Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/12/2024, 06:04

General

  • Target

    data.exe

  • Size

    5.6MB

  • MD5

    d650ccbec4cef66b790c0adbd0c690ed

  • SHA1

    7c5323641a28170edb3121d9ad15d7bf643d801d

  • SHA256

    b8735a6c2caa10ed5e886a60be7f2a1edb55e5d26d60b24d24af5613a8a0e474

  • SHA512

    332dc8e1b3952ac3b3fbcfdf1634eaf9720d6bd85e6a1f0baef0f095c97a98d288f301b774c4d041c45ea8ea5ed8e52e8d786a874b8d0ce41dd5dd25a961b535

  • SSDEEP

    98304:6W1l27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Uc:6jOuK6mn9NzgMoYkSIvUcwti7TQlvciE

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=2024893777&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendMessage?chat_id=2024893777

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/getUpdates?offset=-

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=2024893777&caption=%F0%9F%93%B8Screenshot%20take

Signatures

  • Gurcu family
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\data.exe
    "C:\Users\Admin\AppData\Local\Temp\data.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3076
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpA865.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpA865.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:3356
        • C:\Windows\system32\tasklist.exe
          Tasklist /fi "PID eq 3076"
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2316
        • C:\Windows\system32\find.exe
          find ":"
          3⤵
            PID:3680
          • C:\Windows\system32\timeout.exe
            Timeout /T 1 /Nobreak
            3⤵
            • Delays execution with timeout.exe
            PID:2988
          • C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe
            "C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1908
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AdobeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe /f
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1312
              • C:\Windows\system32\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AdobeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe /f
                5⤵
                • Adds Run key to start application
                • Modifies registry key
                PID:1592

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

        Filesize

        1.7MB

        MD5

        65ccd6ecb99899083d43f7c24eb8f869

        SHA1

        27037a9470cc5ed177c0b6688495f3a51996a023

        SHA256

        aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

        SHA512

        533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

      • C:\Users\Admin\AppData\Local\Temp\tmpA865.tmp.bat

        Filesize

        269B

        MD5

        af89de9825f6d81c18d73d38a72bb231

        SHA1

        d39b6fa0d6922e4f57a329968fe8fa6017489789

        SHA256

        c95e32e14c84a184d960226450a979ee34b1683cbd977c22fd0817f405c5aafa

        SHA512

        4d240596f4fe6d8242946d0ae2422a17b36d6dd40642d173829c4a4b393dfa44ce7896128ff104dca05baaf1ee637b5cbdee777c49740f93a6733c82c2393cc4

      • C:\Users\Admin\AppData\Roaming\AdobeUpdater\conhost.exe

        Filesize

        5.6MB

        MD5

        d650ccbec4cef66b790c0adbd0c690ed

        SHA1

        7c5323641a28170edb3121d9ad15d7bf643d801d

        SHA256

        b8735a6c2caa10ed5e886a60be7f2a1edb55e5d26d60b24d24af5613a8a0e474

        SHA512

        332dc8e1b3952ac3b3fbcfdf1634eaf9720d6bd85e6a1f0baef0f095c97a98d288f301b774c4d041c45ea8ea5ed8e52e8d786a874b8d0ce41dd5dd25a961b535

      • C:\Users\Admin\Desktop\AddInstall.docx

        Filesize

        17KB

        MD5

        96a4f69dcd11797a9373f01bb9cbc093

        SHA1

        75f46ea7345ebb349801860e9f60d19d6aa51c20

        SHA256

        c968315a4bb2443b72d3ab314402926a21b7013a3db5b1b46b8f2f806b18fd95

        SHA512

        93fc13ad23d808500c77731518b37ed0858c108585fad3effc8e206d8c24b1f4ae36d82709879fa819127875554489f37dd73c274374a0fdb7d89b4d83a1a315

      • C:\Users\Admin\Desktop\CheckpointAdd.ico

        Filesize

        243KB

        MD5

        ee679e2e9c5092e52fb714da861fd933

        SHA1

        6cf9e449836a7d704079b7091f35bcc84bcf89c0

        SHA256

        a692328e547ee5c682e1f843e8434e4a681ab3b18a60de76ccd35d76087787dd

        SHA512

        f4ce5aacb23deeeba63c9471d7ace2e3285b64bfff9430b600e7f598560a65971d02bced866719562174fbb8edacd78c84fa96197c0765d63ca9818299b5ccf3

