remcos | cafc1506bb64c57cf27985a99d3f5cf2e22fdd3305a76ce4a10ea8cb1bf81c41

Analysis

max time kernel
299s
max time network
304s
platform
windows7_x64
resource
win7-20241010-es
resource tags

arch:x64arch:x86image:win7-20241010-eslocale:es-esos:windows7-x64systemwindows
submitted
09-12-2024 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

formulario_agendamiento_citas.zip
Size

7.0MB
MD5

b3d078f52643fa3fb774af59ae6973ee
SHA1

038fa27457912ce1cabc9e09e69b44de01b1b6bd
SHA256

cafc1506bb64c57cf27985a99d3f5cf2e22fdd3305a76ce4a10ea8cb1bf81c41
SHA512

7a0c50958b0bb8eba2af07b1e96645ac5ea503e69c38c62006bff10b7957295bac156a092ef43a0c2e628ecb5b1bd80396370534519e2fc5bded94daa81ce51f
SSDEEP

196608:CRvG2kSHzhFB5kmJJyV2eL8HBpfIC5CFPZ:HNELrkmJlGsACMx

Score

10^/10

remcos diciembre 05 muchacha discovery rat

Malware Config

Extracted

Family

remcos

Botnet

DICIEMBRE 05 MUCHACHA

imaxatmonk.imaxatmonk.com:2204

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Acobatlg.exe
copy_folder
edqelofh
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
pixlrfla
mouse_option
false
mutex
increarltda-GIGCIT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Executes dropped EXE 2 IoCs

pid	Process
952	EASteamProxy.exe
1636	EASteamProxy.exe

Loads dropped DLL 23 IoCs

pid	Process
1732	msiexec.exe
952	EASteamProxy.exe
952	EASteamProxy.exe
952	EASteamProxy.exe
952	EASteamProxy.exe
952	EASteamProxy.exe
952	EASteamProxy.exe
952	EASteamProxy.exe
952	EASteamProxy.exe
952	EASteamProxy.exe
952	EASteamProxy.exe
1636	EASteamProxy.exe
1636	EASteamProxy.exe
1636	EASteamProxy.exe
1636	EASteamProxy.exe
1636	EASteamProxy.exe
1636	EASteamProxy.exe
1636	EASteamProxy.exe
1636	EASteamProxy.exe
1636	EASteamProxy.exe
2456	cmd.exe
2456	cmd.exe
1600	sw_ultra.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF	DrvInst.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 2456	1636	EASteamProxy.exe	44

