4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
Size

47KB
MD5

ec033afb87df99a39746c579205bab61
SHA1

525213cf0323b201392cff2b8b8414a07358410d
SHA256

4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6
SHA512

9fdbfb2b96e088292b33a3517f5ee08db53bbe2d4c6b007ff2bb130e5e5dbcf2fc06fdfd221cb12a79d7f52562c5dd9cbf7c3832ed0bc6d1b7573f4b898c4fa8
SSDEEP

768:6CpQFJFKZj1PVs9Ag1vzu4OQZce0Ote9Q77Q6WFelKpaoWQ3655Kv1X/qY1MSd:6Xcx1aeg1v9OQZVUKM6+kKpzHqaNrFd

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3060	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2556	Logo1_.exe
2860	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe

Loads dropped DLL 1 IoCs

pid	Process
3060	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\sidebar.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
File created	C:\Windows\Logo1_.exe	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe
2556	Logo1_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2732	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	28
PID 2416 wrote to memory of 2732	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	28
PID 2416 wrote to memory of 2732	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	28
PID 2416 wrote to memory of 2732	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	28
PID 2732 wrote to memory of 1856	2732	net.exe	30
PID 2732 wrote to memory of 1856	2732	net.exe	30
PID 2732 wrote to memory of 1856	2732	net.exe	30
PID 2732 wrote to memory of 1856	2732	net.exe	30
PID 2416 wrote to memory of 3060	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	31
PID 2416 wrote to memory of 3060	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	31
PID 2416 wrote to memory of 3060	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	31
PID 2416 wrote to memory of 3060	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	31
PID 2416 wrote to memory of 2556	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	33
PID 2416 wrote to memory of 2556	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	33
PID 2416 wrote to memory of 2556	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	33
PID 2416 wrote to memory of 2556	2416	4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe	33
PID 2556 wrote to memory of 2876	2556	Logo1_.exe	34
PID 2556 wrote to memory of 2876	2556	Logo1_.exe	34
PID 2556 wrote to memory of 2876	2556	Logo1_.exe	34
PID 2556 wrote to memory of 2876	2556	Logo1_.exe	34
PID 2876 wrote to memory of 2584	2876	net.exe	36
PID 2876 wrote to memory of 2584	2876	net.exe	36
PID 2876 wrote to memory of 2584	2876	net.exe	36
PID 2876 wrote to memory of 2584	2876	net.exe	36
PID 3060 wrote to memory of 2860	3060	cmd.exe	37
PID 3060 wrote to memory of 2860	3060	cmd.exe	37
PID 3060 wrote to memory of 2860	3060	cmd.exe	37
PID 3060 wrote to memory of 2860	3060	cmd.exe	37
PID 3060 wrote to memory of 2860	3060	cmd.exe	37
PID 3060 wrote to memory of 2860	3060	cmd.exe	37
PID 3060 wrote to memory of 2860	3060	cmd.exe	37
PID 2556 wrote to memory of 2488	2556	Logo1_.exe	38
PID 2556 wrote to memory of 2488	2556	Logo1_.exe	38
PID 2556 wrote to memory of 2488	2556	Logo1_.exe	38
PID 2556 wrote to memory of 2488	2556	Logo1_.exe	38
PID 2488 wrote to memory of 2476	2488	net.exe	40
PID 2488 wrote to memory of 2476	2488	net.exe	40
PID 2488 wrote to memory of 2476	2488	net.exe	40
PID 2488 wrote to memory of 2476	2488	net.exe	40
PID 2556 wrote to memory of 1200	2556	Logo1_.exe	21
PID 2556 wrote to memory of 1200	2556	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
  "C:\Users\Admin\AppData\Local\Temp\4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a19C8.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe
      "C:\Users\Admin\AppData\Local\Temp\4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      PID:2860
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2584
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
b02ce9f89b5fcdfa382e398baae14db1

SHA1
0ccdb48192fa6da97f6fed097e7992d4ffb8c329

SHA256
2d58ebd950e75995c7f4e973b1a3acbd00bbcc957e1c3cc537c9192941e22e0f

SHA512
351e4199b880a52204c10a42f767ea125a430af89fc950c779a30ba9801324045fb6db6b43b4f6f8b1760ac6f5b18fdfbd51b345553440e0903b3228afb105ef

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
c8b074fbff9452f981c52acd82c24918

SHA1
03ffff9c1f1e8da670c6c65b2d858a9ed7eae4fa

SHA256
986587b92dc97769781c303bcf1c6e13dacd413cac927afb4462389b3204d888

SHA512
fc282e5789ea88095cfd50a0aa1c38d63515f70b28c52c2d68da57119f4b8f5f5ba4216a3547fe5202939d0ca3c8ad6c1cd938831c5b0bb3fc6e96b6d834bf8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a19C8.bat

Filesize
722B

MD5
c0204eddcaea2b058cbcf338232e6a58

SHA1
e1817001d7e8b4b60200791849af3a725f013edc

SHA256
c123d915ced941524a2c94ac17b0981b6a4041711baad36bbf70b7c231c8ddca

SHA512
bad288757c25d6ec7a9e02b2a140aab861ce600ae42684f511614477e9c84b74e63b0d180b4500c4cf9a5d9cfd92ad0c6d04c2e8e9c74e0dba9db02665db8d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fa9334a79a7cc8f5b8279ad3c3735efe83635292616951e22913e53e659dec6.exe.exe

Filesize
14KB

MD5
ad782ffac62e14e2269bf1379bccbaae

SHA1
9539773b550e902a35764574a2be2d05bc0d8afc

SHA256
1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8

SHA512
a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
7808bed698ccef82509cf593cc88cc08

SHA1
7fd55fac4955cfe86b991985fad7f7118b2fd34b

SHA256
1ab85edcc778baa7cde7ac968b92acdf829a3db71343db8a05d15cf7c65974d6

SHA512
adecb7877ae2db16ecc80a5ac1bab168f8cc750553fa458a0447d0741d7f52f0da08dee18b3c3ba958fce80243d4b873dcdf2e41e5dfcc4c9debedf0c5113a6f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\_desktop.ini

Filesize
9B

MD5
4b2b75605a65a6762ec4715de0a70902

SHA1
3b85993ef06d2d814abc405188fdd19a1bffea0c

SHA256
77072cc5a7b394508cf5d819ff8cf4385a9b3cb15d8715a59845ccfa235ea34e

SHA512
888361e75afd4308bdad817af543704a42ffdf2d798acef619459e9978ac68f1cf4d468c6e0b146ab738b0109fdf331c4380471aa83f637b0f6ab06164840c65

Download Submit
memory/1200-27-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/2416-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2416-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2556-30-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2556-19-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2556-3281-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2556-4099-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download