913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe
Size

3.2MB
MD5

ebf7aa4e3aaf0355ecf7e9bc726aacd8
SHA1

b5032fd28b13c69c2dbfcd3ee01fb418fcd628c3
SHA256

913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a
SHA512

889eb5ea7195c5aa6e43c42d262e18b4c0a767d999efbef57051d5838fd65c791e68ebc563facfc4a5574e00f0f089cfe5b511c1f754d816eb72baf304c5b537
SSDEEP

49152:X7uUd8g4X/jCb21UhH35rTHhrnwtGVyaB3C1CvEqm+eYIDNVU16j/dbr4imHHXN0:/d8/XrU21ArTJnXVyoIqcYAK4MicHN

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2836	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2868	Logo1_.exe
2632	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe
2152	update.exe

Loads dropped DLL 7 IoCs

pid	Process
2836	cmd.exe
2836	cmd.exe
2632	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe
2152	update.exe
2152	update.exe
2152	update.exe
2152	update.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe
File created	C:\Program Files\Windows Journal\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File opened for modification	C:\Windows\setupapi.log	update.exe
File opened for modification	\??\c:\windows\KB942288-v3.log	update.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe
File created	C:\Windows\Logo1_.exe	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe
2868	Logo1_.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	2152	update.exe
Token: SeRestorePrivilege	2152	update.exe
Token: SeRestorePrivilege	2152	update.exe
Token: SeRestorePrivilege	2152	update.exe
Token: SeRestorePrivilege	2152	update.exe
Token: SeRestorePrivilege	2152	update.exe
Token: SeRestorePrivilege	2152	update.exe
Token: SeBackupPrivilege	2152	update.exe
Token: SeRestorePrivilege	2152	update.exe
Token: SeShutdownPrivilege	2152	update.exe
Token: SeSecurityPrivilege	2152	update.exe
Token: SeTakeOwnershipPrivilege	2152	update.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2836	2272	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	30
PID 2272 wrote to memory of 2836	2272	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	30
PID 2272 wrote to memory of 2836	2272	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	30
PID 2272 wrote to memory of 2836	2272	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	30
PID 2272 wrote to memory of 2868	2272	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	31
PID 2272 wrote to memory of 2868	2272	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	31
PID 2272 wrote to memory of 2868	2272	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	31
PID 2272 wrote to memory of 2868	2272	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	31
PID 2868 wrote to memory of 2616	2868	Logo1_.exe	33
PID 2868 wrote to memory of 2616	2868	Logo1_.exe	33
PID 2868 wrote to memory of 2616	2868	Logo1_.exe	33
PID 2868 wrote to memory of 2616	2868	Logo1_.exe	33
PID 2836 wrote to memory of 2632	2836	cmd.exe	35
PID 2836 wrote to memory of 2632	2836	cmd.exe	35
PID 2836 wrote to memory of 2632	2836	cmd.exe	35
PID 2836 wrote to memory of 2632	2836	cmd.exe	35
PID 2616 wrote to memory of 2780	2616	net.exe	36
PID 2616 wrote to memory of 2780	2616	net.exe	36
PID 2616 wrote to memory of 2780	2616	net.exe	36
PID 2616 wrote to memory of 2780	2616	net.exe	36
PID 2632 wrote to memory of 2152	2632	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	37
PID 2632 wrote to memory of 2152	2632	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	37
PID 2632 wrote to memory of 2152	2632	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	37
PID 2632 wrote to memory of 2152	2632	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	37
PID 2632 wrote to memory of 2152	2632	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	37
PID 2632 wrote to memory of 2152	2632	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	37
PID 2632 wrote to memory of 2152	2632	913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe	37
PID 2868 wrote to memory of 1200	2868	Logo1_.exe	21
PID 2868 wrote to memory of 1200	2868	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe
  "C:\Users\Admin\AppData\Local\Temp\913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a8112.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe
      "C:\Users\Admin\AppData\Local\Temp\913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2632
    - - \??\c:\358b0919ffd7e16ae7ed6f5372cd\UPDATE\update.exe
        
        c:\358b0919ffd7e16ae7ed6f5372cd\\UPDATE\update.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
8ec5693200766aac9a48e10d50c26ee1

SHA1
f9562bd1421aa3528c301b0fef0c6e188b13fb12

SHA256
e3bdff080ff3df735721fcd59dafaae137f18608800fccc1bb21249a367720af

SHA512
801c05d3f96e72b8a4d6ff6fc7fa7924f3b2fd59011e5cef15d6ccef8fa5bf4f95df3d8cea606ab5390318a613aff579aacd453f7469fa70a3cbe39fb14a57ed

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8112.bat

Filesize
722B

MD5
f31992c1061e61024cd07c3cafeaff46

SHA1
b3af3459e0232dc359d3701f9bf038d13dc07165

SHA256
275fbee76c502bdc86591eba1e05dc858aee76e4f8b92f3c804bc2eabf5b0a0b

SHA512
4a07f2e53ba6400313853027a770ae21dcd2fafb292e02dcf259f391da8f9d19523cf970f28a6f23ce0e3132de7c6dabab6e889015ecb103baecc7071412905d

