e3db0f76bdf4a848d0a6d83c73318028928be1e0a57571ba70c09c73a288f4db

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
Size 2.1MB
Sample260715-2zf8nsay91
SHA256 e3db0f76bdf4a848d0a6d83c73318028928be1e0a57571ba70c09c73a288f4db
MD5 fd0af8b6aa202ce75b0f6fcf6f44e0a3
SHA1 4876b984b3c33e209211b7ea7276d127ed96903b
SHA512 f515d3fa50c971f47fd643bef7e236adc62e536c757ec57c4a5ad9d0e9635fd4be0f2e9b9f316ffe6432e7eb478f3447306ee4744b8cd3f1c4f599069e261093
SSDEEP 49152:h7fmPHystHBnjdagWBfYq1VvakTj6PTxf:uKgWtT
TLSH
T105A56A17B66508FAE259C074CE169031DBB27C0907F9A4EF31907AE52E77BE43B39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5052	Logo1_.exe
52	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\attachments\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Oracle\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe
5052	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 5640	1220	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe	86
PID 1220 wrote to memory of 5052	1220	2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe	88
PID 5052 wrote to memory of 4052	5052	Logo1_.exe	89
PID 4052 wrote to memory of 4088	4052	net.exe	91
PID 5640 wrote to memory of 52	5640	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A2.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:52
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 6fdf17b547e04648e08f760e123cd821e664cf26b914a0dca90ca1e093d273d4
MD5 39048a7b9470ec973f62bce61327f267
SHA1 9b337a03c8b50f45cb874551a425d85e53a736bb
SHA512 503ceeaa5c9149f5a26d11dc3c0253dcbb7c6717327f70ec3365269b7ec96a9783666d70917d4e49c785ca0b0ba26933971cc70c109a6db958dd6b0a441ed0cb
SSDEEP 3072:qftffjmNHhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:qVfjmNBG7/fYfLvzB+QFyn
TLSH
T1FDC38D1371D08871E9B21D3049E0EA619E3FF9620B449EA737C466BD0F317D1DE26E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 1f06570aa3d1064cd6e7bb1641c7660e9991de3dfe2f36dcf7168a7ca50f822e
MD5 f2f0fc2163d1d3b8943f7c8ce8652717
SHA1 aa16c31090c81095065f77f884f1a1be1c5bc858
SHA512 a839f70d5294d1971b0d36c98189ce41054837f70fffc9f5232b116103ba4e14c3470c4414b5cdfd25d4abe7cf5723d74671497021f12f095a2ea733ea15db22
SSDEEP 12288:vp7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:x7/BOkUhMXcBwc04nA
TLSH
T18CA47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aE0A2.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aE0A2.bat
Size 740B
SHA256 87bef08b3626708706f8fab0815a6a8f8009373ab610631caab7de80f0570c99
MD5 3553f12e2d19438fafa739eb8d95eb8e
SHA1 eba545c52a639c9e80d340c140d9eb4c62be4c24
SHA512 c789f8ffd7ffdced077eea77f5b8d82dd104aa9c11b6893d1deaf936bef9b10e4a07a5bbdeac5e832b5045c69af1a3f853aa317b2ef86bee9f52f12001fd4908
TLSH
T1A5015E61C1BB49AD4458211305E59EEDC8772DAEBF0D1261BB38C82E12C015FFEA5210
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-15_fd0af8b6aa202ce75b0f6fcf6f44e0a3_elex_icedid_njrat_vidar.exe.exe
Size 2.1MB
SHA256 a12c61d8b0c887eaabd74c032696ce61aea9d7ee310f552325bd21986210f60e
MD5 ac23edc4aba225773e6fb2a56ef8b349
SHA1 be6207bbbbe24d45a7cded1d4fe288d7b30f4981
SHA512 f74676e30aee3b2e5000088c0dbb1d2812f49b4c2bdcbf32862f422a6f9cdd06911b3d5e6504b69abc29d6e7481e4ed34860d00ce592e61075e5cb50f2985c7d
SSDEEP 24576:JIvdc+HystDhsCdfnjdagO7Hjll0Ipq9L21Vva8XYVOj4FJAEToEICf/IS/c/ghR:JmPHystHBnjdagWBfYq1VvakTj6PTxf
TLSH
T11DA56A17B66508FAE259C074CE169031DBB27C0907F9A4EF31907AE52E77BE43B39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 090e6f6571705876a947bf44fa778dc81702b2333621b1447bc0496c2e93f660
MD5 6dc99394dbf89a4d407a08d3da19c9a7
SHA1 63b31469059a282820437a4b33ad95e8bbc80e4e
SHA512 e85f3d8f8d31be8a8558bd8f942c31b363e1e26d015f9701ead6d5abaaaffee8a356ea55eff333e33c7cb13a055c5fa3ab2a6ae5f91095299af464b8374b8f6a
SSDEEP 768:so1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:LfgLdQAQfcfymN
TLSH
T1ACC2E1F812C96A34EC267EBCDBD6A702432D0B79509E663935F2857F2111BB4204EF27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2246396966-3025826688-3847171515-1000\_desktop.ini
Size 9B
SHA256 d8605146ba04ca532b3242764bfe2be90f8cbb4bae83974874fd9662df8003bc
MD5 92adf9411d1bdeb4b9c79323b0dbfaa2
SHA1 41b2310d240ce9d6dac39e3085e1cd3675288097
SHA512 297fa75a2198a90d2409d351d5b10c144f4824d9f458d5278b0c39467707656fd640d2ecbe48d8ceb25ad648a038a950467005efaf3d906359cbfdd0686d9ce8
MD5 SHA1 SHA512

Submit Download

memory/1220-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1220-13-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-137-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-5043-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download