278991f45ed9fd921ce51d414e98581b9299327b5a884b8133d69545e07a27b1

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
Size 669KB
Sample260824-ehc4cssfpe
SHA256 278991f45ed9fd921ce51d414e98581b9299327b5a884b8133d69545e07a27b1
MD5 9ccadbc5e2082fcd7769b2f27f3e4ccb
SHA1 667fa5218f6db40a7b0068807f1aa0508b3d82ff
SHA512 12356a40b6b96d0a42eaa0cec6f7201abf6c1d26935007b671f268e2d4eae69f3ba3357b3381506314fbc615b0b2fecb310438419ceeeb05f73b153264c7d44b
SSDEEP 12288:X7+soi98fUE5wJVOGfq6fKqTUHT3WK8IjtRXE/pw5VBgB2f+h0xs3sgXOT:X7cfUE5wJkSzTUHT3WK8IjtRX8Yg4C0b
TLSH
T113E49D22F900C032E5D1027A87BB4BB55D2E9921172E94D3BBD0ADE85E705F2BD3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4860	Logo1_.exe
4888	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe
4860	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 3596	3564	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe	89
PID 3564 wrote to memory of 4860	3564	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe	90
PID 4860 wrote to memory of 4316	4860	Logo1_.exe	91
PID 4316 wrote to memory of 2312	4316	net.exe	93
PID 3596 wrote to memory of 4888	3596	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE431.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4888
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 72f3d1a36ba06b0e912ae8f70f3c047c6d5e8870d266f4872822ff8860f89ca2
MD5 2062ae0a454a5d8c42f21fdf6029a646
SHA1 da8a1b0722ec51cee9a7a80b210b2286c29aad29
SHA512 27d9c14306dac4ea2657da24cecdc75c61853edc4f8dfaaa691049d92a7c26fad58e2229ddb48a1ac00886218b30b030d02b60125d6b214ed24d2d331b375c11
SSDEEP 3072:GNftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:GdVfjmN2G7/fYfLvzB+QFyn
TLSH
T1B2C38D1375D08871E5B20C3449E1EA619E3FFD620B409EA737C466BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aE431.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aE431.bat
Size 920B
SHA256 8efb226d8e78ea6f87560b918738d7bac4ae38fbb61a7345cb80a062aab0f3a6
MD5 6c2a5f84e3257b538983765bcbcc4f71
SHA1 e50d9f7c8c29773ec60812ead137c2cb4ffac351
SHA512 75e86ff3ff2a1c15018e49a133ae651b4b3b341e6f57a92e644139bb2ee7bbdf27f0e8c1fdabe0f721c2a8c7186c0d87cca420aa1ae661485aa6b0b3d1d208b0
TLSH
T1FB11274181E7CE3F26C9D24B06706CCAD290B51A9F8A1356E231CDCFA9E1CCB75E3680
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe.exe
Size 643KB
SHA256 c84e4070d426407ceb8bacc59cb075241dde62dd7052b95f730f115281dcbcca
MD5 b529de1fb3c4492b029aa2a236210c6d
SHA1 3b5a708a331042a81976e7f8f6fefa81a4fa795d
SHA512 bb9049d741128d4594150b0a1683eda15cba9a30ebe087fbda014f0c897ffd15a70fec907a364d6b233ec8305d9d79ee14585c74c5bc88c7214a7721a16fda79
SSDEEP 12288:goi98fUE5wJVOGfq6fKqTUHT3WK8IjtRXE/pw5VBgB2f+h0xs3sgXOT:LfUE5wJkSzTUHT3WK8IjtRX8Yg4C0xN3
TLSH
T191E49D22F900C032E5D1027A87BB4BB65D2E9921172E94D3BBD09DE85E705F2BD3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 ff8473e9ad4d91b9833df39354443a7ebedb44e0c124d727350f800f5a3565f8
MD5 b7d645e07b6a27a8838afa9d0e40e4d9
SHA1 71e380a1ea280e8231b82c1a7769dfbd4763e769
SHA512 14e0cc13de63e6abe56c1c272e6d505e0688f78426e4e4228eb2cbb3882c0e00bbe6b50972278e9c695e3fb0eaa4a5db0a1e67f36225c93b883022e59a7d57bd
SSDEEP 768:Lf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:LNfgLdQAQfcfymN
TLSH
T17CC2D06A26C83578D826497CDBE39791833D0E7A045F546726F1BA7F2270B64200FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1738198120-2966725515-3980530802-1000\_desktop.ini
Size 9B
SHA256 e7a73e3169f6957e81cc3715978360652a0c0c7f11314e8d737cf084f4bd5e71
MD5 626b4f4b13f8b093beed9653cd01e961
SHA1 9d1650dabbf3eb93f23170f8d9b6d1062bca0b49
SHA512 952f4de7159785706ec276883bf9693cca6083456ef9da3e7b0d9b65f75a3c7b326d75cba0132234d1905a50f0a95392b18062360757a8ecf8ddf37f6418fcd3
MD5 SHA1 SHA512

Submit Download

memory/3564-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3564-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-176-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download