496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe
Size

106KB
MD5

bfcd9e7bb870b2b2d46d56d236145418
SHA1

723cf1794b4380ba67de8d3fb14a1166d79275d8
SHA256

496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb
SHA512

457a60a1b174b1074b4660b0be4f45db6314befa61a87dd16e6f17b803d6e9095d89572d3e6b94d524152af64cbd4522d533f9c81e1b088bc5c187d37b3aa3af
SSDEEP

1536:TfgLdQAQfcfymNr92jcQoXh3zlNEx3nRf4EXtEZ/rL5mAK3N:TftffjmNrYAQWhjlNEx3nJzmrL5DSN

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 1 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\JCLPRMON	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe

Executes dropped EXE 2 IoCs

pid	Process
3012	Logo1_.exe
4480	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lt-LT\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe
File created	C:\Windows\Logo1_.exe	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe
3012	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 448	4868	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe	81
PID 4868 wrote to memory of 448	4868	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe	81
PID 4868 wrote to memory of 448	4868	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe	81
PID 4868 wrote to memory of 3012	4868	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe	82
PID 4868 wrote to memory of 3012	4868	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe	82
PID 4868 wrote to memory of 3012	4868	496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe	82
PID 3012 wrote to memory of 1360	3012	Logo1_.exe	84
PID 3012 wrote to memory of 1360	3012	Logo1_.exe	84
PID 3012 wrote to memory of 1360	3012	Logo1_.exe	84
PID 1360 wrote to memory of 5104	1360	net.exe	86
PID 1360 wrote to memory of 5104	1360	net.exe	86
PID 1360 wrote to memory of 5104	1360	net.exe	86
PID 448 wrote to memory of 4480	448	cmd.exe	88
PID 448 wrote to memory of 4480	448	cmd.exe	88
PID 3012 wrote to memory of 3384	3012	Logo1_.exe	55
PID 3012 wrote to memory of 3384	3012	Logo1_.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe
  "C:\Users\Admin\AppData\Local\Temp\496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3A0.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe
      "C:\Users\Admin\AppData\Local\Temp\496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe"
      4⤵
      Boot or Logon Autostart Execution: Port Monitors
      Executes dropped EXE
      PID:4480
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
244KB

MD5
a2d4bf6246f865ce701c7e090854b155

SHA1
7e52d052ad5b98ac4d120de398ac621c3a499122

SHA256
7c04eb1013af998156fd5a4a3b191e55f2abcc4b5e504ae01ffaaf62c8d3fe5c

SHA512
34ec3468212abd18183c0844011dbcf8f9923084ef4421565806c000f87698865f26c0853b5af398ea1678c08018b9b4cd8f9f41093e2b84ec96a19ff56b989a

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
570KB

MD5
1f0c89210c0c2b6b401d6013df6c5470

SHA1
eed62ebf50a5470a3bd232b1d06642b738d2c1e4

SHA256
93798d7f52e9566661010d6e9eaab19923dbe45e3036c74e4f228be7dd44510f

SHA512
7a251b77deae50aa47f0cde3c631f4ce1be994758bdf00888a72485f5894d6b918d6948ca6422cd4b40062c377eb5c55c3b6585857c1d7b7d15de372be8fc5f0

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
636KB

MD5
2500f702e2b9632127c14e4eaae5d424

SHA1
8726fef12958265214eeb58001c995629834b13a

SHA256
82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c

SHA512
f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aB3A0.bat

Filesize
722B

MD5
7828d185c0666670c8d3b42ab09192ba

SHA1
e21fcf0e80675e0e40cfbbd42ef766c5618c52af

SHA256
f6a425f9a5c0fa766cad82cc6b5639fa3a44e393e8cb4ab01fe47bce27752f76

SHA512
0e8028b6112d389364477b1c090a91b15dade5c9e574caa3323969224ec13b7df2c49f78c87944f70d79d99b6590cd8ee31d16a023639f06bf079abf34980424

Download Submit
C:\Users\Admin\AppData\Local\Temp\496452d080c52873f8332b2ea142a9a89dbd4391696149d0fb3f2464a30cd2eb.exe.exe

Filesize
80KB

MD5
9917321020e7d0a5acc2a10aa4b990a8

SHA1
385bc850672af0ed72db3ef609a1dadc6cf4f505

SHA256
ca21b4956d566dd3225cb2fc22c6fa66e19ce63be626625e3f15bf67952d1e14

SHA512
4d5d5e1c60794f1620c783de6f17a8453e30c586d20c9308707bd0ba44ed4e17c97a0ad953b546953b157ebd7c1dc045be479d9d0e588886d78ffc1ad76d5ad8

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
37dc111dc9c93bf1cbf5c548ec05dfb3

SHA1
eaff3f4d4cf183d169892b72c9edc9b541f269c2

SHA256
56e0db15c975b652821fd3a08b11996354ebec6402f234790d95e50c37aa4ba4

SHA512
faabed4bfd64291487135767887e2f75f856f016d32f5b94b77eda375ac4fb86d94d35d171799520fa3b7208d8c9989af313de6df8f6caa0d12e007edd9d3bd3

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1194130065-3471212556-1656947724-1000\_desktop.ini

Filesize
8B

MD5
5e797d005cfee3b802f98412c511983c

SHA1
1c65a747549afbed9971b65c604d64ec1f1ab898

SHA256
dcb1b824282c0cca0aaad7a62d7857039122e25a100766f82c85f227b36e4c88

SHA512
41116f81a81859b0608b0150a4cd791b3fba9e7516ff3eb98494a3802a3532dda052a2ed955d64c023fe6d8113079d7190df6f5bcc7ef86c8e743419a758706b

Download Submit
memory/3012-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3012-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3012-37-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3012-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3012-1233-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3012-4792-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3012-10-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3012-5237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4868-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4868-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download