e30692bf54e77da26f4ef6b588ad5761912e83681acdee4c86b56e9a74bdf208

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe
Size 1.6MB
Sample260905-apm5pazyft
SHA256 e30692bf54e77da26f4ef6b588ad5761912e83681acdee4c86b56e9a74bdf208
MD5 ae6f15580172bdeb34482c45b39e1851
SHA1 9f84ea5a7399c69109d8d0d74fcbfc28d041acaa
SHA512 313f6ece5b8bd034f615bdd38a5ca4433d8678a5ecd6b498acc3be4bc98b2af01ef3d2cbde68dbc2a0de4a5e88fa0d77d56d0efc98190e2b080d595c666ea778
SSDEEP 49152:q7TAAmtmLtfg2MDMxCKk9IZ0qHdScmBfPMsN:SPmt0NMy7HqN
TLSH
T140756FC3915606DFDCDA923C454A9501E1BB3C894B206BC782B03BB98E7EB977EF5610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1216	Logo1_.exe
5672	2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Projected\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3160	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe
1216	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 3160	4052	2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe	88
PID 4052 wrote to memory of 1216	4052	2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe	89
PID 1216 wrote to memory of 3668	1216	Logo1_.exe	90
PID 3668 wrote to memory of 1160	3668	net.exe	93
PID 3160 wrote to memory of 5672	3160	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1CB.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe"
    3⤵
    - Executes dropped EXE
    PID:5672
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 586db11b186dee68ed5cd0430353215e262e23b9c7c86bafc02d1b3d785f2c90
MD5 8bf3d51f635da38e5c5e82ed12bed61b
SHA1 c9c44872fb0f310e317d86ecd7fc3156bb53527d
SHA512 09c283df8d02289acd14fe547d50a63e47f65bfc2b2b9916e94fb46a3fddafd4dbccda4919321cf0b03e1aaa799b60732123b532f4c1ca5d0c939204748b9c6f
SSDEEP 3072:YftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:oVfjmN2G7/fYfLvzB+QFyn
TLSH
T162C38C1331D08861F5B11C3049A5EA619A3FFD720B849EA737C866BD0F317D1DA36B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aE1CB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aE1CB.bat
Size 902B
SHA256 b019d02744d6009563ee2d4b3d0e2cbaa199a9fad4bcbdb97f2f78bad10fafad
MD5 bb9273dc22206290d78cd6010677ee6a
SHA1 49c25a48e54675ae85db937e36920d4a47460fd9
SHA512 af163f866c9d13f76bffc07d061cc89fea03269ef25186c5477466c9fff0d00502158ffd0f35afd3f794a2f6db3234366d4c86c422f4f9e3c210f40f7a4ef514
TLSH
T18211E94184BBCB756050EA074B64ED9EC28A37623F0D23676B608AC8BD6748DF4A12C6
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-04_ae6f15580172bdeb34482c45b39e1851_cobalt-strike_coinminer_elex_stealc_vidar_wannacry.exe.exe
Size 1.6MB
SHA256 cfc73a8e4d2ba69ca27e8045e6aa89a8cae4fd78208d8b1127f68e2d0efdf989
MD5 532435937a057d6c34ec84a516290fca
SHA1 72ee3b3dd39cc0962ae09beb120f36e97bc1fe19
SHA512 37ac8e2d5293c48227c9045c3d18a99695265052f39e1c134085e9d97f751477cc536a59723fe00693b595896a63760f1f2392164b8ff3e0b5002efdd1127374
SSDEEP 49152:QAAmtmLtfg2MDMxCKk9IZ0qHdScmBfPMsN:QPmt0NMy7HqN
TLSH
T110755EC3915606DFDCDA923C454A9501E1BB3C894B206BC782B03BB98E7EAD77EF5610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 da09620b8384f39cd7acc716c9fd4372bbe8f74ba9e934a534ddc573d1d0b384
MD5 29237f61b62a163efa7b25bfaa3ec532
SHA1 35673d8bf821f85421620dc93d1bf9f43ac1a9ee
SHA512 f4472c62d81a025de5d5fe791e402b702eb3477b95d9fb54844c4df36dfbc6180568ba34620cc49c1fefd748dc2b9ecaafe2cb32393284b946b438708b427362
SSDEEP 768:NQ1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:NCfgLdQAQfcfymN
TLSH
T1A7C29C6532CC1D64F82979BCDAAF1601C229CE7B04DF54653DEF48EA21D0768302AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2246396966-3025826688-3847171515-1000\_desktop.ini
Size 8B
SHA256 da1bb1bca7bacfef83e163458a5dc3de34696cdb080efd4e6b0563ece01f2730
MD5 3edf7bc2ad6b8fcb7eb225adf1decd05
SHA1 2fdddb835eb68f5b222896f748b550101955167b
SHA512 a0e0e480cd32da01a5bbc0a07627b361ff1ad293bd917d567dd18b766081bcd7855f3832c4c7df7bc2755a4a9d7461ba4e80be7c62b0a9e9e875adde684c485c
MD5 SHA1 SHA512

Submit Download

memory/1216-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-171-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4052-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4052-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download