Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    172s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2022, 02:49

General

  • Target

    b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe

  • Size

    149KB

  • MD5

    4f47c6f97a61e28c251ccba05c7c9b86

  • SHA1

    4661d019647d28f9a7687f46ab9dfb25f52cc77c

  • SHA256

    b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af

  • SHA512

    225c0a388317a7f08d01af3fb974dce7d079176292224b6cda26fac5bd90910284cdf92a45eaf7f8473cea6caba5667b8d6d9bdf14dc57429b199105bcb6690a

  • SSDEEP

    3072:JTJK5SKcSNFcmTJK5cjMWoe0c8TilDcq15:JTJrRyWmTJh5yc8TO915

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 19 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
    "C:\Users\Admin\AppData\Local\Temp\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Windows\Executioner.exe
      C:\Windows\Executioner.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Sets file execution options in registry
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3800
      • C:\Windows\Executioner.exe
        C:\Windows\Executioner.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4168
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Windows\System32\SHIMGVW.DLL,ImageView_Fullscreen C:\Windows\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.jpg
      2⤵
      • Suspicious use of FindShellTrayWindow
      PID:3492
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3764
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
        PID:4572
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
          PID:2068
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:1932
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:1156
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
                PID:4768

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\avatar.exe

                Filesize

                55KB

                MD5

                dcb28dcd069c6bdc1a014b25e4f2dacb

                SHA1

                dcdc922afd40161179cbab409380eeb2409dcda6

                SHA256

                d1f3cdac6ca6a037c503bbcb06f2682e81f53f8757f8b1681a52a325dd4317df

                SHA512

                978860b01b243c3079b4df981d7707981946217f4e97137e933d1a69567357c8e104903219529c5984487eaecb35d844268a89fdad68cadc6c3fd9c98379c7b2

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\compare_poster.exe

                Filesize

                79KB

                MD5

                a770eba25991592533b5d7625a4098b7

                SHA1

                f001e7b9446bf41776312241e343a8ea73334786

                SHA256

                ba7f75d0c3437e5ebc805c889b3a1d14d0828ee163cf7c87028c3a29a01ad753

                SHA512

                eab461bfa5473f8876204c25d38d46abbee0d8cf7c6a780d4836e7f95795a6145a2c13c470707642ff37b2b7076d2ca0a082fb3457701184d82e232457d7368e

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.exe

                Filesize

                81KB

                MD5

                eaa52a6e45a7eda452002aede4b99a05

                SHA1

                0f98c5f710ce09d31f52c710806ba873983258d0

                SHA256

                6e77266307287e76ef974157fdef9f6ae2a1ef914120ecc3d1fd699bfe4d77b9

                SHA512

                845780ebdaaf2885217a71beaaf885c1f8b286cc48a46ef43742c3526f4a97dc5577f00f260438304dac913c184daa1fb590fb4893909c7e6735e93a6c0919f1

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\index_poster.exe

                Filesize

                107KB

                MD5

                b87c58cc68d53c45558ab18e684fd32f

                SHA1

                4dc61325d686a830e795f5bbac60e6d94ea7b145

                SHA256

                4a60aa1d1706c0b449bf1c2750fd00ae608c5e92aef9ed0c38261217ebe613f0

                SHA512

                dbff83bae375435adc97472c0a33f870c2e7e750445d59c50761f3e04933a9804cb17393631490d9bc34867721f94f8e208f8c4b3b7c6c8bfb1f763c67a13070

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\javascript_poster.exe

                Filesize

                97KB

                MD5

                326afc5c88561966100c3a52662120d4

                SHA1

                a88005669b9c341191f01a39b32dac144b16c904

                SHA256

                e168250a845e066aa795c70d0eab388e1f26142d6fbb1baac0b4cc514c211b28

                SHA512

                02d1237c5bece52993bdc01e8ba1a69dd2c1a209a36df99cb91255425a822648b440b795e01bb53d3b8ad3190d84bcc7c0f98efdbe7cb9a04a3dcbf145313cfe