Download Submit
C:\Users\Admin\AppData\Local\Temp\913f2197f8bea852bbb7abfdcd3abae2a7bb2309b4b23e444e24beb7b131a21a.exe.exe

Filesize
3.2MB

MD5
448447e0ba4560cd558eddb5f5b0809e

SHA1
86e1cc622dbf4979717b8f76ad73220cdb70400b

SHA256
acd589b57ed104b5e04a7ce28dc166654c09060c9c31ae8e2c9301fa098bbfa5

SHA512
77561d2ddfc80f5e97dd49f9eda22c04bb5f0be37ba0432513fd9bfa8e16acce069e7cc4c1be45f3b8ca16fc8e262d17efb5bf45653ff7746c86518a8114eb9f

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
c494780a332c152a0dc7349f3dba1d87

SHA1
f3f96e94935a679c5edc295f889c0cabab15a7b6

SHA256
e3e429c4d9df580c62d76ee37dc918692182617c6e5d2f6e49fc823f20b27339

SHA512
3d83e26143573b99bd8a3c4930f8cd9e986864f3f2d3f6eca21d1fdcff5ca6ea0d1d6b6da5698bd73f19d7ec4dbec866dcb09cc4eb078e621e7001b25e0359d2

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2958949473-3205530200-1453100116-1000\_desktop.ini

Filesize
8B

MD5
0eba530c95ed92c62635372036e559bf

SHA1
d24bedd9e198e4f71f8e9d0dc36351d486609337

SHA256
fdac71b01088c649a174d112f28b274807c720c98d39c8ea678b0832f8cd4b39

SHA512
7bf606115d882198ab92ff5d7f9f92f83e2e8bb4c2be9601ace2de9d7613938a56ffd51331ae22ff62b47fcc8bb54e9007a0375348a4a37b3b82e59d8ca1f3b1

Download Submit
\358b0919ffd7e16ae7ed6f5372cd\UPDATE\update.exe

Filesize
737KB

MD5
0ff4e4e0dd01e7872d9c2013560fd4a7

SHA1
f6a3aa7d551c99c3e9c00c9592c2be1b1cf1a81a

SHA256
fadc30d8a636762c424ff4f49d528f22d59c46c20c24c5c4b73badb4deb5e8a1

SHA512
8e154e66b6949e93532052a15762db2cbcf9d8dbfce9ef18ae2adcfd126974240716220151d1e59347fb4f094da7ab31701b32d3fdc5726c2da098154319a0b6

Download Submit
\??\c:\358b0919ffd7e16ae7ed6f5372cd\UPDATE\UPDSPAPI.dll

Filesize
373KB

MD5
8d13dfd9d7351b2da87ca237277b6cf3

SHA1
a9ef7f91183857ae6dba937f9f95282f6c590a9d

SHA256
dc2beb43cefa8840d3ac7d622079870f247f97a205a52cb4794b1d688c155463

SHA512
d11eee63de309e2b81a92fa9c72a11c1a587e4491214e1d45ad20cba3677ebf99bf98483bbc7f579d5f830e4ca7473d532abc1c6dd7c64ad455e0cd1bcc9a792

Download Submit
\??\c:\358b0919ffd7e16ae7ed6f5372cd\update\branches.inf

Filesize
926B

MD5
a61274aa24d83a434afddf6a268e061b

SHA1
903ffd4cba6df6c51a95f06bae521e0c09dfc885

SHA256
ec71fdaf0bd5c0bf985cba55c2f507598fc96d0d314daf4b8dc42f7ad9aa0228

SHA512
12be52b5e83db3f15e6cdc43606d36620fd915a885b6271eb08f0cb9997cfe736ae366c43b6473106e493ed035d77cf9a56ce495eb67f468e00ba12169985513

Download Submit
\??\c:\358b0919ffd7e16ae7ed6f5372cd\update\update_SP3QFE.inf

Filesize
60KB

MD5
a7ef70f5666541679a98ea666f07a05c

SHA1
02b7288e94157ddf90402c6a178eacbd40df7e7d

SHA256
1a852829592ed8b1b7c50b2486772a18aaa8714c12c293d1b008306a41c8e2d4

SHA512
b674d54b6ff4a3d505ff7bd3a52124d92a7394854cd59cf64f6ba5c24c1b524a7769067310e8d8e43df12e73cdf43aaec3edfda913be3d17f6ab8ec388f7e73c

Download Submit
\??\c:\358b0919ffd7e16ae7ed6f5372cd\update\updatebr.inf

Filesize
415B

MD5
b4ab410482bd2ee032915b47e2b227e6

SHA1
40ce74791a06414f886f37cea4f40665435da9cb

SHA256
d70a5b22301762d0050bd7c895c9e589bc15b9080cd067b495c21c66e082afb6

SHA512
332e7753afce66ad1e9920e442a8763fbc0ea0feff5d9f21f0898d80b3fffb7fb117a185ced2d8be1ec2418a8e8dc319b0ee2c159707d821f263e331f054b636

Download Submit
memory/1200-98-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/2152-89-0x0000000000170000-0x00000000001CE000-memory.dmp

Filesize
376KB

Download
memory/2272-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2272-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-210-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-158-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-743-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-1993-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-2208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-3453-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download