      • C:\Users\Admin\Desktop\ConfirmStop.xlsx

        Filesize

        10KB

        MD5

        d181cc1a4df3b03d3ec8cd1ea2e230fc

        SHA1

        f334f78096263e550ae281230e3e4aedb04b3b2c

        SHA256

        6546943246edfee255abf3aa15f038285b424186ee2f32cac3f8e350398b19f6

        SHA512

        5cb81dae8ee4234155af0a17629035b2220fc3c19022db0b4c89412d6f05271bf598e6a2e1b5630d5a0fcd1733dbeecc4e24a11734ad6be7d3606ce5a8ee40ff

      • C:\Users\Admin\Desktop\ConvertGet.edrwx

        Filesize

        190KB

        MD5

        35e717e5f8e1331d1470f798e6385a17

        SHA1

        d4398b0095cf8ddaf649a24c094e13edd8a465ac

        SHA256

        736cb42edf3187ce10ab1602ab2c583d8d08361a3c3a83a9c6aca48d66a7fb39

        SHA512

        c25d6eafa05cdf4a3f1a05ec15be001d84b7a87dc5563d0c0349039996d207e3de675305d7cd42207091968da4f63f7cb65d9276cf429c30e89d229e02789780

      • C:\Users\Admin\Desktop\ConvertToCompare.asx

        Filesize

        137KB

        MD5

        d7febecc75ecb5e17ebeecfc9eb8f2d4

        SHA1

        0f2282917198a041316ce6d03b37ebe135472664

        SHA256

        5512771ac21b196216cd13e9e12be562549dac0d625092cd10ade523841f95c3

        SHA512

        fa7d4f70715adfe718f2202730ab21c9d858059f21125bbdcb79a90dc653071799307452e6f565bb71dcc5a5e196388efb854919c3ab27ced720bc8c9c5bb143

      • C:\Users\Admin\Desktop\DismountUnblock.lnk

        Filesize

        285KB

        MD5

        a290fb6f175b0378c9cbbc172f4c3a8e

        SHA1

        f279ba725b13271c1d3144cbd0d92bc89dca8a39

        SHA256

        4231500f9e3a1760db583090dd76473aaef89bee3b9169712ef945876611fabb

        SHA512

        8cba72cd1ac52493b243b073bdd3918a00ec1ebf8fba62533642d141cb9cd382f1819596ede4a61069f9886894f898b185d640a60793f8e115de689f91d4d7ba

      • C:\Users\Admin\Desktop\ExitConnect.mpeg2

        Filesize

        126KB

        MD5

        4ab55c22f79ff10232a37c872438f467

        SHA1

        436053cba6019a105398068b97ac80df6633da7d

        SHA256

        aa9b36c782c7066dc83328fc4e1e4fe4840fed808489269511949f843ce058e8

        SHA512

        54c41f71db9b5ec2afbebac3253552030aae06f6d03101e4e6b6108ab463ef05f58788599b3360e8e8c0b6371b204e39cdd36873e575de0b43be96117efd0c7b

      • C:\Users\Admin\Desktop\ExitStep.xlsx

        Filesize

        10KB

        MD5

        1ba944e0e112763b10bb445c11c9e18b

        SHA1

        f777e787ae21e272e0d997a392a51be41fb2dcc3

        SHA256

        992e7d2aa2284d469158cb5d0a330aecc252455169f49f2023a07cdbf247ffdb

        SHA512

        14cd8066ba240af53145e062110ac7c92683dfd1f4b87ddae55b72a8ffe9d9e7437b6c7339214b48fac746aa7dc7aa1e4d9cc0a53462ae27cfbdc1c50aae2e09

      • C:\Users\Admin\Desktop\ExpandConvertFrom.xlsx

        Filesize

        10KB

        MD5

        2f8d9f863022b290d519481f95b50e5c

        SHA1

        5881dde68bd288ba7740bd126e00a3646ebd6bdd

        SHA256

        6caf91f831ee00702d3f1902d12a755e992c543d3bce098e3fcac3458feb0689

        SHA512

        55b49a4a0cf2ecb8f498c434ac163e4a623c4d3eefe40d93d62a6524fc6ff3aa6d7b62268ffa0c505077fcd261fedddf4ebae5b51f04f42c632fe80fdda58add

