4d9df4ae5489e38813e7fe2eacd1b0af2d1f1161d2390587a1aa59011b7fb9e5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Size 254KB
Sample260723-3w34psdf64
SHA256 4d9df4ae5489e38813e7fe2eacd1b0af2d1f1161d2390587a1aa59011b7fb9e5
MD5 c0c6ba6f8a7e4dfaefe68b82e8cbe924
SHA1 2593de200b6330ab159658abe31a8cd25e6ae244
SHA512 dd7accf0df0dbce7e0312cceb61b1c4659b21da4172f7c1081d14c1160713d8f91440e7d31ae2c2c67906657ad641a29a35f4452f5edac76ec8a7d711161efc5
SSDEEP 6144:WcCbvS3PdUOKrdhXhZVJPGSFgjUE0uS//bTAOUBS3:WzbvS3irdhRZVJ+SpTe
TLSH
T13344AF2175E2C472D47211324978DBB59A7EB9380F2597EBA3D41F3ECE302C1A731A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2744	ApplicationHost.exe
1428	ApplicationHost.exe
2548	ApplicationHost.exe
1720	ApplicationHost.exe
5688	ApplicationHost.exe
3324	ApplicationHost.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\ApplicationHost\perfc13.dat	ApplicationHost.exe
File opened for modification	C:\Windows\ApplicationHost\perfc13.dat	ApplicationHost.exe
File created	C:\Windows\ApplicationHost\ApplicationHost.exe	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\ApplicationHost\ApplicationHost.exe	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\ApplicationHost\ApplicationHost.exe	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\ApplicationHost\ApplicationHost.exe	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
File created	C:\Windows\ApplicationHost\ApplicationHost.exe	ApplicationHost.exe
File created	C:\Windows\ApplicationHost\ApplicationHost.exe	ApplicationHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4604	cmd.exe
1924	cmd.exe
4912	cmd.exe
5208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ApplicationHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ApplicationHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ApplicationHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ApplicationHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ApplicationHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4536	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
4536	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
3812	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
3812	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
840	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
840	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
4616	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
4616	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
4872	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
4872	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
2744	ApplicationHost.exe
2744	ApplicationHost.exe
1428	ApplicationHost.exe
1428	ApplicationHost.exe
2548	ApplicationHost.exe
2548	ApplicationHost.exe
1720	ApplicationHost.exe
1720	ApplicationHost.exe
5688	ApplicationHost.exe
5688	ApplicationHost.exe
3324	ApplicationHost.exe
3324	ApplicationHost.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: 35	4536	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Token: 35	3812	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Token: 35	840	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Token: 35	4616	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Token: 35	4872	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Token: 35	2744	ApplicationHost.exe
Token: 35	1428	ApplicationHost.exe
Token: 35	2548	ApplicationHost.exe
Token: 35	1720	ApplicationHost.exe
Token: 35	5688	ApplicationHost.exe
Token: SeDebugPrivilege	1720	ApplicationHost.exe
Token: SeDebugPrivilege	2548	ApplicationHost.exe
Token: 35	3324	ApplicationHost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3812	4536	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	88
PID 4536 wrote to memory of 840	4536	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	89
PID 4536 wrote to memory of 4616	4536	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	90
PID 4536 wrote to memory of 4872	4536	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	91
PID 4616 wrote to memory of 4912	4616	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	94
PID 840 wrote to memory of 5208	840	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	93
PID 3812 wrote to memory of 4604	3812	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	95
PID 4872 wrote to memory of 1924	4872	2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	99
PID 4912 wrote to memory of 1900	4912	cmd.exe	102
PID 5208 wrote to memory of 2376	5208	cmd.exe	103
PID 1924 wrote to memory of 4316	1924	cmd.exe	104
PID 4604 wrote to memory of 5424	4604	cmd.exe	105
PID 2744 wrote to memory of 1428	2744	ApplicationHost.exe	108
PID 2744 wrote to memory of 2548	2744	ApplicationHost.exe	109
PID 2744 wrote to memory of 1720	2744	ApplicationHost.exe	110
PID 2744 wrote to memory of 5688	2744	ApplicationHost.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "\Microsoft\Windows\WmOic\ApplicationHostTask"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /tn "\Microsoft\Windows\WmOic\ApplicationHostTask"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5424
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "\Microsoft\Windows\WmOic\ApplicationHostTask"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /tn "\Microsoft\Windows\WmOic\ApplicationHostTask"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2376
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "\Microsoft\Windows\WmOic\ApplicationHostTask"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /tn "\Microsoft\Windows\WmOic\ApplicationHostTask"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1900
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0c6ba6f8a7e4dfaefe68b82e8cbe924_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "\Microsoft\Windows\WmOic\ApplicationHostTask"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /tn "\Microsoft\Windows\WmOic\ApplicationHostTask"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4316

