b8f4aaff252b0d7716a0a77362e218aa7b17e820cd0b6d2f96b08f082a44a246

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 2.9MB
Sample260709-pg6dmabs9t
SHA256 b8f4aaff252b0d7716a0a77362e218aa7b17e820cd0b6d2f96b08f082a44a246
MD5 af378bdf64e5a05f636b6ca1e12b61a8
SHA1 87149a2f8d4fb53c402be5f15bb4b801cdc95865
SHA512 d553f685df2777fc8f0428e58cab04331450521253abb766f4d71d4d16b667fa5a62f9916c5968ce833b60607af031af5689c1ada2bcad0ea161baa479d3a286
SSDEEP 49152:yQwRIk/0aTwIzVi0C5KHhx1OPthblHYxYm9Cp/t0mt7KKUwO:8T9Hhx1M4OmG0mdNUp
TLSH
T167E57B13F29940E8C059C078C75A8632EAB2BC89473466DF0690BF563F77AD46B3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2872	Logo1_.exe
1580	2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\theme-light\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\PdfPreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2996	2576	2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe	88
PID 2576 wrote to memory of 2872	2576	2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 2872 wrote to memory of 2060	2872	Logo1_.exe	90
PID 2060 wrote to memory of 2952	2060	net.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9DC.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2996
- - C:\Users\Admin\AppData\Local\Temp\2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:1580
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 4c74cbdc404d0e08db59716972c0ba39499d8e3ca11ea17affb91bde06857fa3
MD5 68b464f0936ace5a9a36d5c6ff9723d7
SHA1 e8e17ad245063c2fabcaca3605e698f3347258b0
SHA512 be113f8889da80fde8cf3e31fda5036835613da391949ec4801741841ad07e68a56e9197739751db2780c93f1932efcbc7f3e597a8fc48a9691db6673fd87436
SSDEEP 3072:JftffhJCuEmULhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:hVfhgujsG7/fYfLvzB+QFyn
TLSH
T104C38D1375D08461E9B50D3449E0EDA19E3FFD220B449EA733C466BE0F327D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 827a0e8827f3c1db2715fc7b2c5c5a92ac3deedd294f7b40622093cb92c328eb
MD5 81aede730abb1e63bf33b30beac52b7b
SHA1 4d333794a9892481914a804d837d4cbacf943416
SHA512 0abf236adebfd10ad158acb6203f584e3384a89eedad16ef7cad224ad6d90fc525366affd43e6c006653b2f9eb903faa093112b465c78e3558896afb88588017
SSDEEP 12288:/pJgurqIOkU8AMXE9B7PElZlP41N+4PUWfo:hJlBOkUhMXcBwc04nA
TLSH
T189A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aF9DC.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aF9DC.bat
Size 824B
SHA256 000456b871d1a57da111b2cd47327bcc9d6ed747007fa9f7e8abb1fef45f979a
MD5 57db901d09eb52bb76abee68974b2406
SHA1 bb45d0a80e497efa2fb8649cb5bbec5743077b77
SHA512 fa32e49807b7d7efb59a1cd1ac2d625a2f7296a5cebbc4b01d78e66b3f8826b792c34464663d5470bf6f1b060fca475658b9471be97973bd6d399602e6e0b0ee
TLSH
T18701C019CB9BDBCC0439611706AD59EDC4D2380DAF2D7A519B84CB1A32D440EE9A2B5B
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-09_af378bdf64e5a05f636b6ca1e12b61a8_cobalt-strike_elex_icedid_njrat_vidar.exe.exe
Size 2.9MB
SHA256 69f81fc137f00dd90ddf28e65972077fc7fede1c7175d402787932ac148b443a
MD5 48c5b060abc5edeabd2d57c1618c0484
SHA1 27813ff0ed7493fef32cc28147352d2eaef3f24b
SHA512 093b30bbef8e5aa8d43706feb57667ef400b843f314278409b32bd171d9732e3024617560d32772f05427325c908099be2e8c245e98bd10ca7aebf5c151e11e5
SSDEEP 49152:uwRIk/0aTwIzVi0C5KHhx1OPthblHYxYm9Cp/t0mt7KKUwO:RT9Hhx1M4OmG0mdNUp
TLSH
T1D2E57A13F29940E8C059D078C74A8632EAB2BC89473466DF0690BF563F77AD46B3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 200f8a688e1a1988f9269b2b4d81ebcda93b43139766b667c9d3ddbcb6c6e72c
MD5 06ab39f71f3f0fcc52a4036f37b05200
SHA1 c263fb7c6437fc9bdded42e956d9151d9e66ebc3
SHA512 0051fa18fb5cfd586001802a7b55a586b970c236bf7149e9432359d4c23139cfd7f02a7540306a8de182205a8636b64a5ee901720f72f7005810ccd1423177ed
SSDEEP 768:/21ODKAaDMG8H92RwZNQSw+IlJIJJREIOABT6UYOn:4fgLdQAQfhJIJ0IOEmUYc
TLSH
T1BCC2C08B3EC49455EC1D0BBCC7EA2AC3C3684C25689D541724F2BABA617B3E52E8543D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-200172840-2662118501-695741713-1000\_desktop.ini
Size 8B
SHA256 3ce72390aa4e5a13bbfe776c90d5df68ff8d761c9af0ee52d491fef48237069a
MD5 8de3f965e4029104e0be5e975833e214
SHA1 d5f15cccbdfaa22505528e3d15f752ea5c48af31
SHA512 1b60e6e79cb84b43b3eaf8bfd1b64bae6ea194d5555502ac376581406e41ffd76d5681374db5a16246e3a847227ed963f52343f58ee51a87cfec9b4fff5c2d63
MD5 SHA1 SHA512

Submit Download

memory/2576-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2576-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2872-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2872-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2872-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2872-115-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2872-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2872-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2872-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2872-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2872-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download