      • C:\Users\Admin\Desktop\LimitResolve.TS

        Filesize

        232KB

        MD5

        c7948a8f3fc06e4aae42252b55abbfc7

        SHA1

        b1fb60229c10fd0e4872d3a65ef8e16b6af9ef40

        SHA256

        3e3a3eda544d412b079026c90b604321ac4a2a3119b062a7b70dce8dd4ca5978

        SHA512

        28c5b810e4c194aa816d7f053d4d2377cae785a32f316ffc82828451b175d4fb7751d12ab57a423bb44ca418678d85c7b528d25cb8756601552a684c20be0d19

      • C:\Users\Admin\Desktop\LockCompare.docx

        Filesize

        14KB

        MD5

        d4ae4d84a68cef8850e558a075669411

        SHA1

        51b19dd4dc0beee75e5c40f2336ef4eb50df30c3

        SHA256

        21f50ad39c87842b95231e675beb7ba941b085b4e8529ddf951d0da07e517cf7

        SHA512

        3267a2eed3884bc6d1a611df9e686984954f05ed358cb2c86bb4ac48272653446c6c41835477c4852f490f40857ffe6cf49566d09b9c15cb36c07694fb524dd0

      • C:\Users\Admin\Desktop\MeasureUnlock.xlsx

        Filesize

        13KB

        MD5

        d1a280f0d5fdb77b73d9d66e2511cb5e

        SHA1

        ba23400ba7ff47043fb7210bf70eac565b48822b

        SHA256

        eef502124edd166a13036f9c322bd19a3f43ae5ed843acceca9cb385c79d6e22

        SHA512

        6661b23c568584f8b6a94b071fb33975ed48edcb9b830f33ca70d1914f760dd89359d95ec5a3ef88bcf58bdf9aad22f10f6549bd660d5159f5b168515811cf93

      • C:\Users\Admin\Desktop\MountSet.dwfx

        Filesize

        158KB

        MD5

        babca1eef25a09f6e017b9b6b8a05fe8

        SHA1

        8b8e1a5cc1e86a4ee859b334357890e0880cd2e4

        SHA256

        430ed7e600841f197fa87feadb41fad6fc419a3822a29c4131c6930718079485

        SHA512

        551f787be0d8fd6dcfc07e9985529eb08e2ec68520466d7f0ca5ec64ac20c5b2ae23c6b7fa22bfe630fe513b14be2961660bfcb66613f0519cb3cc452f8a7d19

      • C:\Users\Admin\Desktop\OpenWait.wps

        Filesize

        200KB

        MD5

        d29b8fa33fcd8ae149e516998cf15bfb

        SHA1

        f6b61d2df0d16faa28d47a1f4a3920dcbe84bd08

        SHA256

        334a71d32be737836cea70d016bbbd098b22fd6e8d020da4542363dace882e87

        SHA512

        af65105d4af0e59f95aec4d67dde90232ff1bf5a40c7f8f7495f10f3ecad121a2242ce6fed5168c367beb6f91d46c330eadf75fc61b451cc6b9d6c40eefa9abe

      • C:\Users\Admin\Desktop\OptimizeMove.zip

        Filesize

        306KB

        MD5

        e501145379a56a037c0da120cf0ebd2a

        SHA1

        edfcc9b06c36cf607edb146239d4b93b906b5092

        SHA256

        80e98e900971abe01d783be7d277ca0c2d7aad9e29443b702033d333cd97942a

        SHA512

        decb337371b04569d6a2202080f4a4cc7106315511613904692c675cff28d1842076356b762a9047c109f8226a15791ef55e5ec85c5650f8a63140dc0182b70b

      • C:\Users\Admin\Desktop\PingDismount.midi

        Filesize

        211KB

        MD5

        0c8daed22a3f6abaa1db5fc89a81266c

        SHA1

        aed77577ebd8ee22d2af4981bf397e4b7976c30d

        SHA256

        854e1f0a57974dae260a5c701c9f1d5ca369804bc53e6d2a407243a261158528

        SHA512

        1a1086ade6bde81ef53c7ff1b5cf8f7335d56a11ebd0c838686d56d92eff757e457be63de65c70ab692dd33114ef086e2de12564c3e808d39001b3db43809ebb

