e9d2c428f2fd782ea578b62a6672bc4eef0b5a26004640be2c028882eb39fcbb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
Size 867KB
Sample260930-2pfjdstgjc
SHA256 e9d2c428f2fd782ea578b62a6672bc4eef0b5a26004640be2c028882eb39fcbb
MD5 2b1e0ccbd6f53082ef15378e06e5fcbf
SHA1 9563bf69a1a7166ae02d8aff8c13b73f7a12593c
SHA512 188a112ea3b153ac7492e2c0de9495f27c4e3d3d24c75195c8b88b35f490a37f3cd4f757bea978689eb36f8ad008bfb966e8a65f3c28b571839d6e63ae321da4
SSDEEP 12288:17+UmNFsLZoXACyRmrK8p+NhJ2Kcp1oWOvp52WV/ETd4fUw:17YFYZ6CGENf0piHvP2WV/ETOsw
TLSH
T14E158F6AB7EC10F5E07AD277C9165516DE727C1A1B31CBCF03A0865A2F176A08E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000016b49-20.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 2 IoCs

pid	Process
2456	Logo1_.exe
2468	2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
	\??\F:\	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_proxy\win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2132	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe
2456	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2132	3368	2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe	89
PID 3368 wrote to memory of 2456	3368	2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe	90
PID 2456 wrote to memory of 3712	2456	Logo1_.exe	92
PID 3712 wrote to memory of 2168	3712	net.exe	94
PID 2132 wrote to memory of 2468	2132	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4414.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Executes dropped EXE
    PID:2468
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 124KB
SHA256 17fd96c24e52344367a065886c2c9ea11718e8206f9f9b18e21a80745dbe2ae0
MD5 1ec8f511811bdeb4ab245e95084bbddc
SHA1 0d1d28d23b19f46560bfa17c123e980522505642
SHA512 67c356aded6dfcb8ba14be03d476d425977a8c23cd9b5c837ba70e7e8a64e939795ceae50201baa4bea4cbcc3696d66b7dcd3cb78acccdeddf9a4ac4fa4f9610
SSDEEP 3072:isftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:bVfjmN2G7/fYfLvzB+QFyn
TLSH
T175C38D1371D08871E5B20C3449E1EA619E3FF9620B449EA737C466BE0F317D1DE26E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4414.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4414.bat
Size 908B
SHA256 f0e6bca9c9242456212350473df54095fc29ca2ac2bee623ae17af46f5f5328f
MD5 77c5a560f8fb19aeabb67dd0ec31d920
SHA1 3a629cade17a2b291086ec1a6be63143f1087470
SHA512 e2ab0f4e5a935ec9951e9ad634d21bcbc1c4eec97457f7773c3ca54b44959246de9141c393b5d34d7c6bfaebfb9b5bc56476a8e0d243c5bf33018870b992f801
TLSH
T10B110815D37BCF964501607B0AE8194FE0D2E9C82FE633A463C08E1E189494CE8EB357
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
Size 840KB
SHA256 8995350defa515dd79efd16f4dcdf2911e8e70ae6246cb9dcb2423fd798a0bac
MD5 a750201c4da31eea76d5a9f3215b0607
SHA1 881418770d0750cf173af02c68845fe63f8147fe
SHA512 36560eb6c84ece0ee2df1d4785cd3e770b10b8608ebef029b64e33d05e7c98b7078a0db1eba6af2eb8f052d7e64509df899904a8e74ee0268987392b6d10ba90
SSDEEP 12288:AmNFsLZoXACyRmrK8p+NhJ2Kcp1oWOvp52WV/ETd4fUw:hFYZ6CGENf0piHvP2WV/ETOsw
TLSH
T135057E6AB7EC10F5E07AD277C9165516EE727C1A1B31CBCF03A086592F176A08E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 fece29ead615f8a7a4a13a36b8415c0fa517cc62954b77ca0c7dedb13a20a0d6
MD5 8922a4ac9c38bcb52124f9efe7e77593
SHA1 d3ed9dd3a8326e982d90926ced067b1a4bb5a663
SHA512 2e17a7c3247b5c38f89b8cb9b502bd92bbb50966662479e9fd476c207e2e1678d394fc3bb9fd3e06e2b83e9b05a83def8a0539fedeb1842f38f0cdcd01363c5c
SSDEEP 768:neK1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:nesfgLdQAQfcfymN
TLSH
T17BC2E17A25D81A74EC6A09BDDFE35702C33D837900AF647927B25D3B1260A29110EE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2304238888-3968896904-642854331-1000\_desktop.ini
Size 9B
SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
MD5 9d7c9e9c175a7f3cb1ed2e1fa8c8e9df
SHA1 45e1bf014e9649fc879b503bc0400201abcceab1
SHA512 ea239cf81a4da3fabb0ff212de337300976ae3d3eec647ab8e2291ff60584f2ce7159f330e28de8c37da31c9ffc727a982090bf94f4f28112437477a4f2a9fff
MD5 SHA1 SHA512

Submit Download

memory/2456-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2456-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2456-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2456-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2456-45-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2456-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2456-5041-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2456-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2456-5514-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3368-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3368-12-0x0000000000400000-0x0000000000434000-memory.dmp

Download