ba6df378838d43e919fcfa5fb634f359944eca261691434d74c3ca398654b719

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 247KB
Sample260604-qgbppafs21
SHA256 ba6df378838d43e919fcfa5fb634f359944eca261691434d74c3ca398654b719
MD5 97e3fb97f117c3b3fa847a4b3ea933ae
SHA1 db9350c4a805ba6318e51678e09abdd06e604270
SHA512 a9bd0ec16b2dc223beb190f42430beafefa38e3a7d5555a3a6ab578f917d57b1f20b6c5015cbdbdfc075e823c236a85a8d74b9ded8aea74c4bba2b3148dd047c
SSDEEP 6144:7uJWqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:gml5a6EdkQgUmR7G9QK3wJx+qSfF0
TLSH
T1D8349E12B5E180B3E9B30D3409F4AE759ABEF9310B158A7F63D84B6D5F30681D226763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1708	Logo1_.exe
4820	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNative\Tracing\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lv-LV\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\Logo1_.exe	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe
1708	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 452	4372	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	87
PID 4372 wrote to memory of 1708	4372	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	88
PID 1708 wrote to memory of 1244	1708	Logo1_.exe	89
PID 1244 wrote to memory of 3896	1244	net.exe	92
PID 452 wrote to memory of 4820	452	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a556E.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4820
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 6dd977cf7c434de909e640a24e23ac89abaaaeed3714c091425e92c086e5a0bf
MD5 b9cd26b6e68969f9a98e774e2d29597f
SHA1 d17b671b0c9ccedf968ef74c79bf5fac5d2cae7a
SHA512 083921641af26ec3f3222ebaf0a78c09ae6e1018aec0562de60a8386eb182c5507962bcc30b6813cb0f8a120ea9c4c9546c4d5736fe696928ffb04ff98855597
SSDEEP 6144:7uJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T13FC40916F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 c000f77b3afd8a0b1498a05f29615e67e9c2aab43693eccf26bb3900ecaf4c38
MD5 8419ad26d74e72ac5c95948f1323ceb3
SHA1 e2db2dda085f42d9d92a88616a441a8fcf420f61
SHA512 cf1e3c51c7608a32d02a42ec4e6293f1c02933c293208a0175d22211b0fbc0f51c06c942eab2a72ca8a02973b09d65130836ecd3652b6730733581eb61eb1531
SSDEEP 6144:wuuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:w4qIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1B9B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a556E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a556E.bat
Size 1022B
SHA256 a08946fe754782af04befaa7fc41729fbd8365eb932974e2839c9b1bafdee3ee
MD5 566d0c20a9a6f008b2bb9903e8941196
SHA1 326771a86797fc1728186259ec19e02afdd5cdc4
SHA512 23729f34779399434a5b9af58ead1b9c4fd46655ba1f092c115c012fa9675e4cb523511a5e74d6b4fdda848a7d121b4b16fe3df0e8d7f009d07c476e31622495
TLSH
T18A11B40A4A7BEBAA1265908786B15DCFC511771A3A172333B3E4855E98D08CDF2D334A
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 217KB
SHA256 04adf40ba58d0ab892091c188822191f2597bc47dab8b92423e8fc546dc437ef
MD5 021c57c74de40f7c3b4fcf58a54d3649
SHA1 ef363ab45b6fe3dd5b768655adc4188aadf6b6fd
SHA512 77e3bbb08c661285a49a66e8090a54f535727731c44b7253ea09ffe9548bae9d120ef38a67dfa8a5d8da170dde3e9c1928b96c64dfc07b7f67f93b478937c018
SSDEEP 6144:Bqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:gml5a6EdkQgUmR7G9QK3wJx+qSfF0
TLSH
T1D9248E12B5E180B3E9B3093409F4AE759ABEB9310B258A7F63D84F6D5F30681D216773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 5988d97fbb78c02498150b678f5b55e0f25a242db3c34f408b6eba9fe40b9304
MD5 34c67d884ee2f13ab12032cb994aaa98
SHA1 005446a9898ccd358dcc21fbb926df181afd340f
SHA512 d6a3f6ca4629a2d02c27b6db7f11344ea8782cff8e614d4783549fd5f9b5ae0b55718b0e963ecfe87705877c4668f6e75214e42c448490574e986440f7713a4f
SSDEEP 384:NbbtW2wwo4P+WBY1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOn:p5W2K16GVRu1yK9fMnJG2V9dHS8
TLSH
T1A1D2E17073ED6EB3F2921FF058B34FAB443BF110EC4AD15F5E6896994CA094089B6917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-876885714-46325919-1482798410-1000\_desktop.ini
Size 8B
SHA256 055ea376e2004e4bba4864f8580ed635e094eb2dded0034a71189c056021dad9
MD5 2f4a1f0fa04a55f8ce91a6bd1ca42ff3
SHA1 63b897dffe8c5c30b66a5d3288269a0cc51d444c
SHA512 c60f3c126f620affacb594e7729fcb10a604c00b94be12a51b41dd10d0aa0bbfbf86aa58534a86d1fb9ff22579b22d6db87ee065ff35d0ede612774564c043e5
MD5 SHA1 SHA512

Submit Download

memory/1708-28-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1708-21-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1708-34-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1708-38-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1708-514-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1708-1247-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1708-5034-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1708-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1708-5547-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4372-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4372-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download