Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/06/2026, 12:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target file.exe
- Size 170KB
- Sample260626-pflmtsa15x
- SHA256 f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906
- MD5 79c3344864afd83d6cfa95aa816e3286
- SHA1 c18fdfd1a053a9c408fb8ae563ea55684be5d4ab
- SHA512 329e047f2624900bbb6cdd6641345b44015f5291e97c2fa389a0874109b0ba3fa96044eb68168dfa1d1d98f78d7e738f845fb1baabe12c29a64ccfef8f332a7d
- SSDEEP 3072:GVDsce3PgRODbw/g4jmlAQJRSeI01tGrrP/lOAg0FuD0k9qMaf5A:GVrRys/Lfg8ex1twMAOJ9pah
- TLSH T1A2046B10B1E2C4B2E673053118F89B75597DBD310B214AFB67D80B7E4F342D1AA35ABA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
remus_stealer
C2
-
http://myrtler.biz:9549
-
http://carogra.biz:4219
-
http://youngel.biz:8768
Signatures
- Family: Remus
Remus is a stealer written in C++.
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" file.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 4 1156 file.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys" WinSysKdrv.exe - Executes dropped EXE 6 IoCs
pid Process 4392 0_240719265.exe 5908 winhost.exe 2212 1_240723093.exe 1380 WinSysKdrv.exe 1796 EmbeddedDriverService.sys 1816 bozuniby.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: file.exe File opened (read-only) \??\V: file.exe File opened (read-only) \??\I: file.exe File opened (read-only) \??\O: file.exe File opened (read-only) \??\P: file.exe File opened (read-only) \??\R: file.exe File opened (read-only) \??\U: file.exe File opened (read-only) \??\A: file.exe File opened (read-only) \??\N: file.exe File opened (read-only) \??\W: file.exe File opened (read-only) \??\X: file.exe File opened (read-only) \??\Y: file.exe File opened (read-only) \??\Z: file.exe File opened (read-only) \??\D: file.exe File opened (read-only) \??\J: file.exe File opened (read-only) \??\L: file.exe File opened (read-only) \??\M: file.exe File opened (read-only) \??\T: file.exe File opened (read-only) \??\B: file.exe File opened (read-only) \??\G: file.exe File opened (read-only) \??\H: file.exe File opened (read-only) \??\K: file.exe File opened (read-only) \??\Q: file.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1816 set thread context of 5244 1816 bozuniby.exe 100 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\NotificationData Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ file.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4392 0_240719265.exe 4392 0_240719265.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3464 Explorer.EXE - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 1380 WinSysKdrv.exe 1380 WinSysKdrv.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1816 bozuniby.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3464 Explorer.EXE Token: SeCreatePagefilePrivilege 3464 Explorer.EXE Token: SeShutdownPrivilege 3464 Explorer.EXE Token: SeCreatePagefilePrivilege 3464 Explorer.EXE Token: SeShutdownPrivilege 3464 Explorer.EXE Token: SeCreatePagefilePrivilege 3464 Explorer.EXE Token: SeShutdownPrivilege 3464 Explorer.EXE Token: SeCreatePagefilePrivilege 3464 Explorer.EXE Token: SeLoadDriverPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe Token: SeDebugPrivilege 1380 WinSysKdrv.