f12ceec334aa86426fbc51d59920bff469ed37cc4bdcbf4893bd60fe9526b346

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
Size 972KB
Sample260602-dkty8acv31
SHA256 f12ceec334aa86426fbc51d59920bff469ed37cc4bdcbf4893bd60fe9526b346
MD5 a03ea06e6d85ade2db3530e5f36988b6
SHA1 056864dedee076755a68377be72523075be57269
SHA512 a5662654743901122824dbd84d57d00950656a6a38a46fcecdf237089f4453320ed66c98895dabc3523a0946974437b362777be356cab9539fb2fec14caa6444
SSDEEP 12288:NMExXTAFFLuQiWqUUtP4yjcsr3yDT05nn5xYbBX1iHU2//gUsUmZ/5YfBWrw6O:fxXTALuTTRr3yQEXErXgnZ/5YfBWE3
TLSH
T1A0257C607766D233E56181F24E78AFA6906DAD2C0F710ACF77C42B3E45361D26E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
852	Logo1_.exe
4596	2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\EBWebView\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.113.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
4596	2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
4596	2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe
852	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 5064	5484	2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe	80
PID 5484 wrote to memory of 852	5484	2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe	81
PID 852 wrote to memory of 4016	852	Logo1_.exe	83
PID 4016 wrote to memory of 1268	4016	net.exe	85
PID 5064 wrote to memory of 4596	5064	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A2A.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Users\Admin\AppData\Local\Temp\2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 5c4ed18c7637b91930ce882da7fdfb760e43d1948586d2106edd2476bc3511df
MD5 bb9ddf2a5a05eb64bfbf61747e9c74fe
SHA1 5ac9bdb47fc3b21d3b376c40b1414cd37d7b39d1
SHA512 26052922d1ed1985e8493da69a62c0d7a792a489f1399e68301d2c3aa0d0730e39e1118de2ecc6552b42da50ad32488a6bec646906c266a3cd5e592bd9e036db
SSDEEP 3072:pxwkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:puJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T152D37B9377F08663E5B1D9330CA1DA61493EFD6249108A6B33C43B3D0F3B685DE2596A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 7540ba171bca9700691a6a1bd3074f13408a46768d2a91a738a3cf6b5a88125a
MD5 22d7daf62fc9843e457edc6632d46fcc
SHA1 27aff713a1d91185f0daf0076c7bd90ce1408f29
SHA512 00f34905efab9f72c93b25cc3ae4908900f66f8c0e9c879d30114c29338a135fc05a788270baff6eca262fc85a2960b9fd4044ea283c779ac2f3614f49bd113c
SSDEEP 6144:+uJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:AXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T15BC40A56F6748332D073C0BAC5D2A69EE971308257308ACB4286D77C7E6B7E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 d4cee758a90a37f2119f27afbd5779cbc3b5587d7b684a9017c9f083a763f84c
MD5 7575efeef9041e8d0bbeda27116a3741
SHA1 c753ac3ff69d3a9b31fcd4f92fb6226883dcb993
SHA512 bff69d2a33a4c9b5b16d6fc898d657b3cdfc09bc15f02bc480beb0e79b276ec9d432112033b01ebdd0e90dd4bfd31ea770261b36cb8d0fbf95b6475142ec37e8
SSDEEP 6144:wVuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:w3qIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1C0B46D31E6A04037D6F106B3FD15D6307E7DA2187B1184AB9394AE2D2EB9497A7F7203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a8A2A.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8A2A.bat
Size 1KB
SHA256 f1f1886e7230f3a9a2d1e87110dc0fd204c5af0383fe73435888a5d1ebb48cac
MD5 fccf0336bc8b471be9844fcb6a16b816
SHA1 ebbc0cb069b1fc57c8779b345e1253f5e6f2d18a
SHA512 40fe016d097fea40077ca5cd7cdfcea23d02a6603e84cb9f1787879e8ad5f930ad00bba469abf4dc2cb6023f174e1888844bca8b51e2cf6f5db4dcf80ddd6d61
TLSH
T1F1112961C97FD3251891E10F53B28CAEC04179DD2F2F5B085BB469D9E8F288CB4D2392
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-02_a03ea06e6d85ade2db3530e5f36988b6_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_njrat_wannacry.exe.exe
Size 942KB
SHA256 52e4222ebcb93ae0c9b0677b74bbf99979f234184152a33872c74d322398bbf5
MD5 76865db7ce3cb1cc306e01661ef0acac
SHA1 f0f60b18d3ae35e961798757a071d270e2f432c7
SHA512 ebcdc04d42f5a1a1823b2578fa92081e5ad3ef2120fe0d238d72740a3fbc0ca106f04a869a8ad05a6ca803989a70c31c64b984de848743aab40bb2a19a701794
SSDEEP 12288:yMExXTAFFLuQiWqUUtP4yjcsr3yDT05nn5xYbBX1iHU2//gUsUmZ/5YfBWrw6O:yxXTALuTTRr3yQEXErXgnZ/5YfBWE3
TLSH
T1B5257B607666D233E56181F24E78AFB6A06DAD2C0F710ACF73C42B3E45355D26E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 e41f5792686038a5482f5f4d72d78fba239091b54399ebbf28d8e159401c6582
MD5 b83ff0532ce04bc37071be93f6e10e47
SHA1 0f60970a293e281196ca26d10dc4081526d6dcd0
SHA512 3db1fc0c7d741228d12ac396f20d8235d858cf43238b605e3ce87862a7a172aaa8e39f8b4d3152deee04b44a72d115194637602bbaf2903e009e5a0ad4f1a32e
SSDEEP 384:NbbWjK1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:p6jK16GVRu1yK9fMnJG2V9dHS8
TLSH
T108D2CEE067FE2763E2A2DFF31CA35F964426BD10CC4A920E1D14B7764CBF50C9AA1602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2043432456-1617298091-2772621413-1000\_desktop.ini
Size 8B
SHA256 e2216e9f68ad9e2b4808eebcb8f03d71f7490b447fa87bf0fc3a1d28d604dcf0
MD5 c0357037ecd5cfa2a23320e167485c30
SHA1 47a81f49348f372bdc7a75d54b7125bbe841a83b
SHA512 1aa212180981ed47c1a2cc8f1335e29613565fbcdbee4099d2c4d1e4f8e066656b283fa3db0a82d6a228b9471accdbd393279e59a5b296cc9848a33f5c4cf0e4
MD5 SHA1 SHA512

Submit Download

memory/852-26-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/852-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/852-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/852-19-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/852-632-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/852-1223-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/852-5004-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/852-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/852-5507-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5484-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5484-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download