1fc4c8e8e29b7a384f7201ab32a004d367168d7df40dbf75b3f89b64a7b26723

Analysis

max time kernel
22s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 11:15

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

script.vbs
Size

1KB
MD5

2dbbaf0e05557f73d94f363a03d69a46
SHA1

c5e5656f3c886d459db584ebcfba51a4b80e90ca
SHA256

1fc4c8e8e29b7a384f7201ab32a004d367168d7df40dbf75b3f89b64a7b26723
SHA512

beb56c77a4d9e7f43ae2fa21bd90ed0cc88d5b21eddcf973958c4831369c9a67f58b198374ec0c8ec08949b9fceba2874551f146412887c3b574f8a4dad0100b

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3708	1632	WScript.exe	84
PID 1632 wrote to memory of 3708	1632	WScript.exe	84
PID 1632 wrote to memory of 4924	1632	WScript.exe	86
PID 1632 wrote to memory of 4924	1632	WScript.exe	86
PID 1632 wrote to memory of 2272	1632	WScript.exe	88
PID 1632 wrote to memory of 2272	1632	WScript.exe	88
PID 1632 wrote to memory of 2460	1632	WScript.exe	89
PID 1632 wrote to memory of 2460	1632	WScript.exe	89
PID 1632 wrote to memory of 4812	1632	WScript.exe	92
PID 1632 wrote to memory of 4812	1632	WScript.exe	92
PID 1632 wrote to memory of 1452	1632	WScript.exe	94
PID 1632 wrote to memory of 1452	1632	WScript.exe	94
PID 1632 wrote to memory of 1220	1632	WScript.exe	96
PID 1632 wrote to memory of 1220	1632	WScript.exe	96
PID 1632 wrote to memory of 2736	1632	WScript.exe	98
PID 1632 wrote to memory of 2736	1632	WScript.exe	98
PID 1632 wrote to memory of 3036	1632	WScript.exe	100
PID 1632 wrote to memory of 3036	1632	WScript.exe	100
PID 1632 wrote to memory of 5040	1632	WScript.exe	102
PID 1632 wrote to memory of 5040	1632	WScript.exe	102
PID 1632 wrote to memory of 4120	1632	WScript.exe	104
PID 1632 wrote to memory of 4120	1632	WScript.exe	104
PID 1632 wrote to memory of 2032	1632	WScript.exe	106
PID 1632 wrote to memory of 2032	1632	WScript.exe	106
PID 1632 wrote to memory of 1852	1632	WScript.exe	108
PID 1632 wrote to memory of 1852	1632	WScript.exe	108
PID 1632 wrote to memory of 2764	1632	WScript.exe	110
PID 1632 wrote to memory of 2764	1632	WScript.exe	110
PID 1632 wrote to memory of 4380	1632	WScript.exe	112
PID 1632 wrote to memory of 4380	1632	WScript.exe	112
PID 1632 wrote to memory of 2212	1632	WScript.exe	114
PID 1632 wrote to memory of 2212	1632	WScript.exe	114
PID 1632 wrote to memory of 4904	1632	WScript.exe	116
PID 1632 wrote to memory of 4904	1632	WScript.exe	116
PID 1632 wrote to memory of 4668	1632	WScript.exe	118
PID 1632 wrote to memory of 4668	1632	WScript.exe	118
PID 1632 wrote to memory of 5044	1632	WScript.exe	119
PID 1632 wrote to memory of 5044	1632	WScript.exe	119
PID 1632 wrote to memory of 4860	1632	WScript.exe	122
PID 1632 wrote to memory of 4860	1632	WScript.exe	122
PID 1632 wrote to memory of 3288	1632	WScript.exe	124
PID 1632 wrote to memory of 3288	1632	WScript.exe	124
PID 1632 wrote to memory of 396	1632	WScript.exe	126
PID 1632 wrote to memory of 396	1632	WScript.exe	126
PID 1632 wrote to memory of 2708	1632	WScript.exe	128
PID 1632 wrote to memory of 2708	1632	WScript.exe	128
PID 1632 wrote to memory of 3828	1632	WScript.exe	130
PID 1632 wrote to memory of 3828	1632	WScript.exe	130
PID 1632 wrote to memory of 2660	1632	WScript.exe	132
PID 1632 wrote to memory of 2660	1632	WScript.exe	132

