Resubmissions

19-01-2022 16:33

220119-t2pzlabeh4 10

25-11-2021 12:39

211125-pvmtfaaee9 10

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    19-01-2022 16:33

General

  • Target

    1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe

  • Size

    6.2MB

  • MD5

    eaf0414732a32787b8c26e69af59bfa0

  • SHA1

    e313935ac46f141a3940236026cfe0eb0f4a1dcc

  • SHA256

    1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181

  • SHA512

    cc9dda5d5072e3ef01ee3e61fe23d0e753ca5957ff9f15e49377bd84a0be5b1f3606aaca9e6cbc7ff6fb67cf130da2d2174c32c5a2e5911706acf6b085706ab1

Score
10/10

Malware Config

Extracted

Family

amadey

Version

2.70

C2

185.215.113.45/g4MbvE/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 14 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe
    "C:\Users\Admin\AppData\Local\Temp\1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1642354238 " AI_EUIMSI=""
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      PID:744
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E9F852242E8E5FA73471493FC06EE9CF C
      2⤵
      • Loads dropped DLL
      PID:1988
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7D0ED9B251F4AAD0ADD4D912A7CE51A5
      2⤵
      • Loads dropped DLL
      PID:288
    • C:\Users\Admin\AppData\Local\Temp\603c0340b4\furm-extensions.exe
      "C:\Users\Admin\AppData\Local\Temp\603c0340b4\furm-extensions.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1084
      • C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
        "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2000
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
            5⤵
              PID:1692
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F
            4⤵
            • Creates scheduled task(s)
            PID:1596
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {255E662F-142B-4E6D-A587-F98C2A5C4167} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
        C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1288

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Install Root Certificate

    1
    T1130

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      MD5

      23e191a31c91054bd9c06f6025015f82

      SHA1

      c3ec3cb34f58ed31954bd232d59307726f6cff1c

      SHA256

      1ce8e7e2abf928eb1ee0d098a83dce8bde5a2959065e5ff2ad3fd5d4fefcc5e0

      SHA512

      d72a79df92931544f511bf1679e371c1c9a77ba1393c563864fb5aba3186cb10387e2338cf7a8e56902f36821f41d91f74b54c6c6fda4b9116b9d7aab36604df

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      MD5

      da02b556a165eabb733fc94af033c9a4

      SHA1

      e73da952ffeca0b46a9aca898b0a4c0388f4b9e7

      SHA256

      f401064abe4f4f8a9f63c9c9e7b710e92dde4ad68df0c7d1d1a84025dbdfdc50

      SHA512

      4b33cc7668abc0e0d89108696fd3d9eae421ce7ed0d4cbefa0676a145bd48174e39ac050d2aedabd11ed102cd961ab292e7083e36f6f12e8365b60bfe8327eb5

    • C:\Users\Admin\AppData\Local\Temp\MSIFA12.tmp
      MD5

      a32decee57c661563b038d4f324e2b42

      SHA1

      3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

      SHA256

      fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

      SHA512

      e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

    • C:\Users\Admin\AppData\Local\Temp\MSIFFDD.tmp
      MD5

      4e2e67fc241ab6e440ad2789f705fc69

      SHA1

      bda5f46c1f51656d3cbad481fa2c76a553f03aba

      SHA256

      98f4ebaa6ea1083e98ea0dd5c74c2cb22b1375c55b6a12cfdc5d877f716de392

      SHA512

      452df66dd2b09485bf92d92b72b3ad2638cbf0a570741b80309056d1e67e68a18cbd0ad3616a2943bb29de62a057848a7382b6c64c3821335a51b0a03131564c

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\3DBITMAP.LGO
      MD5

      c7eb72cbf51334c39e297403a6e00e5c

      SHA1

      eb8e6b0b81888da182730c055ad228907c0e49b1

      SHA256

      f29fc7faf7d4bb8797367c5ab027c797c2af33edcf081efa9daa7a7e7bd9ee0f

      SHA512

      f6e79a3e723baeba11b21694d5177d8211510ac69e770f9f05553094c681e91613c2e6687da1b253a72d9e242c9975c25d62b3493fc070a1fdecd41cf3bd02f2

