3c4b5f3665d9ce4c7d45307ec0b9d684e7a8a45a467a766228d86f428324cbde

Analysis

max time kernel
150s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
Size 43KB
Sample260425-ppa8fsct2q
SHA256 3c4b5f3665d9ce4c7d45307ec0b9d684e7a8a45a467a766228d86f428324cbde
MD5 47a4ef09a26f3aca4266393f56087d88
SHA1 32b0862a66618fbb8b03476b695de392d66388b0
SHA512 92dafb5d83d26881a0de90eb3deab8fb9dee04e5201e2b2bac56f9d2e76ae272151d1ce865579e442207af321b8409a203a0d339b0dad6dec741f33ef701aebd
SSDEEP 768:pL16GVRu1yK9fMnJG2V9dHS8/WQ3655Kv1X/qY1MSd:ph3SHuJV9NDHqaNrFd
TLSH
T1F113AE529BE864A2F7FB0AB078FB2F974972FD108C84DA1E4A707B9D0C34640E566317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6120	Logo1_.exe
2788	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\PdfPreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingNews_4.7.28001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2021.2012.10.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GamingApp_2021.427.138.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe
6120	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4112	3108	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe	79
PID 3108 wrote to memory of 6120	3108	2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe	80
PID 6120 wrote to memory of 1336	6120	Logo1_.exe	81
PID 1336 wrote to memory of 4484	1336	net.exe	84
PID 4112 wrote to memory of 2788	4112	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2277.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2788
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 ea20de2a11738202c5f49ea2543b1cfc74356c121c49c1177d8b4bfe5a42a9e7
MD5 6b4c588f937ec734b38daf073e8a05a7
SHA1 80f5bdbbdfcaf61f286458a682d7d4502572d05c
SHA512 4b43c1f03b79938d414a410f2113248b84b2b18367d493343d897383370c6dad183a060ed149e30a32bbd63d7b973acf46972e25e7f1f0d243af86877121bf4a
SSDEEP 3072:ptkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:0uJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T1DFD39D1376D08472E5B2593108A1EE71893EFD624D50DE6B37D42B3E0F316C1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 6e666e54000c945c096709c7972496c39c9486e7f023daae5048b9f515a1871d
MD5 a32953eab166b6e0b737c391590f227c
SHA1 08cf2399131df0cfc0cb591a7a821f0c0efb2ac1
SHA512 24d945415b1c4f8b2d463b105f4d2da7b1f1096554a7808f78c0cff3e7156de56043b035ad08218dac67d593f53e6480ad3ba7014ea627dcb39421f95a202035
SSDEEP 6144:0uJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:uXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T138C40916F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 33eed0776e70128759b6b69204542fef0b324599c45336a55a715d33021b77c1
MD5 1a5ab22b970a87e526b0d20b596882a5
SHA1 e8b374a387685516a02904eab9fdc400e8e6f3f0
SHA512 76d36d5f395a376b6c06483e25464575038c0fd2bb949a9d01b6dc49aa7a3fdf0635ce6eef11721ecb9fcae3caa58824b951abc20f900ab42faf33bac183fe61
SSDEEP 6144:weuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:woqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T144B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2277.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2277.bat
Size 722B
SHA256 297c35a7182cc0e6b1071952cc2772e3ee7ab84c4d6cb9c7716e282cbc2d192e
MD5 59b519b2c925e952a181867d3f1486f9
SHA1 77ae46fef2d256596f5ef5ce2318d18c5bb3bccc
SHA512 f2905a83402f350c43b7e1bdaaba1944022c9e79d17f9a41b5e34c39e1ffa3d92cbd65649c885b40e557d63484715cadf9fde056065a3327839c7d2891447fcb
TLSH
T1BD01525183BD657E3848900B0FB069CFC521F8493A86177763A5CA4956E281DFBE6383
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-25_47a4ef09a26f3aca4266393f56087d88_amadey_elex_wannacry.exe.exe
Size 14KB
SHA256 1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
MD5 ad782ffac62e14e2269bf1379bccbaae
SHA1 9539773b550e902a35764574a2be2d05bc0d8afc
SHA512 a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
SSDEEP 192:aplw/Q3AjmqdD5KOEBrXGWRVkdQ2l+8275N5y+NXNUoynP+yJihMrKbbP28d/o:MlgQ3655Kv1XtRV2QicXax+yJ+MObd
TLSH
T11A62D502CBA454E1FBFB0631B9FA2A875AB6BD104894DE1E47B07FDD0C34680E566367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 5ebf30aa9e1d1ce8586f9201aef58ffda47afd0c730459a804848318513127eb
MD5 f5e9a746c4a271414e99a836930ded93
SHA1 70de4bfdcc7390b9c0e03baa1c5fddf19fa9f990
SHA512 1c1e91306a7dd895f765672cc8c7a83f1c9d4ffb3eeda612b94f46d6054b227f68c4a07493792705e7a8a1248a9a03e1d510e3f98787ee282c05f56bf7544e5d
SSDEEP 384:Nbb+yp91Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pL16GVRu1yK9fMnJG2V9dHS8
TLSH
T12CD2E174BBDC7663F7AA1FF068A35FA74422FE20ECC5921F2D34BA5A0C706405966613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2397528088-2630719772-1129911217-1000\_desktop.ini
Size 9B
SHA256 49ae628b21eceb52cfae7af66d488c736e334e8e5a05bacaac62b3ddd791251b
MD5 acdb534d0253a176a2a0e1fd11e837b9
SHA1 a527b792940d294bca3c2fcec3cc01f48de60689
SHA512 ae6fee904c215193b2a84e2af6e46875b5c4ede55ec8a53eb88fc6204a207329b7b4e140e16c0630b3df64395b8533c4773e1a2157b654962d7c1390dc8097fe
MD5 SHA1 SHA512

Submit Download

memory/2788-22-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/2788-23-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/3108-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3108-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3108-10-0x00000000020B0000-0x0000000002172000-memory.dmp

Download

memory/6120-30-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6120-38-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6120-44-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6120-47-0x0000000000660000-0x0000000000722000-memory.dmp

Download

memory/6120-21-0x0000000000660000-0x0000000000722000-memory.dmp

Download

memory/6120-426-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6120-1234-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6120-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6120-5017-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6120-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6120-5522-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/6120-5525-0x0000000000660000-0x0000000000722000-memory.dmp

Download