d4234134b56dbc6504e743b50f4eef9a1d4b3e1a67d34c729830e27bb139fde6

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.9MB
Sample260701-gp7yesht3v
SHA256 d4234134b56dbc6504e743b50f4eef9a1d4b3e1a67d34c729830e27bb139fde6
MD5 266bd896b857732869cebcd57baebb57
SHA1 be7a76bf7327319e842a2c48efdbf2e22ac301e0
SHA512 0b4cb1709a494495d65efd5f4a5331c254f67d4e0f133690f7c806e846873a31fe3f5150d833ab704cb10e9c6045d95a0af51aa3d468202c52143b519bbe7913
SSDEEP 49152:O7NXho76s7ComtU69rjek57/kyMG5EG19wF9/a:5AeO8E
TLSH
T113957B17F29900E8D05ED1B8C74A8232EEA1BC454B24AADF0794B7952F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4272	Logo1_.exe
2140	2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Reference Assemblies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{6D9A8F9E-89B7-4650-9C1D-6E17F6AF53AB}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe
4272	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5292 wrote to memory of 2040	5292	2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe	88
PID 5292 wrote to memory of 4272	5292	2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 4272 wrote to memory of 4784	4272	Logo1_.exe	91
PID 4784 wrote to memory of 4432	4784	net.exe	93
PID 2040 wrote to memory of 2140	2040	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE48F.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:2140
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 877996867ceff5c7bb88fbe52ed5223b7751c8042d9f240af22fe256159c742a
MD5 4358a3f83f8086a6c045324d141786c9
SHA1 26ffab6165b30d16449bfcc5dccdcbd78b757463
SHA512 4e90dbbb20861d0da04a138e028723421dedf1d80834ca6c4d2df6bb4a8d91c9334e99d96abed2cb6de6ec9e4e3ee7415fffe79b05c28140e7d611a24b4a71de
SSDEEP 3072:urftffjmNHhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:aVfjmNBG7/fYfLvzB+QFyn
TLSH
T1FEC38D1371D08871E5B20C3449E1EA619E3FF9620B449EA737C466BE0F317D1DE26E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 2345a6a6afd153a76f7e96e2a0096cd05f1eafa7329b6388bcfb2b6c740cb7d1
MD5 07017dc06e6c42a1d38809068381ada0
SHA1 8e2524fd660a875e3d5f42248ba86b0f37ef2385
SHA512 1a3ec939a18fb395b74f585cc40c18653ce417d0c1b9b0856085a421240b1e845a8423dc33a38c4e2007cb83e067b772e911acb653fc435dccc25dd563bcc1bf
SSDEEP 12288:cp7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:g7/BOkUhMXcBwc04nA
TLSH
T115A47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aE48F.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aE48F.bat
Size 824B
SHA256 7537cda17f0261beb57b42730115f095c7021af9d2db06d2b5b1710cdf9c111f
MD5 8e9d3803d83ebb6688540961e65ebf76
SHA1 fefb0207b2f93b1c88c4dfd681d5f56f03632db4
SHA512 b2b4ce3eef263fcfa44dcf1d0542cc34e0d203c0a6da7cc0ca94426c465855b095fe707074badb611fd8e966243831903a0d8d470d644f9b610433434d85b746
TLSH
T1EA01DB21C2ABDDD8142D309346914CDCC0A1B8586F5E3E6197BCD404E1C0A0D79EA757
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_266bd896b857732869cebcd57baebb57_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 1.8MB
SHA256 258f4007910207abd3c6d43ca47edc5dd81c691943ac82d4bf49f45fe69da9b9
MD5 5b33111f95fc0774df7267eb1c958c7c
SHA1 5a975f7d41e0bb5cc4e6d4a7377a2ef13e0db065
SHA512 6f55bd5c0b26695d66ce6dd6172259033ba3c56bc0ac31407a69b0dfec2f57c28d811aee1ad4ddaefca7550932f550620e5a1cbcabf232624a2dcb27c760070a
SSDEEP 49152:jXho76s7ComtU69rjek57/kyMG5EG19wF9/a:0AeO8E
TLSH
T131957B17F29900E8D09ED178C74A8232EEA1BC454B24AADF0794B7952F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 818aa75d29d2e57b36ace6e1bfc9a4f7f28f95d8aaef74c8359683cb74ace266
MD5 241df2feced1e98155c6a6e6a2938d64
SHA1 b12da442190ced4f62657d4742adf9e1c8e3e94a
SHA512 beaad3261b17cf9f9d7b691be1c3805fbb8a6a11a97338c090c168bcaefda518e152bfe3047c97c450ca83ac99de5534b78cd37d3ea478da2303059f81c555e3
SSDEEP 768:ZJot1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:ZyrfgLdQAQfcfymN
TLSH
T1A3C2E1F812CA2A74DC264EFDEBC76302432D0E7950EE552639E2557B2621B75304EE33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3865087520-2734723108-1233268525-1000\_desktop.ini
Size 8B
SHA256 089caef252dd451f6474cb4a71db68e1e1f050b73538fffe20d8598c65c496b3
MD5 0c2b4a90bff350f25a3fcec9d23d7f7f
SHA1 8ea76cf1cbe0252a3d07f0ddec341bec69f27172
SHA512 da34008f0f75a253ad7cbc1ce91a2ba488d604f850ef17692bcb7fb5afae5cdeeefc534b404d82d8345e255b5db68ee5677fe3bba1f2b923f4110cdf7dabbb52
MD5 SHA1 SHA512

Submit Download

memory/4272-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-124-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-1245-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-5040-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-5513-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5292-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5292-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download