9d7093565895f1d4238500706079fb82014f5688925a5ca02a763bcdb2a24ec1

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 324KB
Sample260819-rtm4xsysgx
SHA256 9d7093565895f1d4238500706079fb82014f5688925a5ca02a763bcdb2a24ec1
MD5 e618ce1951bc9d98a2c919120f8d7fed
SHA1 d333a3ea29f0c51f4b1ec90141d115e9b5a1a2e3
SHA512 f00c5650160f1f0eed03c3f80366d663fdd9a47bbc578a7cad61409512dc243bb4f524e0a2e626b16d7c352fdf1e5619372c16f596fa851e192b5548aae6700f
SSDEEP 6144:9uJGhabloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8P:4l5MiU50jb854fgfK5qiw8Ik0ggwJhis
TLSH
T15C64AE0276E1C072E5721A325978AA7359FDBD300921CAAF13D45E2DEE316C0D63AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
464	Logo1_.exe
5096	2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\IDPValueAssets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\styles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sq-AL\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\Logo1_.exe	2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
892	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe
464	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 892	2028	2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	86
PID 2028 wrote to memory of 464	2028	2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	87
PID 464 wrote to memory of 1868	464	Logo1_.exe	89
PID 1868 wrote to memory of 1920	1868	net.exe	91
PID 892 wrote to memory of 5096	892	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B46.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5096
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 ef414088b6438b6589694a5d6d04db41f05a5c64c5352898ed3100fce69fd843
MD5 76402175b8f8c04f87ba2fdf454b9499
SHA1 0e3b9a73667a8660476ba45c5d4c7fad0c386927
SHA512 44fd9ee0efc99cad81a31b7baa3ee2aa00c37ea4c82b2cd26d3977f24798031798b3295550839cd18bd452eb296e190d08c3218fc69d07bd0bb116b1042d5d14
SSDEEP 6144:9uJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:ZXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1C9C40916F6748331D073C0B9C5D2A69EE97230865B30CACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 14fea991fd042b8b26c81b04b51bf3bc9532cc5785442937a042c24ac4f57428
MD5 0701a11a9b91954ba2c5a1385ad42010
SHA1 9f2f757881ac0811ae3d1e13216fb6a2f69400b7
SHA512 809e42c4f1d8b6870ba2f9a7848d618c5cf5719f21dfa8ccc636e333f5d6dcf445900c13d798c3ecda02f608fb9cb9f3292a58db8c10f524a2bb45b6031f039a
SSDEEP 6144:wNuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:w/qIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T140B46D31E6A44037D6F106B3F915D6307E7DA2187B1184AB9394AE2D2EAC4D7A7F7203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a7B46.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7B46.bat
Size 1022B
SHA256 7f9fe20528a5279cb8a727ae0a6353e8254c940040080b826e5cac1361fb521f
MD5 d6fad9891aaf19416d2c6564c2d42bc7
SHA1 4ff5955a977f62e1a0a9f8c554fb44d5b9ff8fcd
SHA512 2ba591a59bf36a07a754d35198ba4c4f13996dd30d5661678063adc5e9aa10015ec7c3d2bc4999dafd950517973c95240de64b9478f25c64b95de77fdcbc28c8
TLSH
T19E11D61A88AFEB5E0D86F04F45B65DDAC023A50A2A0B332373A5D61E50D098EE59334B
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-19_e618ce1951bc9d98a2c919120f8d7fed_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 294KB
SHA256 8fe2226e8bec5a45d4b819359192ab92446b54859bf8877573ab7a3c8b4ada76
MD5 4c3832fbe84b8ce63d8e3ab7d76f9983
SHA1 eea2d91b7d7d2cdf79bb9f354af7a33d6014f544
SHA512 e6e316bf3414ffb2674bf240760b2617ced755b8a34ad4b3213bcca6ea9a0aa3c2e094319d709a958f603b72197bfa34b100dbe87b618e17601b2e0dac749f84
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8P:al5MiU50jb854fgfK5qiw8Ik0ggwJhis
TLSH
T1AF54AE0276E18072E9721A325D78BA7259FDBD300921CAAF13D45E1DEF31680D63AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 8184813d9664e7021b7b568d33d55b5b08c1de903d2cf3a518253cbff94897e2
MD5 4c49546edd435f12ff3437a964133ff8
SHA1 d7d9bda12c5ed828683d16a818a739b8c2e1ebad
SHA512 e72f86991211586b23b0e624888e7fef4cd601d0aaaa8a6f649893de57ea92013e6c2a7aa51cf065d9b9e43d29fa93ca100f7ac8c1ff75c740e646080e79ae4d
SSDEEP 384:Nbb/0Q3TsHvXb1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzG4:pgqsHvXb16GVRu1yK9fMnJG2V9dHS8
TLSH
T17AD2DF7423ECD922D2B11FF084A3CFB74926B911DC89D20F5E656A7FDCAC5C045A2A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2370214745-1838013427-2987045292-1000\_desktop.ini
Size 9B
SHA256 bf338b34373be371e656c2348ef628bb1afde20017d7c8cc3a19088398d512eb
MD5 87ab4a51f1c98361592566882a732eea
SHA1 a7cf922a8968711006d7fe5f0db0df186f08c58c
SHA512 cd1d9c2280657fb7434b2fb830ab4856a0831338907bfe71e3361a2e388c7e3769c16027a9b214b2c80285cbc1dd7d1a380b5b5d96a17f33ce7e31b6d8acf0c0
MD5 SHA1 SHA512

Submit Download

memory/464-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/464-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/464-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/464-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/464-417-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/464-1246-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/464-5094-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/464-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/464-5611-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2028-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2028-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download