C:\Windows\ApplicationHost\ApplicationHost.exe
"C:\Windows\ApplicationHost\ApplicationHost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\ApplicationHost\ApplicationHost.exe
C:\Windows\ApplicationHost\ApplicationHost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\ApplicationHost\ApplicationHost.exe
  C:\Windows\ApplicationHost\ApplicationHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1428
- C:\Windows\ApplicationHost\ApplicationHost.exe
  C:\Windows\ApplicationHost\ApplicationHost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\ApplicationHost\ApplicationHost.exe
  C:\Windows\ApplicationHost\ApplicationHost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Windows\ApplicationHost\ApplicationHost.exe
  C:\Windows\ApplicationHost\ApplicationHost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 b4314a865be4784da0f844f0e994e096ad25f01443069701f2433f5566988eb9
MD5 855e5f360b04397350b583d3ff7e6138
SHA1 6c4138fad82d8fc49f1216928fa8b500fb451d24
SHA512 215c27373d973bf5a15ff2cc507392cfb392bc347fdb58debeb37c9368d5d1a450ba2acbe5b599a538f40cd7b244f9ae08305f1e04bd9aa0728f3956b0e449a2
TLSH
T1C821C69A8BB236D1AF806E0722D4CA3B2CE3A6C104AC404A6239948561103927B6A92A
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_753F63EC53EEAE0B44735E2394BC522D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_753F63EC53EEAE0B44735E2394BC522D
Size 1KB
SHA256 dcdca5202b6b8e6dbfcd0194dcea69507129128fd76f439bd9708430011c4329
MD5 9d3dfc4b47bbd75080382d63dc9d9de4
SHA1 6b4848ceb6cacba244b5eb1a8715573729caa43b
SHA512 43962fbe250ec1cb226c3c677b31aa69965b2c1c139950b981742aea5ae908bf126ab892202cdc4dd9796c0a48abd21fdb4f973cac0eb85a2797e41533bc9fdd
TLSH
T18F21C183188828810742DDAF1C9ADBB35E70E8C98688B810207AE09CA8143C3AF0C69E
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 b04ff2a1d33075a2ec74a603e1bb902adcd1f94aee2bbedea2b69924a080e846
MD5 19616a56fffc00e05cf3661c90a2e8fd
SHA1 507e4a4b1416b9c9807c93813cce036c9e812f38
SHA512 b51519c7f0f54c9be969cef39e8033cef889219665aa693848b5bf5c94cbff968ddf7462dbfd18b558e969987953ec60bb8cf36972b27b88b5b749c05257176b
TLSH
T14BF05C1C45B8422BF172DE399AC83666867BF647210516A437E5C70CBE06E063C0693D
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_753F63EC53EEAE0B44735E2394BC522D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_753F63EC53EEAE0B44735E2394BC522D
Size 536B
SHA256 dc07a668ae156c16fe1abe5e7603554b00cfc3d53b2b4836550ea032646f5a32
MD5 37bb18d3c8a2d0e185b976b71c204d22
SHA1 1ecccfab1b2d99c4416bc46d0336c91d17bbb0e5
SHA512 6888a95de5298b363eb183184a9822ff1045cf32486fb84d7b454627b2f2cf8c13daa0194ab18ccea6570eaece283fa52de4785e94cc051d105b7dd03f230503
TLSH
T1D5F09E28B1B6444DF073E9742FD161A58C31F815FE01A56F1DEA4329A906D002DE1739
MD5 SHA1 SHA512 TLSH

Submit Download

129136[1].bin

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJDESKSS\129136[1].bin
Size 2KB
SHA256 e24d723373b63e1303c6b3c7057c5262d1e13cf98aa889735d61d770d7d51b38
MD5 510ecea094f179f1441d9c2a4a6c1a3c
SHA1 b6fcc5651bb524657f7b5fed0accba449bfedc4d
SHA512 b8e2df569ab2b0d075e331ed7d6288a2feb2c50f5a6b1a7bc6e73508bde1d4cb2487ed81e32e3419d5fc07b76b577fb5ee5f2eaf7686a316d1b7172c56e343f6
TLSH
T12B512AA5B0A3C64D41EA9D1CF0B8A09C09E2FE6F50C0B29123669DC685B2D994F79C1C
MD5 SHA1 SHA512 TLSH

Submit Download

ApplicationHost.exe

Path C:\Windows\System32\ApplicationHost.exe
Size 254KB
SHA256 4d9df4ae5489e38813e7fe2eacd1b0af2d1f1161d2390587a1aa59011b7fb9e5
MD5 c0c6ba6f8a7e4dfaefe68b82e8cbe924
SHA1 2593de200b6330ab159658abe31a8cd25e6ae244
SHA512 dd7accf0df0dbce7e0312cceb61b1c4659b21da4172f7c1081d14c1160713d8f91440e7d31ae2c2c67906657ad641a29a35f4452f5edac76ec8a7d711161efc5
SSDEEP 6144:WcCbvS3PdUOKrdhXhZVJPGSFgjUE0uS//bTAOUBS3:WzbvS3irdhRZVJ+SpTe
TLSH
T13344AF2175E2C472D47211324978DBB59A7EB9380F2597EBA3D41F3ECE302C1A731A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1428-26-0x0000000000C60000-0x0000000000CA4000-memory.dmp

Download

memory/1720-25-0x0000000004820000-0x0000000004821000-memory.dmp

Download

memory/1720-28-0x0000000000C60000-0x0000000000CA4000-memory.dmp

Download

memory/2548-27-0x0000000000C60000-0x0000000000CA4000-memory.dmp

Download

memory/3324-6-0x0000000000C60000-0x0000000000CA4000-memory.dmp

Download

memory/5688-29-0x0000000000C60000-0x0000000000CA4000-memory.dmp

Download