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\measure_poster.exe

                Filesize

                135KB

                MD5

                3333999d514e2c5282d2baf84464b441

                SHA1

                b967001286471606f0a4cdf5b9380989f845699a

                SHA256

                67e9a3e35e66f30ade3dde0477f6f6233a9d4c1115a5de48a8a5aadb90bc435f

                SHA512

                d402c25c13695ee850cc22a6a87ac331a2e4c37189ab065c2c95a157195f5c142dfa7b62990df8a3d1c16c003108566174987ecbd4aa5c2cf735851cd5bd8892

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\media_poster.exe

                Filesize

                117KB

                MD5

                ba5a5dde8bcd5538f95a14dc63d86e2f

                SHA1

                5ecdd84f08b9be00c083f6c91ea4f9fb7c105198

                SHA256

                05b70c0b453c6989fb7a8342dbd782ffe2594aef91ad46caee56d192497b9e00

                SHA512

                bec7b8c4847e60ce33b1f1ac0347a70efd24153abd0094718b88b37e89e43ea556ca45d5f3420d6d9e49ca6ff4870419fffe01a2b79d351c752e907060fc0a2e

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\optimize_poster.exe

                Filesize

                75KB

                MD5

                4358191d2de60cf00e957cb1ee8166d6

                SHA1

                61bc932e0e052df685a89ade21f44dc169faf19e

                SHA256

                52be321249d565ec75a603cf4dbb35dcf8be03461600d2d1c5f6dd3d1dbfe9c4

                SHA512

                ba826a7002fd698057dcaf70392876b3d415065f3334282667c528fb08a875ff4ee5bc268ba7408585fb1d3367c4d3aed979f48ad72c9ce134b0fd5567621949

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.exe

                Filesize

                120KB

                MD5

                73e5ddf65e5ce8fb4fe48fd57dacd350

                SHA1

                d39c0e3d53dba67bbbe208ba64ecee2e21c08f59

                SHA256

                3e0aedc0dd62cf20ea5a49d63abdfde4a5ca48abe38e9927c1c1d799b4475166

                SHA512

                cc9504c4a5f9974e4a6854c329e5678a51cb5a7dfa74972f7ec61cb23aef42ee1f1ca07d4e99e19da44df219e47a5e278d3986787ab7869545d06c6a7f3589c7

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\protect_poster.exe

                Filesize

                75KB

                MD5

                308e3f3eaed60a559164a1b2b6602196

                SHA1

                ea29a20bbabe6f159de8488e97988a4709b57a33

                SHA256

                5df31a6bf0775d5ed0e09dc63f7ec942d1ff9b688e5ee43f37065d60065c13f6

                SHA512

                3ca9de31237c77cf39e09a15b878920aec427a2b9b0871574f844ee62583b85d723dddf093104e9483bcf5efaee6415929808c1fa55e87c7035305cbebb61ca0

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\redact_poster.exe

                Filesize

                79KB

                MD5

                4aa0959f6b52380de49dbcf1692d700b

                SHA1

                f615be14d007db0e59e70c1ba7880cfe03641ba3

                SHA256

                986d93e0c190b396d5cfac955a13122f5e736934777f06e274e30809acf17273

                SHA512

                158d24a2e468b07c97ce4ca01cb1c55c1e1ba02ab639a1fcf79530ed434652687db15194802870b5e403e601fc6e618e9530244d1ec3df2f99d05b048ab9b4d1

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\review_poster.exe

                Filesize

                118KB

                MD5

                531fcf030caf9c12a59d2c9a2efae533

                SHA1

                b09d7fe912b312242e04ec5d0a4333287c5223a2

                SHA256

                b4b1202d32c5b5fbe4596043940b6c914de871fda65cec80a4133c48f4a9c0dd

                SHA512

                b947f0f300b39da7688f33668ec9f4e16fc90ff915e89165c889342a96fa78d25a5ae078a9f75d7508c49bf2f418f143c98aec273a96134e9cfbd64694f02d94

              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\scan_poster.exe

                Filesize

                82KB

                MD5

                7661efba8665c6e9dd1d741a3e84f02c

                SHA1

                d42a47cfe9dae09efba30d669240245354158b68

                SHA256

                8c973d9052ea98a2591868fd367f957d376354743149c4a2c0ae1de206e0ae93

                SHA512

                c9d58f305fa5fed7409a4e22cbdb2f3cf7bb7593e08af5dbcf4686f0b3079ec5c24ca68fad907173fdb328e2b7ad0833c1d2bb2b49dd90520a484fe0b5325288

