043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
Size

164KB
MD5

05d3c6e1c2726cfa659f044cc6c3f232
SHA1

b82f957011ea799358735b7c4422188a03d0a09f
SHA256

043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf
SHA512

68cf693d6b60afe565b38a5b117d00e2bd4977a2b11226a737f202d000a75b56657360f21985dd087de4536df0330b65121d5417f3d7c409755ad38b2df3b2a7
SSDEEP

3072:xHe+aX38yas99djmMGWBgh1002J8emEu3T7TO+9Z9sTOVrZzxVxU:c+aX38KYWBW1Wu3rOOuOVr8

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2912	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 3 IoCs

pid	Process
2604	Logo1_.exe
2612	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
1260	Explorer.EXE

Loads dropped DLL 2 IoCs

pid	Process
2912	cmd.exe
1260	Explorer.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Offline\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\PROOF\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe
2604	Logo1_.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2612	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
2612	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2796	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	30
PID 2728 wrote to memory of 2796	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	30
PID 2728 wrote to memory of 2796	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	30
PID 2728 wrote to memory of 2796	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	30
PID 2796 wrote to memory of 2780	2796	net.exe	32
PID 2796 wrote to memory of 2780	2796	net.exe	32
PID 2796 wrote to memory of 2780	2796	net.exe	32
PID 2796 wrote to memory of 2780	2796	net.exe	32
PID 2728 wrote to memory of 2912	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	33
PID 2728 wrote to memory of 2912	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	33
PID 2728 wrote to memory of 2912	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	33
PID 2728 wrote to memory of 2912	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	33
PID 2728 wrote to memory of 2604	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	35
PID 2728 wrote to memory of 2604	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	35
PID 2728 wrote to memory of 2604	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	35
PID 2728 wrote to memory of 2604	2728	043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe	35
PID 2604 wrote to memory of 2580	2604	Logo1_.exe	36
PID 2604 wrote to memory of 2580	2604	Logo1_.exe	36
PID 2604 wrote to memory of 2580	2604	Logo1_.exe	36
PID 2604 wrote to memory of 2580	2604	Logo1_.exe	36
PID 2912 wrote to memory of 2612	2912	cmd.exe	38
PID 2912 wrote to memory of 2612	2912	cmd.exe	38
PID 2912 wrote to memory of 2612	2912	cmd.exe	38
PID 2912 wrote to memory of 2612	2912	cmd.exe	38
PID 2580 wrote to memory of 2660	2580	net.exe	39
PID 2580 wrote to memory of 2660	2580	net.exe	39
PID 2580 wrote to memory of 2660	2580	net.exe	39
PID 2580 wrote to memory of 2660	2580	net.exe	39
PID 2604 wrote to memory of 3036	2604	Logo1_.exe	40
PID 2604 wrote to memory of 3036	2604	Logo1_.exe	40
PID 2604 wrote to memory of 3036	2604	Logo1_.exe	40
PID 2604 wrote to memory of 3036	2604	Logo1_.exe	40
PID 3036 wrote to memory of 740	3036	net.exe	42
PID 3036 wrote to memory of 740	3036	net.exe	42
PID 3036 wrote to memory of 740	3036	net.exe	42
PID 3036 wrote to memory of 740	3036	net.exe	42
PID 2604 wrote to memory of 1260	2604	Logo1_.exe	21
PID 2604 wrote to memory of 1260	2604	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260
- C:\Users\Admin\AppData\Local\Temp\043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
  "C:\Users\Admin\AppData\Local\Temp\043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a3C26.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe
      "C:\Users\Admin\AppData\Local\Temp\043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2612
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
946ef88164c84cf4afd633befc8327ac

SHA1
534a32a75e4f01757deecb2ff6d1631d6d5f830f

SHA256
b3725df35745187cb73641ee87c19ded286e57b0ef98d81aff4b3b7ecf497a4e

SHA512
79f937e4fcb88d5b73db3525f3384a22e4850a70aa4a23487962d7b27965c0c3a770f46b9e8af4ef2613cc15fc4077111d4aaac9dc834d0484798aa33c545af9

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
aca7c167ac0b287aaf64c7a0e90b55ea

SHA1
5e79edea9c86fe70af0e337f05fb2a221b238294

SHA256
adcd795e674078d9209b99d472cb4930c17d650a7606fcd490950a699c69751f

SHA512
f6e9d12d5043d8e1eae307dbe2bb1486d17be4b34fed500b2b4199d8fd644d7b66b5cc354ddd3d63fc0c1b6250e972a0fd514ce14604668a4f46a16046bce974

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a3C26.bat

Filesize
722B

MD5
c2bb18f5d90aaaa5edfeb2f93a050ba1

SHA1
5573615f21189a32e9af858232b66a410fed1a11

SHA256
f3038a9df9f100736335d4f760b3d1fc6f45c1d69f69ef99ebec2aa1afcd290c

SHA512
1271576ccc0dacd66800305043e03518c7b3fa897428de5dbe1ab7ff29c5de6ebdde7602dc160b542e15bf1258c996af987d4c547c61d4ff211313a368bd9364

Download Submit
C:\Users\Admin\AppData\Local\Temp\043824e73122c345e4081841e81d64ada72700e8f95549eb4b0ae0a07ee0d8cf.exe.exe

Filesize
131KB

MD5
16438a96a8adb85472ca72da04701b29

SHA1
b1f5ee8bc083804de4de820255107f6541c84735

SHA256
9291cd97d2f1b119438f16e97ea75119f19fd959ec5414e84b337530d692e289

SHA512
58f659a29cb34245a261b7666b1cda4b76f2df1039f3713dda6ff5a97c33b4cc273b110d10b4131a6a5c13897efcfa9a5ef3031e0e5fb14db1adc0ac1ef25dcd

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
fac489180a927456fde29aa70b6c863c

SHA1
b7638615678d7137f7c9a8ab01952fd6266730d0

SHA256
e888702980111bdea63056293f56946432701aac652c474a5f8614a137e021d7

SHA512
cbe953def68f48b32003143d8980b0443c46373395d31ceab62192cb0d2a97d45428e950f54f03b507b9e39b12770c9701e2b5de6e1fda1ce763a9aede7e6682

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\_desktop.ini

Filesize
9B

MD5
5412111268dd2c1fb1cf8697bfab9b6c

SHA1
16d0b289e83c74cb50a004edd7c5750ac706f321

SHA256
f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc

SHA512
13fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf

Download Submit
memory/1260-31-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2604-946-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2604-34-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2604-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2604-3352-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2604-7575-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2604-9330-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2612-25-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2612-36-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2728-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2728-17-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2728-15-0x00000000003C0000-0x00000000003FF000-memory.dmp

Filesize
252KB

Download