fcb03c78207dfb86e599e907016deb734ad674a9ae9628b8f17db1d5ea9a9951

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Size 333KB
Sample260810-1kntjayhnd
SHA256 fcb03c78207dfb86e599e907016deb734ad674a9ae9628b8f17db1d5ea9a9951
MD5 d32b98c381e18e248b8f12f271ba66e9
SHA1 1863c2b1476ce9b554a957839cf203a703ede6f1
SHA512 717d1e6889c86f922e0b85a05378da73cb172dd8e18c6b926f573624586b6e90eaa3303e2d31b27c9f63f4aa7223891d1e8641254f99e542dc0e9a0c70c18024
SSDEEP 6144:WdVfjmNHWl5tfsXY4hrU/Mm79iDSM/gDExD65DDlJAz8AOb3URXEk:+7+HI2trmMm79iDSqgQOJURXEk
TLSH
T154749E907691C072D9B215325E68DBB6493EBD114F2545EB73C81A7ECE303C2EB31B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4048	Logo1_.exe
3108	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{3776D576-0A64-4D44-BF96-63E8D160091B}\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\Logo1_.exe	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4172	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe
4048	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 4172	352	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	88
PID 352 wrote to memory of 4048	352	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	89
PID 4048 wrote to memory of 2776	4048	Logo1_.exe	90
PID 2776 wrote to memory of 2368	2776	net.exe	93
PID 4172 wrote to memory of 3108	4172	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEF1.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    PID:3108
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 72f3d1a36ba06b0e912ae8f70f3c047c6d5e8870d266f4872822ff8860f89ca2
MD5 2062ae0a454a5d8c42f21fdf6029a646
SHA1 da8a1b0722ec51cee9a7a80b210b2286c29aad29
SHA512 27d9c14306dac4ea2657da24cecdc75c61853edc4f8dfaaa691049d92a7c26fad58e2229ddb48a1ac00886218b30b030d02b60125d6b214ed24d2d331b375c11
SSDEEP 3072:GNftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:GdVfjmN2G7/fYfLvzB+QFyn
TLSH
T1B2C38D1375D08871E5B20C3449E1EA619E3FFD620B409EA737C466BE0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aBEF1.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aBEF1.bat
Size 944B
SHA256 9a6b1a0d3f50118db9dba04897fb88a6d4f7a285faa1c6040d4f01bb5c18c8c3
MD5 9e8199a70056014e3d428cf17cf42749
SHA1 a0b61a20159c19c9eae84741647dd4d4ce6bd298
SHA512 2e18b67594a6ebc8ff953dc57c4c50fbb8adeff4d925e6587de8121172ad415850ae59b7efbc7b7d85980acdddfc9e4ca25c1f3e1b321952803903a2a1c5f0f8
TLSH
T17411822F879FCF190A96F41B42E62DCBC651AA4A264E2B217380C21D94E194DE6E3746
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe.exe
Size 307KB
SHA256 affd87f344207744e4c43215d29add1a6ccf4eaa6a17591654d14cfa164b8b0c
MD5 175968b17779fb17e8235d3d6a5e523e
SHA1 1fd4db82e026c971733350107d7cf52656aa542c
SHA512 b53222aaff7922674c7e59bcf6d172b1518e6c7e69e23337d5c8376dd5df6ad18677da5ff2a5d8b455d17e90576edb04275359f6200ba61d7c92bfefc5682522
SSDEEP 6144:zWl5tfsXY4hrU/Mm79iDSM/gDExD65DDlJAz8AOb3URXEk:zI2trmMm79iDSqgQOJURXEk
TLSH
T107649F90B691C472D9B315321E68DBB6493DB9514F2495DB73C80A7ECE303C2EB31B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 047f0e5cd405822a0e53adfa3d29cc56914d67f6cf3a80cf95792306068555c8
MD5 6442b83cec12263de4226b8f395748df
SHA1 7be431f51fd0995684575a8b2208a9ad7d0decd8
SHA512 0f947deda93f1de12feee1d7e2d1c4f884be80f07f02244aac05edf92ee4279a797e1fde63a116235b3b1aa7198fe325fb652df231e4527c69b269954fa60cd7
SSDEEP 768:Wf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:WNfgLdQAQfcfymN
TLSH
T109C2D07A26C83578D825497CDBD35781833D0E7A085F596726F1BA7F2270B64100FA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2115213192-531537726-3295841909-1000\_desktop.ini
Size 9B
SHA256 a6a30469b07b10cfc3228a527f800194638f4d6c88b814a540b333c9371056f8
MD5 809f47ced3507b857f0be4647cd218fe
SHA1 fbdf780581ab4fd33bf33b14c662c16ca9d056c5
SHA512 2705955b3b04d3e8bff5203d6797609799bd979a883244e0f5528b588b34efa751c9703151715153c72a073f037fb47da4ace7dc7bf30f8f418e4d375f8d8fd7
MD5 SHA1 SHA512

Submit Download

memory/352-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/352-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-73-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download