Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 08:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe
- Size 159KB
- Sample261011-kbftkaef47
- SHA256 2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e
- MD5 a25267f79d8e075c7a105a45e190f461
- SHA1 675c8963b2d3ee17d49d6ff3ef320a2d153fa9f7
- SHA512 f5ca3ac660d2042044490e7b3b17cfac18aab3c8da12c680f0dc787c757540949078a3e1c27934961373fd48eeb1a1ef186edb8d79400da9d4b58cb079f9a811
- SSDEEP 1536:pp23SHuJV9N4OW/8cs/c59bqgU/KMkDE7JnRl1qgU/KMkDE7JnRle5c7dxol:pkkuJVL4P59eguKMkDEmguKMkDED4l
- TLSH T128F3B24D875944ABE57049B6C0AFBE5002A02D3DBE83C7BAFE58B50379723C9A433579
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3736 Logo1_.exe 1272 2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\cs-cz\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe File created C:\Windows\Logo1_.exe 2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4352 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe 3736 Logo1_.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1224 wrote to memory of 4352 1224 2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe 89 PID 1224 wrote to memory of 3736 1224 2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe 90 PID 3736 wrote to memory of 4172 3736 Logo1_.exe 91 PID 4172 wrote to memory of 4272 4172 net.exe 94 PID 4352 wrote to memory of 1272 4352 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe"C:\Users\Admin\AppData\Local\Temp\2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA6.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe"C:\Users\Admin\AppData\Local\Temp\2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe"3⤵
- Executes dropped EXE
PID:1272
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4272
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe
- Size 230KB
- SHA256 996fd1a48d450513c5340472608ac1945a23cce91efce1519397fec6d29cece4
- MD5 63dda6216d1264d42101492148d68d17
- SHA1 68e8923a59ecff9bca05284c48be59125ba993c2
- SHA512 03eb2601e5875df589b5727bcf06c5d22a1155d3592e3eeb532e32c1248bea9fb7c785a626e0520a94f15a8fd23c791415b2269b145ea4814c10169331581e55
- SSDEEP 3072:pDkuJVLl/rfzYT6X/D/24l/DFeodwgjf+FvC6C36lnWesuoB+ICTRK02Bd9Pqwro:OuJZrZl/DFf3WC3as7B+WCR
- TLSH T14134701273F84929F8F39E316C398F2A993ABC31EE34E66E1644119E1D35A519D31B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
- Size 663KB
- SHA256 e4794e804622c25a6641705a584e23e904e368d5cc7c81e9cf73873cefac3939
- MD5 839e5b7dfe319153b00f4261bdd22749
- SHA1 f1622eb4c1e69f44f36a86105e9b771d2a328901
- SHA512 667e0682f2b6e7ba06e467e4f3b6521335e7751cc797f4dcd909b1efafcaaeec73a28a64bd43d4f7234fafafc0c3e60f281763491f822e0099903bcd76281993
- SSDEEP 12288:wTnMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:0MysZgjS1hqgSC/izJfojymk4HM5yJ
- TLSH T19BE49E32D5604032E6F206B3B958A2347D7CE218671489AEE7E8ED5D3EA848177F7347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aFA6.bat
- Size 721B
- SHA256 89e6192383fc1564a2ae83e2531085e02468439582f681f2ee3756a2c59c49ea
- MD5 4ee3bf2d77c72a10863f523667d0bc90
- SHA1 dcf3af0794c0507cc8810273582368a86ead1885
- SHA512 e9b8b1693075fb685a18f0e2344ed75ae9443d438c01c9bbb806993805219f052a5f94b6985d2f9e0bdd41612cb2d4d5bd9e839fe020800a741253bedf506d0c
- TLSH T1F201F737C246DF690FC8602F935118CFC1B9097C77492652AD1394AF6BD590AFD831CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2050a7ef9b4010cfd5eb1f9dd9e93ab0486eeb556caa2e58b3f7841ab42b890e.exe.exe
- Size 130KB
- SHA256 5f726d95a9ba1aebe43e8188edddb26556c730e03fb6227745e8afbf07d80c54
- MD5 b42c964e0e6aa56983e77542692320cd
- SHA1 b75ceacd2e7f73b2c5c8b95373e08665a28a1ae3
- SHA512 6a29fe2add03e2a7c860cce440ca891e6eacf4e5d2a2476e03f618132adb30be46dff1965479fd2c3e564f3941e03dcc6a265834ac8f218dcb6ee26dd55a0b72
- SSDEEP 1536:DOW/8cs/c59bqgU/KMkDE7JnRl1qgU/KMkDE7JnRle5c7dxol:DP59eguKMkDEmguKMkDED4l
- TLSH T154D37E4E875944ABE57059B6C0AFBE5002A02D3D3E83C7BAFE58B50379723C9A433579
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 29KB
- SHA256 52a57177234eb7932551c89f157572f1be54944e483b2f1e110d59674b35be4d
- MD5 bb0bf90957db94241b7051d0777fefa4
- SHA1 5a7316dfea5e0fca259363e3dbc7aa4bb9ecd0db
- SHA512 390bf71b0141e0356a0842b0ec327d9db38888d76caaf6ef1eb9cd31bdecc3954d564e8761213061b2ca29cafa54c57c377747a9c6ab7b7a1d8a2c4aedaf70c0
- SSDEEP 384:NbblrewxU1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:ppfU16GVRu1yK9fMnJG2V9dHS8
- TLSH T171D2E0A0F3DC29E3E1910BF098EB5F964426F658EC4EC21F6D2462562EE06045D73E37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\_desktop.ini
- Size 10B
- SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
- MD5 abe10c07c39b10751737f269a71677ad
- SHA1 fd681da28ec949033585f258c97fdcd4c2b770ed
- SHA512 9fd85ed0473d0bc29e8ba5f9ae48c455eaca7695981ac3e6e58bd941f7cf20fea3cf4317539335d03db64809e239b08b7e7bd6e6b4ad28bd2862c44e8b07651c
- MD5 SHA1 SHA512