e3db0f76bdf4a848d0a6d83c73318028928be1e0a57571ba70c09c73a288f4db

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
Size 2.1MB
Sample260715-2zf8nsay91
SHA256 e3db0f76bdf4a848d0a6d83c73318028928be1e0a57571ba70c09c73a288f4db
MD5 fd0af8b6aa202ce75b0f6fcf6f44e0a3
SHA1 4876b984b3c33e209211b7ea7276d127ed96903b
SHA512 f515d3fa50c971f47fd643bef7e236adc62e536c757ec57c4a5ad9d0e9635fd4be0f2e9b9f316ffe6432e7eb478f3447306ee4744b8cd3f1c4f599069e261093
SSDEEP 49152:h7fmPHystHBnjdagWBfYq1VvakTj6PTxf:uKgWtT
TLSH
T105A56A17B66508FAE259C074CE169031DBB27C0907F9A4EF31907AE52E77BE43B39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4480	Logo1_.exe
1532	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Security\BrowserCore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\el-GR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe
4480	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 4592	1784	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe	85
PID 1784 wrote to memory of 4480	1784	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe	86
PID 4480 wrote to memory of 4824	4480	Logo1_.exe	88
PID 4824 wrote to memory of 2272	4824	net.exe	90
PID 4592 wrote to memory of 1532	4592	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a172.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:1532
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 b6b7b1cce8db0faa946dbc373e7f4feacc2a7515512bd9f8b71a7ae7258d907b
MD5 e264202db66f6e3c934188064f0ce4b4
SHA1 7cad4fcd51e0e725acce00daff5976aaf32c39f0
SHA512 16e52b861b32cdee9c407de0a00e3797cbcb713c0ff5c17c6afecd5a57515cde9fc46c5588627638b0a8e97667b0342beb8f57a0aa70427d72c4f299b2ef3dbd
SSDEEP 3072:qftffjmNTYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:qVfjmNTYCk3ET+Tu3fC0zB+JHv
TLSH
T134C39D1376D08472E4B2693109A0ED718A3EFD621950DE7B33D51A3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 d61cf5498b2fb064f3d966bf8b2e251e329546d37cf5026caa967c7f9d0ca431
MD5 554b4366f73326b3da5e4f32ba59c30c
SHA1 53c57cc1f6963fd6968c6042b5b6acb7ab8d646c
SHA512 0874fd68bcb6fed4eee815881b1abcddd5574d8993a4dfe5fcbeb4fd2bd34f3fa21a6177b372472c18b5de87b32c0edfc0296a7e6bb92678dcce8760a9e81be2
SSDEEP 12288:h7+CXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:h7f0Le5ji0hmxNrM
TLSH
T1DDC40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 1f06570aa3d1064cd6e7bb1641c7660e9991de3dfe2f36dcf7168a7ca50f822e
MD5 f2f0fc2163d1d3b8943f7c8ce8652717
SHA1 aa16c31090c81095065f77f884f1a1be1c5bc858
SHA512 a839f70d5294d1971b0d36c98189ce41054837f70fffc9f5232b116103ba4e14c3470c4414b5cdfd25d4abe7cf5723d74671497021f12f095a2ea733ea15db22
SSDEEP 12288:vp7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:x7/BOkUhMXcBwc04nA
TLSH
T18CA47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a172.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a172.bat
Size 739B
SHA256 bf532cd53a62349125b8dd71055fe319f19537c704f71957e5b5e39e36be4921
MD5 c40e05f56387300cfdcd11301ed2ea35
SHA1 cc33acdfc75f6a79b637d4747c10d39479ea6daf
SHA512 0b7ed0980459568a6139a323b5a438a9a6391dbc784fa6e808d1f827197d3929734bcacfe1a14fc7eb764d5e548c22a3b60e8ea1454ee42867e7c773883cfc14
TLSH
T1F8015E61C1BB49AD0458211309F59EADC8772D9EBF0D1261BB38C82E12C015FFEA5210
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe.exe
Size 2.1MB
SHA256 a12c61d8b0c887eaabd74c032696ce61aea9d7ee310f552325bd21986210f60e
MD5 ac23edc4aba225773e6fb2a56ef8b349
SHA1 be6207bbbbe24d45a7cded1d4fe288d7b30f4981
SHA512 f74676e30aee3b2e5000088c0dbb1d2812f49b4c2bdcbf32862f422a6f9cdd06911b3d5e6504b69abc29d6e7481e4ed34860d00ce592e61075e5cb50f2985c7d
SSDEEP 24576:JIvdc+HystDhsCdfnjdagO7Hjll0Ipq9L21Vva8XYVOj4FJAEToEICf/IS/c/ghR:JmPHystHBnjdagWBfYq1VvakTj6PTxf
TLSH
T11DA56A17B66508FAE259C074CE169031DBB27C0907F9A4EF31907AE52E77BE43B39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundl132.exe

Path C:\Windows\rundl132.exe
Size 26KB
SHA256 090e6f6571705876a947bf44fa778dc81702b2333621b1447bc0496c2e93f660
MD5 6dc99394dbf89a4d407a08d3da19c9a7
SHA1 63b31469059a282820437a4b33ad95e8bbc80e4e
SHA512 e85f3d8f8d31be8a8558bd8f942c31b363e1e26d015f9701ead6d5abaaaffee8a356ea55eff333e33c7cb13a055c5fa3ab2a6ae5f91095299af464b8374b8f6a
SSDEEP 768:so1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:LfgLdQAQfcfymN
TLSH
T1ACC2E1F812C96A34EC267EBCDBD6A702432D0B79509E663935F2857F2111BB4204EF27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2370214745-1838013427-2987045292-1000\_desktop.ini
Size 9B
SHA256 d8605146ba04ca532b3242764bfe2be90f8cbb4bae83974874fd9662df8003bc
MD5 92adf9411d1bdeb4b9c79323b0dbfaa2
SHA1 41b2310d240ce9d6dac39e3085e1cd3675288097
SHA512 297fa75a2198a90d2409d351d5b10c144f4824d9f458d5278b0c39467707656fd640d2ecbe48d8ceb25ad648a038a950467005efaf3d906359cbfdd0686d9ce8
MD5 SHA1 SHA512

Submit Download

memory/1784-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1784-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4480-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4480-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4480-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4480-399-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4480-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4480-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4480-5094-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4480-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4480-5611-0x0000000000400000-0x0000000000434000-memory.dmp

Download