19248e97c61b6252734c7a6f1fded6c6b8419db313adad37dd92a5cff176010c

Analysis

max time kernel
150s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
Size 319KB
Sample260517-tls2baa14s
SHA256 19248e97c61b6252734c7a6f1fded6c6b8419db313adad37dd92a5cff176010c
MD5 a67b5fade733702e311f2914950e7da8
SHA1 97e02a3804f3f7ae640eadfab5477043463d87ee
SHA512 28c80cdc17ac3d49181609e152c1c3e6bd3be2ea70e879d734af7c498e94ec74042cf9e97f5ee53d2d8ac1d1017f101b1e98ae8877be438d325c12566b2e344c
SSDEEP 3072:pmOkuJVLWDCvl29k+ryysDCXKV93Wz82fBJSRAHOisuD85B03eC0D:UuJeCvF+ryyFuKSG7SdD
TLSH
T1E664C303A6EC3CE6D03A8630A77747C0EB2EEC4547A0D58F56D006A5DE3E693792A7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1988	Logo1_.exe
4032	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nb-NO\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\Logo1_.exe	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe
1988	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 1148	688	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe	87
PID 688 wrote to memory of 1988	688	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe	88
PID 1988 wrote to memory of 4600	1988	Logo1_.exe	90
PID 1148 wrote to memory of 4032	1148	cmd.exe	92
PID 4600 wrote to memory of 1668	4600	net.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41A8.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Executes dropped EXE
    PID:4032
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 67c6dffb1a9adad50d54c1ed758f2a4a80f0b4ac342281941808d7df509c8c4f
MD5 a38964c8a56d79ca5346391d2a9593fe
SHA1 2114a17491f54137e794488ad7baa28cac029797
SHA512 3a540ae0045f480db51ab00c853cc9c917db42827cb9b7f713d74b47cc424d7d4e5d515b4873d86a4d5b7bf8791c051e208b3ee32783d204b61bd34ce7c7c41c
SSDEEP 3072:plOkuJVLDYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:nuJtYCk3ET+Tu3fC0zB+JHv
TLSH
T1DBD39D1376D18472E4B2593108A1EE718E3FF9625D94CE6B33D42A3E0F316C1DE2696B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 66af1f7dbcc5d1918eedc82b8eab8626ff905b6000c0c9c743669b2a2e3140d0
MD5 c207ce00d9cd30676a65493b3c6c339b
SHA1 19a7cd258f2ff695fbb3677a2dbcd2356a688195
SHA512 7f71c5d32c3ebfae6224a50979d2af9fb7e41eb5d4986f47ff80523247c4d12f52a665039e8bd39711be4db958b0489417d070509d8318b327d463f861322f39
SSDEEP 6144:UuJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:OXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T103C40916F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 2cd1ea7b5bc267846e0fb1ef348ecef353627fc52d6591b6cba1ff16408e44c8
MD5 6098ea38ec05a4b6b3cfe01ae79052f0
SHA1 6957689ee3f65766a6b340aa4c88587cc38f69ea
SHA512 620e6772ffbf931af5039db5bad754ba62c1756ef050706ae13b0574b73f451aae363497169f01b23052c83eedb3a9b635f012367d0e0923562460ae494e6823
SSDEEP 6144:w7uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wNqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1DEB47D31E6A04037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a41A8.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a41A8.bat
Size 908B
SHA256 c336aaf61d394dcaa4807229d9e293a7b78480b2408e3c8ff06cbb637e323c4b
MD5 bef909bacba9a93f85804e10d9c4c41f
SHA1 cd2558c11fe7c8d0c8d1ca65093b97cc431c55fb
SHA512 5f128643ab7e9307a15b4c8f038ccc9ca4d4e843f5e649af574f2f566c6c6abef2a628ec15112f679be2f309dd613ca28ceaa37b5e5f9887badddc0cde291850
TLSH
T19D11061643E7CF5A451112574BFA1D4FC09A7EEBAF87226153C48EAE10D193CA89238E
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe.exe
Size 290KB
SHA256 c571d6e1595827a2c3b6baeb654ae5be9fa688cdd34fd0bb4453a96ed93590a5
MD5 65d1459dfdf9803e0531c36b91d7be1a
SHA1 8e946bd77490094c92c8b9958d65b3d850d77077
SHA512 28da6993f99ede3fafcaf3b98843db12d8b93f502d28273164d07c89d3edac51935019e50be34f73585ad3cac9db83e00292ab22cabbef13be3fa4047d9ef269
SSDEEP 3072:zDCvl29k+ryysDCXKV93Wz82fBJSRAHOisuD85B03eC0D:HCvF+ryyFuKSG7SdD
TLSH
T13754A143A6EC3CE6D03A8630A77743C0EB2EEC4547A0D58F52D006A5DE3E693792A7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 fc6a14958b74c4b0092e9ce9aafd801d1be275a3cf1a79716a882a91e1fdee9a
MD5 2a900face7f3854755b84c9f46a9de39
SHA1 34add6ffe766ca3e94c97953b9e979603bbff7ce
SHA512 e7dd8eb2b8ebced13c9a9987a2c656328318c63caa2236fde613ba3f71c345285b7f0389ad05706f856550245f66c13bcf117cae500449c7a460aceb74759f85
SSDEEP 384:NbbkHE1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pmE16GVRu1yK9fMnJG2V9dHS8
TLSH
T136D2BF2B37BE5D5AD1999EF098534FAACF27B522ECCDC14F4E30BA4B0A5170065D2923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-204488895-2999877624-296153668-1000\_desktop.ini
Size 9B
SHA256 72ace29665e300aa419b87ef2ca3544877abf8af2326e8f038cdeaea197d4ca3
MD5 6d8255ce116221e1fbaf70d632e4eb98
SHA1 c3413a7c01858c9bd7ea3abd52ffa903b8f86702
SHA512 33da7b46078aadcdbce21a055b70b967a60803ac9927539621d6e640b7bcedbc20a444d488181cdeb4911e0f958699351eb1ad85b645f088b73e79895e80a518
MD5 SHA1 SHA512

Submit Download

memory/688-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/688-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1988-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1988-38-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1988-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1988-55-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1988-1246-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1988-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1988-5035-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1988-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1988-5540-0x0000000000400000-0x0000000000436000-memory.dmp

Download