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\ConfirmClose.ttf
  2⤵
  PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\DebugRevoke.jpe
  2⤵
  PID:4924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\desktop.ini
  2⤵
  PID:2272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\FindDebug.xps
  2⤵
  PID:2460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\FindReceive.ADTS
  2⤵
  PID:4812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\FormatSwitch.cab
  2⤵
  PID:1452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\GetResize.inf
  2⤵
  PID:1220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\GrantRegister.vsw
  2⤵
  PID:2736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\InstallConvertTo.mht
  2⤵
  PID:3036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\MountCompress.mpv2
  2⤵
  PID:5040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\MountLimit.jpeg
  2⤵
  PID:4120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\OpenUnprotect.vbs
  2⤵
  PID:2032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\OptimizeEdit.zip
  2⤵
  PID:1852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\PingJoin.ico
  2⤵
  PID:2764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\ProtectEnter.docm
  2⤵
  PID:4380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\RedoTrace.vsx
  2⤵
  PID:2212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\RegisterBackup.3gp
  2⤵
  PID:4904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\RegisterDeny.DVR
  2⤵
  PID:4668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\ResetImport.xlsx
  2⤵
  PID:5044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\RestartResolve.tiff
  2⤵
  PID:4860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\RestorePush.pub
  2⤵
  PID:3288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\SelectCheckpoint.ps1
  2⤵
  PID:396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\SplitCopy.dib
  2⤵
  PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\UnregisterUpdate.ppsm
  2⤵
  PID:3828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del/s/q C:\Users\Admin\Desktop\WatchUnregister.vsd
  2⤵
  PID:2660

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roamings.vbs"
1⤵
PID:1492
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:2736
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:3564
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:2540
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:4488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:2824
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:4832
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:3828
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:3228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:396
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:2724
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:2940
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:3584
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:3576
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:2612
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:364
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:2232
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:4196
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:4932
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wininit
  2⤵
  PID:2032
- - C:\Windows\system32\wininit.exe
    "C:\Windows\system32\wininit.exe"
    3⤵
    PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x3hceerb.113.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\tase.vbs

Filesize
39B

MD5
683dfe35aa1dff3011f8c9ab4cbce03c

SHA1
0096ea14c6ae595a7b24ad7ca3a666ecedafcad8

SHA256
31f19c00142e1d7fa6c153fb72b77a21a1c65899355362b961ba739e0ff5ba41

SHA512
ec7773c60ea8881246f241b6ef76e8ce478a4afb578763275066cf046242c725b3ad33ce2adbdba81635087b219b9598c2c325b0d6c3818cec25dc8abf764cb1

Download Submit
C:\Users\Admin\AppData\Roamings.vbs

Filesize
676B

MD5
b571cf609f720ad0a79eda45635bb974

SHA1
dc78241531a0f52fbbeac3ffa8ed57e34e79820e

SHA256
fbfddaf321578f179fc4259362de5f69ced2cdfdc36541fd27dd298ad33f2768

SHA512
e0627a43e90779aca60fba4b4875f9792cd3f0a8a81fa371779306f480d647a949c4a2c0202d85740dc7be432d620a2d2e773a1ebbc378cb56ef0265ab77dfa2

Download Submit
C:\Users\Admin\Desktop\DIE104.lnk

Filesize
1KB

MD5
6f06faf9b1d882d384779c40d3452990

SHA1
cee630bd6732cc020eef4822e7d8fbdc7fa62b40

SHA256
ae25d049bb82d29f1043f7c5f4d1a8ecd34e3c5641ca572b52ab5fb766925e13

SHA512
f4e79092be55da72f8b1c80cc3efe5410e63a5b1cae9d32d840867ba769eb91e032dab12998b2fe3e5ebdec9bef9c1f0642c86b06b6b6f88f2efaf01c49dcdb4

Download Submit
C:\Users\Admin\Desktop\DIE109.lnk

Filesize
1KB

MD5
f9f585b403caf34d5f3f21a4b6bbdac5

SHA1
5c52bc813c5d79b740f04bb9519287316e337426

SHA256
702b36c1497f84ddcce45c987737bdc96f1df2d598cb74d98fdefbe44a4c8468

SHA512
70c5082199810f62ea91f4490dd3b2bf6a07ca1e1895de87bb9e5c5dc50fc993ab2ddc05b47b3a6d8a4b77783622a37a9ce8c5f24bda72ef78d433552b58d89b

Download Submit
C:\Users\Admin\Desktop\DIE114.lnk

Filesize
1KB

MD5
b57b7d02ac7f487f046a5590af649ec0

SHA1
62c87bd0477455b07269352056975ff4c928fedb

SHA256
9672a0ff7f5f32664e14213ab20f1dc8795cb47c099d6112387cd5a38e6f88f4

SHA512
42b09d1345e04542bb8ece753d1ca0edfda5adb60b665972bdf26b0709a151aca18b206dbb891b86aaa008486f14bdc15bc300221514d828ead7b5c587b57042