      • C:\Users\Admin\Desktop\ReadDismount.vb

        Filesize

        327KB

        MD5

        090c5c0225d0bad7825d9bdd1edce8dd

        SHA1

        65b793b4c8861b8795306d6ff0201a636ff8607f

        SHA256

        ebad7e060412eaff2dc634471ec4958bd569cbf9c5c2039b064f029336c7f166

        SHA512

        3d88b9218f02a8511923f4b436aac7d1174f38ef8334a92b93da1823de6f18f533d973b077220ecc1b725d0ff3cb65d61ab3fc2b32ed1f4e779ed99b5c1f23c5

      • C:\Users\Admin\Desktop\RemoveUse.DVR-MS

        Filesize

        222KB

        MD5

        22db2c61dd337028b9cb72b8293146c5

        SHA1

        ecd6327a520dcbfb6732cf4c9d4ed57bd102b9df

        SHA256

        7897debedb0572eab5efd6ec33b03676b8db33d621d8f7d3eb758641e81dde7e

        SHA512

        3c68b7046e04c872dbde3ba1b85f8bac3c00ffbfcd013984d2014fe4d5396ead6b3593a52567d0148a403abc5e61f951c5f1a2a704434a224aef454b2f6f5d2f

      • C:\Users\Admin\Desktop\ResolveInvoke.vsx

        Filesize

        253KB

        MD5

        abd888ff59b1ee152501ac914e90fca6

        SHA1

        88f644016070f1edfd5f98a15d1e2809429702e3

        SHA256

        51335acd05e9764c2b4abe763f598708df533b24d36924ae69224dc4f52d5111

        SHA512

        d11c3549a570f26af2ccfc77b5303173c2c51f6b6423935bb1627f8204b715dd36e70e174caa5b6ac8fbe8271e415d6bb14e76b42167f99e6fc26ea5b072fb10

      • C:\Users\Admin\Desktop\RestoreRead.fon

        Filesize

        169KB

        MD5

        f67cce436a982b87e980443dbad3b129

        SHA1

        c981eb809675803597e18e44f4eacb196fd0e025

        SHA256

        14d61477b836d7b28408e863e8046696d101f317de419bcb815a97f01dfdf022

        SHA512

        b58d5b737881c0ed133153a5d26e3298a5f26dc5b286b2ee178e30e297a7ede5634862ca9226814e0aaa1cace64e42cc65e3b98c04be409e5e626ef4945d62c1

      • C:\Users\Admin\Desktop\SaveResolve.xltm

        Filesize

        317KB

        MD5

        bd36f25606122af51d4baa3820e8498b

        SHA1

        23ac65e37b5883f481e3fd7487a7772937e194aa

        SHA256

        434aee9faf53bd9abaa37471fd1ecd07c3a0f34c97f6197fa5284f521de8d0cf

        SHA512

        3db5c1fcbf65d573243f85f0b9a493eb0cd88fa459cbda850750a4632b956df3d0486296793987758c5bfcdd29efa2be0c1eacdf0708518b43060ae2f66910cb

      • C:\Users\Admin\Desktop\SelectWatch.html

        Filesize

        148KB

        MD5

        c574bba1d40792b81f66ef08a59b1dc9

        SHA1

        9758eba07dba6d798ba8c3749fd96b2a21d4d6f9

        SHA256

        733f9fb74ff58e40e3d591a274bb0902485d63fb6223384cfc84c871f6211e72

        SHA512

        56b7656588a537ae7da98c21e36cf753bfb2f6fd12dd48075dbcb93ba530b8274a4a81eb2fa3e0236d8f25f471fa13d63f4b9eae456c2fe5329498c292c25c9a

      • C:\Users\Admin\Desktop\SkipConvert.ico

        Filesize

        264KB

        MD5

        65ae319be6881dc2159d120c88123a03

        SHA1

        49662af83b5bd1faf361c162805f943b4d94f925

        SHA256

        baecb20d086f248604275576e88f10e67b49c6fc47e2aca4885f73a0e5df982b

        SHA512

        ecc6152585d8c5f60603e527814496de8d59fb9574a6e3f99f22f398fb6c6e85f207c635ce6d665b133870c5c11c546bcfd03b1843765b056b5ca5f9b9690464

