2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
Size

491KB
MD5

65dd19564cf8d9136999784be998dffc
SHA1

923b2520746c20ba98d0c47d273cb52a1c76a59c
SHA256

2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d
SHA512

7a1bd7162258a2c4d49569f2134242b9e271b9a53962c3954988925d777a5f05bb64fe59d727c4169403c32e3279b9bfb2d1871db85c21c3348a38f65245752e
SSDEEP

12288:J21quIf1gL5pRTcAkS/3hzN8qE43fm78V:s1q45jcAkSYqyE

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2656	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2664	Logo1_.exe
2536	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe

Loads dropped DLL 1 IoCs

pid	Process
2656	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_CN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe
2664	Logo1_.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2640	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	30
PID 2060 wrote to memory of 2640	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	30
PID 2060 wrote to memory of 2640	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	30
PID 2060 wrote to memory of 2640	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	30
PID 2640 wrote to memory of 2736	2640	net.exe	32
PID 2640 wrote to memory of 2736	2640	net.exe	32
PID 2640 wrote to memory of 2736	2640	net.exe	32
PID 2640 wrote to memory of 2736	2640	net.exe	32
PID 2060 wrote to memory of 2656	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	33
PID 2060 wrote to memory of 2656	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	33
PID 2060 wrote to memory of 2656	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	33
PID 2060 wrote to memory of 2656	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	33
PID 2060 wrote to memory of 2664	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	35
PID 2060 wrote to memory of 2664	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	35
PID 2060 wrote to memory of 2664	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	35
PID 2060 wrote to memory of 2664	2060	2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe	35
PID 2664 wrote to memory of 2568	2664	Logo1_.exe	36
PID 2664 wrote to memory of 2568	2664	Logo1_.exe	36
PID 2664 wrote to memory of 2568	2664	Logo1_.exe	36
PID 2664 wrote to memory of 2568	2664	Logo1_.exe	36
PID 2568 wrote to memory of 2836	2568	net.exe	38
PID 2568 wrote to memory of 2836	2568	net.exe	38
PID 2568 wrote to memory of 2836	2568	net.exe	38
PID 2568 wrote to memory of 2836	2568	net.exe	38
PID 2656 wrote to memory of 2536	2656	cmd.exe	39
PID 2656 wrote to memory of 2536	2656	cmd.exe	39
PID 2656 wrote to memory of 2536	2656	cmd.exe	39
PID 2656 wrote to memory of 2536	2656	cmd.exe	39
PID 2664 wrote to memory of 2584	2664	Logo1_.exe	40
PID 2664 wrote to memory of 2584	2664	Logo1_.exe	40
PID 2664 wrote to memory of 2584	2664	Logo1_.exe	40
PID 2664 wrote to memory of 2584	2664	Logo1_.exe	40
PID 2584 wrote to memory of 3016	2584	net.exe	42
PID 2584 wrote to memory of 3016	2584	net.exe	42
PID 2584 wrote to memory of 3016	2584	net.exe	42
PID 2584 wrote to memory of 3016	2584	net.exe	42
PID 2664 wrote to memory of 1184	2664	Logo1_.exe	21
PID 2664 wrote to memory of 1184	2664	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
  "C:\Users\Admin\AppData\Local\Temp\2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aFBBD.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe
      "C:\Users\Admin\AppData\Local\Temp\2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe"
      4⤵
      Executes dropped EXE
      PID:2536
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2836
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
36ee61e120a8032f3502a9507973f37a

SHA1
2346447ef1958bd451ac3317f2343658598b9e78

SHA256
c26722adbb67a45285fcb049fd55346dd71c54e9b6d4fffaf4fa1ea08473f3a8

SHA512
8de97fd486a0f75de854d5a1d5aa0864a358755fd513a660fa3956c94b68c9b90557bf66db7015d10a6ae90e5bf4e5d1f63b7297917574af1580d24120e2bcea

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aFBBD.bat

Filesize
722B

MD5
320236aafcd20daad50dd9f8de9223ee

SHA1
d32d111b218fe00f00aeb383f3a9cc3a6ceafdc9

SHA256
78a173a9cf61b57883963ee0f0e3aa4bad12a5fcae0907f6fa0c5fbda32c3d82

SHA512
fa97990ee5b6852e051c18cd71944afc55a1a485667ea38cb4fed7a661ae116a5690c5c165ec571cb24af9ad020047577673a692d52756be18d23488f76bcb7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2b992dbb3e1520f201b49cad00f0b44d3e3824a09d4e15cce81e9a2b4362b72d.exe.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
d9f4f8b3dccefdc485c02f1f0952a7bf

SHA1
fbc2711d2f6a163d04d61f501d5f80e79bb5da94

SHA256
c0ac58af88165336a655cc0a6353e2824cac0f5731d4458b50fce9a6266f891c

SHA512
cf4d794c9c21abda4cf00f11804bff10d1214e15c161aa8ab8821d32bb282f471db0f51e3a9e492d99315e4ff9e9f4cdeb0b8037bf357564d7ca269154dd2165

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\_desktop.ini

Filesize
9B

MD5
b7beb43f344015405dc34dab081d8434

SHA1
f194ae965145f76e4825c67337ef69da96f3954f

SHA256
d069f2206a0ca683611b357b347af3abd4c559602b5617591232512e6c0e1b02

SHA512
ee85ee5a36f6fe3381a853d2e0a0209e3d83271f29a9f980d1cbfb0309430f26b2658eedc501c0639d0dd6c929b093b8f9bf1e1a3ff1179e581fc07ae635a678

Download Submit
memory/1184-27-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/2060-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2060-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2664-18-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2664-31-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2664-3302-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2664-4153-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download