020c68285659079b91ec164248a436ab762ec0852bbaf2ccab96fdcf208968a8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Size 930KB
Sample260807-st2sraybkh
SHA256 020c68285659079b91ec164248a436ab762ec0852bbaf2ccab96fdcf208968a8
MD5 bef0b846a7356df8bb812fcc07cf646b
SHA1 7b2ed1c087395df182ff3905a64158295b591aae
SHA512 405a2020e17254a979b2469285b90f5703c4c287a7aa7442e5c711f579435f41d00f69f7a4b9353983307022119dfcf9be4f9e3f960eb98d4fb29725c5fac9e5
SSDEEP 12288:/7+5uVq4ZOhSv1TaejTq8DlXesYe2KiRLCtnmTaF5EyP6GZNsIWWdZSQMQPP3S6x:/744Zqu1TaATdHocmGFaGvZSQMQ3S6j9
TLSH
T17E156D607666D333D46180B24E78BFA6D06DBD294F7146CF63C82B3E95391D22E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3492	Logo1_.exe
2088	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Windows\Logo1_.exe	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
2088	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
2088	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe
3492	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2984	4936	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe	85
PID 4936 wrote to memory of 3492	4936	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe	86
PID 3492 wrote to memory of 1220	3492	Logo1_.exe	88
PID 1220 wrote to memory of 1088	1220	net.exe	90
PID 2984 wrote to memory of 2088	2984	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F68.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2088
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 e6729ff49b4fb751cd56a867fc0ba3928020e854bb8b6f7b25b7275e20af5dc5
MD5 81d1d86c45f18ee43f604f9fd1c652c6
SHA1 9bedf7136bd60fdb45dc26ff38116d924984cf7e
SHA512 362dbd0154079f4614d91f0fcbc16cfcb175226863030fed49c999380ed505b1c40105b31d3e70fb98ae798a64d155af4bd56190a36835d03009984fcb9b57ce
SSDEEP 3072:MxftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:0VfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T118C38D5337E08573E4B299330DA1E961493EF9620950DE6B33D41B3E0F3A6C1DD29A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 afc8b3abab80c1502979db7ecf756118301f05209e0192b2c94f147c17db3b5f
MD5 addd123b34fcbd0d06512fccd91cfff0
SHA1 8f2d0f07118e9a11220c83f026f154dc73bb0940
SHA512 b5621a5e315613a3509cabe007af5561d2842f1a7125f67322dd73eba92d0cbf1b047f3341d563e0e190aefc09a6306d924e4c25dff7e82a9fecc6a4f7777a33
SSDEEP 12288:/7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:/7o0Le5ji0hmxNrM
TLSH
T146C40956F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a9F68.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9F68.bat
Size 938B
SHA256 86f09a5465cac14cc3b9aa824f65615a04d69bb3f9251aa83ff08d4c01a143fe
MD5 1fc057184bc301b4538a4e5dc7bb6f60
SHA1 3b7bf1d86a5654fae07150ccc3e02a0300ffea7b
SHA512 b72682862c596a6f287c3a24ad9ace21bddcd15a743fbeb3a3ad8fcb97ce94b8305e8a8aaf03a4ddf83d63facdcf3946fb9b692a16d653222ed18f02a0c5ad02
TLSH
T10011C85245EFE3E944D5534607A0BD8FC09665EE33492713FB69858D60E484B74F9342
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe.exe
Size 903KB
SHA256 28f990585547b7ea429349356f47dea76ec3387d8d258c0f7f44dbd2853f188e
MD5 16a7f5bf58f3fc50c1b566f656bfadad
SHA1 bf5eb46c2421a178add7386f552edd0b1fa16abe
SHA512 8486a508cee14672f8fc62b20abd8a537dc8c99dbf4ab541cdeeb1626a55f842ab61969c177b3599db3ed1d6e2cc62c52da4d4e4b7d891145e2356325f7f6c33
SSDEEP 12288:luVq4ZOhSv1TaejTq8DlXesYe2KiRLCtnmTaF5EyP6GZNsIWWdZSQMQPP3S6j9:34Zqu1TaATdHocmGFaGvZSQMQ3S6j9
TLSH
T175156D607666D333D46180B24E78BFA6D06DBD294F7146CF63C82B3E95391D22E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 449b2bf4a84e027375af2a6bbe59a0b18c07edfc9aa96c6ff52adfc195fcd739
MD5 2f809e1bc24e065a06eb9cc885f52666
SHA1 5a3f1009a867e84081c8e510a95a6aa67d0ea4f7
SHA512 25338b9c6561fce3574871b08ec6f5705ca78b74e22828efaed88fb51c2c3a92d6afcd96eabf273ab19678cde13af96ad6db22532e5750e4da6202adb314435c
SSDEEP 768:3jP1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:3xfgLdQAQfcfymN
TLSH
T142C2D0F517F81737D825CD7FDFD26702833D0769049F686525A28B7A225F66C100EA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-889581200-2041691093-2048517887-1000\_desktop.ini
Size 8B
SHA256 cb7bedc97bdd2d63203eb6ba133a1f2298106db82404f9055a36ff6d137d0f86
MD5 cdafaf40f18f1b84f5c564f8618a53c5
SHA1 d6778fe9d23f3cb9ae7b983cbced89febe0167f6
SHA512 e2d158d9d6e18a5ec5b381dd92d092ba4eafd77ace54370c53ad151f7f78120a3a27846510bf5dee427adf6415eba744e277b7955cd3398430c6ed2053c542b0
MD5 SHA1 SHA512

Submit Download

memory/3492-26-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3492-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3492-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3492-19-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3492-356-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3492-1245-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3492-5034-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3492-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3492-5539-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4936-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4936-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download