      • C:\Users\Admin\Desktop\SuspendOptimize.wdp

        Filesize

        455KB

        MD5

        035c1c1583ec37a3a1fca14621394ecb

        SHA1

        d8ae1a84b50ca058eeb6389ff183d7f3025567bb

        SHA256

        44399cca78753bad5af8e2c388509b1d4e1da4dffbff7fda73fb0f17ab76b961

        SHA512

        e2c53fc2dffe75b3d86f8e8a70f9cca62dbe152b651e3065f97f4a9e987bbfef64221b36d5fbf34771f3d36336f8b5c30fc84a2fe3f37050ab895b16e6ec7567

      • C:\Users\Admin\Desktop\SwitchDeny.xlsx

        Filesize

        9KB

        MD5

        11fe80065c20e47d7895622824bf47b9

        SHA1

        7b810c88574d7f39f07b875dae2646db53b82de6

        SHA256

        dc014f847f2d7f03650a659d724be285b165eaed2c4422d884c1fb32ec64f339

        SHA512

        94f5dd776aa4e504eb26969ae1871a1e7a25f9e64025a95e6d18de7a9707fb29f0eaf0a8abe2e30c37cc2aa5296c2407c5796b7632f3984320cf853c86ec87e0

      • C:\Users\Admin\Desktop\UndoWrite.m1v

        Filesize

        179KB

        MD5

        622c8970a455bb67339fd38181c9490f

        SHA1

        ab811a5d18d0c7f856b523cdbdb95d057039eb21

        SHA256

        965bb4968ec19ef2a031b4db2947ead2d826f8512c94983d31c614a2e42383fa

        SHA512

        fbc532f1b255dd0f4b6d6f719ed354aa63f9b455f2ec7d91faea77da174433888f82c70c7e6c9a1d48ef4554dfbf3ed0b4cc52772b669b7abdd5a24df5f45863

      • C:\Users\Admin\Desktop\UninstallFind.cmd

        Filesize

        116KB

        MD5

        73232b9b43b1884704ed835e0d55b28a

        SHA1

        165eacbfbdde38ead412cfd31aebb05782363269

        SHA256

        a2cd7b94a68d48918a16c9f138b13c722dfeac1385d067fe30036648c51f5dc7

        SHA512

        18264dcb731f2c7bd44004fe51328ed889c722f77aa8e97c4bcd6c5fd58cc56e19713d7d6726c3ba3c7148f187e797a0b4daceae40a8bf25044700fa683bde39

      • C:\Users\Admin\Desktop\UnpublishUnblock.mpeg2

        Filesize

        275KB

        MD5

        d6256889aa843c1daac38c0992aba015

        SHA1

        137ae429ecaac90d8bae8a2f13729f6fdfd7ea5b

        SHA256

        4f446411202928b5372c178ea53bcf9c97767f93d077a30b83d7cb4e32b08a93

        SHA512

        af4f56059f36db69275f7ca7c9d16ac5fb08ce45394598022dccf9a9e6073fa968fc54b548aaa0e94e9fd6184083a5d381ff4fc5f79a501f176151beac49f501

      • C:\Users\Admin\Desktop\UnregisterBlock.otf

        Filesize

        296KB

        MD5

        d4fe9823e4f765c6dd10a723f4bb1ed5

        SHA1

        528e7038e41579b2f182f394272f410bdb0d0fca

        SHA256

        e1c6d8c0a7fda3cbe24c41dfe285286b92213b4dd141bfdbd28a303f5dcfcd57

        SHA512

        1684647d4bb05482efdc9e3e8f4fcee364339549baed92d9d185fa5d2c8d3cc1885f560c22690b4b652419cfaa39f3f9d001a926f8f3a64e5d5c0ba09fa84386

      • C:\Users\Public\Desktop\Acrobat Reader DC.lnk

        Filesize

        2KB

        MD5

        10745b20e7e9355b0eee19e7da2ecc5e

        SHA1

        20d67e6edc29bd1751c597982c09cc501aed5f17

        SHA256

        d7a6d1cff01c08a690af05a360e5c89cf13e4ae9702fa3d5682ff1cfde51a76d

        SHA512

        72e26dc1f0a844424110cfc509fbe3e710f4fcc75e257a0676ef021c23b81672c82d302d36e699406a5a2342fcf5aeffc34e3f7c2b3f9cfb1b48ec450d5d37ec