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\3DJOY.LGO
      MD5

      1dfb4a0a7e6372acdb89c2a9817284ea

      SHA1

      d87b2a9d393c3515dc2712c93727db41d600ad80

      SHA256

      e10b673f954c12e31812afd7773dee18940fb46b2fdd9aa70ea9ec3d4df4b488

      SHA512

      f80b3215c8c7162be25c5897e5b2bf60461299eedb18d4217e73ca2607afa6dcbdf9c3ee929eeac8f7ed6761febebc068451131b9cbfb6c625c50a8e7ef0e96d

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\3DMOVIE.LGO
      MD5

      85319eb1c4096384e18e71658148190e

      SHA1

      7cea0551747d67b4a08b6f78ced0567199f8e38f

      SHA256

      979982407f136490d2d2788055cc0feae741f584f8daed331f18cb5ae969c287

      SHA512

      2d20c9c509b929f6220bb62b047177db9fdf4dc6c891733733c1db0c3deb8a12a802cb17ba1567cea5b3b24b0f707ae75be0108dea2b23c7086abf931ab8db66

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\3DSIMPLE.LGO
      MD5

      77eae74dd7bd2ca9982bd2f12adff615

      SHA1

      9c82d2fadc1ead2cd0848a261b1430b49f806e79

      SHA256

      4018202e5192fdf1e92a2d4784b884af3c9f27409cabe16a8f1b8803df599ccf

      SHA512

      0d2c268994584fa15c88e54f7c673349ee259f006a40b69098b673d28ecaca6042840b98198015b80cfd61b106b2585ff05f47e6c470b4e8a2aa6cd967a6ffe2

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\3DSTEPS.LGO
      MD5

      8bb174bb497395b6d679af159b75e9b1

      SHA1

      6e286d495c5720c6c236f2d521e4baa7affd09ed

      SHA256

      520cb66f51f5822ab2c164fd23badf8879f3c22f63706a9875b4f3d87db0919c

      SHA512

      6ab2ec5c91442c6ba0412d6d66b65f274fee303a053f883ca934bb8791c18871c239347967c1ccaaf56724aa1115a39257deebfacf70abc7ce7d8c6ac715122c

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\AXIS.LGO
      MD5

      3be7e79f251f5dee60215a123df636bb

      SHA1

      5fce52c40ad8d6054f77bb5e84cfee34b145c447

      SHA256

      288e25d6e2b5346eab20256bb581aadb6e3752076412d60934642f79478be20f

      SHA512

      02d9ff2aefd3e29786f5b674b6d3458bf25ec221d093f1f6ae3ed6828912a2e7cf421fa3166081cda2e9fa0deb6497ad767510d22d63bf702ca644a6a5c64c76

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\CHECKER.LGO
      MD5

      829044c299c931e3773faa5340869b2d

      SHA1

      4a88dbf1901bba3b5d8b4cf2bb7c66998add9a58

      SHA256

      2cf7197f40b2cdb9b381975690f664a305696a1e84b56202364321b009e5eb54

      SHA512

      65bc42f88c69b1539ffac2d34a45efa98b8b684c3a35643f779a1176d3a0095ff15ce51d816b314b35c6ad73c3e59a47b9601947f0db96f772a1f7a405fa0c37

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\HILBERT.LGO
      MD5

      bf351f6bd2d7a44fcf9bcb99324d4b36

      SHA1

      52bc9e082584357fde1f4daffb840573cec864b7

      SHA256

      1e0bbb9ffdabe16183a87c789a4e737f2c46179b01c71c7b8a88ac62fffb2c11

      SHA512

      6d44570429ffe78645ae6fb659d1b528a05b1aba77213ca62668ab2144aa26e267fd8493b6214d9bde056d33c9824a50f76381b4b8ca2a0aa6f2b7fc24525d74

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\ICOSAHED.LGO
      MD5

      1a52a14106fd3e659d3f960f7cf45ab5

      SHA1

      72e840e28848c0e0ea0c60eae20bfd775043c8e3

      SHA256

      9caf0a5e3ea51b7125a67fc6a8acfc21aecce0bb35746bb57c0abca8e9c801fa

      SHA512

      e2d81e0d9f9f9199296a097e859859227e31063110568221deae5a6651378a45920915a57b6c84c64e1ea497fa59621d0491133d05525b46796735f50bfc6a0a

