020c68285659079b91ec164248a436ab762ec0852bbaf2ccab96fdcf208968a8

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Size 930KB
Sample260807-st2sraybkh
SHA256 020c68285659079b91ec164248a436ab762ec0852bbaf2ccab96fdcf208968a8
MD5 bef0b846a7356df8bb812fcc07cf646b
SHA1 7b2ed1c087395df182ff3905a64158295b591aae
SHA512 405a2020e17254a979b2469285b90f5703c4c287a7aa7442e5c711f579435f41d00f69f7a4b9353983307022119dfcf9be4f9e3f960eb98d4fb29725c5fac9e5
SSDEEP 12288:/7+5uVq4ZOhSv1TaejTq8DlXesYe2KiRLCtnmTaF5EyP6GZNsIWWdZSQMQPP3S6x:/744Zqu1TaATdHocmGFaGvZSQMQ3S6j9
TLSH
T17E156D607666D333D46180B24E78BFA6D06DBD294F7146CF63C82B3E95391D22E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5360	Logo1_.exe
4156	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Windows\Logo1_.exe	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
4156	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
4156	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe
5360	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 4332	3140	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe	89
PID 3140 wrote to memory of 5360	3140	2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe	90
PID 5360 wrote to memory of 1104	5360	Logo1_.exe	91
PID 1104 wrote to memory of 2864	1104	net.exe	94
PID 4332 wrote to memory of 4156	4332	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4156
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 75dd163d14946bc12bb5f23a868443a310afe992388753af9b3b993d26b3a4fd
MD5 1ad364b0d4e6563fc3ac15d7cf37a8c8
SHA1 bd377115c0af12acf29ad034e14f76a4e4684202
SHA512 56d37771a8409d676b4a27d2a3478ffc2f50198c30c6b1b75099e2733ec82d03aedf3039b2ec530e01ad699798e8cdb207dbb1bd075bc4fff1c2c59696b1fd2c
SSDEEP 3072:MxftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:0VfjmN2G7/fYfLvzB+QFyn
TLSH
T1FAC38D9333E08562E5B18C324DE0EA61993FF9620B409DA733C4577D0F3A7D1CD26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4CBF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
Size 938B
SHA256 05376b68254b9d33310a79ab74bb422d4ae4c3c540fd1ad64bc22c0b9d73e987
MD5 89991a3be1dc79a608937fa8a32bba35
SHA1 c17a54a0c69e40f9b136a39c3570861ebd467d7a
SHA512 046b41359d922ed7cdd20c0f523b2150833a7f10355a2eeedcd7429685cbe8cc27456f59736164444fc1951732bf58c20c61919f8cab5ec220c97b310750f86b
TLSH
T1F211C45245EFE3E944D5934A0BA0BD8FC09665EE33492713FB69868D60E484B74FA342
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-07_bef0b846a7356df8bb812fcc07cf646b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe.exe
Size 903KB
SHA256 28f990585547b7ea429349356f47dea76ec3387d8d258c0f7f44dbd2853f188e
MD5 16a7f5bf58f3fc50c1b566f656bfadad
SHA1 bf5eb46c2421a178add7386f552edd0b1fa16abe
SHA512 8486a508cee14672f8fc62b20abd8a537dc8c99dbf4ab541cdeeb1626a55f842ab61969c177b3599db3ed1d6e2cc62c52da4d4e4b7d891145e2356325f7f6c33
SSDEEP 12288:luVq4ZOhSv1TaejTq8DlXesYe2KiRLCtnmTaF5EyP6GZNsIWWdZSQMQPP3S6j9:34Zqu1TaATdHocmGFaGvZSQMQ3S6j9
TLSH
T175156D607666D333D46180B24E78BFA6D06DBD294F7146CF63C82B3E95391D22E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 449b2bf4a84e027375af2a6bbe59a0b18c07edfc9aa96c6ff52adfc195fcd739
MD5 2f809e1bc24e065a06eb9cc885f52666
SHA1 5a3f1009a867e84081c8e510a95a6aa67d0ea4f7
SHA512 25338b9c6561fce3574871b08ec6f5705ca78b74e22828efaed88fb51c2c3a92d6afcd96eabf273ab19678cde13af96ad6db22532e5750e4da6202adb314435c
SSDEEP 768:3jP1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:3xfgLdQAQfcfymN
TLSH
T142C2D0F517F81737D825CD7FDFD26702833D0769049F686525A28B7A225F66C100EA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-189034102-168398478-1159367937-1000\_desktop.ini
Size 8B
SHA256 cb7bedc97bdd2d63203eb6ba133a1f2298106db82404f9055a36ff6d137d0f86
MD5 cdafaf40f18f1b84f5c564f8618a53c5
SHA1 d6778fe9d23f3cb9ae7b983cbced89febe0167f6
SHA512 e2d158d9d6e18a5ec5b381dd92d092ba4eafd77ace54370c53ad151f7f78120a3a27846510bf5dee427adf6415eba744e277b7955cd3398430c6ed2053c542b0
MD5 SHA1 SHA512

Submit Download

memory/3140-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3140-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-77-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download