b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
Size

963KB
MD5

05856185e19e9591005fbc3b1b71c064
SHA1

fb53f199268d0cb1a9dd2b0358062dcd33a46928
SHA256

b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226
SHA512

14559d721cedbd62473dabb7c0117fb12199cc22f71f3e2f9497621e50b0e15cc0a49254aa64f8be7a1c3f25e5628c23a2ca04d33a610dd35dd760da18ca86a1
SSDEEP

12288:v+aWRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:vBPBpDRmi78gkPXlyo0G/jr

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2580	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2980	Logo1_.exe
2612	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe

Loads dropped DLL 2 IoCs

pid	Process
2580	cmd.exe
2580	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\management\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Journal\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
File created	C:\Windows\Logo1_.exe	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe
2980	Logo1_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2612	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
Token: 35	2612	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2884	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	30
PID 2792 wrote to memory of 2884	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	30
PID 2792 wrote to memory of 2884	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	30
PID 2792 wrote to memory of 2884	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	30
PID 2884 wrote to memory of 2824	2884	net.exe	32
PID 2884 wrote to memory of 2824	2884	net.exe	32
PID 2884 wrote to memory of 2824	2884	net.exe	32
PID 2884 wrote to memory of 2824	2884	net.exe	32
PID 2792 wrote to memory of 2580	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	33
PID 2792 wrote to memory of 2580	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	33
PID 2792 wrote to memory of 2580	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	33
PID 2792 wrote to memory of 2580	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	33
PID 2792 wrote to memory of 2980	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	35
PID 2792 wrote to memory of 2980	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	35
PID 2792 wrote to memory of 2980	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	35
PID 2792 wrote to memory of 2980	2792	b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe	35
PID 2980 wrote to memory of 1904	2980	Logo1_.exe	36
PID 2980 wrote to memory of 1904	2980	Logo1_.exe	36
PID 2980 wrote to memory of 1904	2980	Logo1_.exe	36
PID 2980 wrote to memory of 1904	2980	Logo1_.exe	36
PID 1904 wrote to memory of 2592	1904	net.exe	38
PID 1904 wrote to memory of 2592	1904	net.exe	38
PID 1904 wrote to memory of 2592	1904	net.exe	38
PID 1904 wrote to memory of 2592	1904	net.exe	38
PID 2580 wrote to memory of 2612	2580	cmd.exe	39
PID 2580 wrote to memory of 2612	2580	cmd.exe	39
PID 2580 wrote to memory of 2612	2580	cmd.exe	39
PID 2580 wrote to memory of 2612	2580	cmd.exe	39
PID 2980 wrote to memory of 2864	2980	Logo1_.exe	40
PID 2980 wrote to memory of 2864	2980	Logo1_.exe	40
PID 2980 wrote to memory of 2864	2980	Logo1_.exe	40
PID 2980 wrote to memory of 2864	2980	Logo1_.exe	40
PID 2864 wrote to memory of 3068	2864	net.exe	42
PID 2864 wrote to memory of 3068	2864	net.exe	42
PID 2864 wrote to memory of 3068	2864	net.exe	42
PID 2864 wrote to memory of 3068	2864	net.exe	42
PID 2980 wrote to memory of 1180	2980	Logo1_.exe	21
PID 2980 wrote to memory of 1180	2980	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1180
- C:\Users\Admin\AppData\Local\Temp\b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
  "C:\Users\Admin\AppData\Local\Temp\b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aF622.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe
      "C:\Users\Admin\AppData\Local\Temp\b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1904
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
73e7e4d64d7a01f7e8df598641540111

SHA1
8104ed53131db904b94106abb83ffcb9693dffbc

SHA256
335e21eff92c60c2aaad42dbca6076e20ac1de9d8ed5fab0ccec6775a668270c

SHA512
839540049b9d4eb31d9681a1cda73e6d5f4c608c27e1efaead55dc80fde9963d473bce2ca8f72a7e753042c1fe60934af9fe7b1c1c40fd864c5bc7e9ce8d2598

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
cca83bbf5782b69f2b55fb941c4d5b14

SHA1
db61bf16b63cf2f336089100add5e608eba10614

SHA256
462539b52a7f88960d280083fc7b25639e97e860b329c7ebd3ed356254a0079a

SHA512
a0833fdc5a6611f8b81b0265da1d6802245535c3246342252c3bba3680c9b3f0a0c916ba02b3ab26faaa5c4db1c88a8d9ba9e4bebd4be06de095c82adc857e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aF622.bat

Filesize
722B

MD5
5f3c1618d7a6627070d4a10d6f8f9891

SHA1
f134985fca1607470f579b9d6d807dcfff8a7a28

SHA256
cb64582264a5928be365b00445ec4603eda8839f6c65ff8f861a24042131c18b

SHA512
d160fb7cf00cc2fafb179403f8a84e801954af72a28b70ae71faadc3ff3c6e0bfef6262f7f14f181b7634e0d68d52acfcca86e1db61243ef0883f61f2072e254

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6227408df6a45bb24ae89b2cbf4aa6e387334a612532ce80828dd150f104226.exe.exe

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
7e619692b53866243cf3f4bcd669d555

SHA1
5a8429b110acd43c0ddb3f101eac0bf55afb402b

SHA256
d33a86247c1731fc2f4acd320bd281542e708ae43ffdb05ee62a89f50bf034ff

SHA512
e7d65a2f4fa9e54b2f3445cc3c51d2e442e42ea1132b77c8fe0abf67052eb75a32414e02b10cd172e62b84996898c7dffa1e88496a1b5441dd3fb5059a320421

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\_desktop.ini

Filesize
8B

MD5
5894100cc85ef83f995c15a4d7fce813

SHA1
55d61ce36a76e549348eff08abae3e32e96b8123

SHA256
4912abab5bf4a890230f6c060bcae7827f96d9ffcf6025852967b53a65fc315d

SHA512
248346b25ea49cbaaa8bbd25f2fb26ad59c3f1ba650efd4e9eda9b32d1e918292bab3e5f1b19d92543d416cfe9d8a0b49d09f1eebcdca085a031e8238d461655

Download Submit
memory/1180-29-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2792-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2792-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2792-16-0x00000000002B0000-0x00000000002EF000-memory.dmp

Filesize
252KB

Download
memory/2980-32-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2980-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2980-3001-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2980-4190-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download