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f79a6ab.msi	msiexec.exe
File created	C:\Windows\Installer\f79a6ac.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f79a6ac.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\volsnap.PNF	DrvInst.exe
File opened for modification	C:\Windows\Installer\f79a6ab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA94A.tmp	msiexec.exe
File created	C:\Windows\Installer\f79a6ae.msi	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sw_ultra.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF\LanguageList = 650073002d0045005300000065007300000065006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1732	msiexec.exe
1732	msiexec.exe
952	EASteamProxy.exe
1636	EASteamProxy.exe
1636	EASteamProxy.exe
2456	cmd.exe
2456	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2000	7zFM.exe
1600	sw_ultra.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1636	EASteamProxy.exe
2456	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2000	7zFM.exe
Token: 35	2000	7zFM.exe
Token: SeSecurityPrivilege	2000	7zFM.exe
Token: SeSecurityPrivilege	2000	7zFM.exe
Token: SeShutdownPrivilege	2732	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2732	msiexec.exe
Token: SeSecurityPrivilege	2000	7zFM.exe
Token: SeShutdownPrivilege	1684	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeSecurityPrivilege	1732	msiexec.exe
Token: SeCreateTokenPrivilege	1684	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1684	msiexec.exe
Token: SeLockMemoryPrivilege	1684	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1684	msiexec.exe
Token: SeMachineAccountPrivilege	1684	msiexec.exe
Token: SeTcbPrivilege	1684	msiexec.exe
Token: SeSecurityPrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeLoadDriverPrivilege	1684	msiexec.exe
Token: SeSystemProfilePrivilege	1684	msiexec.exe
Token: SeSystemtimePrivilege	1684	msiexec.exe
Token: SeProfSingleProcessPrivilege	1684	msiexec.exe
Token: SeIncBasePriorityPrivilege	1684	msiexec.exe
Token: SeCreatePagefilePrivilege	1684	msiexec.exe
Token: SeCreatePermanentPrivilege	1684	msiexec.exe
Token: SeBackupPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeShutdownPrivilege	1684	msiexec.exe
Token: SeDebugPrivilege	1684	msiexec.exe
Token: SeAuditPrivilege	1684	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1684	msiexec.exe
Token: SeChangeNotifyPrivilege	1684	msiexec.exe
Token: SeRemoteShutdownPrivilege	1684	msiexec.exe
Token: SeUndockPrivilege	1684	msiexec.exe
Token: SeSyncAgentPrivilege	1684	msiexec.exe
Token: SeEnableDelegationPrivilege	1684	msiexec.exe
Token: SeManageVolumePrivilege	1684	msiexec.exe
Token: SeImpersonatePrivilege	1684	msiexec.exe
Token: SeCreateGlobalPrivilege	1684	msiexec.exe
Token: SeBackupPrivilege	1136	vssvc.exe
Token: SeRestorePrivilege	1136	vssvc.exe
Token: SeAuditPrivilege	1136	vssvc.exe
Token: SeBackupPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	2440	DrvInst.exe
Token: SeRestorePrivilege	2440	DrvInst.exe
Token: SeRestorePrivilege	2440	DrvInst.exe
Token: SeRestorePrivilege	2440	DrvInst.exe
Token: SeRestorePrivilege	2440	DrvInst.exe
Token: SeRestorePrivilege	2440	DrvInst.exe
Token: SeRestorePrivilege	2440	DrvInst.exe
Token: SeLoadDriverPrivilege	2440	DrvInst.exe
Token: SeLoadDriverPrivilege	2440	DrvInst.exe
Token: SeLoadDriverPrivilege	2440	DrvInst.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2000	7zFM.exe
2000	7zFM.exe
2000	7zFM.exe
2732	msiexec.exe
2732	msiexec.exe
2000	7zFM.exe
1684	msiexec.exe
1684	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1600	sw_ultra.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 952	1732	msiexec.exe	42
PID 1732 wrote to memory of 952	1732	msiexec.exe	42
PID 1732 wrote to memory of 952	1732	msiexec.exe	42
PID 952 wrote to memory of 1636	952	EASteamProxy.exe	43
PID 952 wrote to memory of 1636	952	EASteamProxy.exe	43
PID 952 wrote to memory of 1636	952	EASteamProxy.exe	43
PID 1636 wrote to memory of 2456	1636	EASteamProxy.exe	44
PID 1636 wrote to memory of 2456	1636	EASteamProxy.exe	44
PID 1636 wrote to memory of 2456	1636	EASteamProxy.exe	44
PID 1636 wrote to memory of 2456	1636	EASteamProxy.exe	44
PID 1636 wrote to memory of 2456	1636	EASteamProxy.exe	44
PID 2456 wrote to memory of 1600	2456	cmd.exe	46
PID 2456 wrote to memory of 1600	2456	cmd.exe	46
PID 2456 wrote to memory of 1600	2456	cmd.exe	46
PID 2456 wrote to memory of 1600	2456	cmd.exe	46
PID 2456 wrote to memory of 1600	2456	cmd.exe	46
PID 2456 wrote to memory of 1600	2456	cmd.exe	46
PID 2456 wrote to memory of 1600	2456	cmd.exe	46

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\formulario_agendamiento_citas.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2000

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\formulario_agendamiento_citas.msi"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2732

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\formulario_agendamiento_citas.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1684

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Sleigh\EASteamProxy.exe
  "C:\Users\Admin\AppData\Local\Sleigh\EASteamProxy.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Users\Admin\AppData\Roaming\signremote_v2\EASteamProxy.exe
    C:\Users\Admin\AppData\Roaming\signremote_v2\EASteamProxy.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\sw_ultra.exe
        
        C:\Users\Admin\AppData\Local\Temp\sw_ultra.exe
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:1600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003F0" "0000000000000060"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f79a6ad.rbs

Filesize
9KB

MD5
d22ff6970e5c3f9770d9251db9b03f7f

SHA1
313e662d35c56cde30754c40d3426324df28dcf0

SHA256
095aef1aaaa64759f01d271a9812d8279e14ebabef3812bca44106dd477f1bce

SHA512
7d8dd0c79491f257e8ebdb991df1ca44ea9efa467d6c5b90cf63cc2c8b6e14cf0736a069583af420d4bee82885877ae2656e8edc8043f8c78de7d912fb8a0c97

Download Submit
C:\ProgramData\pixlrfla\logs.dat

Filesize
250B

MD5
8ec1534bf95452b33556d4e63f6d6209

SHA1
4622ce9df488c3879da56a422edc705b9cbb00b4

SHA256
6a5284da9e20156ca4a21938367e67928426e0409fa9d1163d79933ddf3995eb

SHA512
e6ccf8143a1cb0f173493e9c26fc2e2d25e650140b66b4107eb9248b34d5457a0d93eb81cb152ed789ae5896d09c62e328991c20aa74454a8c0f4c4a8cf85c61

