5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
Size

394KB
MD5

bd02d506ced5a2d426ed2ec4cbdba431
SHA1

ffad8deb84486101c55ba01754def8aa75620235
SHA256

5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c
SHA512

6aaad2bfafccf27a44ccd235e16547f10c7720649860fe245f2db5c00fcd7f321cb4f5a62d6dca6aa7a704d8e6927b2ac4b20be937f61e744e38f82db3e78c23
SSDEEP

6144:dG5KtP2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuYF1moH2:dPmahVy41

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2616	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2872	Logo1_.exe
2720	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe

Loads dropped DLL 1 IoCs

pid	Process
2616	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft.NET\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe
2872	Logo1_.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2728	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	28
PID 1728 wrote to memory of 2728	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	28
PID 1728 wrote to memory of 2728	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	28
PID 1728 wrote to memory of 2728	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	28
PID 2728 wrote to memory of 1044	2728	net.exe	30
PID 2728 wrote to memory of 1044	2728	net.exe	30
PID 2728 wrote to memory of 1044	2728	net.exe	30
PID 2728 wrote to memory of 1044	2728	net.exe	30
PID 1728 wrote to memory of 2616	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	31
PID 1728 wrote to memory of 2616	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	31
PID 1728 wrote to memory of 2616	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	31
PID 1728 wrote to memory of 2616	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	31
PID 1728 wrote to memory of 2872	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	33
PID 1728 wrote to memory of 2872	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	33
PID 1728 wrote to memory of 2872	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	33
PID 1728 wrote to memory of 2872	1728	5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe	33
PID 2872 wrote to memory of 2540	2872	Logo1_.exe	34
PID 2872 wrote to memory of 2540	2872	Logo1_.exe	34
PID 2872 wrote to memory of 2540	2872	Logo1_.exe	34
PID 2872 wrote to memory of 2540	2872	Logo1_.exe	34
PID 2616 wrote to memory of 2720	2616	cmd.exe	36
PID 2616 wrote to memory of 2720	2616	cmd.exe	36
PID 2616 wrote to memory of 2720	2616	cmd.exe	36
PID 2616 wrote to memory of 2720	2616	cmd.exe	36
PID 2540 wrote to memory of 2492	2540	net.exe	37
PID 2540 wrote to memory of 2492	2540	net.exe	37
PID 2540 wrote to memory of 2492	2540	net.exe	37
PID 2540 wrote to memory of 2492	2540	net.exe	37
PID 2872 wrote to memory of 2712	2872	Logo1_.exe	38
PID 2872 wrote to memory of 2712	2872	Logo1_.exe	38
PID 2872 wrote to memory of 2712	2872	Logo1_.exe	38
PID 2872 wrote to memory of 2712	2872	Logo1_.exe	38
PID 2712 wrote to memory of 2436	2712	net.exe	40
PID 2712 wrote to memory of 2436	2712	net.exe	40
PID 2712 wrote to memory of 2436	2712	net.exe	40
PID 2712 wrote to memory of 2436	2712	net.exe	40
PID 2872 wrote to memory of 1196	2872	Logo1_.exe	21
PID 2872 wrote to memory of 1196	2872	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
  "C:\Users\Admin\AppData\Local\Temp\5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a22EC.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe
      "C:\Users\Admin\AppData\Local\Temp\5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe"
      4⤵
      Executes dropped EXE
      PID:2720
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2492
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
b5b1f5646542e384afa7df94f5558dc1

SHA1
c08ac0f9d2982247414cdfc901e89fe2b2d7d6d8

SHA256
8b384efa768302ee176fd51c816a434b302162704e0816f06a022592ef08913d

SHA512
dcf104b02efddbe58ea4c6ed8bfda1bd6d923aab589038f1871439c649cf88ee7329197e45037bad1bc16c638469941bc260430c4d392f531c47a4162e76a785

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
5264aab343fc1f53c29d1065346d0010

SHA1
db43bc0b28b4ada0c5635db50fd0b64410ab76ad

SHA256
d33d56847b353c8207a43aa01cc75527328ebf4bba669e90e29266d1b6fb57dd

SHA512
bb4ba1f7c5cae56cef564dd99f1a1fd3e2c656f8004f689a22ea641d886cbb3a19dde3dce5be4cf8cee4ce190170fd8c5390cb9c7c40ae54109559685119a958

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a22EC.bat

Filesize
722B

MD5
a67299e90766d9c8a9db5eea8f7f76ea

SHA1
a7bce9ead3d683afe9149978f97e33e80e2901d0

SHA256
76bc3cf00c565616336649a9af48fdf43848f552615fdc01111f3a18b02c5848

SHA512
ce285484e69a31d6a1968efe8292eae34614228a5a2cdd1df6e951b03b3fa97a1306b551a3e0affe443e00af8382f1c9394a40a4a905f76bfbfb5222fe2fdeca

Download Submit
C:\Users\Admin\AppData\Local\Temp\5dfa6493d9527f086cd8ce55daa5e9dbc98dd0909a1accd25db2764c58fb0c2c.exe.exe

Filesize
360KB

MD5
5fbd45261a2de3bb42f489e825a9a935

SHA1
ff388f6e9efe651ec62c4152c1739783e7899293

SHA256
9e63701598199d5c47217e23b44d0e3ec5d53f5419166b1b6c68a7e9e8fc47a4

SHA512
7f22b1995a07016adb342c551454d602bfbe511525139aee8581b62116608e9e278fd81c26382f1333c7eccded4474196e73c093bb5cbf8e8f203e865024c058

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
21c31ac73db60142f947a5b68485db7a

SHA1
857c9c62c586fca11e3b5ae1a97518fa0a9eec46

SHA256
4d957e31bf06c4263f70fdda77e0275065d3501738cd5276d59b0813c1fdc2a2

SHA512
72ca302ca87c2c6cc71a3b8b3df8ecbfdd715ff6953b55c06d2c32a3cd6fdd6a02ac60b71c7393e5cf58fa70d61775c0fc5ea9efbcf7f5b824eafa8926b5f49a

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\_desktop.ini

Filesize
9B

MD5
1884bfdeea71ff22db39c196f4447c9c

SHA1
3eafc7e6e17ba6ce7a087a3588fb1efb596da038

SHA256
163167bc5a01ad6b3ed4406c2a9a1baaf2c0ef4620ab7d5b39aeddf976ca776d

SHA512
b22124aa3a912462e6face7f71ad3dfec4b27dab16b2e20e3a0adc277f89f631ec889c91b185ac4b9b670933d881b8fd26c25d6f405e465aa8148cdbb7f7c3e2

Download Submit
memory/1196-25-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/1728-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1728-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2872-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2872-2973-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2872-4138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download