faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547

Analysis

max time kernel
103s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
Size

26KB
MD5

bcdca6d2167972b1a840681e443e5e6c
SHA1

9c562b56d28373b0a562782e82b676ef00043db1
SHA256

faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547
SHA512

6adbd5608ced2543382e2823b475471ad4d666626839615569b2b12a3a2d3d38389a427235916e502aaf981681b31abf013d6390c6a43f501df7e9d7eca7e853
SSDEEP

768:gF1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:gjfgLdQAQfcfymN

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\P:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\K:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\E:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\Z:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\W:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\V:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\J:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\H:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\T:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\N:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\L:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\R:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\I:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\G:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\X:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\U:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\S:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\Y:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\O:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened (read-only)	\??\M:	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Google\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_desktop.ini	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2392	2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	24
PID 2080 wrote to memory of 2392	2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	24
PID 2080 wrote to memory of 2392	2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	24
PID 2080 wrote to memory of 2392	2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	24
PID 2392 wrote to memory of 2840	2392	net.exe	30
PID 2392 wrote to memory of 2840	2392	net.exe	30
PID 2392 wrote to memory of 2840	2392	net.exe	30
PID 2392 wrote to memory of 2840	2392	net.exe	30
PID 2080 wrote to memory of 1320	2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	18
PID 2080 wrote to memory of 1320	2080	faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe	18

C:\Users\Admin\AppData\Local\Temp\faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe
"C:\Users\Admin\AppData\Local\Temp\faf8f8e4605f4797fa4c221ca1b3337d2dba13a38368779eb29b79c524639547.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    PID:2840

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
12KB

MD5
c666a9acefe7859b0c35f95acfbea092

SHA1
ed6c717d875125629e726bb0e474ebc24c6f278f

SHA256
bffd84d7134037b4f4f23ad97d14734d89027f8a46f67e35a259a4f66480229b

SHA512
b32d7e2f8f1f3da2fd144c47b82c33b2bf2e6f101414fcd4be72432c8f586fa7ca2897563e21620990e3090ac2305a0c3a06f039576d9871c822858a648bb535

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
32KB

MD5
0ec1ff86b8ace6c685576de4334533f1

SHA1
29d72a0240f48ffb268d1f432d49c77419404603

SHA256
ba2508f1643e5f096b15cce855570c19ff80a149b4c1cc0daddcfe49fd172da4

SHA512
9322b4ebaf4e9d2a1355de79cfbd5ab0ce3f7c205914439badfec90fae93d6e3c9c9412ad8c6110c295044e014c196656c99a6c18f41211ad4392740f4f74fe6

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-928733405-3780110381-2966456290-1000\_desktop.ini

Filesize
10B

MD5
fae432e16d94d42a8d76fc8e8371df2f

SHA1
6dac778159c5e1e1e74e34c671f0ea17a2ce02e6

SHA256
58029e3ed60f40e0999a6865c646900fd31a7aad8f7b6724a5f144b3e26aa977

SHA512
bce2a1ee89e19165244986dc8ea4d77ecc9081ae64979f91a3c2d57a54261022ed2aca1e806900f6e71ddcd3a8cf1cd8c73935e1bf3d353baabcc86147af1ef5

Download Submit
memory/1320-5-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/2080-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-67-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-1825-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-3285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download