Download Submit
C:\ProgramData\pixlrfla\logs.dat

Filesize
274B

MD5
79a9f3e6ca7bec7b67f9957d2451c323

SHA1
bacddfd38da3f29bb368d34bfcae645580b231b2

SHA256
16571ff4e4061e3bd867a8de798f976bdd10a19ab5e20d4da80b52a872cba2cb

SHA512
f572c5f131ff4fdcea29324b08c53c7e8ea62b47a12f430d4dfe2b0d291514b3712ef4a5030e98567d330986323ca4bb997bc189278c1d8c94501e89daedb7fe

Download Submit
C:\Users\Admin\AppData\Local\Sleigh\Qt5Core.dll

Filesize
6.0MB

MD5
68e600cb754e04557ef716b9ebc93fe4

SHA1
8302ab611e787c312b971ce05935ff6e956faede

SHA256
8f4c72e3c7de1ab5d894ec7813f65c5298ecafc183f31924b44a427433ffca42

SHA512
8bbd7d14b59f01eba7c46a6e8592c037cab73bed1eb0762fc278cf7b81082784e88d777a32f71bc2de128c0186321004bfa4ca68d1bcaa5660694c007219e98e

Download Submit
C:\Users\Admin\AppData\Local\Sleigh\Qt5Network.dll

Filesize
1.3MB

MD5
c24c89879410889df656e3a961c59bcc

SHA1
25a9e4e545e86b0a5fe14ee0147746667892fabd

SHA256
739bedcfc8eb860927eb2057474be5b39518aaaa6703f9f85307a432fa1f236e

SHA512
0542c431049e4fd40619579062d206396bef2f6dadadbf9294619c918b9e6c96634dcd404b78c6045974295126ec35dd842c6ec8f42279d9598b57a751cd0034

Download Submit
C:\Users\Admin\AppData\Local\Sleigh\VCRUNTIME140_1.dll

Filesize
48KB

MD5
cf0a1c4776ffe23ada5e570fc36e39fe

SHA1
2050fadecc11550ad9bde0b542bcf87e19d37f1a

SHA256
6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47

SHA512
d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168

Download Submit
C:\Users\Admin\AppData\Local\Sleigh\hneggqx

Filesize
1.1MB

MD5
8770e325895738a7f1e79ac5d0258d15

SHA1
bfe730d1e4bf4c2a179e056f332ea240ed526742

SHA256
31c51d0135f088d36da43cd029914e61ddd96f4198259812990fa1dd7e49dc4a

SHA512
4d2a0312bd3fbe5e49abdd1188b36f1426682354ca8a8be22f610e13e4ce465cbe0e6493ccad463162cf8089543a75bfbf563dcb423e6ebe78b55cd802944f5c

Download Submit
C:\Users\Admin\AppData\Local\Sleigh\libssl-1_1-x64.dll

Filesize
669KB

MD5
4ad03043a32e9a1ef64115fc1ace5787

SHA1
352e0e3a628c8626cff7eed348221e889f6a25c4

SHA256
a0e43cbc4a2d8d39f225abd91980001b7b2b5001e8b2b8292537ae39b17b85d1

SHA512
edfae3660a5f19a9deda0375efba7261d211a74f1d8b6bf1a8440fed4619c4b747aca8301d221fd91230e7af1dab73123707cc6eda90e53eb8b6b80872689ba6

Download Submit
C:\Users\Admin\AppData\Local\Sleigh\ylkln

Filesize
52KB

MD5
958c1c9f428c7b93a9cd15b6f05454cd

SHA1
4044b10ca7c7fbeac46f0a23dfbca5f7760116a4

SHA256
7c5d6dd61c89f4880a98ef9bc122829958c7ed7b2ab4d8fdf6ca1de345be04b0

SHA512
abade75f117395191ae35393d41ff0e9b17c4277a25f21ca047f08a57a99a133cbdd56eea267d82fb6917844a7c056cf04ba27662c6ac81b2ddb6200f8010cc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3b055307

Filesize
1.6MB

MD5
e6a8b0d5e92337bccdb2f576d9de6c1a

SHA1
cad45f403a2cd5764591517cd704d59d7db19d60

SHA256
7cf61674a9b851620f3094d7f047862b20333560575d8e23d3d0da720abd1f55

SHA512
a30fec84152286ec2f28559bcc9a6742b19bc9dd7d4da8284e1b1bd9ce90ea0bf18cec1a26e05c935ceb2debebabb4d18344213cd708100addeebbd27e2da68c

Download Submit
C:\Users\Admin\Desktop\formulario_agendamiento_citas.msi

Filesize
7.1MB

MD5
0579a377e4d014fb6e208b94dd2064a6

SHA1
edcf26e71cc6ba2593699c080f69f75a3c30f315

SHA256
0c302dc8e0d0684e8494300870a27bfc5c9121ab209ff2d3e4fe17306a3b5222

SHA512
15434bcc1eef8497295a4ac7ded8e2b3dc03db632eff9f241eef7995bf6c686a84e0aacffde44da44783079c51aff5b479fdf5566642770f3338cd8f87adb6cb

