067a51d0cca211e2009c11c07383e50bfbc62228c0fe639620178f36c0ede01d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe
Size 4.9MB
Sample260731-dgdstsvtgx
SHA256 067a51d0cca211e2009c11c07383e50bfbc62228c0fe639620178f36c0ede01d
MD5 6df7bca6e8fdc612f5d6a8103fdfcfb7
SHA1 bb0f08b4198f35fa604c7e987e488ed54e6ff29a
SHA512 f109f7ebe2fdfbbf377af4de4b0905c3d7e49ebe622a5837d47bbaccd3ad3ce5b55f92c8e15fbd7f9e988a2489779b9998213a899d2d100302ed8c7097a36dea
SSDEEP 98304:ZE+DXzTBZp6X73BUwbhLApCOZxUTn6trLj:2QXz9Zp6X73uwbOCOZxUT6tHj
TLSH
T1D9369E11F3E420D5D876C238CA26E527E7B6B8181370ABDF1964D6691F63AE02E3F744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4868	Logo1_.exe
4600	2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadLine\2.0.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\EBWebView\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Notifications\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpCmdRun.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe
File created	C:\Windows\Logo1_.exe	2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe
4868	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 5904	4364	2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe	89
PID 4364 wrote to memory of 4868	4364	2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe	90
PID 4868 wrote to memory of 1784	4868	Logo1_.exe	91
PID 1784 wrote to memory of 932	1784	net.exe	93
PID 5904 wrote to memory of 4600	5904	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49FF.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Users\Admin\AppData\Local\Temp\2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe"
    3⤵
    - Executes dropped EXE
    PID:4600
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 b20ae889c5be456e8693e90fcaf767573b89935fa837f1c008422852a665658c
MD5 89d62f42044ea19a7a6918efc1f6ec0b
SHA1 33dfb30ad106d3dcabd2e2ec9aefb86e77cfa5d6
SHA512 d34567bbd04f3c5c69fe2afcf638e7458f4cf9f1f6d4fe19d425395a49f7b8c207a7b6b78cf79ee5594ff52f6208fc80baaeb2a0cd6f14ef5a41807afd6e69e6
SSDEEP 3072:NftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:dVfjmN2G7/fYfLvzB+QFyn
TLSH
T177C38C1371D088B1E5B20C3459E1EA619E3FFD620B409EA737C4667E0F317D1DE26A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a49FF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a49FF.bat
Size 902B
SHA256 941e47fbabd2fa30dcb9930cbc92dce0962c5f85a8f412d6cb5a3d34d2f64995
MD5 fb1db004bc07bdbd58e2f0c3e7e9d1de
SHA1 2def9e139b136f689baecc0b5c24115fd86c30d7
SHA512 ee02ebfe2c74ab9e7d764789e815bef8a38b3415c0b50d6c3fac4c2f42929f112eab0936d406978dc65a150012b1bb919dd1be900fc639c0496958d611bba806
TLSH
T10B11940485A5CFE94096A0334851BDDDCCE45A6AFE493369C328C48E67C5C0FBEC5311
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-31_6df7bca6e8fdc612f5d6a8103fdfcfb7_coinminer_elex_glassworm_hijackloader_icedid_njrat.exe.exe
Size 4.8MB
SHA256 0683dc73b1841dc6b7fb00bf52969ade31ae6715eba8965b67c05f663bc56a33
MD5 7e808d398710127ea5ac9e9491ed8f59
SHA1 ea2a14ca37b5921144fddab9c277e35d3c5265ba
SHA512 952dcef3cc818d33c502a9ef75b20b1547aab67061cd603270d11e03adec68b75f5c9cd02f2eeb99f9f1560b45545e0dd10009f0b0256492889052230676f28f
SSDEEP 98304:vE+DXzTBZp6X73BUwbhLApCOZxUTn6trLj:sQXz9Zp6X73uwbOCOZxUT6tHj
TLSH
T1D5369E11F3E420D5D876C238CA26E527E7B6B8181370ABDF1964D6691F63AE02E3F744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 35d1021b794bea3715cf8fde6d9226e011ee436a515675e815db389a7829917c
MD5 1f3e215a5e17b82f1fd01418b547cad5
SHA1 559e7902ca019975f9f0549226ea8025cf5c48cc
SHA512 3bf78ae597cd14825189bee007e7c6321625499817b76f135a11e1444ef4df0bfbceaba22d186c9e58f7f46ed84eb3f33d367eca58507f21a5b74e35ed5dcc88
SSDEEP 768:xw1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:kfgLdQAQfcfymN
TLSH
T136C2D0F617C81679DC12697DFBD26702837D0F79409F2C6539E2B93B2274A68500EE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\_desktop.ini
Size 9B
SHA256 996ad9b60efeb5dca4d8f6c323dc89c19991d156aa1111e9ebae9e0591ba4753
MD5 0346498f67c65a2d83a0cabfdcd02af9
SHA1 785cfa6c8bb5ad7d644d17fa99aa1cd4d424c415
SHA512 c539f06aa88d1d7c9e069f110cadb10f72036b455ec76cafd5ed6b904809733e9bffa9034a054508c8a177a0c6c5bf2c8bb898d9a9ca59e05193a4061ec29ca5
MD5 SHA1 SHA512

Submit Download

memory/4364-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4364-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4868-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4868-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4868-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4868-139-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4868-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4868-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4868-5041-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4868-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4868-5514-0x0000000000400000-0x0000000000434000-memory.dmp

Download