URL:

https://anonfiles.com/t9fa70rbz3/InstalarConsultorio_exe

Full analysis: https://app.any.run/tasks/31147fec-0353-4b73-ae65-a2337387a46f
Verdict: Malicious activity
Analysis date: May 15, 2023, 19:18:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

554269BFA28E48AFB7395439B581CA7F

SHA1:

9ABEF757FB1E0824319CB01E9E557B5FDCB21D9C

SHA256:

6A44F928C920485FDD13BBDB574FB5DF42918458A9BDF1BD8C4191C410FFDE52

SSDEEP:

3:N8M2KcdP+TQl:2M2HdP4Ql

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file the system directory

      • setup.exe (PID: 3444)
      • Setup1.exe (PID: 3824)

    • Create files in the Startup directory

      • setup.exe (PID: 3444)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup.exe (PID: 3444)
      • InstalarConsultorio.exe (PID: 3140)
      • mdac_typ.exe (PID: 2400)
      • Setup1.exe (PID: 3824)

    • Reads the Internet Settings

      • Setup1.exe (PID: 3824)
      • Consult.exe (PID: 3612)

    • Creates/Modifies COM task schedule object

      • Setup1.exe (PID: 3824)

    • Searches for installed software

      • Setup1.exe (PID: 3824)

  • INFO

    • Create files in a temporary directory

      • iexplore.exe (PID: 3932)
      • setup.exe (PID: 3444)
      • iexplore.exe (PID: 1604)
      • InstalarConsultorio.exe (PID: 3140)
      • mdac_typ.exe (PID: 2400)
      • Setup1.exe (PID: 3824)
      • Consult.exe (PID: 3612)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 1604)
      • iexplore.exe (PID: 3932)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3932)

    • Reads the computer name

      • setup.exe (PID: 3444)
      • Setup1.exe (PID: 3824)
      • Consult.exe (PID: 3612)

    • Application launched itself

      • iexplore.exe (PID: 3932)

    • Checks supported languages

      • setup.exe (PID: 3444)
      • InstalarConsultorio.exe (PID: 3140)
      • Setup1.exe (PID: 3824)
      • dasetup.exe (PID: 3696)
      • mdac_typ.exe (PID: 2400)
      • setup.exe (PID: 2520)
      • Consult.exe (PID: 3612)

    • The process checks LSA protection

      • setup.exe (PID: 3444)
      • Setup1.exe (PID: 3824)
      • Consult.exe (PID: 3612)

    • Creates files or folders in the user directory

      • setup.exe (PID: 3444)

    • Reads the machine GUID from the registry

      • Setup1.exe (PID: 3824)
      • Consult.exe (PID: 3612)

    • Manual execution by a user

      • Consult.exe (PID: 3612)

    • Reads mouse settings

      • Setup1.exe (PID: 3824)

    • Checks proxy server information

      • Consult.exe (PID: 3612)

    • Creates files in the program directory

      • Setup1.exe (PID: 3824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe instalarconsultorio.exe no specs instalarconsultorio.exe setup.exe setup1.exe mdac_typ.exe setup.exe no specs dasetup.exe no specs iexplore.exe consult.exe

Process information

PID
CMD
Path
Indicators
Parent process
568"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3932 CREDAT:3872032 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1604"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3932 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2400C:\Users\admin\AppData\Local\Temp\msftqws.pdw\mdac_typ.exe /q:a /c:"setup.exe /QN1"C:\Users\admin\AppData\Local\Temp\msftqws.pdw\mdac_typ.exe
Setup1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
2.50.4403.12
Modules
Images
c:\users\admin\appdata\local\temp\msftqws.pdw\mdac_typ.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2520C:\Users\admin\AppData\Local\Temp\IXP000.TMP\setup.exe /QN1C:\Users\admin\AppData\Local\Temp\IXP000.TMP\setup.exe—mdac_typ.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\ixp000.tmp\setup.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sspicli.dll
2608"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\InstalarConsultorio.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\InstalarConsultorio.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\instalarconsultorio.exe
c:\windows\system32\ntdll.dll
3140"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\InstalarConsultorio.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\InstalarConsultorio.exe
iexplore.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\instalarconsultorio.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3444.\setup.exeC:\Users\admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
InstalarConsultorio.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Bootstrap for Visual Basic Setup Toolkit
Exit code:
0
Version:
6.00.8804
Modules
Images
c:\users\admin\appdata\local\temp\wzse0.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
3612"C:\Program Files\Consultório 2020 17.0\Consult.exe" C:\Program Files\Consultório 2020 17.0\Consult.exe
explorer.exe
User:
admin
Company:
VBB Software
Integrity Level:
MEDIUM
Description:
Sistema de Gerenciamento para Consultório
Exit code:
0
Version:
17.00
Modules
Images
c:\program files\consultório 2020 17.0\consult.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3696C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exe /Q /NC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exe—setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\dasetup.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
3824C:\WINDOWS\Setup1.exe "C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"C:\Windows\Setup1.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic 6.0 Setup Toolkit
Exit code:
0
Version:
6.00.8450
Modules
Images
c:\windows\setup1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
53 216
Read events
52 450
Write events
468
Delete events
298

