b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
Size

577KB
MD5

78e854681e1d3a897c7e1a32d8154138
SHA1

8c86c373573f432e25b80870cb36dbddfee8fd22
SHA256

b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5
SHA512

0fbb1bea1de300ff06b3a7ddc2bbdcc1f000e2641ef79fa48e7158f10db961cb3d1731265fd3a11b6ef12ebbb34af344c32404b38b84227a881e1db734cd9bbd
SSDEEP

6144:MG5KQE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:MPr7a3iwbihym2g7XO3LWUQfh4Co

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2528	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2552	Logo1_.exe
2492	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe

Loads dropped DLL 1 IoCs

pid	Process
2528	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\management\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
File created	C:\Windows\Logo1_.exe	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe
2552	Logo1_.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2180	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	28
PID 1400 wrote to memory of 2180	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	28
PID 1400 wrote to memory of 2180	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	28
PID 1400 wrote to memory of 2180	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	28
PID 2180 wrote to memory of 1936	2180	net.exe	30
PID 2180 wrote to memory of 1936	2180	net.exe	30
PID 2180 wrote to memory of 1936	2180	net.exe	30
PID 2180 wrote to memory of 1936	2180	net.exe	30
PID 1400 wrote to memory of 2528	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	31
PID 1400 wrote to memory of 2528	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	31
PID 1400 wrote to memory of 2528	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	31
PID 1400 wrote to memory of 2528	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	31
PID 1400 wrote to memory of 2552	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	33
PID 1400 wrote to memory of 2552	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	33
PID 1400 wrote to memory of 2552	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	33
PID 1400 wrote to memory of 2552	1400	b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe	33
PID 2552 wrote to memory of 2456	2552	Logo1_.exe	34
PID 2552 wrote to memory of 2456	2552	Logo1_.exe	34
PID 2552 wrote to memory of 2456	2552	Logo1_.exe	34
PID 2552 wrote to memory of 2456	2552	Logo1_.exe	34
PID 2456 wrote to memory of 2924	2456	net.exe	36
PID 2456 wrote to memory of 2924	2456	net.exe	36
PID 2456 wrote to memory of 2924	2456	net.exe	36
PID 2456 wrote to memory of 2924	2456	net.exe	36
PID 2528 wrote to memory of 2492	2528	cmd.exe	37
PID 2528 wrote to memory of 2492	2528	cmd.exe	37
PID 2528 wrote to memory of 2492	2528	cmd.exe	37
PID 2528 wrote to memory of 2492	2528	cmd.exe	37
PID 2552 wrote to memory of 2648	2552	Logo1_.exe	38
PID 2552 wrote to memory of 2648	2552	Logo1_.exe	38
PID 2552 wrote to memory of 2648	2552	Logo1_.exe	38
PID 2552 wrote to memory of 2648	2552	Logo1_.exe	38
PID 2648 wrote to memory of 2356	2648	net.exe	40
PID 2648 wrote to memory of 2356	2648	net.exe	40
PID 2648 wrote to memory of 2356	2648	net.exe	40
PID 2648 wrote to memory of 2356	2648	net.exe	40
PID 2552 wrote to memory of 1408	2552	Logo1_.exe	21
PID 2552 wrote to memory of 1408	2552	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1408
- C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
  "C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a8E1C.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe
      "C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe"
      4⤵
      Executes dropped EXE
      PID:2492
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2924
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
616f8c1916ec81484c8aefe8899f7c35

SHA1
4e5fc08bd9b2994582dd4f7fc33f544a89bc5fd5

SHA256
d00dd083b9e7d238419f3f6d4c9c67489b752d8a44911a7ab4d8e9758ca63919

SHA512
f2fc79f30a6eb798d2b8916341014849cf2375d011b14577ef40f13906f44c1bf512203979b3ca8ac544e84e503d2cce93b0c4408f50b05a862996dd49d90fca

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
fa1ca34b203e8244b1102d8ad38035c2

SHA1
d3ec13ced225363368a77396e000538a66d0fd37

SHA256
a48bfd2e24c826fbabe3adbc037da84fb2ab5dc4942ed22ca31fad3ef8e657cb

SHA512
68943886e5f7c6f7f0b52a6b10232dc3a12db86a3246e12a0da9c827ca0ee115d35e1182b56ef8a9c824e01daa1c5e147bc349ab8e41703a9807e93926b7a165

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8E1C.bat

Filesize
722B

MD5
eb452b5c13e8ab42c7c89ae4fdda3b21

SHA1
d42e821fc25b0c1b98b5c65f4dc98cd40d3acbd1

SHA256
9b1c4d73a2a125ce3cc38887e6f9657c95b352308fb9569c5eb9fd7dacf896dc

SHA512
e1b90fec0f98e102003bc91ff029b8ed5a6e33a13f60a2ee4a36d352a7fa32b0ab14c1536b40a0bbe1262b39a97b9293570214fc53aca0adf0d8c220a474c872

Download Submit
C:\Users\Admin\AppData\Local\Temp\b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5.exe.exe

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
5f4b64deb280c001783cf744b06bef33

SHA1
e3962fe8ed4214be0cf4605b5ec6114320949eed

SHA256
53f7b777df32f27c60853a9b5d65a8e6f99cddd820daaead05f938239d6bdb35

SHA512
ad10ff2e3837acc133e0945e58f1fd3748242506d47694ad4efed6ac22325c7383ced5bc57dec390b3fd09952f5ffaef6946982972d67a969f333573492ed3cd

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini

Filesize
9B

MD5
137c71ab33d39f41d1d0f506748620c6

SHA1
615708c800cedc2541589174e6e677e1563367b5

SHA256
f1a3a71540f6e454bf800af51e8e8085c233f7281852519bd8b0ae36071f13e0

SHA512
cb8e0ffac4c5606dec5cc9ccdb6ac981ed120efc64a4f4750ac59149280da5fb379c2af737bde3d9e23ca21c3ee3fa9e6c252dee9ef22102886e2390c9d504fc

Download Submit
memory/1400-16-0x0000000000890000-0x00000000008D0000-memory.dmp

Filesize
256KB

Download
memory/1400-33-0x0000000000890000-0x00000000008D0000-memory.dmp

Filesize
256KB

Download
memory/1400-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1400-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1408-27-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2552-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-1348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-4074-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download