3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
Size

1.1MB
MD5

f4926ba34c279f8f111d959725a34d63
SHA1

9546c63e4a77640758391206dba5083bb532feb9
SHA256

3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be
SHA512

2e4c9d72609430e4955d8e089b726225f471572a182d0bc8a7b71269a783108d108968d5baff2d8a1e4c88ca36dd32401a665782f945685f4deca1b5a6311405
SSDEEP

24576:nBvf9AiKGpEoQpkN2C4McuKo0GTNJpyT5RGeQa0s:nBv+GtCi27mVHyT+a0s

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2716	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
2748	Logo1_.exe
2580	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe

Loads dropped DLL 1 IoCs

pid	Process
2716	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe
2748	Logo1_.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2860	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	30
PID 2644 wrote to memory of 2860	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	30
PID 2644 wrote to memory of 2860	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	30
PID 2644 wrote to memory of 2860	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	30
PID 2860 wrote to memory of 2652	2860	net.exe	32
PID 2860 wrote to memory of 2652	2860	net.exe	32
PID 2860 wrote to memory of 2652	2860	net.exe	32
PID 2860 wrote to memory of 2652	2860	net.exe	32
PID 2644 wrote to memory of 2716	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	33
PID 2644 wrote to memory of 2716	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	33
PID 2644 wrote to memory of 2716	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	33
PID 2644 wrote to memory of 2716	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	33
PID 2644 wrote to memory of 2748	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	35
PID 2644 wrote to memory of 2748	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	35
PID 2644 wrote to memory of 2748	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	35
PID 2644 wrote to memory of 2748	2644	3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe	35
PID 2748 wrote to memory of 2692	2748	Logo1_.exe	36
PID 2748 wrote to memory of 2692	2748	Logo1_.exe	36
PID 2748 wrote to memory of 2692	2748	Logo1_.exe	36
PID 2748 wrote to memory of 2692	2748	Logo1_.exe	36
PID 2692 wrote to memory of 2740	2692	net.exe	38
PID 2692 wrote to memory of 2740	2692	net.exe	38
PID 2692 wrote to memory of 2740	2692	net.exe	38
PID 2692 wrote to memory of 2740	2692	net.exe	38
PID 2716 wrote to memory of 2580	2716	cmd.exe	39
PID 2716 wrote to memory of 2580	2716	cmd.exe	39
PID 2716 wrote to memory of 2580	2716	cmd.exe	39
PID 2716 wrote to memory of 2580	2716	cmd.exe	39
PID 2748 wrote to memory of 2728	2748	Logo1_.exe	40
PID 2748 wrote to memory of 2728	2748	Logo1_.exe	40
PID 2748 wrote to memory of 2728	2748	Logo1_.exe	40
PID 2748 wrote to memory of 2728	2748	Logo1_.exe	40
PID 2728 wrote to memory of 2560	2728	net.exe	42
PID 2728 wrote to memory of 2560	2728	net.exe	42
PID 2728 wrote to memory of 2560	2728	net.exe	42
PID 2728 wrote to memory of 2560	2728	net.exe	42
PID 2748 wrote to memory of 1196	2748	Logo1_.exe	21
PID 2748 wrote to memory of 1196	2748	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
  "C:\Users\Admin\AppData\Local\Temp\3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a741.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe
      "C:\Users\Admin\AppData\Local\Temp\3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe"
      4⤵
      Executes dropped EXE
      PID:2580
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
2d5dc0e2365add6101339ca3601e4844

SHA1
27e0ae2b53f348cde2138b61ec8893ccb5e18842

SHA256
06d01bbe9ea2aa34904f77fc3582ce1c0624a44d09f3d71a2ef2a718065aa4c2

SHA512
5e54034137c3dc52282c69dcf1255c82d2ea8fab9fdca59b86f6fcd9d04cff08ee74c51cf844594fb27e7cbcb28450c0992bd9ee533b313b5bcaef63c9fbdc84

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
477KB

MD5
c32f3ae2a93a21a604cd493d86b40278

SHA1
4428387f1a1dd12ff5607459bcf4d89cd8ed80fe

SHA256
b84bbbbc007c88ca79ea94b2cf92e7a3093c8de3a8ce4b70b6f4d0a9480595a8

SHA512
5e7bb3318deebf7663fc4b9c3b20ce75986e32cbb27c34ec94fccf5affde4f0dd9e5dd0bef38510d088ec00b885dccafff09706a75fd927f882540ead7cc7965

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a741.bat

Filesize
721B

MD5
8e6cf288036d371905f33568596c7af1

SHA1
680396cec1e873182dac88158508b7831c096c7d

SHA256
64a551b538b72f5d58789edcef4d5cb062a95e2bdea12e3954d7ae8cf7bc92cc

SHA512
04752d1e86882988b2407af01039cac31fde58201acb6fd9be041da8051c2f5e8f5f56a9a71e12af69c39fd803affb7bc6c7b28b3b7074358b0f4fce92d877ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\3c4a7e22d5344ad877e69e97e99474cb4242d5fd1c2121dcd28056405a4181be.exe.exe

Filesize
1.1MB

MD5
09239e688ff75cd636ac932100b243f9

SHA1
2a7964c81b9a34bb77c4e3676e7d31b7d2668297

SHA256
a36ef4c18a08ee8d8c0d10d96ab37a0c3ce22a8f328733af8c0451579e4edcb1

SHA512
686708321d8756ddcfa2d1585ca7261be0ece33bd9d134888cdb4655b8484c727b34b4ac7f12d919184e85ab65088bc565549c262289cb64f9aeca0508290825

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
0fa99b8acf13f45b95bacb99fad6efef

SHA1
d6271ca22be5d6bbfba2ef4229dca71182d43892

SHA256
c41ba3c322874847191377fd1671808aff7f2aac06b0ad1a8d1e81679e498b01

SHA512
efdbb5b56a621d6bffe454cf860483a21a64d59ece212cbc42f45f6a2259f5afd99621b88253b8808af5429b7e67d69136dc5fa63b304389e3e2ac090495cc31

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\_desktop.ini

Filesize
9B

MD5
475984718232cf008bb73666d834f1f4

SHA1
12f23c9301c222f599a279e02a811d274d0f4abc

SHA256
a5b32591119f87eb3c8a00c0c39e26ea6d6414aa9887d85fcb4903e1c14921b5

SHA512
80235dc2560b7991d79f9550cdeca6ac02c00cee6bf186f8f20d4ff3fbd7718be937b73ab768d71c4027e153557b08bbfd95ea88d2e0857a7c70cf1da6fa9937

Download Submit
memory/1196-28-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/2644-18-0x0000000000230000-0x000000000026F000-memory.dmp

Filesize
252KB

Download
memory/2644-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2644-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2644-12-0x0000000000230000-0x000000000026F000-memory.dmp

Filesize
252KB

Download
memory/2748-31-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2748-3001-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2748-4154-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download