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3464 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1156 wrote to memory of 4392 1156 file.exe 89 PID 4392 wrote to memory of 2096 4392 0_240719265.exe 44 PID 4392 wrote to memory of 3464 4392 0_240719265.exe 51 PID 4392 wrote to memory of 4356 4392 0_240719265.exe 63 PID 4392 wrote to memory of 4408 4392 0_240719265.exe 64 PID 3464 wrote to memory of 6084 3464 Explorer.EXE PID 1156 wrote to memory of 2212 1156 file.exe 92 PID 3464 wrote to memory of 1932 3464 Explorer.EXE PID 4392 wrote to memory of 1816 4392 0_240719265.exe 99 PID 1816 wrote to memory of 5244 1816 bozuniby.exe 100 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2096
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Modifies visibility of file extensions in Explorer
- Downloads MZ/PE file
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\0_240719265.exe"C:\Users\Admin\AppData\Local\Temp\0_240719265.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\bozuniby.exe"C:\Users\Admin\AppData\Local\Temp\bozuniby.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe5⤵PID:5244
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1_240723093.exe"C:\Users\Admin\AppData\Local\Temp\1_240723093.exe"3⤵
- Executes dropped EXE
PID:2212
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4356
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4408
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe1⤵
- Executes dropped EXE
PID:5908
-
C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sysC:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys1⤵
- Executes dropped EXE
PID:1796
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0_240719265.exe
- Size 43KB
- SHA256 9ef81e30de63b209b970c48d63f893cedb17f958cd9bafebf27cca6aee4eaa48
- MD5 f29432f7ad9571119dca3cd5c9b4bf89
- SHA1 c68728ce1137e3dd255adcac69182985d85a1ecf
- SHA512 e7908734b90bb8314d21161451ad0e4118e1d178fd9fa245abc44c1679ebc80f5ad7957cd17762db108d87076ef25d7848e1cf3e4c63d1c3ceaf07c5c15c0600
- SSDEEP 768:NT9UJElgiV+/TVYNgvxVWpm/9BRnD0/ShlkKieNsfLmidxPPVVZRxzEzyC:lUElgc+hYivxZ/LRDUSUNzVdxPdbRcyC
- TLSH T191133C1E5EE91156ECA1C334C7695737DE20B442B7281EAF0FAACE591F23223F511E25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1_240723093.exe
- Size 265KB
- SHA256 a09b8f3482137394a421f6a96eaa3664f468ddfbcdf01651dae8fc0898e9a13e
- MD5 b31e9f2479f734538e6a378656f05ceb
- SHA1 1a716ea4ead1f0bb4110689494fa6fef7dc3cfad
- SHA512 32ea8aae9f44b49511ab02abfce662fd7eebb0c5d9ceb6f2ec652279f3185d1403e189d98f6502ec0780372b704c1a6401d6cc6f9a6ea490fc5534b75006250f
- SSDEEP 6144:FJHTrrdy4gptRY/6l6Zaoxf7rxyBNdOfUHJF:FJf5c2SlI5xfMBNA
- TLSH T1F3447C4663E524F9E0B78238C9A54B46E771F8621330ABDF07A0865E1F233D1AD39B71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
- Size 34KB
- SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
- MD5 485a04675df7cf40a8865706e003eb25
- SHA1 711ef221526997039e804a18db9647c91680bbe2
- SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
- SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
- TLSH T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
- Size 147KB
- SHA256 be495b5cd25cba230cc88aa99d34f2f7b70201b7047ae7a605950756acce215c
- MD5 e57325406173324144960bbafbad6a11
- SHA1 f9fde8480bb883016207f154dd473e56d629b36f
- SHA512 fd0ed85d29948c512cb072f13d2046677318dc4af588a1b7507adb538cc0227bb00634204feacb7840f0e3fc21b26074b6dda61d1737156e38ea41f918719686
- SSDEEP 3072:zEM70gfA56h/elpYxyB+yLgFeOWX+LIbnZz8EN9lDt:/xf7rxyBNdOfUHJ
