eecce94ec478c08ec2bd471449cf34e6ef865f62f6872133a4e2fda4e152e310

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
Size 2.6MB
Sample260715-rtp9aahw71
SHA256 eecce94ec478c08ec2bd471449cf34e6ef865f62f6872133a4e2fda4e152e310
MD5 2c555b03faba41bf10885d50fbc2e6ec
SHA1 ea9fd883ae16fb6bcf341682258c8824c54c52cd
SHA512 d55d37d26384803f824da0b100619fbe1924e3a172de496b561c0a4d6142f66c213db546f048b22b857af28cee04b794c16aee41b35c74c31a742d61e6adc96f
SSDEEP 49152:t7uBLlxwV6v0BT6iUdxPAAAAM8/4PvTk3fqNotWDIAi/5lAi/5OwvE6m2:AfwI1/b4PvTk3f8HJi8iD
TLSH
T165C59E017A81833AE95342315E3DAB64946DBD710B3981E773C47B2E99326E2DD32B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4492	Logo1_.exe
3556	2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\EBWebView\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
4492	Logo1_.exe
3556	2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
3556	2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 1852	5500	2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe	88
PID 5500 wrote to memory of 4492	5500	2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe	89
PID 4492 wrote to memory of 1380	4492	Logo1_.exe	91
PID 1380 wrote to memory of 4300	1380	net.exe	93
PID 1852 wrote to memory of 3556	1852	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60D3.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Users\Admin\AppData\Local\Temp\2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3556
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 18090a5a9b10a36b9a6823423e0d69d4425d77353b115f2d3f6f672794cff422
MD5 36a62636501099f2f78477c00bfba842
SHA1 fd89c2a3ee31d81f03b99a126bc4fefe51828118
SHA512 8322f63e077bdc883a35360f71d465d49b054085c40aed8eca8ffc71ef0928f9b32fb3b9469ed84e47b4b0702b210729625ada84de64a501a203517850232ea7
SSDEEP 3072:uftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:WVfjmN2G7/fYfLvzB+QFyn
TLSH
T154C38D1375D088B1E5B20C3449E1EA619E3FF9620B409EA737C4667E0F317D1DE26E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a60D3.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a60D3.bat
Size 950B
SHA256 5b7a58ad997c874a3e71a730b27caea5c2212c60330428e059a55977a685e822
MD5 9a3eb6cec8bb09923f8dd547187e2ea7
SHA1 fb740897247dcd6a4c2f7c1d71947069836ecfd6
SHA512 a71a18919a72513c5a82fbf754b66e469aa872fdbf0efe9e673342de52eaf4de313e613b56a16b8ccc9cecc026048b165ab62b0ec28bd3f5590248482b68994a
TLSH
T11C11270240B8D7352182E80B1BF1691FF060BCEE7A1E339573249ECE6AF148F71E6180
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-15_2c555b03faba41bf10885d50fbc2e6ec_amadey_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe.exe
Size 2.6MB
SHA256 a5111e859525b5bef8e66b90cc2b0f15f6876de638118b0af1c22243b0fbae8a
MD5 d31b9644acc3472f70fac751538766e2
SHA1 319812d7c065292448abfeb507d7ed43f133aecb
SHA512 b2d2c685af994670282db796aaa52e71716683190d85d8ac03a740ad9e95853b53c3edcc0425a591e47fe865a7139560868d88962527ba4e864c34c06ccfd076
SSDEEP 49152:bBLlxwV6v0BT6iUdxPAAAAM8/4PvTk3fqNotWDIAi/5lAi/5OwvE6m2:1fwI1/b4PvTk3f8HJi8iD
TLSH
T1DCC59E017A81833AE95342315E3DAB64946DBD710B3981E773C47B2E99326E2DD32B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 26KB
SHA256 214d219c981e0f6973b48d061f340d5aa5ef86ab4b00a2c5ca2308f7e030b11a
MD5 97399919fa3c1a59b1a84e52315919a0
SHA1 6a89be874575f60905792f1c21a0897e77181fc2
SHA512 2bc3e5c2fabcaf2aa1022c438d081998a0162d87b3318e2786521141d85b7a7b78596a29f6f44a98ed390470180ea6f0f0ecd1c842f4798348efe1815c062b32
SSDEEP 768:R1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:HfgLdQAQfcfymN
TLSH
T125C2E0791AC91678E8660D7DDBF36701C37D077D409F59AA2AA2993F2360B68100EF37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2246396966-3025826688-3847171515-1000\_desktop.ini
Size 9B
SHA256 e364702191d7bad386e0e119e959764fa8ba675a1c38bf293de851a39dfb46d1
MD5 5163114d1812c769004b2acd9a93d8b3
SHA1 9a60427ef77ae3c8f56b3ebdcc646bc2e1452f1a
SHA512 5f8863247d2dd65b928806a0a633254932cf6e3cfec669a63d9caf9b94b4c438dbb23060d91c6d9034be1ad11946f3edec5906d7ebfaebaf181f135af462cfb6
MD5 SHA1 SHA512

Submit Download

memory/3556-23-0x000000006E150000-0x000000006E160000-memory.dmp

Download

memory/4492-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4492-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4492-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4492-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4492-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4492-87-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4492-1248-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4492-5045-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4492-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4492-5518-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5500-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5500-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download