f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe
Size

117KB
MD5

396d83e6a55e77195fd116b2a88f75cd
SHA1

a861ab2cbccd0f9bcb83878984ce80af5caaaaa4
SHA256

f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313
SHA512

730813f360af0587e73e11492bda2abcd14cc40e774c3af0aa8a0ccd68db64037766977779ed50544cf93d783af85efe8857c55ecaaa896acb1350ec9fedc6c5
SSDEEP

1536:p93SHuJV9NWEiHWRtLlaAXNnjgFJGYgaVJUcbUXRnjgFJGYgGVJUgbmc5:p9kuJVLWHWfN0JQa0Km0JQG0Omc5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2476	Logo1_.exe
4560	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\am-ET\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ml-IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\HoloTileAssets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-Toolkit\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\gl-ES\View3d\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe
File created	C:\Windows\Logo1_.exe	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
4560	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe
2476	Logo1_.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2516	2360	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe	84
PID 2360 wrote to memory of 2516	2360	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe	84
PID 2360 wrote to memory of 2516	2360	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe	84
PID 2360 wrote to memory of 2476	2360	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe	85
PID 2360 wrote to memory of 2476	2360	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe	85
PID 2360 wrote to memory of 2476	2360	f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe	85
PID 2476 wrote to memory of 2820	2476	Logo1_.exe	87
PID 2476 wrote to memory of 2820	2476	Logo1_.exe	87
PID 2476 wrote to memory of 2820	2476	Logo1_.exe	87
PID 2820 wrote to memory of 2880	2820	net.exe	89
PID 2820 wrote to memory of 2880	2820	net.exe	89
PID 2820 wrote to memory of 2880	2820	net.exe	89
PID 2516 wrote to memory of 4560	2516	cmd.exe	90
PID 2516 wrote to memory of 4560	2516	cmd.exe	90
PID 2516 wrote to memory of 4560	2516	cmd.exe	90
PID 2476 wrote to memory of 3524	2476	Logo1_.exe	56
PID 2476 wrote to memory of 3524	2476	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe
  "C:\Users\Admin\AppData\Local\Temp\f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79C4.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe
      "C:\Users\Admin\AppData\Local\Temp\f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
247KB

MD5
68e36169421ac75ee71c2cb5885fc48b

SHA1
a80490bcad9f82a31461ac8556e99f7cf38b5869

SHA256
46c4e83fd2c0a9b25f52a88aca77fe16e44dee3166a39e96c3185e487818216e

SHA512
28648f065bba25837d0e61383d0154648b567a8e80f72817c5001a6a974bbe13c1a7e7d0cb095868f7774cf17f00da3c9c9579527b576ea8e70230918cc12268

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
573KB

MD5
80a91ca7e5b8765b1b6ce306878d96a7

SHA1
a00b0bf5cad2c194ba8fe43f78c5de663b5fa9c6

SHA256
4d35e30fb26917f4541ac0e5dbcd01cf3a336a5fc90452b6eacc320316a0aba0

SHA512
79710a753b4b0056b786e437902be3fb49d6dbdde67645f7664638a542948d7ca91de042be86f3a0f63479cc1107e86178f588f65e424922c945b8df479c40c4

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
ff7ce6c4ffc92d1beca4883dfcfde0af

SHA1
4a52e320cd88765f13e2799a4980a12f788c98a4

SHA256
5a4e150d03f1cfadccd40a407a3ae8ec5ffbb5d28ea95dca136d67cac24fd8b5

SHA512
99056bcbb382e545304a33002a6cfbb7a57df663feca5a3842bf077d1126931ba78d5e04a93cbd72a7c6d9eb09005750e5cff1030d8586e26838e7634d7ad583

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a79C4.bat

Filesize
722B

MD5
eee7a8ff67c6603ada4fa7ba873ba099

SHA1
bb99f943554db9880a084d5ba229b127fca6355c

SHA256
f6badebb769b0b0139e0b6c57a579e0253c07f2326fc325313a6b02cbddceadd

SHA512
ec3c66ee9d00242a21a683ae59a2ceabf921257228eafe36417a15cb9c5f02bea6d8935e6f200c8682e466845e3932e27715333d65bb4f848c0a719f6c0cbdd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\f9bd5b3954d7a6294315a69fd2889ba579aeda9492b1dbce1e7786c54ab22313.exe.exe

Filesize
88KB

MD5
2f851b878c85546b7d9ed24c826a2019

SHA1
effe8496047dbf0cc104ad448ca5de14efce5e56

SHA256
843a6655e8d428c0945ff484756ea5c2bb268036f92333d2ae63258828f36c61

SHA512
a60eebf9ab21ec858e3c44785ff4d36b86e37f8c9241c29e7ee98f59520519fabe3b061d1929f0756dd16b3dcff202c798fc57e2e80669756920f1fe960034c9

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
20c6e98c959558ea79c93b292b62b085

SHA1
b1bed6910b2eb263d3d1268ee884266b5d1f3e16

SHA256
b413c3a51cfcce35b310d048cca6be88d60fd9513d900e6050b75b1200931a69

SHA512
2a95a2ed5dc36e4f0bf34965a439e5c0a4ac946b3497fec8fe2d8246d89c37e5b002e3727a218e715e314c08f4dc96f1c16e563cdd1fe1fa8e58068f35c7192e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\_desktop.ini

Filesize
10B

MD5
52a225cec34530c05c340f9ae894aa31

SHA1
d6553bc25b5bc40447184e9dd520dd7c88f5c2aa

SHA256
bddf98f152ff77575c277b91c8f7aa5f69973cd3bfe7aa55ebe61b7d3df17fab

SHA512
726f8a96e3dab9ec548bda81a01dc3e0d93afa2363c76c4bf639de4b0471f8a43a8e32e90b230b95639e82b7daa8da3e8d9c848755e2b58398aa48e46e5ba5b5

Download Submit
memory/2360-10-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2360-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-37-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-41-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-43-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-1238-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-4789-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-5258-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4560-20-0x00000000008D0000-0x00000000008EC000-memory.dmp

Filesize
112KB

Download
memory/4560-19-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

Filesize
4KB

Download