Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 10:18
Static task
static1
Behavioral task
behavioral1
Sample
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
Resource
win7-20240508-en
General
-
Target
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe
-
Size
47KB
-
MD5
35ad4a5df82a58e29516cc6cecfa7988
-
SHA1
8839daf770de6a149ca22983450353f67c3ed009
-
SHA256
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36
-
SHA512
f7cc0b34b0682e1f522f6723f5800968782f1c86f91f3c640779438c7609e2f468b51a114dbb9eb864ff68fe350ef73e97addd3fe1dad1b8f08c2cbc98f9f411
-
SSDEEP
768:QioRJbj/O5RroZJ767395uINCjPZf44S6nCaexaNjWQ3655Kv1X/qY1MSd:QioRJbj/e+Zk77RNCLp44x6UHqaNrFd
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2648 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exeb914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exepid process 2808 Logo1_.exe 2712 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2648 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\Stationery\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Chess\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Journal\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\ext\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exeLogo1_.exedescription ioc process File created C:\Windows\rundl132.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe File created C:\Windows\Logo1_.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
Processes:
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exeLogo1_.exepid process 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe 2808 Logo1_.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exepid process 2712 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exenet.exeLogo1_.exenet.execmd.exenet.exedescription pid process target process PID 3016 wrote to memory of 2488 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe net.exe PID 3016 wrote to memory of 2488 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe net.exe PID 3016 wrote to memory of 2488 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe net.exe PID 3016 wrote to memory of 2488 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe net.exe PID 2488 wrote to memory of 1524 2488 net.exe net1.exe PID 2488 wrote to memory of 1524 2488 net.exe net1.exe PID 2488 wrote to memory of 1524 2488 net.exe net1.exe PID 2488 wrote to memory of 1524 2488 net.exe net1.exe PID 3016 wrote to memory of 2648 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe cmd.exe PID 3016 wrote to memory of 2648 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe cmd.exe PID 3016 wrote to memory of 2648 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe cmd.exe PID 3016 wrote to memory of 2648 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe cmd.exe PID 3016 wrote to memory of 2808 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe Logo1_.exe PID 3016 wrote to memory of 2808 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe Logo1_.exe PID 3016 wrote to memory of 2808 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe Logo1_.exe PID 3016 wrote to memory of 2808 3016 b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe Logo1_.exe PID 2808 wrote to memory of 2784 2808 Logo1_.exe net.exe PID 2808 wrote to memory of 2784 2808 Logo1_.exe net.exe PID 2808 wrote to memory of 2784 2808 Logo1_.exe net.exe PID 2808 wrote to memory of 2784 2808 Logo1_.exe net.exe PID 2784 wrote to memory of 2832 2784 net.exe net1.exe PID 2784 wrote to memory of 2832 2784 net.exe net1.exe PID 2784 wrote to memory of 2832 2784 net.exe net1.exe PID 2784 wrote to memory of 2832 2784 net.exe net1.exe PID 2648 wrote to memory of 2712 2648 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 2648 wrote to memory of 2712 2648 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 2648 wrote to memory of 2712 2648 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 2648 wrote to memory of 2712 2648 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 2648 wrote to memory of 2712 2648 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 2648 wrote to memory of 2712 2648 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 2648 wrote to memory of 2712 2648 cmd.exe b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe PID 2808 wrote to memory of 2716 2808 Logo1_.exe net.exe PID 2808 wrote to memory of 2716 2808 Logo1_.exe net.exe PID 2808 wrote to memory of 2716 2808 Logo1_.exe net.exe PID 2808 wrote to memory of 2716 2808 Logo1_.exe net.exe PID 2716 wrote to memory of 2768 2716 net.exe net1.exe PID 2716 wrote to memory of 2768 2716 net.exe net1.exe PID 2716 wrote to memory of 2768 2716 net.exe net1.exe PID 2716 wrote to memory of 2768 2716 net.exe net1.exe PID 2808 wrote to memory of 1208 2808 Logo1_.exe Explorer.EXE PID 2808 wrote to memory of 1208 2808 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a2D09.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
258KB
MD5087437b5d40197b39196f13de881a4c3
SHA11730cf453aae759eb6270bd4268270f99648019c
SHA25664300550756f2872e5cc83e44b3a9e9a1fd48db40d70255244d7fea2d7188256
SHA5129cf8e79721002615fd73b80ad843b5a36db0fab4adac9a9411800b0e506b25b61fdaf939ea2bb60291694abc50449afb4106e3af327971b89d926624c9d00ae0
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exeFilesize
478KB
MD5f01e1e0718ca3110b117e544489e3839
SHA16c19ce81349add991c3a88926d586b3de6ff9548
SHA256b044da00ae636042dc22870432b28488014098b7e01350031e82a361d45b588d
SHA512ee9a34b33e30eed3ef7676c7c86c88f748886527fe61d2133a8f3365d11848de66b1c118ea4d3a05f97363d6dc829c4490e839e20a16847a651cc915b47b5a93
-
C:\Users\Admin\AppData\Local\Temp\$$a2D09.batFilesize
722B
MD53e3baadd1c4bbb7e012eb06e1ec659a8
SHA1132347ca27016749c52913396d45ada243b0ae77
SHA256b3d08e3491faf17054aa3bfa6c6dd37ef5fef90c1983c895833c0b442d11363b
SHA512eae532b30e2a3e4fa70cfe6c4e9bfded6b20f8a1d7893510f66c366b635071982717ddc608a8fb0d6eb3fae4f17de8d9d4cfd944650dc0d0b283e255d72a5766
-
C:\Users\Admin\AppData\Local\Temp\b914abf02bc3eed99579cc0fb1b4fff2f931fff9b839f5838fa5806591cd6a36.exe.exeFilesize
14KB
MD5ad782ffac62e14e2269bf1379bccbaae
SHA19539773b550e902a35764574a2be2d05bc0d8afc
SHA2561c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
SHA512a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
-
C:\Windows\Logo1_.exeFilesize
33KB
MD5a51381d9a97c98438725ecee862236b3
SHA1fab4fca7633bc7de56ad02bc5a8165e709e9f06b
SHA25684aa7b7f5581336f4b54c55b70d17c1fb0460db983f55739d01d158eedee8668
SHA512c70207ff04c9a65c2f06400b65ca7597d075743af5c62e02b625e4ed30289075fe314872bbbb6037833e1eb6d5b07c506392637e3122ef642e6afb544a0ee82e
-
F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\_desktop.iniFilesize
9B
MD531874817e0fb055be8d2c971c0e3bbde
SHA1ee8a35d6a86cb6d13f354d67d912e194bb09c74b
SHA25694de8b492bc2db9a9592f7c9433547eb7f80826ed67f48d2bb7e22db9d49f544
SHA51255747c69ae50fa212576d095f60cf33b42e26789cf8c34fc5120a45b1988aae95f91d9e37cb17298c5ac5243b2e4c40e1d0e084ce7fe14bceb4ebb318c65c944
-
memory/1208-28-0x0000000002F60000-0x0000000002F61000-memory.dmpFilesize
4KB
-
memory/2808-31-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2808-20-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2808-3346-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2808-4171-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3016-17-0x0000000000880000-0x00000000008BF000-memory.dmpFilesize
252KB
-
memory/3016-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3016-16-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB