d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7

Analysis

max time kernel
150s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe
Size

959KB
MD5

742b89549f8e79de1eed666f7d62597d
SHA1

57dee2e77f4a17ef53ac1ee34df704daf4656146
SHA256

d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7
SHA512

e2ccba0007290615a82359a2c427b6f382dabcd8ff0177c18deca8a3fdbded7615f07300dca05d4c6fc09e56669f13c1f070a0cca8393271862c4095455e714a
SSDEEP

12288:JRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:mBpDRmi78gkPXlyo0G/jr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
516	Logo1_.exe
4644	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe
File created	C:\Windows\Logo1_.exe	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe
516	Logo1_.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4644	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe
Token: 35	4644	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 1512	3868	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe	83
PID 3868 wrote to memory of 1512	3868	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe	83
PID 3868 wrote to memory of 1512	3868	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe	83
PID 3868 wrote to memory of 516	3868	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe	84
PID 3868 wrote to memory of 516	3868	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe	84
PID 3868 wrote to memory of 516	3868	d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe	84
PID 516 wrote to memory of 4864	516	Logo1_.exe	85
PID 516 wrote to memory of 4864	516	Logo1_.exe	85
PID 516 wrote to memory of 4864	516	Logo1_.exe	85
PID 4864 wrote to memory of 3272	4864	net.exe	88
PID 4864 wrote to memory of 3272	4864	net.exe	88
PID 4864 wrote to memory of 3272	4864	net.exe	88
PID 1512 wrote to memory of 4644	1512	cmd.exe	89
PID 1512 wrote to memory of 4644	1512	cmd.exe	89
PID 516 wrote to memory of 3420	516	Logo1_.exe	54
PID 516 wrote to memory of 3420	516	Logo1_.exe	54

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420
- C:\Users\Admin\AppData\Local\Temp\d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe
  "C:\Users\Admin\AppData\Local\Temp\d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F74.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe
      "C:\Users\Admin\AppData\Local\Temp\d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:516
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
247KB

MD5
594816405c659b8c10ac507bff412043

SHA1
d86db1e94a11efc09a45285e3124fccd7d0e9d13

SHA256
0077af6b7b60dc8f20d3fadb3da40f12b201f6842c5ec39963da1b1115a918cd

SHA512
f70e0e41bc8700bc5c56d74ab54838c258c79b87f4bcf8984996d15c74c9a44a962ec7bb420de682ac74e588d24236584d3d5e6a1cdf2bdbdd32c9325f7cc84e

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
573KB

MD5
48bde0ce6f8b4185208793200b6ac804

SHA1
3320efc2e380900bf00d57d1a5f429cb8c1f7397

SHA256
203faf74daa76be1d6d3c9a40b9314ddcd5c51e9d2223c8aeb15cd6abf754b6b

SHA512
bfd1a310c8dcd08acec83bc27bdc7e928ed072dec20502f6e1138ef14067a04baa1d55c29cdcd7f5e4d4e4dbf39bbdfdce0da3cae5b72609c0260590b573820b

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
91c0f7855ee5d8b8e2d7bbd1c8d34f38

SHA1
4e7a556b7646b4626554476217fc44d67111e391

SHA256
5dbd4f96bc7b6132f8d234903a5310eb035259a18afe9e8829cf966d55effa66

SHA512
86426bb06bff9bc015558abb3f022e0027d732f9a5870416d2f1ed1f8604a2ca6d5051d3d93e2d14aa6ce86ed1afc94eb01ae68a729514d35038554e2a91bc82

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a4F74.bat

Filesize
722B

MD5
5190f8d0d571125119724cd2e81c113f

SHA1
20362fa6ae61e3b292ccff1e6ec9128cf953ce74

SHA256
a6536b7597cff9112b9d4db205815595d8dee161dd7994f2d7a721e97b6a93a1

SHA512
0c2c9c48b9d60d602fb165279d966ac9e36d39bc0b3ecf91138c7578f326103cfaf066ac5297a3121038a6f1b09f2b1214f978f1322f1769ade49b49b186ad44

Download Submit
C:\Users\Admin\AppData\Local\Temp\d279931fb8fed02760ae4d77b3cf14ebcfd509168f8eaf0dc089fbbcc6736ef7.exe.exe

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
bf2faa4bea2a63703088aed73a9c71a1

SHA1
b2ef58869de08789cfded220f98310b43052c3e5

SHA256
7bdc3769c776164640ea637faf845edacabd916cf0a0cfb77c9c31c879a8526c

SHA512
34f2e40b9b200596716194fcc4c714e0ccea9290ad25b06a097c50ab13a3fac8a80ce41078e306e14847284ff11d34aca43198675a1ccce6008685fbcd18f15b

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-656926755-4116854191-210765258-1000\_desktop.ini

Filesize
9B

MD5
1d7eff79e14bea77e992f25202a6decc

SHA1
2481953494e9f17a5d9c8186bac1e89c460da06b

SHA256
0bc3f26881fb44793cd3a989e616ce2b45848152d57eb4a38fd5f06df63f0a9a

SHA512
e9cffe2ce1cc689a1a0c9bee4da9e0ab90625931729257893780b13eb9060ee26bf373c87c0ae33e3fcdc3e8614d415ac00fe57fd7f1fb4908212cc145c8d9ad

Download Submit
memory/516-27-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/516-33-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/516-37-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/516-20-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/516-1234-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/516-4792-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/516-11-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/516-5237-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3868-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3868-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download