Download Submit
C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF

Filesize
5KB

MD5
5e961b1e105c3b3e61e882a553bf5355

SHA1
a5410576b80da1982c64fd9bb81b85f6bc7cd12d

SHA256
1b68210cf77bbf95273c182120e0e38bc6750b361a5c2725319afb753dcfc0d1

SHA512
943d43bb77968c9d1df98076ec4a344c01596b2ae7771ce37dd10389ff96eadca91412106f404da5b54fb345d6e0e845259c8cec4537ff4d23c46a5a4e8d756a

Download Submit
\Users\Admin\AppData\Local\Sleigh\EASteamProxy.exe

Filesize
5.4MB

MD5
ad2735f096925010a53450cb4178c89e

SHA1
c6d65163c6315a642664f4eaec0fae9528549bfe

SHA256
4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e

SHA512
1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9

Download Submit
\Users\Admin\AppData\Local\Sleigh\libcrypto-1_1-x64.dll

Filesize
2.7MB

MD5
78c6831007ac63cdec78eb7b032c461f

SHA1
1012ff593fb7df5d2d911cd6e80621215d223476

SHA256
a00ea7fa0cdfd017c9a4d947501583e37b08784111deaf6d6fbd1b3eb51241c4

SHA512
bc5c6f135cce8eda81d5589e67e9d7b7ff6d3a6413afe1914ad96fced26f659271f1d83e42e8d763315e91168cf2486fa8bc575de1555cf134ff97cd77576016

Download Submit
\Users\Admin\AppData\Local\Sleigh\msvcp140.dll

Filesize
564KB

MD5
1ba6d1cf0508775096f9e121a24e5863

SHA1
df552810d779476610da3c8b956cc921ed6c91ae

SHA256
74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823

SHA512
9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

Download Submit
\Users\Admin\AppData\Local\Sleigh\msvcp140_1.dll

Filesize
34KB

MD5
69d96e09a54fbc5cf92a0e084ab33856

SHA1
b4629d51b5c4d8d78ccb3370b40a850f735b8949

SHA256
a3a1199de32bbbc8318ec33e2e1ce556247d012851e4b367fe853a51e74ce4ee

SHA512
2087827137c473cdbec87789361ed34fad88c9fe80ef86b54e72aea891d91af50b17b7a603f9ae2060b3089ce9966fad6d7fbe22dee980c07ed491a75503f2cf

Download Submit
\Users\Admin\AppData\Local\Sleigh\steam_api64.dll

Filesize
291KB

MD5
6b4ab6e60364c55f18a56a39021b74a6

SHA1
39cac2889d8ca497ee0d8434fc9f6966f18fa336

SHA256
1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3

SHA512
c08de8c6e331d13dfe868ab340e41552fc49123a9f782a5a63b95795d5d979e68b5a6ab171153978679c0791dc3e3809c883471a05864041ce60b240ccdd4c21

Download Submit
\Users\Admin\AppData\Local\Sleigh\vcruntime140.dll

Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
\Users\Admin\AppData\Local\Temp\sw_ultra.exe

Filesize
433KB

MD5
fea067901f48a5f1faf7ca3b373f1a8f

SHA1
e8abe0deb87de9fe3bb3a611234584e9a9b17cce

SHA256
bf24b2f3e3a3c60ed116791b99e5421a4de34ac9c6e2201d34ab487e448ce152

SHA512
07c83a2d3d5dd475bc8aa48eba9b03e8fb742dbbd7bd623ed05dc1086efed7dfd1c1b8f037ee2e81efba1de58ea3243d7c84ac8b484e808cd28765f9c7517023

Download Submit
memory/952-69-0x000007FEF5090000-0x000007FEF51E8000-memory.dmp

Filesize
1.3MB

Download
memory/1600-136-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1600-149-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1600-160-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1600-137-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1600-157-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1600-139-0x0000000076E20000-0x0000000076FC9000-memory.dmp

Filesize
1.7MB

Download
memory/1600-140-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1600-143-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1600-146-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1600-152-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1636-114-0x000007FEF4FF0000-0x000007FEF5148000-memory.dmp

Filesize
1.3MB

Download
memory/1636-106-0x000007FEF4FF0000-0x000007FEF5148000-memory.dmp

Filesize
1.3MB

Download
memory/2456-120-0x00000000745E0000-0x0000000074754000-memory.dmp

Filesize
1.5MB

Download
memory/2456-119-0x0000000076E20000-0x0000000076FC9000-memory.dmp

Filesize
1.7MB

Download
memory/2456-128-0x00000000745E0000-0x0000000074754000-memory.dmp

Filesize
1.5MB

Download