d77a3682ec3a3f3479d3a5b3524eda89ab5ab5125b92ff3b717970e6ca88be48

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe
Size 2.2MB
Sample261104-ylkr6aee93
SHA256 d77a3682ec3a3f3479d3a5b3524eda89ab5ab5125b92ff3b717970e6ca88be48
MD5 59ba6b38b0e8b3fd5a3695a423b7376e
SHA1 6e1710d8ad3be7eaa1f80dbc48d3b81ccadaf11d
SHA512 f2f6eafb98c949be3efb22693d9fd85945b4c12841e22f4cbc20fb0338de8f5e3c303b9b3cb16859ffda67c4e533b31144799a36d2f8f4fb03bc6324e603bfc6
SSDEEP 24576:k7EPKyeHQduLXzumnW5PaDyfnWFVSA81BmYfVtqlh9ZeFjUAtdSh/D8gTVcpcUn:k7EPKyWpeICnWFwtqL6FjUAtdQ/bo
TLSH
T15DB59C03E29602FDD03AD5348B465232EA65BC45BB317ADF0A81B2551E7EEF05BBD720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4188	Logo1_.exe
3248	2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Visualizations\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_feedback\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\css\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe
File created	C:\Windows\Logo1_.exe	2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1600	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe
4188	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1600	4800	2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe	85
PID 4800 wrote to memory of 4188	4800	2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe	86
PID 4188 wrote to memory of 2396	4188	Logo1_.exe	88
PID 2396 wrote to memory of 3844	2396	net.exe	90
PID 1600 wrote to memory of 3248	1600	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE1D.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe"
    3⤵
    - Executes dropped EXE
    PID:3248
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe
Size 236KB
SHA256 8972380cca68dec1da7c90772d2d7bb0143261555b46db8247e24495b2a0126f
MD5 2b5e8dcb5934f7dc8175671f3342f6ce
SHA1 b95a457d132e1327c0bb8f6006467cac617e852a
SHA512 37b4c25cb093fe7f97286a5b11cb2a4677db0d7572b9dbfa3df3f0b11a040aa4698e28352f15ab49d64de12f42bc3bdc219f5535f562db71817524a41e06cf90
SSDEEP 6144:MVfjmNr7gKNkhSR/5kHouyXnZhB+h8WH3:O7+r7gKNkhm/JuyXnPB+h8WH3
TLSH
T18734912233F84969F8F35E306C759F29993EBC359E35E72E1640219E2D35A41D922B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 660KB
SHA256 a33ff0fbf40f2a77a95b70ba499d0efe12131b471f27efe68509fbe2ba287a47
MD5 0d9c90532c6ddcc0db641042fe66e031
SHA1 3ef0d8fd2c2e44feef74ed8a24921ac1f8ea1d2c
SHA512 72c7861fa2c1d9fe388446ae88d6c38ff5a7ce15674b57674a48340b1116eeecbfa269cacce4070ba9010f0fe7573da9f470a6f6a64f7ac97d3ef61bca6d5975
SSDEEP 12288:Pp7+znMwHskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN9:R7SMysZgjS1hqgSC/izJfojymk4HM5yJ
TLSH
T1BDE49E3294604036E6F106B3B958A2347D7CE22867148DAEE3E8ED5D3EA849177F7347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aAE1D.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aAE1D.bat
Size 704B
SHA256 3b4d3b47272343bc9c5cb430b9ff71a58866e7d68df8a991a7143b490c38cda1
MD5 9110f034b4d30b0054f730712ccd198b
SHA1 1411b0cf2caac8d9ba1a82c2ab9fb18bcb40ccd7
SHA512 3405de4c9e53f40bc3341f2c97c7c8d1b4f0c8e63e2e753a840c4a7dd7b53c13b290fe251e06a18ed7e5ad09db90f584248a8224947063e49cbb410e332bb62b
TLSH
T1CF01DF8BC5AE4EC9641CE01B08F78DACC8113CA42FF5AAA88730CAB52DC150C6783B04
MD5 SHA1 SHA512 TLSH

Submit Download

2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-11-03_59ba6b38b0e8b3fd5a3695a423b7376e_elex_icedid_njrat.exe.exe
Size 2.2MB
SHA256 13251a0787f88f1bfdf48c7a636973b0620575df7aa41b131ddf78c3d6089bea
MD5 7cda51fc48073b0f05d70dbba079a11b
SHA1 7fa4815d8a8f12584e6f98ed0893288d6b99eb11
SHA512 114848297ae39f9064310f9c040ff92c3223ba0d27d0aede81fe989528276ea2e7aedb8b62cb40161935d15c52c7ce1f82655c73f1b69d14085f75bc0783c85b
SSDEEP 24576:FPKyeHQduLXzumnW5PaDyfnWFVSA81BmYfVtqlh9ZeFjUAtdSh/D8gTVcpcUn:FPKyWpeICnWFwtqL6FjUAtdQ/bo
TLSH
T16EA59C03E29602FDD03AD5348B465232EA65BC45BB317ADF4A81B2511E7EEF05BBD720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 ffc047ed7d188063e107c3a451cdd18aeedfa091b28ddecfb72d2a16a1d8e25b
MD5 7e751c639bdc77ee28d7308734b7966e
SHA1 fa4f716e02bd08dc5b6363d628d93db43f611319
SHA512 8de7bcd92d760b7112686cc8387fac7dd963819dd69e3bf8727f7b9bd0cccc96531e5620f829d7fc320163c8aa0aa3cd237ebc23127e3c7d2af8ed3848f5cbf5
SSDEEP 768:41ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:qfgLdQAQfcfymN
TLSH
T1D8C2E17A26CC5678E865497CDFE35702833D0B79059F686B29F29D7E3250768200FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\_desktop.ini
Size 9B
SHA256 60f2de9b05db074f16b71c07d74dcd0dcf1cb266941c4d99bc75fc2c35d3c4e7
MD5 d4363b60fb8a51d92a46be8cdf70eba0
SHA1 966026f5e6e14aaa5913505ef6450fdf6ffbb517
SHA512 bb64c06339dc34365c97b8da5dcef1db03589489a7efebb5b714dec249d447ca3462829f302e8abd490d9a7ccd09f1aa2bb7c6d6c57c6d90c9201269864610de
MD5 SHA1 SHA512

Submit Download

memory/4188-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-419-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-1247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-5036-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-5553-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4800-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4800-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download