- TLSH T10CE35A4363E920E5F1778638C9A58646EB71B8320720ABEF07A0465A5F237D1ED3DB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bozuniby.exe
- Size 319KB
- SHA256 bfba9ffd723cb8aba936c02db11d71aa37838efac3ef258b9e97180c49577eaa
- MD5 1f0924fefc5e5b945bade42870df13e1
- SHA1 c22a5ed2d7b09ec8981563a0a8a477b9feb4918f
- SHA512 652bf1965326cbe718b9f1af63404239d70f4db27f2e56f64e77812ea1dff41578f4356e4d554f3cdf8d26abfcf78ef67f2031cb690ce2cdf9e67d173834dc76
- SSDEEP 6144:JrkejPzxtdQQPduBjAfokhPYJJuMjBUnm3XfMmuXz:5kQ9wBjqSJsMtT/MHj
- TLSH T1CD64F16B73AA30F8D1F78A3984A50518D362FC361B619BEF07A142522F272D54D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Desktop - Files.lnk
- Size 572B
- SHA256 8244aae5a51d6a752b620cf6cfb20f85935bd873614631758f8788e55905c062
- MD5 f296493d70ae6ecbd3b41f3262fe8430
- SHA1 d9ec98c4b678bdbc3e1bf8fddd51a6a5c81a909a
- SHA512 4d1530d8085b912bcf84a789b6431f760854fa653bd599d65573f81816f5193bfcdb5824c469c657370e67aaf4fd2e906c276903bd3d46371b30aeff227b0e76
- TLSH T17DF0590312F34F6EC123D9B964790385C371FE02A142D60F40D48A1A2D963408158B12
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Desktop - Files.lnk
- Size 927B
- SHA256 824a2a9fad1de6f0f131aa4613503735d03c94e0e010bca8099fc8710856f8f8
- MD5 76555d0bace977457248d4e737ecdcd7
- SHA1 fcd67432807792574d8c0e8fdf25872720ea81bd
- SHA512 917889a680faca8132cb48b848dc8bc7062d6ac253f861f9043413c062e65fce84931a8a4289d8c201511c988673035bd203312a5c899d1f1d8ba9b3f95196e3
- TLSH T1CF11F12369D30F16C0ABE7B438BB1368D2B1F61573166B5E4090C6052D52F81974AB27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Downloads.lnk
- Size 761B
- SHA256 32efa48314b52c65896a74fe63541bef52c353c37ea0221f7b8f666a8742beb4
- MD5 63be04546f41b679a9ccaf7b09288bad
- SHA1 a0747d731d247aa5e31dfcd3014ddc8fab92fb53
- SHA512 fac5077b595508d9ff7cb23e84bf534b51c6c1a367361f53b4885f26e704de1c1aa26228f8a8e4de805e8bdb9fc49119540502b71889c04401d921c5740b5d3b
- TLSH T18201990A16D2473AC2A6F43CA8AD13CA9361F60276028EDE89E497052CA22C3A54DE56
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\My Documents.lnk
- Size 761B
- SHA256 3c781fdd0715eb3d02030fc018794326ed02814f621b61b157507cc6b82b8d64
- MD5 8d9fc437b6048997247550548f1d4679
- SHA1 5aab4a7b1eb162da268d8ce8f12df612d9f666c7
- SHA512 5b7c8bd11eb12e770153904133c57fbbf052422d7ec50fe39a1bc5527f4b0479cad69515d8788766ae45b4e5e584b93e4ab7dfb85c8b454fcb018e443972151d
- TLSH T1CE019E0A16D2473AC156F43CA8AD138A9361F60276024EDE89D497052C622C3954DE56
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Shared Photos.lnk
- Size 761B
- SHA256 889fab54cae744dc9d92188b55ea4143d85ad8918e4c639477bfc18e24b4714a
- MD5 df3a98776ea8e1416350c39c3c7602bf
- SHA1 981351d3bcc636e6dc4daff60b25bd9f226b00a9
- SHA512 07cd06eea58a6a49fd5daa82d64a5ec63ad3c9d6e770b83a36eb7c5f1d69177b0fe914de3a98a0f450a26d1f0271a58ab6cff7384af26bf6b81fa2568faaf33b
- TLSH T1DF019E0A16D2473AC156F43CA86D138A9361F60276024EDE89D497452C622C3954DE56
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Work Files.lnk
- Size 761B
- SHA256 f973c980203b055490b28858ab8fbd111f157caa28f8551449b74e6b42b38f78
- MD5 595b851f76d331d26ecf1c568940d428
- SHA1 306f032d5eca4b166a91b3563ff2d566f0c03d07
- SHA512 2fbac7f4008b1d0146494f463825f65df5028f53d8b49ec8806db8841f579c4dd0270309b0df950915e879908d20a5b4ecc0e7c0f920b8693e67a565f6ddbee5
- TLSH T19E019E0A16D2473AC156F53CA86D138A9361F60276064EDE89D497052CA22C3954DE56
- MD5 SHA1 SHA512 TLSH