Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/04/2026, 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe
- Size 496KB
- Sample260425-lp49rad19x
- SHA256 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd
- MD5 79ec08400e269a32a96c8b976edb0283
- SHA1 9483ba5968c371704a92cd2589b68db7e9920865
- SHA512 b36f55d588be438f3738b2ad747cb8b03585ab687f154ebcaf5e8bffb2eb2bfc496f58b8b152d09fb8581d1ee0f776bf3d1c908d5d0153041b070ee0dca3047d
- SSDEEP 6144:Lj9c9AWdC+v3cpQvYJvKPSwv2nPEuJ1fHbIop44Sm5FpxyN90vEbsN7:LjiEpQQJvKPSwvY1fHTHy90w67
- TLSH T10EB48C16BBD4C039D5A20630B86EA76692FEFD707574820BB7D0779A1C71A82DB30B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2984 Logo1_.exe 2996 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe File created C:\Windows\Logo1_.exe 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3828 2984 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe 2984 Logo1_.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4296 wrote to memory of 3284 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 87 PID 4296 wrote to memory of 2984 4296 47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe 88 PID 2984 wrote to memory of 4840 2984 Logo1_.exe 90 PID 4840 wrote to memory of 2140 4840 net.exe 92 PID 3284 wrote to memory of 2996 3284 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe"C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5E9.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe"C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2996
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2140
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 8323⤵
- Program crash
PID:3828
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2984 -ip 29841⤵PID:2296
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.1MB
- SHA256 a7da3b87b25fa0907b8ec74d7d9870faf45038f94f16e06383f16ad2eea87b7f
- MD5 bf9174a876561390cce0291944ebcbfc
- SHA1 70195b67604b49ed92e11da66ca10e1c5405b363
- SHA512 5a4185d7625f483726e22d7f4420321a503506f3f3a5a7da39b16c2476d638f8576d54faf265b4b841b9af2c1f0c86fd0b0b9f6e4a4cc5c2bd1527431834feb3
- SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLd23UQ:7QRQyi36YOcP+Lvw2gAf+PN34
- TLSH T1F0566B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aF5E9.bat
- Size 722B
- SHA256 6821a0c537f1f36d487deffa100f902d98edc5633e087668974ca7668559d707
- MD5 a49eabd62d1f94d571bd06616d51d00e
- SHA1 d19bc6ad07b21e75c8728d4dd19400b58ed23ce9
- SHA512 3238d46c792dfdfd454fdd78bc60460710f7e506b4525bb25682b8e1f8cd583a50f281fbda5176b626343135eb388696fc50e28506017fafa3a5b10948981b6b
- TLSH T1650144C981B957AE1E45D0730F9868CFC0632E4B3BAF7A36A7709A7818DDA1BD3D5140
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\47be47a37e4705c386f1a3ee45deb8a03bbd5d1904d2814b1c921cfa612898dd.exe.exe
- Size 452KB
- SHA256 e69c4abcc4d2f130e66560fc27829b4fe62a2b1f66933790a3060bd7f4fcd878
- MD5 95b8a4245a6cd37d36e56fae5a23e2b1
- SHA1 139e0223e64a2d4f7ae94e347c657bdb86dfd5ff
- SHA512 9114af555b9d97c87834982c80d9a4a7cc97b8678ed55d96a1a02999b551e9e018d376b404d0925bbb87dcd2aa8e0fa8bf7745f60096a7df01cd918002fb0bf1
- SSDEEP 6144:bWdC+v3cpQvYJvKPSwv2nPEuJ1fHbIop44Sm5FpxyN90vEbsN7:aEpQQJvKPSwvY1fHTHy90w67
- TLSH T16CA48C16B7D4C039D6A30630B8ADA76692FEFD706574420BB7D07B9A2C71982DB30B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 44KB
- SHA256 af695904422ca5d4364d45955082db74f12efffa36b583458bd1bb866e1b3dcb
- MD5 3dde3b7ee3d05628fd88a2fc9c1abeed
- SHA1 fe1f8bf294385460071553167fdcc96c1a462084
- SHA512 a8f37a714db80d546a7fbe72768125686c224c54743e628502c0591f9595eda7036a3eb9ad57e335966464df1b2c73fcc45324eddc84749262e7a0291260bfea
- SSDEEP 768:ZmpT2ljlL5b+nXLpXwnslmxtOsoI8A+bbHj3eVoKt/pIxDdct5l0m/gJX:ZmKj95b+nKbIs78xHC/payND4X
- TLSH T1CC13D01B3F4E6574E69698744A2B1FB58B387CF2FE12D204C3B055AEDCE5358FA02941
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-745935970-1373868228-562466063-1000\_desktop.ini
- Size 9B
- SHA256 49ae628b21eceb52cfae7af66d488c736e334e8e5a05bacaac62b3ddd791251b
- MD5 acdb534d0253a176a2a0e1fd11e837b9
- SHA1 a527b792940d294bca3c2fcec3cc01f48de60689
- SHA512 ae6fee904c215193b2a84e2af6e46875b5c4ede55ec8a53eb88fc6204a207329b7b4e140e16c0630b3df64395b8533c4773e1a2157b654962d7c1390dc8097fe
- MD5 SHA1 SHA512