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\SHUTTLE.3DV
      MD5

      e00bbd821c702566c9d17e47bb00d665

      SHA1

      a9ba7176147341e1555b0c63592bc57d371063e6

      SHA256

      ca6769e5a8b34067878e96647027ed50dfde0402ca4371bf008589d9e53d188f

      SHA512

      1f16a7245945f4e70e0c8f44bce86537f01fd6f5d172c35f450894edcf51f9630822631bc4301bed44012282e7ea3f1ae0f7bd95311b6e97b0d9fbc7d6b0e95c

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\SHUTTLE.LGO
      MD5

      ba4b027fb49d27471ee578dc93d5296b

      SHA1

      d9fdd8bed9931dcdb2d3f3056cbd5286d903c6ac

      SHA256

      0d4839f083cf2037256048560fb3979113f2948941d580158dde559429491ebd

      SHA512

      65bb4b4fe447c5c86bde7d4e85b524cee9e707c0ab10f07df189fdddb844a1fa83cc29aadd0c99028d71a17a6158ae6b3104ae1cd4a01cad60ae0daf84efff0c

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\SOLAR.LGO
      MD5

      6c567d552d2fe350bcb0986273162253

      SHA1

      bb8fc18067bf1ebd8445ac22e2486a4ddf0d3242

      SHA256

      faf3487c2b65f41ed6b534280625a40f936d08ff225f9c5484bcd84655f8a53d

      SHA512

      bb31975f186281e4c357fa6e8d6fae13c0f83b07714f822bba78d790fd9c2bc3e486d4f3309c5e6c22f651469ca1dfd313159e9d5c5fbffd3378406f208d60fa

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\SPHERE.LGO
      MD5

      7b7b9b7b4be184e7fabda2d590c93923

      SHA1

      4657b5a118948a309a9d1478aeab63ac8625efb8

      SHA256

      578342aa2c859a7e2930f4051169306178122c992595ac809f3a2f603d5cf73f

      SHA512

      bfbf1a2f68b1b9f2cdd218f2f8053ec1768f25a96ba31f879641ed24918cfcf5667b473396f3c87b8aebbc37a016fed02d65e883ec5c5b0e339baeae32024000

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\STEREO.LGO
      MD5

      d62e05f8d0dfcec9216febad10e110ca

      SHA1

      25cec291197969161924b7219ceb6a8dfdc4b45c

      SHA256

      780eb93d0eb99cd2c75137be9e37205b220d44892c0ceaa0ae090d2cf7624b92

      SHA512

      371d62f09d5d5ebdb9970d7e37f90ed3d4b3ee5e5e9c8ecc3cd51ce0f9917b121d6ec666ae8d985c9e1c500cbb3116d3fe3135d315875a1d9df65bb91e1f3a20

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\TORUS.LGO
      MD5

      362cada28e17ad2e41b5fafdb31f41fe

      SHA1

      1dac44fe205cfe218b0007560827b5631b937af2

      SHA256

      27be594b0236fc144ff7553084ed2a1473332038ca104006b0edcabc6723c7e4

      SHA512

      c3dc94584d63e10717e48c6a4fac17eabc9eb96fb3c8788937c344b6f7abe50d3166dc3453fe40d10ce658372bda63c6c246b261c131759cda96e5d5fff58e1a

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\3d\fmslogo.bmp
      MD5

      074091f21cae34e830cac8ef5422b840

      SHA1

      2cf882243c45a7bb657cc74543850c07227ffa3d

      SHA256

      f8656e1e1ab41af29efa9550769e354e7e0f4476b802e32090e706880ec86603

      SHA512

      62ea398ffa3be0ad6c128bb51bb6d28d9dd2366420beb88a357d27f3a3d3951e69b822e23c6f4389d994408e647c4ee294a37f71615a4945b7d25ff851adcd81

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Misc\CAR.BMP
      MD5

      5fc366b3371bde5c769a8c5b9d0ff966

      SHA1

      124f3a48111e1adba8cbee101655d6bf438c9129

      SHA256

      4b0231a2577be467d7d37612b75e38d6e944b7ba757f7fe1c36b697e0fc5ee46

      SHA512

      e78445e2e70e7ffe3100ff91f5c388817b3cec3964e58ea3e5f415e221c88faf421712d363edcb954ec32d929f6c9e7e3da9e8fed0877e2516312afc5fa585b3