              • C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.exe

                Filesize

                55KB

                MD5

                aa4a0ff6290d8223db6d04553b1bca55

                SHA1

                c9587464635912ed24dd403e45154589aff8e6fe

                SHA256

                732643b138058a9e78e4d470283af2982566f678a184b787552fbb6e211af9fc

                SHA512

                20de29dcdfe091286667f69de21e30064140a3826c6b9505010f88771095240290640a8b880c9009ede8dc73d894f10f4a4b2e9563427c7d683d03826bb6db21

              • C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.exe

                Filesize

                55KB

                MD5

                aa4a0ff6290d8223db6d04553b1bca55

                SHA1

                c9587464635912ed24dd403e45154589aff8e6fe

                SHA256

                732643b138058a9e78e4d470283af2982566f678a184b787552fbb6e211af9fc

                SHA512

                20de29dcdfe091286667f69de21e30064140a3826c6b9505010f88771095240290640a8b880c9009ede8dc73d894f10f4a4b2e9563427c7d683d03826bb6db21

              • C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.exe

                Filesize

                53KB

                MD5

                3aa5d10b2cd74b643a7c5ba36433c6c8

                SHA1

                7447e8367bf6f80bb85e8f1961f1823f251d3182

                SHA256

                fd040168f07b6aca2fc7d9dcf415a2ef9f8f3926dd308fceeb4ab8db8947382e

                SHA512

                b8e87f125edccbdcb1a8c84734a98421f076f64f7dae8e9ac7b94091fa51500bcac55eefa1364f62518cae07d4edb3b1e6f779aad64f10909eb30001afadc0f8

              • C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.exe

                Filesize

                53KB

                MD5

                3aa5d10b2cd74b643a7c5ba36433c6c8

                SHA1

                7447e8367bf6f80bb85e8f1961f1823f251d3182

                SHA256

                fd040168f07b6aca2fc7d9dcf415a2ef9f8f3926dd308fceeb4ab8db8947382e

                SHA512

                b8e87f125edccbdcb1a8c84734a98421f076f64f7dae8e9ac7b94091fa51500bcac55eefa1364f62518cae07d4edb3b1e6f779aad64f10909eb30001afadc0f8

              • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG

                Filesize

                106KB

                MD5

                1f84678fbf1b0cfe7e409efae3230177

                SHA1

                cb4a4dc0ea3212e3792ed3974b1ed4996502c7d2

                SHA256

                75163d32b70211076ae6a62cae9534f56e4edfd66b9c787b7a6c07cb709ca646

                SHA512

                78e3a8b3940b458a01473f639487bd36e0690b6e41ca525a5f1178c2c32c3760232bb5d7e7601172591cc2ab82aa5342ef7c39de7808b26e0a1d3274762e7aa6

              • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG

                Filesize

                106KB

                MD5

                1f84678fbf1b0cfe7e409efae3230177

                SHA1

                cb4a4dc0ea3212e3792ed3974b1ed4996502c7d2

                SHA256

                75163d32b70211076ae6a62cae9534f56e4edfd66b9c787b7a6c07cb709ca646

                SHA512

                78e3a8b3940b458a01473f639487bd36e0690b6e41ca525a5f1178c2c32c3760232bb5d7e7601172591cc2ab82aa5342ef7c39de7808b26e0a1d3274762e7aa6

              • C:\Program Files\Windows Media Player\Media Renderer\DMR_120.exe

                Filesize

                55KB

                MD5

                aa4a0ff6290d8223db6d04553b1bca55

                SHA1

                c9587464635912ed24dd403e45154589aff8e6fe

                SHA256

                732643b138058a9e78e4d470283af2982566f678a184b787552fbb6e211af9fc

                SHA512

                20de29dcdfe091286667f69de21e30064140a3826c6b9505010f88771095240290640a8b880c9009ede8dc73d894f10f4a4b2e9563427c7d683d03826bb6db21

