3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe
Size

452KB
MD5

c2105935a40d402235f3283d93b012bc
SHA1

a315d0c489b35d5b4b11702c031f0b87ddbc24eb
SHA256

3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624
SHA512

7d6eb372c0699d6c3d723bd8e315b5425e93ad03b8c25bafc75985d21d8c6df17876b27fc70bc43f6eb8284b98c803840adfa4304b141454a9e63d8a9d6ddadb
SSDEEP

6144:+VfjmNFbYKn7Z6/BMO/g6v1028qIGoRiqFuMrB5vALnbE3kDvshbN92Uw4wAalLw:A7+O/SrnY83kjs/92Udmcxjnx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3000	Logo1_.exe
2252	3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreRating\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\en-US_female_TTS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sw-KE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2252	WerFault.exe	92

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe
3000	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4200	3272	3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe	86
PID 3272 wrote to memory of 4200	3272	3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe	86
PID 3272 wrote to memory of 4200	3272	3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe	86
PID 3272 wrote to memory of 3000	3272	3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe	88
PID 3272 wrote to memory of 3000	3272	3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe	88
PID 3272 wrote to memory of 3000	3272	3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe	88
PID 3000 wrote to memory of 4460	3000	Logo1_.exe	90
PID 3000 wrote to memory of 4460	3000	Logo1_.exe	90
PID 3000 wrote to memory of 4460	3000	Logo1_.exe	90
PID 4460 wrote to memory of 3764	4460	net.exe	91
PID 4460 wrote to memory of 3764	4460	net.exe	91
PID 4460 wrote to memory of 3764	4460	net.exe	91
PID 4200 wrote to memory of 2252	4200	cmd.exe	92
PID 4200 wrote to memory of 2252	4200	cmd.exe	92
PID 4200 wrote to memory of 2252	4200	cmd.exe	92
PID 3000 wrote to memory of 3244	3000	Logo1_.exe	51
PID 3000 wrote to memory of 3244	3000	Logo1_.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3244
- C:\Users\Admin\AppData\Local\Temp\3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe
  "C:\Users\Admin\AppData\Local\Temp\3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73D8.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe
      "C:\Users\Admin\AppData\Local\Temp\3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe"
      4⤵
      Executes dropped EXE
      PID:2252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 820
        5⤵
        Program crash
        
        PID:2736
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4460
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2252 -ip 2252
1⤵
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
0ea45ba5ad4de7d4e7e65b38cf38cd4c

SHA1
aa9821be2687abd3cb71cfee3bc38aaf632cd93a

SHA256
44227ebfba06eff21aac1d1dbf7ce0aaccefeb0d7023722c08614fb24dda62f0

SHA512
afc85ade151a0c5e4a2b51e9ddab0077c1851504cb61087cf8d58314d8f14c0a57b108940e00e009e800a7dfdce903e8b6b7878091fdf0358002b265c91ff2ec

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
484KB

MD5
1dccdf21eb48d426e19ed403153ffb9e

SHA1
67fd9fdf04443aa28dba88560faf1efdfc20f9d7

SHA256
64049aee01d870a96f287f8a4d11147aff5aaa9b1dcd5ea6f0016f9f5150e871

SHA512
04ab2bb1a1c79ce4d1e7a36dd2055c6101d8e35eb312a97e9e479727b7028568f2ac6f80dc9a295f4af1bb9baf7058e11e420f93bbc6ad4407021e8cb729d0f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a73D8.bat

Filesize
722B

MD5
be06179d18f32203a1e5cfc81c6ef7c4

SHA1
1e574ca4b5cd5bcad8d437b41ae2797e16c88b52

SHA256
2822432b2aedd50f824df10a2a54be861384b265bf2329590f7636a817bcfa6f

SHA512
bf73ab16dc38157f6922fdbfeb1dfdddbaada8ce4a5df4191f729fcc9783911ede9d5f7d2a92a2a1f0d817769d7317b7663104931c4d7c684ee803419e8ae206