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Misc\CARMASK.BMP
      MD5

      afe2ac27f1ae91549f64971d1ba81e1c

      SHA1

      a717af1a26506bf440d8ade244e12b9283b2b7bc

      SHA256

      c889fe2430b247aa02e7a101360002b88151cfef4df3a99116c22ee80040db0d

      SHA512

      15f45e1a6743fd2d6b2ae06840466e20efa3018e659f3af65bec14ae372f42adc9ac81e5745c38ad7ae40d6c033d087d82699975afc482d89e441b772ed4703a

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Misc\CLOCK.LGO
      MD5

      c4acddb7dacd73b0a509fc54e9c607bb

      SHA1

      9f1e79be02b00a5eea5d615094eda6ffc4a45af0

      SHA256

      070086e62f194b7de43c7145508c1e68b8081d7c8393a43e4c49d6e5a147143d

      SHA512

      e21ec056a9952a441ba571db14d681274b1384e6dd10299d193223516f6ffea9bcc31c3bc114bc9cea8e71c9ce15fc483e7d51ca0295e8d3cd02aa81838ddb17

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Misc\CURVES.LGO
      MD5

      a20a8a5480c82964f58b62ba8b29f932

      SHA1

      1d48183b50b6abb30323b70922175042fe573f18

      SHA256

      4ca29c112c6486054e71ddbe4c49b809e227c9e2e6760b4c36ee30afd7b255cb

      SHA512

      f561e9d53d2c6d896abf80bde1e1ed2adf2aeb5397e9b73723d0cbbb69129a084d570a412e5d409c3dcc154a37f6b106d6c704141effa6fef0363b9f20c67e5e

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Misc\HANOI.LGO
      MD5

      a21687bf228a38528aa1963d2c8a78e3

      SHA1

      c816e2c99e20f2a79ec0ce9a8e0e9f3c05c9af13

      SHA256

      288699cdfee3880ca1ad2056e1cf4a2217a9d684005c5c690a6594f3d54709ae

      SHA512

      1802a7ab95a54fd17c11e2214da5c671618994fcba3efe2e4d366c59e8941a592f845c9f71826d266b15062554e6a32fd207ec09cea14e7bf12fa66966bff887

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Misc\JOYSTICK.LGO
      MD5

      99dc857ce06ae8878881adb61e4f1a40

      SHA1

      1cd90a57c1fd3cccf4ba2bd5c4d6eecf1bca6a1b

      SHA256

      3a8f8507f77f89a00c45c50f1d98bbb4ec0da58706d8e3bcc2ffd2be9f5b89a9

      SHA512

      367887c6aa8bb4e23ffad02f0a1e8e6c1767765aee04ab1c1b11c0cc4519c2cd68f16cf26e8546d98031e8bcf121ec646b5b59b351cea8057557dd0fb3625a85

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Misc\PLATE.LGO
      MD5

      8cea513a308679aefb4edba1375c4cd4

      SHA1

      0aa936e6cb1dbda47b22a4fd3c506002e84b4ffc

      SHA256

      924f989f6f9f54e97df021e22ebe002aa44ac8d69d44e289cdfa6644ad70bfad

      SHA512

      a8987e1bb9b06741b27800b34144ece709012d396b8501dbaef90b4686cc67ec0ff78d3084eb130f8553972dfb72a35f08e510f783c56890897ec406123f612a

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Misc\ROAD.BMP
      MD5

      11836818b440d6cba5a3aef15393a5e0

      SHA1

      4c49a9d1bd3ece0e031d80e8746e55f0ad08f399

      SHA256

      8a64eef1ee52de71fcd074dd39ebeb408558da79a7dbf1ef4305e9a4a23ced58

      SHA512

      15fa97e739906957ecd9ae9f939d4dc3b6a4b211bc5dd23b68863e53c8df72a3bae7cfb5367d8780f0cf37ac322c88d981565f85d2da61deb8652db22a879476

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Misc\SPRITE.LGO
      MD5

      54085d51ffc8c72c37a70a0cfaf5354f

      SHA1

      7134793d8954f439284b5f76cce6095a97a4af81

      SHA256

      2e91c6dfb9317ed8a7e9e798bce808aedfd3dfb0b05daecffcc7d8ecbad0fcc6

      SHA512

      1921a7cd80b17b0bd2e98b74dde8f5a0884e0874b93869d732371760a3f087b56941dcbffba35b7a6924bea233336aec778d62c740dd92d4a6c0093afe27ad56