              • C:\Program Files\Windows Media Player\Media Renderer\DMR_120.exe

                Filesize

                55KB

                MD5

                aa4a0ff6290d8223db6d04553b1bca55

                SHA1

                c9587464635912ed24dd403e45154589aff8e6fe

                SHA256

                732643b138058a9e78e4d470283af2982566f678a184b787552fbb6e211af9fc

                SHA512

                20de29dcdfe091286667f69de21e30064140a3826c6b9505010f88771095240290640a8b880c9009ede8dc73d894f10f4a4b2e9563427c7d683d03826bb6db21

              • C:\Program Files\Windows Media Player\Media Renderer\DMR_48.exe

                Filesize

                53KB

                MD5

                3aa5d10b2cd74b643a7c5ba36433c6c8

                SHA1

                7447e8367bf6f80bb85e8f1961f1823f251d3182

                SHA256

                fd040168f07b6aca2fc7d9dcf415a2ef9f8f3926dd308fceeb4ab8db8947382e

                SHA512

                b8e87f125edccbdcb1a8c84734a98421f076f64f7dae8e9ac7b94091fa51500bcac55eefa1364f62518cae07d4edb3b1e6f779aad64f10909eb30001afadc0f8

              • C:\Program Files\Windows Media Player\Media Renderer\DMR_48.exe

                Filesize

                53KB

                MD5

                3aa5d10b2cd74b643a7c5ba36433c6c8

                SHA1

                7447e8367bf6f80bb85e8f1961f1823f251d3182

                SHA256

                fd040168f07b6aca2fc7d9dcf415a2ef9f8f3926dd308fceeb4ab8db8947382e

                SHA512

                b8e87f125edccbdcb1a8c84734a98421f076f64f7dae8e9ac7b94091fa51500bcac55eefa1364f62518cae07d4edb3b1e6f779aad64f10909eb30001afadc0f8

              • C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.exe

                Filesize

                57KB

                MD5

                30a8695f168538db192c865b34b523e6

                SHA1

                8cf9b362c403408e449ed2a183eed663ddaa9332

                SHA256

                9e5c0b9dba4c03849178df52ae23138cc6a70666ddc04516a3a4365e699d7ab6

                SHA512

                508ba0bb17fbf96b1ee4051fd36466197d4b0ff3a99776330607a52342c8c66ef32f0b5c173cb63e7170563d760bd254c9a21310ece775996e9940da50e19ec8

              • C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.exe

                Filesize

                57KB

                MD5

                30a8695f168538db192c865b34b523e6

                SHA1

                8cf9b362c403408e449ed2a183eed663ddaa9332

                SHA256

                9e5c0b9dba4c03849178df52ae23138cc6a70666ddc04516a3a4365e699d7ab6

                SHA512

                508ba0bb17fbf96b1ee4051fd36466197d4b0ff3a99776330607a52342c8c66ef32f0b5c173cb63e7170563d760bd254c9a21310ece775996e9940da50e19ec8

              • C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.exe

                Filesize

                57KB

                MD5

                30a8695f168538db192c865b34b523e6

                SHA1

                8cf9b362c403408e449ed2a183eed663ddaa9332

                SHA256

                9e5c0b9dba4c03849178df52ae23138cc6a70666ddc04516a3a4365e699d7ab6

                SHA512

                508ba0bb17fbf96b1ee4051fd36466197d4b0ff3a99776330607a52342c8c66ef32f0b5c173cb63e7170563d760bd254c9a21310ece775996e9940da50e19ec8

              • C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.exe

                Filesize

                54KB

                MD5

                b8e63d10143ba02cb9662c775fd4de9f

                SHA1

                5f007b602a545d799787d2b67898c52ce724052b

                SHA256

                deb0e11c6662ae6a0a9eb7beeb03ced6eef2cd18fac82a8e514c5b93cbcc7c3e

                SHA512

                b1a92021822487ea3978fb1cc8ca6443ac1bfe63632d4bde8c1d11dea9cfdc5a3ebad2930530233589d96e19422821695638d3be5556be28b82a4694eb1dcbe9

              • C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.exe

                Filesize

                54KB

                MD5

                b8e63d10143ba02cb9662c775fd4de9f

                SHA1

                5f007b602a545d799787d2b67898c52ce724052b

                SHA256

                deb0e11c6662ae6a0a9eb7beeb03ced6eef2cd18fac82a8e514c5b93cbcc7c3e

                SHA512

                b1a92021822487ea3978fb1cc8ca6443ac1bfe63632d4bde8c1d11dea9cfdc5a3ebad2930530233589d96e19422821695638d3be5556be28b82a4694eb1dcbe9

