e437b2faa15a899d811f123eeb7ef9fb464904ee0a0cc01138a827eb84b2d382

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
Size 1006KB
Sample260809-w2dbxatcqc
SHA256 e437b2faa15a899d811f123eeb7ef9fb464904ee0a0cc01138a827eb84b2d382
MD5 8e651eadaeaa39b983ec89a50cf72ffa
SHA1 a8418e5c41ec8301bc671b7686b604a3c652cd2b
SHA512 db30429e2e60dd42fdc2ca72722961e28a0f1e4aafcb8995b15e3d17639af3df71af6fee30c1f9f97aa1bf095474f4d065c880b1f25a399a4f11dbf2ecb14c3b
SSDEEP 12288:97+faURs8XbMhmCryZjevG/0Y0EZcuadLULqtRCFIVk2fZo4YVTeUGcr7r/:97SXb6rKSY0EZi7RCFIvZo4K7Xnr/
TLSH
T17F258F61BAF9F231D85049B02E686B759079ADFEEF7103EB5E82365940341D21F30BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5064	Logo1_.exe
6124	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\attachments\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\PdfPreview\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x86\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe
5064	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 5080	3276	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe	89
PID 3276 wrote to memory of 5064	3276	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe	90
PID 5064 wrote to memory of 5412	5064	Logo1_.exe	91
PID 5412 wrote to memory of 2592	5412	net.exe	93
PID 5080 wrote to memory of 6124	5080	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A8E.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe"
    3⤵
    - Executes dropped EXE
    PID:6124
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 ba44ba8a966dea4fa3dd66402fd0a20bce209338ffdb618d53d9ff3dd7815548
MD5 47e2cd81c416254486d9f115e9b2cf17
SHA1 dcb6f7f8b99cec99935b5c0cbd0295605f735370
SHA512 1d7ade860db5ea53598bb996f1080e16f710d892205ac71e8764f73436bcbbfdf2dd14ae5753149ee8fc05dcffaa2cefba3bcfb3055f133fe572423d95f76fc5
SSDEEP 3072:lftffjmNHhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:lVfjmNBG7/fYfLvzB+QFyn
TLSH
T1F0C38D1371D08871E9B24C3049E1EA619E3FF9620B449EA737C466BD0F317D1DE26E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 1f06570aa3d1064cd6e7bb1641c7660e9991de3dfe2f36dcf7168a7ca50f822e
MD5 f2f0fc2163d1d3b8943f7c8ce8652717
SHA1 aa16c31090c81095065f77f884f1a1be1c5bc858
SHA512 a839f70d5294d1971b0d36c98189ce41054837f70fffc9f5232b116103ba4e14c3470c4414b5cdfd25d4abe7cf5723d74671497021f12f095a2ea733ea15db22
SSDEEP 12288:vp7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:x7/BOkUhMXcBwc04nA
TLSH
T18CA47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a3A8E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3A8E.bat
Size 860B
SHA256 6a030fe724e938ed301e0fd0a29432f8aea21b22ba246c6cdc93b638dd6bcf23
MD5 ecf7da90464c4d1f8271b931f457c793
SHA1 0c7fb629273eab4c6584eef1219da7aaa0eba22a
SHA512 d9cef81be536902640ff4620b9d1453523a54212cf23775475ca1262e0d17b6fccb7046b25a002bba952af1370258b82277bd06140267b8f896367ae7c094821
TLSH
T133110C01437AF67A2884904B8F60F82FD0447A2B6A5E3726662CC7CE96C6C4AF4663C1
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe.exe
Size 979KB
SHA256 00907042e89088616f9fb65d6017341415f65c56fa15c379e514d12a283f815a
MD5 0b1681ddf12618284a6a29ca4817774d
SHA1 492597ae04c962a497b24bcec6d1f5096b1d7989
SHA512 cfe8784e1481c2826c647749c5fa7e5023c396b48517acbe3fb2aeed00e7fbe02f6ba8a96d2bb98fe5311be5cbc589e2eccb5b465ddb1488bf233762715fe46b
SSDEEP 12288:WaURs8XbMhmCryZjevG/0Y0EZcuadLULqtRCFIVk2fZo4YVTeUGcr7r/:wXb6rKSY0EZi7RCFIvZo4K7Xnr/
TLSH
T112257F61BAF9F231D95049B02E686B759079ADFEEF7103EB5E82361940341D21F30BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 1b301776d9eba1270010a8a158c707ceaf69c752c957d6644e952a87f4375a22
MD5 cd45b437750e2d1d99b5364daa7c8614
SHA1 99ba9d50341762530576c9cd60c2bb2b08dbc8f0
SHA512 eda8083bda5dffcb25da054efab1c0dec7b2793171152769515d3f3ce891b2880e6237eb17a1f36b853aae78861b29e4d1e4359858612e504abd9265124d2a75
SSDEEP 768:YsJ1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:XfgLdQAQfcfymN
TLSH
T1D6C2E0F912C96A74EC228EBDCBD69702432D0B79109F282575A391BF2111BB4204EF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3611646547-550105268-947503007-1000\_desktop.ini
Size 8B
SHA256 9665de4083439d021866163b21bda2a5f96fd16cd7572fbd2966e90951743829
MD5 fbd4d05c754ca8e6e9927860714ab856
SHA1 70f0865f40fc4cede69e788e26ed14ba0a05a242
SHA512 cab7618c5a9e453f59e89acf2cdfde870b9c226cbfdeaa200be64076935cf258481018f241f15ab258d2dc85534ce3edfc3f3a27a7f035cd4c3a16fb03a88b57
MD5 SHA1 SHA512

Submit Download

memory/3276-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3276-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-43-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download