Modification events

(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
474
Suspicious files
138
Text files
2 118
Unknown types
79

Dropped files

PID
Process
Filename
Type
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:36B67BE9A16B7A74A95AB64DD3597014
SHA256:1F4151A39608794DFFE248F1115ACFC8F25B279A1EC6B65FE049B973DF63D250
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F00B5D9B3A99FD5BB8375BC7C5931AA0
SHA256:29AC3EDD3D150567A3CADE0E3BD134A1A78822D1E44A2F8F3C8C6CEBBC3DA9D2
1604iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar19B0.tmpcat
MD5:4FF65AD929CD9A367680E0E5B1C08166
SHA256:C8733C93CC5AAF5CA206D06AF22EE8DBDEC764FB5085019A6A9181FEB9DFDEE6
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:EA6065BC7D02B08D77AED3BBC4EB9B30
SHA256:B51C19A4F64E58F0C228D365CAD83ACACE8D925A8C1862BB9DC2463EC6FCD3AA
1604iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\anonfiles[1].csstext
MD5:B97CAB6E1166955E8EAE870B2DC08774
SHA256:BFD1D04319976B5C2CBBE73CA7197ED05BD718901D49DA2F65CECF751D3EFC65
1604iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab19B1.tmpcompressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A11DD062BD6941BA904CE326B76441E7binary
MD5:D5316B80011376FCC4AEF5A2FD2B9388
SHA256:424A261EF15B33CED20FAC41A4701CE472931807F86D0B2F1E4B2B25FE3B4130
1604iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab19AF.tmpcompressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
51
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
568
iexplore.exe
GET
—
35.208.72.84:80
http://www.vbbsoftware.com/consultorio/instalacao-concluida/
US
—
—
unknown
3612
Consult.exe
GET
—
35.208.72.84:80
http://www.vbbsoftware.com/ccad_auto.php?nome=adas%20asdasd&email=asdasdhkjashjasdasdsa@asasasas.com&time=30121899202335
US
—
—
unknown
1604
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?345a7c7068bb3aa6
US
compressed
4.70 Kb
whitelisted
3932
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
1604
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?60ac977cbb08d7af
US
compressed
62.3 Kb
whitelisted
3932
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
1604
iexplore.exe
GET
200
184.24.77.64:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOI%2Fr6VlRk2IWfPujbwCtjKYg%3D%3D
US
der
503 b
shared
3932
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
1604
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHwqDCE%2FxlVTRckfGR%2B4Tvo%3D
US
der
1.40 Kb
whitelisted
1604
iexplore.exe
GET
200
108.138.2.195:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3408
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1604
iexplore.exe
45.154.253.150:443
—
Svea Hosting AB
GB
suspicious
3932
iexplore.exe
92.123.104.63:443
www.bing.com
Akamai International B.V.
DE
suspicious
1604
iexplore.exe
45.154.253.151:443
—
Svea Hosting AB
GB
suspicious
1604
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
1604
iexplore.exe
23.56.202.135:80
x1.c.lencr.org
AKAMAI-AS
GB
suspicious
1604
iexplore.exe
184.24.77.64:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 92.123.104.63
  • 92.123.104.28
  • 92.123.104.62
  • 92.123.104.31
  • 92.123.104.32
  • 92.123.104.33
  • 92.123.104.34
  • 92.123.104.38
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
x1.c.lencr.org
  • 23.56.202.135
whitelisted
r3.o.lencr.org
  • 184.24.77.64
  • 184.24.77.72
  • 184.24.77.74
  • 184.24.77.83
  • 184.24.77.81
  • 184.24.77.49
  • 184.24.77.62
  • 184.24.77.78
  • 184.24.77.50
shared
vjs.zencdn.net
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
djv99sxoqpv11.cloudfront.net
  • 13.224.194.18
  • 13.224.194.38
  • 13.224.194.125
  • 13.224.194.221
shared
o.ss2.us
  • 108.138.2.195
  • 108.138.2.173
  • 108.138.2.10
  • 108.138.2.107
whitelisted
ocsp.rootg2.amazontrust.com
  • 52.222.206.202
  • 52.222.206.73
  • 52.222.206.67
  • 52.222.206.35
whitelisted
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://anonfiles.com/t9fa70rbz3/InstalarConsultorio_exe