              • C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.exe

                Filesize

                54KB

                MD5

                958b253956fd89a0a11ed8fc83b386c4

                SHA1

                3fdb4f72c4b0f02d57bb00c63c7b1a18d50b3693

                SHA256

                5b3c4f119cce1e3be5cc1f34511b0d37b3f5c1d3b5143077a7c57bec7982dc77

                SHA512

                9e8318536fead52c0a492f9d1f15a4c5aa71c7aefad909b2608e090b0a4f68ce8ff59fb5527a70307e36f175e975b2d0fef97e691e845c5f42aae1bf89f90172

              • C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.exe

                Filesize

                54KB

                MD5

                958b253956fd89a0a11ed8fc83b386c4

                SHA1

                3fdb4f72c4b0f02d57bb00c63c7b1a18d50b3693

                SHA256

                5b3c4f119cce1e3be5cc1f34511b0d37b3f5c1d3b5143077a7c57bec7982dc77

                SHA512

                9e8318536fead52c0a492f9d1f15a4c5aa71c7aefad909b2608e090b0a4f68ce8ff59fb5527a70307e36f175e975b2d0fef97e691e845c5f42aae1bf89f90172

              • C:\Windows\Executioner.exe

                Filesize

                149KB

                MD5

                4f47c6f97a61e28c251ccba05c7c9b86

                SHA1

                4661d019647d28f9a7687f46ab9dfb25f52cc77c

                SHA256

                b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af

                SHA512

                225c0a388317a7f08d01af3fb974dce7d079176292224b6cda26fac5bd90910284cdf92a45eaf7f8473cea6caba5667b8d6d9bdf14dc57429b199105bcb6690a

              • C:\Windows\Executioner.exe

                Filesize

                149KB

                MD5

                4f47c6f97a61e28c251ccba05c7c9b86

                SHA1

                4661d019647d28f9a7687f46ab9dfb25f52cc77c

                SHA256

                b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af

                SHA512

                225c0a388317a7f08d01af3fb974dce7d079176292224b6cda26fac5bd90910284cdf92a45eaf7f8473cea6caba5667b8d6d9bdf14dc57429b199105bcb6690a

              • C:\Windows\Executioner.exe

                Filesize

                149KB

                MD5

                4f47c6f97a61e28c251ccba05c7c9b86

                SHA1

                4661d019647d28f9a7687f46ab9dfb25f52cc77c

                SHA256

                b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af

                SHA512

                225c0a388317a7f08d01af3fb974dce7d079176292224b6cda26fac5bd90910284cdf92a45eaf7f8473cea6caba5667b8d6d9bdf14dc57429b199105bcb6690a

              • C:\Windows\SysWOW64\Dakila.nfo

                Filesize

                13B

                MD5

                267cc58988d233a0e6614d4c6e5a8dd5

                SHA1

                ba769a9c5ffedecbaa6bb017862d52c36ad306c1

                SHA256

                918ded25f95297bd62c0c1bf1bedee75568fa7df79c643bde120c287ac61f6e1

                SHA512

                6e25e7a7efc855ecc33ca14bb1c3a829db5e5b5709dfa3bfdff040e4228065475a8c857b00cea7736c9e47a64018bfad902713c69f575f6b343c64227c186e54

              • C:\Windows\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.jpg

                Filesize

                97KB

                MD5

                6002f55af3cfc00f7985865dab16fdf4

                SHA1

                932ebb5b11a29170cffe977210019cb1bf027d9f

                SHA256

                d4d6ef8cc38c4eefd9e8da8c0ae3237c9caa41868749fe968b5e50ec05dbb1ab

                SHA512

                f54c8e52c775dd607b3f051ccf2f46deb32a2ac070296f7a8058db750efb4a97c4e5394d3dec417507bbd5f05d13952777a0d72c63f19b6aed0b8d674947e238

              • memory/4504-132-0x0000000000400000-0x000000000041D000-memory.dmp

                Filesize

                116KB