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\CDROM.LGO
      MD5

      b7e032a03eca04ab9a57cd9378c2daea

      SHA1

      9819866aa84e9f69ac1cf244306e4055c20376c2

      SHA256

      4dac6972d0437a91f0e8d122c2d5a3b3dbd7ea7cae44ba30a210b948b7bc8082

      SHA512

      1ce2cd639efb2ac6ad6dbff9ca895485fd67d27b0497973003957769c4a9167288816d21c61af047500caf7f16cc0822a3b7d6b6c44a76ca64fd12d95e0d1544

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\ECHO.LGO
      MD5

      4ce0cb03e9b2e5707843f40f051c7e2a

      SHA1

      cf264b2656cb5515edd4728cbd3800aac335fa9d

      SHA256

      de0662b380865e9a1986d583c3279f1daa806db77d8a51061e9ceb9fa4c1dc04

      SHA512

      94d09dc730eba52110824cc46560172dde98bcd8cb8065637868baf9f9c11929ab7d847eaa4588f0f72c717d95d0bb9841eeca18c0ed06f1fef06bc12041e8bb

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\GROW.LGO
      MD5

      513bbfe7b10a230b9ccd71071132e60f

      SHA1

      7ae0d03ddcf3f07760009625b7a61724899285e7

      SHA256

      66dc1d10c8d6a022ba82a6d446786e894a540ef3a59673287ed33d00be9a1293

      SHA512

      c14dbf4c407c4918e5404a94d0e96e602ae8a731f668c792a64703c6c50410ce1dddcf4f0b97f5796e98a9f0abddb439e5a124783260ef8b815cbd43a3bcae3e

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\MIDI.LGO
      MD5

      c22e11b97c187b90cd5ef7301c4c4dfe

      SHA1

      c053efe04e861e77d34b2054163f9e22677deb65

      SHA256

      d0ec35bb6cdc36621db633dd61eaf296368c4046ee0d5d5d9b37c5a572581b17

      SHA512

      6d05655e153ce98f3aa1851b0cdeb664e08629daacde9638c28ba81b37046301c7acb239b174848a20bcf6b93e2acb95539d39a5ed8a1212af5d1b50a75e4afe

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\MIDIFILE.LGO
      MD5

      6ea09ca25cdfa1ce3f1ce56fe71a9d6d

      SHA1

      e9056ee56f9b94271deabf6641186536a39b0953

      SHA256

      75a5dd57944dd55d6c3b3a99c14cce5b0e78701594dce3aef69c3fc5032c1520

      SHA512

      b9bc85a5ed091cc8661e438ce0aa420b23397be562ccd750f0c89cb2fce5cf7300feee5a8cc180ea2d1f132ddd70ba850cee4c088eac4aab7edd8ba19d244a17

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\NOFLICK.LGO
      MD5

      a31b6aff18b705a87ee602db78de2807

      SHA1

      b4ce404e99d23fd7b971df197861e4608ce8f32e

      SHA256

      22cef6653bea027c527e756e0a6172aa65a2934a0b8d412b66ce4f1b427a703f

      SHA512

      28cd412c192ca50a9a22d7542d45f2f35d37f35f57f4d7cc731741152dcb1233d7ce27f84b4ff5ab68a198448378f08141dddb81f32db2542f24bce7d2ddfdbf

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\PAINT.LGO
      MD5

      ac8a45e9af464471cb24ae03f6a013eb

      SHA1

      7e5d6fbc7f8a2e602400d5b5cea72340604c26f9

      SHA256

      f6233aa2a13cd8a69a0121b10a4980263b697dde777db0019117d2f7d0ba5405

      SHA512

      6b2c9097af60cc08f54c783852a272eb29956a86b6e215f8d7d245054dc309126a49c5561aaa06e1ca439d2dd8461d516660f79381cfa15116feb80f89d07c1a

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\SHAPES.LGO
      MD5

      0332b5c3611edd45f37327f77790bdb3

      SHA1

      2d7c75029ef8b90ab5967882477a359a75c3ed7e

      SHA256

      5ab5a634483c48e05ffa3ae23615cdc5aeef699e374c9cbd0e6a002b4fab80e1

      SHA512

      0ec71ac30c03dff87baf70808add8b15cb13de990f352eb50140ca78bca5b85dfc0b292cc527ce6f6f38595af7552c747dc5354a09aa1881058418e9c3cfb1fd

