61b96f9dc8dd09bbb85a4286557eb3b9d85f6aa341734b37dd3956f68f923672

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe
Size 214KB
Sample261014-215mnatwhy
SHA256 61b96f9dc8dd09bbb85a4286557eb3b9d85f6aa341734b37dd3956f68f923672
MD5 3e46cec371566bd0b85c739f18b332ec
SHA1 3cf95079dbecf46bc782a77853b6efbf22870f2f
SHA512 9c358f9578ae866fb4786b0926213cd30b1584ab0d18a54bd6b856a1dedaf601f2e2fdf4f4bdcab0f79a3d8db22972f561eef9aeee776452f9d36aa2c47d94ad
SSDEEP 3072:LekF3p5LEs+CGsZUhmLXostDi7z9GJ7jmUsrgfSu1+f:LbFpOsVFUELYIMYZpP1U
TLSH
T1E3247C4772A820F9E0678279C8924A05FB72B8714B60ABDF0764837B5F337D19D7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4268	Logo1_.exe
2752	2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\AdSelectionAttestationsPreloaded\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe
File created	C:\Windows\Logo1_.exe	2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4296	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe
4268	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4296	3212	2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe	88
PID 3212 wrote to memory of 4268	3212	2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe	89
PID 4268 wrote to memory of 1252	4268	Logo1_.exe	90
PID 1252 wrote to memory of 2476	1252	net.exe	92
PID 4296 wrote to memory of 2752	4296	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71BB.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Users\Admin\AppData\Local\Temp\2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:2752
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe
Size 228KB
SHA256 d7c1bb2605ec652659e701cb341639cf21f2e4e7e6b95901aab7f73e5bde83a9
MD5 23382e379d099ac7d179bb6ebebdd872
SHA1 95cacf751efd08ee592621d21c343f9fde98cd19
SHA512 3395d7848ed012f01c7eb53b400d125e8d072997c295cc001d47eb7d00bd7eb5128a9a3834a04d735146b7a5cf3c7bf8bf0066f29242e923bed9b8a65dbb2482
SSDEEP 3072:7ekF3p1/rfzYT6X/D/24l/DFeodwgjf+FvC6C36lnWesuoB+ICTRK02Bd9PqwrlK:7bFpvrZl/DFf3WC3as7B+WCR
TLSH
T13B34801233F84929F8F39E316C398F2AD93ABC31AE34E66E1644119E1D35A519D31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a71BB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a71BB.bat
Size 830B
SHA256 1410113c46778cb926657d247d92914fd8a71bb09d7cb2c335c640673107da39
MD5 d06077f736b01c5e567a0696b15e2ae8
SHA1 89a254b5252e13f0275ea86771c4a06ff8e95435
SHA512 cfd375abf7744669d7c4ce0cc1c79836f7180c64a396af0d838534d01c5c7020232d773d3ca0aba42ca4bed84508e841dde973ab3bc1f09ffab4e3722d7595e0
TLSH
T145010842425ACEC74451F29315D9A89DC81118AD7BCC3F719350C38821F963D6CA2BDE
MD5 SHA1 SHA512 TLSH

Submit Download

2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-14_3e46cec371566bd0b85c739f18b332ec_cobalt-strike_elex_icedid_stealc_vidar.exe.exe
Size 186KB
SHA256 9bef155e6efd0cde278ca28577d3d00845b99a1fab55abdacaa09827f298eae6
MD5 feb9223c9a7c4930927cc509ab0cfcd7
SHA1 971a1a55b9da7a11349c87ca7f98221b44d503f0
SHA512 92a02f52bb3ecdda34046d5843683d8a275ea2a0fd7f9e1af6e6da466e6a70d05ec83d2028c0416db125ddb0a09b51dddeecf097ee50a037a0ab6a165922cf53
SSDEEP 3072:8LEs+CGsZUhmLXostDi7z9GJ7jmUsrgfSu1+f:nsVFUELYIMYZpP1U
TLSH
T15A145B4772A820F9E0678239C8914A05FB72B8711760ABDF076483BB5F333D19D7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 27KB
SHA256 18a28a072772de2ea8aae4b024443699bf276c4fdb1500bdeeca8747c8fe0482
MD5 e8788c24205bc3f41f3dd3886b552295
SHA1 0a5cc254a136a858857ecadd0aa3788c715bf704
SHA512 ad1e802c3cb4596edb50c99ef34a286127c39077fd42f96a73a597c918f243371338e498a3e93604289c063916a1bcad5b4a57cd4096f171c93e81d24574cd2a
SSDEEP 384:MVKDvJ3K1Gt5M0zhIV/DZ3KZp7JcTO4yf9KFL/KaUUqd3qR+FlYTj9QTN0wpD9pN:LJa16GVRu1yK9fMFLKaTxsujCT7pZpY
TLSH
T174C2D0B0D69A5691C4C452F60CDF0A6644B6F153DDCE3AAB2BE82C4F0D72D1AC06960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 10B
SHA256 a84e084245e3f6886d865b686fe7721ae199dc4fe5e57e3e07f34424861de421
MD5 20b7f5812ac25c2ff17d9da9c4db2839
SHA1 3aa2f0c98212ecad4f21ac6327b40e9d85401fe5
SHA512 dac4c34863dec1a639182b05fa1b04af1fc11a0b71f64049b8e2395145a4b0ff1a13ff5d0342399003ebcad9ba3c14040d460e873f316f7c23a410bb43676131
MD5 SHA1 SHA512

Submit Download

memory/3212-11-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3212-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-30-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-23-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-36-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-40-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-148-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-1247-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-12-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-5042-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-5515-0x0000000000400000-0x0000000000435000-memory.dmp

Download