      • C:\Users\Public\Desktop\Firefox.lnk

        Filesize

        1000B

        MD5

        8aae4c0a55153f0eaba4c84a7358dbd5

        SHA1

        95f72b5704be50b15e2fa51c551066c918b680fc

        SHA256

        67af6b489216de8b721cadf6af6827797038e12842657f169761ea1006fcd050

        SHA512

        69ec275c473ec65757356eb630c146b1ffe6deb7a3893232286b2837fc1e3403564e520e231ed2c4690cdcbdf82a15d9d511d66e888d053be65f9331363d678b

      • C:\Users\Public\Desktop\Google Chrome.lnk

        Filesize

        2KB

        MD5

        35372101637f4dc7c7a1be117e22bd93

        SHA1

        3bd377e1f6dc7b0353f444300ca4d50f55e1ef49

        SHA256

        6e66ef5d3046b5c665d70d503fc2ef46df0915391d923083af2b8ab707f1ee01

        SHA512

        4b032fa969a0d3b3ffe0692c56c3ccd21a21557b26e013a2501d8d00b491a84e92cabf952dd34b2bcd8343a79623a5e8f07d54f74098cc6fcdb548549db0efb5

      • C:\Users\Public\Desktop\Microsoft Edge.lnk

        Filesize

        2KB

        MD5

        d675712966536298792caeba0091cf53

        SHA1

        1dc5e294425f38c018bbdeef6c37ed5418fa0cab

        SHA256

        9abbfe2aa01eaa2647ddc86fc74ebab6a5309526cf5feb0c25f82c206b226085

        SHA512

        802c963a35ec8d93dda55bbbd5c8a696e987fe34a1a259b3e0b5d2bfdd051dc63605f9ca8a4fceebe9f7b0f2a403b64af99d34c0f90808c9c4252f38e1fc3dac

      • C:\Users\Public\Desktop\VLC media player.lnk

        Filesize

        923B

        MD5

        d9150fdfffd31af3f2ff3a7dcc000d10

        SHA1

        02c717b778b01e47b793670833ed716698f3e416

        SHA256

        658afd099f71932ba212b98b136a399f9fcabfb6d3221a03b5010a3da053759f

        SHA512

        9e255b21a4d64f6afc45764767207593688ce73c064a19d9e89351db439f9da914923039cdff0c4fe5a97cd6cf7f8b3a3a8cfcf892f244df917408b5bec1ba27

      • memory/1908-23-0x0000024BFC4F0000-0x0000024BFC540000-memory.dmp

        Filesize

        320KB

      • memory/1908-22-0x0000024BFC3F0000-0x0000024BFC4A2000-memory.dmp

        Filesize

        712KB

      • memory/1908-24-0x0000024BFC540000-0x0000024BFC562000-memory.dmp

        Filesize

        136KB

      • memory/1908-26-0x0000024BFC5B0000-0x0000024BFC5EA000-memory.dmp

        Filesize

        232KB

      • memory/1908-47-0x0000024BFC610000-0x0000024BFC622000-memory.dmp

        Filesize

        72KB

      • memory/1908-20-0x0000024BFC380000-0x0000024BFC3EA000-memory.dmp

        Filesize

        424KB

      • memory/1908-27-0x0000024BFC570000-0x0000024BFC596000-memory.dmp

        Filesize

        152KB

      • memory/1908-28-0x0000024BFD240000-0x0000024BFD56E000-memory.dmp

        Filesize

        3.2MB

      • memory/3076-0-0x00007FF814CB3000-0x00007FF814CB5000-memory.dmp

        Filesize

        8KB

      • memory/3076-1-0x0000020444880000-0x0000020444E22000-memory.dmp

        Filesize

        5.6MB

      • memory/3076-6-0x000002045F350000-0x000002045F3C6000-memory.dmp

        Filesize

        472KB

      • memory/3076-7-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

        Filesize

        10.8MB

      • memory/3076-8-0x0000020446A10000-0x0000020446A2E000-memory.dmp

        Filesize

        120KB

      • memory/3076-9-0x0000020446A40000-0x0000020446A4A000-memory.dmp

        Filesize

        40KB

      • memory/3076-13-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

        Filesize

        10.8MB