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe

Filesize
425KB

MD5
ca803e321a5657953b268466b7be08a6

SHA1
086ff36349b00455dc0a590362fa8f213d39f4ee

SHA256
a9d5eaecf97449a713e494492a0c86b53f0c7da10e783740c60036239e103f1e

SHA512
63dd90d62f00b5bc0e4eccdf25586f6ae01834a5f45d4faff076116fae1879e2e78cd4c7ad305dd0559b3f6f18d8dab2004665b2535165d199becb1604ca49e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f91d5c32ef659cf177d1e5d60e88526e608f2971de2c8ef9f13a947c9aed624.exe.exe

Filesize
425KB

MD5
ca803e321a5657953b268466b7be08a6

SHA1
086ff36349b00455dc0a590362fa8f213d39f4ee

SHA256
a9d5eaecf97449a713e494492a0c86b53f0c7da10e783740c60036239e103f1e

SHA512
63dd90d62f00b5bc0e4eccdf25586f6ae01834a5f45d4faff076116fae1879e2e78cd4c7ad305dd0559b3f6f18d8dab2004665b2535165d199becb1604ca49e5

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
fdd0d43a296e2baf16ff04a2ae282346

SHA1
cde5a89ac8cee3eb3d2970b36c3dfbcf595c00d6

SHA256
c4e87195d00e62a48ce38b324f555e455f2b2d9404390f478e8494a0ec1faeb6

SHA512
38af53def2cda996d378a65b2623fbade958ebd8228b797e1f2a898142a0427d83c32a654c5d53978d60627a6aaadd5ba6f5ab61cf58a955dbc62f6dbacbad8f

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
fdd0d43a296e2baf16ff04a2ae282346

SHA1
cde5a89ac8cee3eb3d2970b36c3dfbcf595c00d6

SHA256
c4e87195d00e62a48ce38b324f555e455f2b2d9404390f478e8494a0ec1faeb6

SHA512
38af53def2cda996d378a65b2623fbade958ebd8228b797e1f2a898142a0427d83c32a654c5d53978d60627a6aaadd5ba6f5ab61cf58a955dbc62f6dbacbad8f

Download Submit
C:\Windows\rundl132.exe

Filesize
26KB

MD5
fdd0d43a296e2baf16ff04a2ae282346

SHA1
cde5a89ac8cee3eb3d2970b36c3dfbcf595c00d6

SHA256
c4e87195d00e62a48ce38b324f555e455f2b2d9404390f478e8494a0ec1faeb6

SHA512
38af53def2cda996d378a65b2623fbade958ebd8228b797e1f2a898142a0427d83c32a654c5d53978d60627a6aaadd5ba6f5ab61cf58a955dbc62f6dbacbad8f

Download Submit
C:\odt\_desktop.ini

Filesize
9B

MD5
872506f1dadcc0cedd1e9dee11f54da4

SHA1
d1e87145ed1d918f10ae4e93ccdbb994bc906ed5

SHA256
a0049e98811438481e150df54f7b555026746c943cb03106677bf75b4e412104

SHA512
6cf3aeeed18e66a16ed653a5c33133ec8d5fb58cf42aab9e712cf473233e506d4f14692dff04b7c20847718e5c344ec2651e57d2ae7a034610b07679b786344c

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2890696111-2332180956-3312704074-1000\_desktop.ini

Filesize
10B

MD5
dbf19ca54500e964528b156763234c1d

SHA1
05376f86423aec8badf0adbc47887234ac83ef5a

SHA256
bfa0ad2e861e2369dc239edf8f62fbe1c4507d877ec2f76e46e48f1e68fdd5ae

SHA512
fb8ce1253ad6d3c1b7d970614dbc2d21574576336a490b54a8dc705a3d8637c0669747ba821fb2f4da14d7447dc24607aca988b0cd3bd9fc4d9d5988b4b631d0

Download Submit
memory/2252-18-0x00000000742E0000-0x0000000074A90000-memory.dmp

Filesize
7.7MB

Download
memory/2252-19-0x0000000000640000-0x00000000006AE000-memory.dmp

Filesize
440KB

Download
memory/2252-21-0x00000000742E0000-0x0000000074A90000-memory.dmp

Filesize
7.7MB

Download
memory/3000-22-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-30-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-45-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-1281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-1520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-4823-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3272-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3272-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download