61c509b6f2b9b6911b6f9cea57270d74d2731955752d21dc8112c79ac254174e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe
Size 2.4MB
Sample261027-lvf44ss1ay
SHA256 61c509b6f2b9b6911b6f9cea57270d74d2731955752d21dc8112c79ac254174e
MD5 a8739869904c6ae1db5b21a61b65a4ec
SHA1 8b91a2d666eb1401c8621ed7c5a5f7f9376414c1
SHA512 752b1a8509d8858b3012a6a7cacde2ab816e5670dd82a9d699dd24e50088dae77ca7c0ff7933cb409105a2f66b5a7249ec75f3437cdfadb386c7739a97cf2764
SSDEEP 49152:4BYYfHwi2T65R40nzVeYq/a0j3/KmCJy6/WZoM2+VpfK9WIhvYDlE9I:HYYlTQIU9M2+KkSgJ
TLSH
T1D1C507117A4AA9BDD15AC470834A4AA31A2138DB1F35BDFF44C8A6753FA9AF41F3D304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2368	Logo1_.exe
3032	2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3356	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe
2368	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 3356	1736	2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe	89
PID 1736 wrote to memory of 2368	1736	2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe	90
PID 2368 wrote to memory of 4240	2368	Logo1_.exe	91
PID 4240 wrote to memory of 4308	4240	net.exe	93
PID 3356 wrote to memory of 3032	3356	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2438.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Users\Admin\AppData\Local\Temp\2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe"
    3⤵
    - Executes dropped EXE
    PID:3032
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe
Size 230KB
SHA256 fa6efa7261bbf59a0c71004db6dff9a43f999cf17573b1a7fe26d1b50ad5a114
MD5 f421b48e7aa1c003f9dec978bb753c2d
SHA1 5deb6f0a2c4a81decf9a507a4e89e4bd985b3efc
SHA512 81ad70209446bba0bc0037499713e627e8c56aa62baf03e4e139be4528cc43a155397e59a16d35ffc27c2dbe61b171082dd6c1d9f86bf2418cf73e5eedb8a109
SSDEEP 3072:pUkuJVLl/rfzYT6X/D/24l/DFeodwgjf+FvC6C36lnWesuoB+ICTRK02Bd9Pqwro:fuJZrZl/DFf3WC3as7B+WCR
TLSH
T1BD34701237F84929F8F39E316C398F2A993ABC31AE34E66E1644119D1C35B51AD31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 663KB
SHA256 8d4d48168a7d52f1e1c53e6355b9b76a262458330d8616792dc87695cc45a72d
MD5 faf09bf5321ee6aad0fe4f0d71cf08d7
SHA1 6ab84bec89181e7fc60ce7928817f69191210c37
SHA512 24eda649f6f9cfd11f306505919f5d3acce9ae24151a399c69d1b93309b162fe932c379822e36bb5480b9578811be046188a841d90baf2116d2861c5af0b0e38
SSDEEP 12288:wsnMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:VMysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T1E7E49E32D5644032E6F206B3A918A2347D7CE218771489AEE3E8ED5D7EA848177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2438.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2438.bat
Size 746B
SHA256 72de6e717259a6eee642e7ad68eacb69365e36c7bcc5c5758e76a10305fa8c88
MD5 84ac2df02011c93ebaf1a7e74915e669
SHA1 4e8fda39746b4c1d0141912f0f55d39b7749fc8f
SHA512 bc58bc6dfdb792bcf077f7c9354eba5f349d5f388975ee27273172acb0e24a67c9ad03422f1390fcbdcbafee7a3d8a6a5433b5ab8ef8113912c6b6083388aa2d
TLSH
T150017142C25FCA570D61B24386B29CCED4B63C7C7748274853AAC2AE61F9D58ACA52C7
MD5 SHA1 SHA512 TLSH

Submit Download

2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-26_a8739869904c6ae1db5b21a61b65a4ec_akira_cobalt-strike_elex.exe.exe
Size 2.4MB
SHA256 0a928e3d032a058d65c233f4b94dd91eabe41f92527ddea5b632768a8514a8fe
MD5 9b5ec0b766a91c5d4959f827341e1534
SHA1 3413698543fbce2012f28be032447de6a6f43428
SHA512 231f3386ff11ee49ff667c0a55d3deb9d3e6d1cc4621a2fcbd1cd408fd605dd20f43f604a629bac149c019282161ae5e7a85387ef877b0b3e20b04b7cd37a8f0
SSDEEP 49152:dBYYfHwi2T65R40nzVeYq/a0j3/KmCJy6/WZoM2+VpfK9WIhvYDlE9I:oYYlTQIU9M2+KkSgJ
TLSH
T124C5F7117A4AA9BDD15AC470834A4AA31A2138DB1F35BDFF44C8A6753FA9AF41F3D304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 29KB
SHA256 0dc900bd4fd16132c8b5853dfffc23edf060349a33a5b214873f314b88d091c6
MD5 108d478b606226cdf8ae9bbfe040b383
SHA1 796c6b1f9268b3fcf83dd3de2adc361921cac301
SHA512 c709e40bbd8c827cf13906cb7bd1c99a9611b8351790c62030f67c222091be25c034c58c6c6df17f6b38cd02bf0b6b39248d436156cd893102140644e4c90ba7
SSDEEP 384:NbbMKDft1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pV16GVRu1yK9fMnJG2V9dHS8
TLSH
T11CD2C0232FDD59A2D5D10BF008A34FA60835F912F846E25E9F90AA5EDCF1B40F65110F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 10B
SHA256 429d13db37d4bb1357cb28a091ed6f6ce018fbc952452c34f11de1e40dcb3a59
MD5 110a11ae4d7bb9a6e9c5c9e2c8fcde6c
SHA1 c6ec8483b3628cdea8519f90023429191a4d8918
SHA512 514a94c9c2f76cbb621a856fd2f69e39dac4e977d1c95762eebfae279cabdf021bce4d87f48fa69e4a420106b1fd9440f18887159004df843aed26bfc6c2f41f
MD5 SHA1 SHA512

Submit Download

memory/1736-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1736-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-31-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-40-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-92-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-1247-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-23-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-5042-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-10-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-5515-0x0000000000400000-0x0000000000436000-memory.dmp

Download