90
- SSDEEP 768:bblN1dkT2ljlL5b+n8WF6mucTrVwp6NS3w0n:bJZ/j95b+n8wKcTI6
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3518521428-3897247806-4080064211-1000\_desktop.ini
- Size 8B
- SHA256 7ee98acf971e32cae894381122352197a76e04e7689903e61cef63ad4f690736
- MD5 5e50f2ec682db49e5e80b04589040bc9
- SHA1 233cb585ea62e42d93795c6a681748643313fd2d
- SHA512 a8d6e4cbdbd582807ede9532ab633f4679ec5675416101ce98f7b96a5ad78095e8b13b9cd280831beadbc5a6de5dc1358329ff0edb0ff6f2693771379047a6d0
- MD5 SHA1 SHA512