Download Submit
C:\Users\Admin\Desktop\DIE119.lnk

Filesize
1KB

MD5
ac54bb6b15ecd1124cfd5fb79ccf790a

SHA1
e8f77af1d757ddeff4d953b40f961d5c7148964b

SHA256
c3f41daec9d697f3a920891fe1bf3173c2a64008e41d58e4efaf8be59d55ba4d

SHA512
5714bfcd7f5123161ad6018410c128d0816a4cf5cec322f6ab1f3a9c39eeaddf86eaafca1e557e5c4cde089b8d6d45f7ab35e0310c9fe61381d189c67bef4d20

Download Submit
C:\Users\Admin\Desktop\DIE126.lnk

Filesize
1KB

MD5
f306594a6d30a137f81bbd13720228ab

SHA1
f8c7922e9b4c04ec4318ab90ecf9d7c833a51bf2

SHA256
7159c8d42ac6d5012302b60d60888b3c3ceae97e9e97757bdeedc9f52361481c

SHA512
16450c32a8ecfd2f0de5364427cd1c48139022a134e68e040e01364eb6df5664cd648ae5b7ebabd0639e363fce606f89adc8a4482700b81d47231a25343a00b9

Download Submit
C:\Users\Admin\Desktop\DIE137.lnk

Filesize
1KB

MD5
128d7a6d7aa96e1f7cebc4feb9e28d0b

SHA1
893f9d7cae6a17af5c0bccd84420e5dc5366a703

SHA256
ac2564fa6d6d167328e45e4cd418882e2eb2ae21ecbf70eeda173b1250fd5e8d

SHA512
c2702cc547c659aa1cfe31cc399f85d085a3496477257cd3772f2c1aef050ecb0023c23c0679c38786fa2d36c2dbd548274ab72bb4e5d7b35cdbf1614d97b518

Download Submit
C:\Users\Admin\Desktop\DIE144.lnk

Filesize
1KB

MD5
27ce1b82be4cda0e7afcde944b6fd916

SHA1
a3821ac26ee5f6cdf4388ad617e3ea29a7f27e2f

SHA256
7139e4ef16b558c4d4400e15363856b668c27a1b499411fc143386feb39b6482

SHA512
13e85ed5d4761af4c1c0eff569fc5bf86070460ecefe401f104d161de1434f16018ebd7230b6f5b159fb899b436c1bab96d5a913d50f4510ac0e2dc4fdb5cadb

Download Submit
C:\Users\Admin\Desktop\DIE153.lnk

Filesize
1KB

MD5
f5175e010a6c39066cdb45a098e517b2

SHA1
36e4ab833c8ddeb1951a4fbe12ee6808c09f2d32

SHA256
205ba45acaa36aa36d75a99b15c3f2f681668ee5ba8a0b3d536b3acd1c0634af

SHA512
aa843e024598237bd00b37a4b680f7d7176ff4ea7a90295c66fbef488876ae00dd9d7f415612acb507ca1302aff6a2c5c329374c96602ac907e473c6b90c0ec9

Download Submit
C:\Users\Admin\Desktop\DIE162.lnk

Filesize
1KB

MD5
db490fda7a2b20bfd9be7004088a82a9

SHA1
d823141a5ca5231f3792412d0a985323d1339fbd

SHA256
901422103cb6464acdfddd90772f666a4868744a1f0c029a939f006628aae86e

SHA512
f6fe1d6432ff72506f032b20826a815e4a9e9eb42fd8ecc6bbe8766b437b399851f631c747136c0dd3d56ab1105dc9f9ffb5309a71f4afa6f287a126054a74b2

Download Submit
C:\Users\Admin\Desktop\DIE170.lnk

Filesize
1KB

MD5
1709b1e0016449db2cd5690ed8a47c13

SHA1
619454258b5b1144fbcbb1a7cd9f9705b7823724

SHA256
9edfdc99d2ebbce5c0ea5003d7372e893a43df9147900d51826ef6d42ee32355

SHA512
2b1c8a81e823eeb2775c953f2b2da3adbc5bc5f11be5287fb4be4b9925134a0269c00697f7e29906946876be98d1f4b7c8eddb5ff627895d6d895553e44e9982

Download Submit
C:\Users\Admin\Desktop\DIE178.lnk

Filesize
1KB

MD5
9c8bbdb1740884b4559c1cf9cd3e54b1

SHA1
c74a6f43d03733fcaa9d27d7a622c5fd32933086

SHA256
6d40bb9d1a22a81464f09cf83ae0f1791e9168ede99b013aae88197fb435bf37

SHA512
a1b94ead88dcc18b4255741cd787dea378bfd5315a560aa0140f2fd51849fc88da070c067a0f41c1ba6c0d46c0f4a69571db982cb165b9a3f7877d40cb4332ca

