55d67873ea80711c49d0b200db40bd37b59ee7d08ebdd4c1ac15912dc9dd5209

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 735KB
Sample260930-par8estwh1
SHA256 55d67873ea80711c49d0b200db40bd37b59ee7d08ebdd4c1ac15912dc9dd5209
MD5 3f35514a67a9aaa8993ee41e1d01e4b0
SHA1 d34518616298b37a231b01fc37d249582b4e4a0e
SHA512 1da0683c55680bf9b28d1e4c9cec6544ec28e88fbe0f476c3c9b356ec81cccf88b2d505fb5c93377d148fd8c2e187eda6aebc217e595bcd449317a62f2d1d7da
SSDEEP 12288:cEWCEGaAca9QMo7rv/E4GV3TV31utHC1v0XHEjCwiC:cIaE9QMo3EzuuvSHEjC8
TLSH
T157F4172225D9BCB6E4B202716B7F97E5871DEC200765C4CF63C4451A4A7C9E33E32BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2820	Logo1_.exe
3388	2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
	\??\F:\	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_proxy\win11\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\Logo1_.exe	2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 6124	2564	2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	88
PID 2564 wrote to memory of 2820	2564	2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	90
PID 2820 wrote to memory of 2140	2820	Logo1_.exe	91
PID 2140 wrote to memory of 3824	2140	net.exe	93
PID 6124 wrote to memory of 3388	6124	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63CC.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3388
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 127KB
SHA256 981dac38bc62556f49c109e7d1e87679e2fba53e0fb423e97fa33a0be12b77cd
MD5 0df5ce1235dbf0050c533307d2a5d981
SHA1 149e541ee1786515de2ad3bf3f32f5f88764f6a4
SHA512 4463ebc3e1627ff56511e14e763c390f3d7adf9a0735089f1481fd73e35ef9c197bbc0ba2e81c6ea85857ec7da740b28bf97d88c9ee3a547d40948543904e229
SSDEEP 3072:pIkuJVL3hUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:3uJTG7/fYfLvzB+QFyn
TLSH
T168D38D1376D084A1E5B20D3048A1EE719E3FF9624F409EAB3784667D0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 f7f8080cd2ea2bcb95ab1c65557c7705b74ffccd9235af1fb7d1dc1d03ea610d
MD5 df4d2cb09061afa272666799168763cd
SHA1 62cd935e969a9386bef89ad12660899cca1fdaa4
SHA512 4a3d7ec19bf974871e4b182f6a7e4fa38586b3b13c3039b4c1b027dbee4dff9a425b5aec205ba9279bf78a6877f4b5a07be53ca2a9c15eaf7b9026d1423ae85c
SSDEEP 6144:wPuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:w5qIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T119B46D31E6A04037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a63CC.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a63CC.bat
Size 1KB
SHA256 bd9d1a5c919b6188772481a0b964f265aaa8bc2a65af00b188620d39b7b0ed53
MD5 e13c392a3d765577250848d0c79b3af0
SHA1 075c4fe8aa72d588bbaaa346f5fbb55e409c5b5a
SHA512 24985f494fd3701b316c9c32748ba52fb51e1273e2706e33a93412e380587dc78ff7f35ebd52593fd62ef2012ac465329ccc05f6bfac8840f232c3067577cf29
TLSH
T16611E706803BEB9E0660D80B87E26E9FE081974B375BA711B354C01E48F054FF9DB34A
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_3f35514a67a9aaa8993ee41e1d01e4b0_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 705KB
SHA256 9aa4d990627ed0136eb9e8e004614aca8e5bba4f2891842a99393791bcc09e91
MD5 c5b22f4a7f0f66d0588a03d1c25bd266
SHA1 deed7d558c48f9e88556a597e05b64719d31942a
SHA512 966a2c63897fcbc7f8bbbb11a441dc6256fc859afa34a3e7bbb700204d142ba6879b51b8cac6472451403594b74759f7d0baebbb7207c93e26084d2a84c89ddb
SSDEEP 12288:hEWCEGaAca9QMo7rv/E4GV3TV31utHC1v0XHEjCwiC:hIaE9QMo3EzuuvSHEjC8
TLSH
T1EAF4172225D9BCB6E4B202706B7F97E5871DEC200765C8CF53C4451A5A7C9E33E32BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 9b9303fc8d359ea23ce726fa74d524f90169cdf02f804b898165dc880d6979e6
MD5 ef8327b122c651163d51926d4ebce49d
SHA1 12899af61822e8cb1579ca3fe7c1e3a277bf7142
SHA512 2804f92025ebd6a1b72315a1c03e94a2cef0e378662a194b17f227586615f2d0782bb7f65ceb454c4fcd90804199ea39e90d7e6aece65ded475883ffc296e902
SSDEEP 384:Nbbnv1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:p716GVRu1yK9fMnJG2V9dHS8
TLSH
T10DD2F1A4A7EC15B3F2B31FF050931F5E9B33F515CD4BC21EAE6496464CD09440A7690B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
Size 9B
SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
MD5 9d7c9e9c175a7f3cb1ed2e1fa8c8e9df
SHA1 45e1bf014e9649fc879b503bc0400201abcceab1
SHA512 ea239cf81a4da3fabb0ff212de337300976ae3d3eec647ab8e2291ff60584f2ce7159f330e28de8c37da31c9ffc727a982090bf94f4f28112437477a4f2a9fff
MD5 SHA1 SHA512

Submit Download

memory/2564-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2564-12-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2820-30-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2820-35-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2820-39-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2820-105-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2820-1246-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2820-22-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2820-5043-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2820-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2820-5516-0x0000000000400000-0x0000000000436000-memory.dmp

Download