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\SOUNDS.LGO
      MD5

      f7057962212a95c144bcc6e60aef04dc

      SHA1

      abce5ff6866f17549efa4c236e337e8ab79a1087

      SHA256

      8199e3101e53dcba42657fc9a83aeed957e1df4dde0a9aa6cca7addb9a02883f

      SHA512

      b2e5521debecd8589d6dcd1a112d0f39c04d2d121bd2bdb821c7573aa6e91f7523361aecab58404edc90144c2563f84b2ba3fc3111c2aaf52b0d420a9e0e822e

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\VIDEO.LGO
      MD5

      41e2e2486bed7aa9f30ba50886dc7091

      SHA1

      b30e92ef28ad24604eb52f8c3dcfb86e6a155285

      SHA256

      1d8bb0715855870c869995e6f118cc8cbca85e777491a8dc343707e1b85d1714

      SHA512

      ac1ce071612fe55a41c57ca0b26ecfd5db2f694be7c0ab0cf87a75b9696003717907c3c73cc66c1d60808182823f5c59cade7595b9f04d7f93c98ee407a84a0b

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\frogs.wav
      MD5

      29ee1c1753fc1c9f203c19d848c63c24

      SHA1

      f50fe3bfecfa872cb47bd218ff7545b1a1d858f0

      SHA256

      12ac3386432759ccf45c9e531c351ec5a049af608233160f6d23978c58f00001

      SHA512

      2c2c954500df3c5de10dc05bd91b4cb77163440f58ed516cd01af0349114907595f1a9165db406bb25053ac206aa36753db7f1c23a119557f698419fe65bd087

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Multimed\sonata.mid
      MD5

      d67a9682a6273e3f17b10ac2a3eceece

      SHA1

      1404f805b1358be8b56f8f44323497fa0b9d1557

      SHA256

      14f2c63e55954ec0b8e8b1fb3900abc0cd13aa41fbf24273154683d3470ea28c

      SHA512

      8ba7515a3888d1fa8b2bf1e1f6f1646cd437c4d69aba32e97c98ec66ae0eedf871a1de17f081dbb5741d6e04992911bc306c2f48bf088cdb580d5491b4399e7e

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Network\NETLOCAL.LGO
      MD5

      886a6ec4c437b9d71c061c0b95f4fd40

      SHA1

      9e601bb54017a9a24df60b6c5709b86321fbdd60

      SHA256

      04ebc67ede85c171148c4a41c19ddfaf64a8342c6d10aaf97a3b7dc8da08ae76

      SHA512

      b2ee5ac1a59e3003469435b1138e7d2b64f0cee50eb7c7f1e47daec9d6d222b5c38f8ee0e482865d2845ef3bddeb0b0c525121f5a7bd1386360363529190f023

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Network\NETPAIR.LGO
      MD5

      6f1cb2cf27a24705015e8eb15885569c

      SHA1

      944bb87d86a9002df7ea41b15194ab567bf134a0

      SHA256

      cfb1e061d77b0e4aa2873221cdfe429b8a760888bad139d14323160a98475941

      SHA512

      9559e7ad0b1ff0ed306c1bb349f58c662992d57ae984c508a3341061ad16838777a6d415af6e4e7d1fbf854528e3ef80d25173fb905174fa81dab9cb63e358bc

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Network\NETRING.LGO
      MD5

      be5c1dfc49994bffc946f64c223544ff

      SHA1

      559b7f3287c1a8dad9f4c6a92cb07b1891a7ad98

      SHA256

      a677db6a1b0cd3b7a7c799a57c429b93ea482b30fd3fa6661b0204cf0c4f768e

      SHA512

      a9d0ba4afb451807fe367b9944bd4f181d8a2e3b0b2152ae182e113066f39f7980241b2a8237a882b2382a50c4c0fb04fb63dd1d344d55d8a664593ba6575437

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Pascal\CARDS.PAS
      MD5

      b5e99669b838116e212ff4cdc97550ad

      SHA1

      2642129e6ca9263e465908ad3f2164442a5ec3b4

      SHA256

      9df2836c574e5597fde9decf6e626f3dfab36cb8e286a67ccc269a085f2263df

      SHA512

      465f0a13ec509c018894e2b0ce02bfe04c7458d4a4b398da8899a96fd02a61a5703764eafa4148d06b99263bdc8fa190d5fbf30b333be2954d5ac821f26ad281