Download Submit
C:\Users\Admin\Desktop\DIE190.lnk

Filesize
1KB

MD5
dbe89d73755a05f885b2e95a962089e0

SHA1
912323e98ae5dd99d8acd4359485a39bb439ef2e

SHA256
b7b62209e4098344ce95c732c2fe9ae0103e261b5abe1833cdcb69fb10996f57

SHA512
92980a88783bd8f39a3fdd629338add704cd4ca7e07168dfc813f4bf9b9be009858eb6a1b6cc08064689221fd4d733045ac13d0d6ac0b22a170c41d3d64c0ae4

Download Submit
C:\Users\Admin\Desktop\DIE199.lnk

Filesize
1KB

MD5
1bb8c5fe1c00a2824fdcf13bf67244bb

SHA1
01cb3faf96a22bbce17d8a723feead14d7544200

SHA256
a6160543240f1f6e3eac9fbd8ba13c9b5afb27839ea655ab8ae7d50a8aaf60d3

SHA512
79c2a409abcef01bfd50f00dce45dfee85c2a237dae84fe636deefda6cde3282ff15ed5e18850500726334c5a04be63c8b259e14daa75dd32c97c2721325df07

Download Submit
C:\Users\Admin\Desktop\DIE36.lnk

Filesize
1KB

MD5
22865f2ded37c56e11c05a1d77cb3b9f

SHA1
b967d1e10b219679a52e599fdbf07911a484b4ae

SHA256
16601599d96a7ac615b4e69308f2778f17dbd00a1c07e5f01ff24f952b6d1238

SHA512
fb72dc7a062f51ee70c66c5c45f20257de93629c61519d89789fb7d02c9262decfe9c7bd82a9de954f0cd6599b1fcfaff7f6797e9e16a019c571b334c4aac30a

Download Submit
C:\Users\Admin\Desktop\DIE46.lnk

Filesize
1KB

MD5
16630301fea894344742b6daad216dba

SHA1
6649fce81a5f9888fd2c8ab9e5f26f8f79ad5829

SHA256
e9c2b448229df6090e6457a4133798ed4ebb3430ddbae339f8d2c11213e6a338

SHA512
ce56156be9ef735c9eeaf8beab1db7ca414ab7869a6176a53e4c4d74a78dc6247c2641cb4cccdccf3519c627783ef53373453da9d154b7b0f8f9adb2fb4ae601

Download Submit
C:\Users\Admin\Desktop\DIE59.lnk

Filesize
1KB

MD5
0f49f815d84b220ef8f8e198c7fd286b

SHA1
8753c993eca29db5dfd4f3f753eb13710c1e255c

SHA256
340085658056c5e041d7f1a9cc3b16027651de2cf935bb5c106d7822b01cd9fe

SHA512
324bd58e65f0e9440d9c272817d723f442154140b333d769022b79ba743e805c515791e93778fe45f451ce119da086487f2252712fe4f17563815a9e3f090f73

Download Submit
C:\Users\Admin\Desktop\DIE6.lnk

Filesize
1KB

MD5
b08d5178126b4fac5a0b69f3a666c148

SHA1
60271d45ba589bba6212aeb97245eafb7ffdbafe

SHA256
26a07f86f189a1fd0587164a3d076e4b899b49b05afabba76e4bd3977c2a6552

SHA512
d81b03e82d3cb6031b36edb514faad51117e8db6a3c8eb656a0c36f5adea7f2e740a57b02e1395921c4e69889c9e572eb0230c19c8d9618c0e721f35a88ae0ea

Download Submit
C:\Users\Admin\Desktop\DIE70.lnk

Filesize
1KB

MD5
411a05e412889c475a1df5be2ea32809

SHA1
c85b34d37727f4075fe1925b419ed7f9f6225956

SHA256
468e6e269ee387e7416457106b142fdc8b8087f0b72c4c5776da35f6bb9bc8ed

SHA512
77bbf281ef03735ef20275aebfeb0ece9648b58814f4ebd8e1577f34e686114d5a07ed68d3005209a0733add3b5d092bcfb91fa44b15972082e4a149c60ae750

Download Submit
C:\Users\Admin\Desktop\DIE91.lnk

Filesize
1KB

MD5
606eaa0c3dbdd01dd2248cff0257e428

SHA1
dab28c303473bc7669b98edb142e9c96937d10f6

SHA256
94401773adafa162dea5f1c659f7bdd36c2ea34dd7e57a41aababbfafeb9a2e5

SHA512
b9441119b68ef12022dcf59974211b3a4ef15c37879cf19b9361b64fa1e6744d86175bc1cec517fe9833452159cb940300569f410f7a4c3c76cb20b7c69cc02a

Download Submit
memory/2032-450-0x0000014E45230000-0x0000014E45252000-memory.dmp

Filesize
136KB

Download