4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
Size

69KB
MD5

2feb676c5f153761ef3769e1d9747c6b
SHA1

41c88ca92198c8f54dc7b3c6af6bed0076561558
SHA256

4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc
SHA512

eb16f6cb4e89214df38cc30f37c9ca2361ebab150df3fd0be75eef52369d56dda3dce176fa1517817763967b179952068e34fe89043fedfea424c7e36cadb92c
SSDEEP

1536:8qGKFe+Zk7VJbwlYXjPrsqrZMYR5p8wZq9khDRGadegghOgmgk:85Ye+azbRPrlr9RXFI9k9dehhOgo

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2872	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
1692	Logo1_.exe
2844	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe

Loads dropped DLL 1 IoCs

pid	Process
2872	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Install\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	Logo1_.exe
File created	C:\Program Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
File created	C:\Windows\Logo1_.exe	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe
1692	Logo1_.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2136	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	30
PID 2828 wrote to memory of 2136	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	30
PID 2828 wrote to memory of 2136	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	30
PID 2828 wrote to memory of 2136	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	30
PID 2136 wrote to memory of 2836	2136	net.exe	32
PID 2136 wrote to memory of 2836	2136	net.exe	32
PID 2136 wrote to memory of 2836	2136	net.exe	32
PID 2136 wrote to memory of 2836	2136	net.exe	32
PID 2828 wrote to memory of 2872	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	33
PID 2828 wrote to memory of 2872	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	33
PID 2828 wrote to memory of 2872	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	33
PID 2828 wrote to memory of 2872	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	33
PID 2828 wrote to memory of 1692	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	35
PID 2828 wrote to memory of 1692	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	35
PID 2828 wrote to memory of 1692	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	35
PID 2828 wrote to memory of 1692	2828	4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe	35
PID 1692 wrote to memory of 1708	1692	Logo1_.exe	36
PID 1692 wrote to memory of 1708	1692	Logo1_.exe	36
PID 1692 wrote to memory of 1708	1692	Logo1_.exe	36
PID 1692 wrote to memory of 1708	1692	Logo1_.exe	36
PID 2872 wrote to memory of 2844	2872	cmd.exe	39
PID 2872 wrote to memory of 2844	2872	cmd.exe	39
PID 2872 wrote to memory of 2844	2872	cmd.exe	39
PID 2872 wrote to memory of 2844	2872	cmd.exe	39
PID 1708 wrote to memory of 2304	1708	net.exe	38
PID 1708 wrote to memory of 2304	1708	net.exe	38
PID 1708 wrote to memory of 2304	1708	net.exe	38
PID 1708 wrote to memory of 2304	1708	net.exe	38
PID 1692 wrote to memory of 536	1692	Logo1_.exe	40
PID 1692 wrote to memory of 536	1692	Logo1_.exe	40
PID 1692 wrote to memory of 536	1692	Logo1_.exe	40
PID 1692 wrote to memory of 536	1692	Logo1_.exe	40
PID 536 wrote to memory of 1012	536	net.exe	42
PID 536 wrote to memory of 1012	536	net.exe	42
PID 536 wrote to memory of 1012	536	net.exe	42
PID 536 wrote to memory of 1012	536	net.exe	42
PID 1692 wrote to memory of 1192	1692	Logo1_.exe	21
PID 1692 wrote to memory of 1192	1692	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
  "C:\Users\Admin\AppData\Local\Temp\4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a674B.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe
      "C:\Users\Admin\AppData\Local\Temp\4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe"
      4⤵
      Executes dropped EXE
      PID:2844
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:536
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
484KB

MD5
79d4fd1cb70f3844796aa1ea18a238e2

SHA1
78d207a7de2aeb85eefc185d894b0b7626e1e1f3

SHA256
ccaacc3965c1bdfce8cd1e934895a4563dddf082016e56846966c250bed87d5b

SHA512
7a0167cbce49f09ea39e490862b8c371eacf8ce3d74d6a6054e7f0e1df4b307019f5adee03603fcb9d4db2b17841cbc9cf129e9480d70b20c266fe82b3979b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a674B.bat

Filesize
722B

MD5
cebf1456b5e9116a3ebce155c2553ea9

SHA1
49ca2430d853728713e499687bb64a5253c295a4

SHA256
57a5bf680ef1e6ff58d4148f3654437838cc7846c36db27debd03a0bf052fd47

SHA512
ad8d6983952c86237eea0e2f73a8a2214950be23dfd87dda85c0b0af75aa75edf9f61cc9e61842b9302827d4a978721317becd8859a6ee3dd11efdf92166a8f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\4930e47c1bdf1e07c1693f1d61888d894c5b6dd2a362de4b1a87219bdeda3cbc.exe.exe

Filesize
29KB

MD5
0cac659cc68e68ed44223ddb7343275a

SHA1
cb75dd7034e31eb575668f7c69b7d990653c0248

SHA256
7c32fe8ec1851e273763a2742a67a1f9c09a3725c9eaec76e22fcfc92dda7c88

SHA512
1c0c3b170bed3a3cbd7821dfa008e776df675f620afe85905f84f7d86b68b487206af0c6acf8207ae346b8ae7deb71a756128cb5c199bf648952d2c582aa9023

Download Submit
C:\Windows\Logo1_.exe

Filesize
39KB

MD5
f5426c6a2885c53c2d5c827f28eb4906

SHA1
29f3d57f5f10d288fe190c14447b39ceed97c27b

SHA256
f23391169ad3906bdc57d7ed47696ab57cf8e83c33d11c2a230145ccee980236

SHA512
fffa2083d6dc26230b3febfc923b0e74c4a13bc87b6f933dfba8c9ea7f444d37eb5c1e14f7540e8b7106e4e60a7365da6dcc0388a80bbb72259d3ea397443fce

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2039016743-699959520-214465309-1000\_desktop.ini

Filesize
10B

MD5
dce9bef24921d1fb94c029be04b911db

SHA1
d5ff43d520d5df3ee58c947db0b2ac3a039667b6

SHA256
c09fceb912fc9cf0f284d9d24ab0029af67d3a3bf08b81d9c0d8a7681b82c157

SHA512
cefdb984819b6b058b8d7747c2a9a74c94f6acf2728e884520154f2ffe42776f19b5a5b22b43b61acbb679acefb8489318c7be92e360a3b239ffaae445d6d97b

Download Submit
memory/1192-28-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/1692-32-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1692-2246-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1692-4194-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2828-18-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2828-16-0x00000000002C0000-0x00000000002FD000-memory.dmp

Filesize
244KB

Download
memory/2828-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2828-12-0x00000000002C0000-0x00000000002FD000-memory.dmp

Filesize
244KB

Download