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Pascal\MULTI.PAS
      MD5

      f65f84a53407207c05e71f75ec5a1a20

      SHA1

      f052c53d9507e015fae59da984589343e01a3b8f

      SHA256

      c6aa7014cfe7bcb8e91aa3fa7c647d89fb5cc787f00253d9810c7b133eb4a66b

      SHA512

      5ce5192e95e975e4e3222335b21b1a4db1edb9fc9ffa61c4b1cbd0012e473978da895dd3ce5ed04cab0f35760ab5f6e04a6993048b582bc1878a3f7a9e1fbd63

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\Pascal\PASCAL.LGO
      MD5

      44ab45df331ae7745814a5505729cc72

      SHA1

      bebf1fe31acc66adb103e20c029458ce3bfb61ae

      SHA256

      0d8c11139495211acbe1278145705a568a6ba789299eb432e9b42945681f1e96

      SHA512

      bc90401a2dc755ed948d25f703bb7b929fe509e8a811a128f3aa3c221251d7a701655d12fcaf8bb6d7b974f0772e10a8106334133d18006a0573fd296ca61ac8

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\Examples\index.html
      MD5

      6e86736d64a4522b490c716cde97a8bc

      SHA1

      e48de1ddecfc842bbb8924c1023029ec21f838f6

      SHA256

      26d4e150e3fcb0b881d9cadf4adfc1aa369ca96e16b46c6935b7903d3916c04e

      SHA512

      67fe43cacf04a4844c4b11580ca549f4cb7fff160f32be5cd8d8449a6c47775f91a78b6503802615a5fc7e450358bfc53d486a07d302099fc73f8d67fa2b9804

    • C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\adv.msi
      MD5

      226eb8424ea089fc4c72d029fb2040ea

      SHA1

      a69a0f440ff92942e6b9b7414e1c76402dafc7b3

      SHA256

      efd9133fd1c74dca11726927c2e2f9943e3f7fcc261eeaf98ab992111c76b6f7

      SHA512

      40491285da7e80a6e4abd5ec2e0753f64e2ae7333e32c72f1b9bb297baeebad92d362254d236d981b6d9ecd4fb000bdddef74932f95196fdb417623a46ccced0

    • C:\Windows\Installer\MSIA80.tmp
      MD5

      a32decee57c661563b038d4f324e2b42

      SHA1

      3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

      SHA256

      fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

      SHA512

      e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

    • C:\Windows\Installer\MSIB6B.tmp
      MD5

      a32decee57c661563b038d4f324e2b42

      SHA1

      3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

      SHA256

      fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

      SHA512

      e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

    • C:\Windows\Installer\MSIC37.tmp
      MD5

      4e2e67fc241ab6e440ad2789f705fc69

      SHA1

      bda5f46c1f51656d3cbad481fa2c76a553f03aba

      SHA256

      98f4ebaa6ea1083e98ea0dd5c74c2cb22b1375c55b6a12cfdc5d877f716de392

      SHA512

      452df66dd2b09485bf92d92b72b3ad2638cbf0a570741b80309056d1e67e68a18cbd0ad3616a2943bb29de62a057848a7382b6c64c3821335a51b0a03131564c

    • C:\Windows\Installer\MSID7F.tmp
      MD5

      a32decee57c661563b038d4f324e2b42

      SHA1

      3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

      SHA256

      fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

      SHA512

      e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

    • C:\Windows\Installer\MSIE2C.tmp
      MD5

      0be7cdee6c5103c740539d18a94acbd0

      SHA1

      a364c342ff150f69b471b922c0d065630a0989bb

      SHA256

      41abe8eb54a1910e6fc97fcea4de37a67058b7527badae8f39fba3788c46de14

      SHA512

      f96ef5458fdc985501e0dca9cac3c912b3f2308be29eb8e6a305a3b02a3c61b129c4db2c98980b32fd01779566fa5173b2d841755d3cb30885e2f130e4ad6e2c

    • \Users\Admin\AppData\Local\Temp\MSIFA12.tmp
      MD5

      a32decee57c661563b038d4f324e2b42

      SHA1

      3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

      SHA256

      fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

      SHA512

      e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

    • \Users\Admin\AppData\Local\Temp\MSIFFDD.tmp
      MD5

      4e2e67fc241ab6e440ad2789f705fc69

      SHA1

      bda5f46c1f51656d3cbad481fa2c76a553f03aba

      SHA256

      98f4ebaa6ea1083e98ea0dd5c74c2cb22b1375c55b6a12cfdc5d877f716de392

      SHA512

      452df66dd2b09485bf92d92b72b3ad2638cbf0a570741b80309056d1e67e68a18cbd0ad3616a2943bb29de62a057848a7382b6c64c3821335a51b0a03131564c

    • \Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\decoder.dll
      MD5

      831e0b597db11a6eb6f3f797105f7be8

      SHA1

      d89154670218f9fba4515b0c1c634ae0900ca6d4

      SHA256

      e3404d4af16702a67dcaa4da4c5a8776ef350343b179ae6e7f2d347e7e1d1fb7

      SHA512

      e5e71a62c937e7d1c2cf7698bc80fa42732ddd82735ba0ccaee28aee7a7ea7b2132650dfd2c483eb6fb93f447b59643e1a3d6d077a50f0cd42b6f3fc78c1ad8f

    • \Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\decoder.dll
      MD5

      831e0b597db11a6eb6f3f797105f7be8

      SHA1

      d89154670218f9fba4515b0c1c634ae0900ca6d4

      SHA256

      e3404d4af16702a67dcaa4da4c5a8776ef350343b179ae6e7f2d347e7e1d1fb7

      SHA512

      e5e71a62c937e7d1c2cf7698bc80fa42732ddd82735ba0ccaee28aee7a7ea7b2132650dfd2c483eb6fb93f447b59643e1a3d6d077a50f0cd42b6f3fc78c1ad8f

    • \Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\decoder.dll
      MD5

      831e0b597db11a6eb6f3f797105f7be8

      SHA1

      d89154670218f9fba4515b0c1c634ae0900ca6d4

      SHA256

      e3404d4af16702a67dcaa4da4c5a8776ef350343b179ae6e7f2d347e7e1d1fb7

      SHA512

      e5e71a62c937e7d1c2cf7698bc80fa42732ddd82735ba0ccaee28aee7a7ea7b2132650dfd2c483eb6fb93f447b59643e1a3d6d077a50f0cd42b6f3fc78c1ad8f

    • \Windows\Installer\MSIA80.tmp
      MD5

      a32decee57c661563b038d4f324e2b42

      SHA1

      3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

      SHA256

      fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

      SHA512

      e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

    • \Windows\Installer\MSIB6B.tmp
      MD5

      a32decee57c661563b038d4f324e2b42

      SHA1

      3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

      SHA256

      fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

      SHA512

      e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

    • \Windows\Installer\MSIC37.tmp
      MD5

      4e2e67fc241ab6e440ad2789f705fc69

      SHA1

      bda5f46c1f51656d3cbad481fa2c76a553f03aba

      SHA256

      98f4ebaa6ea1083e98ea0dd5c74c2cb22b1375c55b6a12cfdc5d877f716de392

      SHA512

      452df66dd2b09485bf92d92b72b3ad2638cbf0a570741b80309056d1e67e68a18cbd0ad3616a2943bb29de62a057848a7382b6c64c3821335a51b0a03131564c

    • \Windows\Installer\MSID7F.tmp
      MD5

      a32decee57c661563b038d4f324e2b42

      SHA1

      3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

      SHA256

      fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

      SHA512

      e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

    • \Windows\Installer\MSIE2C.tmp
      MD5

      0be7cdee6c5103c740539d18a94acbd0

      SHA1

      a364c342ff150f69b471b922c0d065630a0989bb

      SHA256

      41abe8eb54a1910e6fc97fcea4de37a67058b7527badae8f39fba3788c46de14

      SHA512

      f96ef5458fdc985501e0dca9cac3c912b3f2308be29eb8e6a305a3b02a3c61b129c4db2c98980b32fd01779566fa5173b2d841755d3cb30885e2f130e4ad6e2c

    • memory/1084-130-0x0000000001290000-0x00000000017B3000-memory.dmp
      Filesize

      5.1MB

    • memory/1356-58-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp
      Filesize

      8KB

    • memory/1464-55-0x0000000075F81000-0x0000000075F83000-memory.dmp
      Filesize

      8KB