b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e

Analysis

max time kernel
194s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Size

840KB
MD5

6b3ce93d85920fbb6945ae50444e9814
SHA1

4136c8bd98230f322a66b716657b5416e5b54709
SHA256

b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e
SHA512

99d1a5634dcce95b58804dc03cef2e6ad282db415ceeb2e47bb26ddaafe5d4a26800271ddefd471b1508271b3f5fd9ca5a6fb4b3880135456b4200b7d7fe68d7
SSDEEP

24576:6Woih7R4t1VyWkuS6/D7TnF7Ex7UM4Fs:6IAkW77p

Score

10^/10

evasion persistence ransomware

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	dswg.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	dswg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dswg.exe

Executes dropped EXE 2 IoCs

pid	Process
1144	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
432	dswg.exe

Loads dropped DLL 4 IoCs

pid	Process
2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	\??\c:\windows\Desktop.ini	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
File opened for modification	\??\c:\windows\Desktop.ini	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
File opened for modification	\??\c:\windows\Desktop.ini	dswg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	dswg.exe
File opened (read-only)	\??\B:	dswg.exe
File opened (read-only)	\??\N:	dswg.exe
File opened (read-only)	\??\O:	dswg.exe
File opened (read-only)	\??\U:	dswg.exe
File opened (read-only)	\??\W:	dswg.exe
File opened (read-only)	\??\Y:	dswg.exe
File opened (read-only)	\??\I:	dswg.exe
File opened (read-only)	\??\K:	dswg.exe
File opened (read-only)	\??\L:	dswg.exe
File opened (read-only)	\??\M:	dswg.exe
File opened (read-only)	\??\T:	dswg.exe
File opened (read-only)	\??\X:	dswg.exe
File opened (read-only)	\??\F:	dswg.exe
File opened (read-only)	\??\H:	dswg.exe
File opened (read-only)	\??\P:	dswg.exe
File opened (read-only)	\??\Q:	dswg.exe
File opened (read-only)	\??\S:	dswg.exe
File opened (read-only)	\??\V:	dswg.exe
File opened (read-only)	\??\E:	dswg.exe
File opened (read-only)	\??\G:	dswg.exe
File opened (read-only)	\??\J:	dswg.exe
File opened (read-only)	\??\R:	dswg.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\XPs.ini	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
File opened for modification	\??\c:\windows\SysWOW64\XPs.ini	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	dswg.exe
File created	\??\c:\windows\SysWOW64\maxtrox.txt	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	dswg.exe
File opened for modification	\??\c:\windows\SysWOW64\XPs.ini	dswg.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	dswg.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	dswg.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\Wallpaper = "c:\\Documents and Settings\\Admin\\Application Data\\Microsoft\\NIMDA ANGEL.bmp"	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\Wallpaper = "c:\\Documents and Settings\\Admin\\Application Data\\Microsoft\\NIMDA ANGEL.bmp"	dswg.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	dswg.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	dswg.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	dswg.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	dswg.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	dswg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	dswg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	\??\c:\windows\Desktop.ini	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
File opened for modification	\??\c:\windows\Desktop.ini	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
File opened for modification	\??\c:\windows\Desktop.ini	dswg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	dswg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	dswg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	dswg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	dswg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	dswg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	dswg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	dswg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	dswg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	dswg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	dswg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	dswg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	dswg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	dswg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	dswg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	dswg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	dswg.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe
432	dswg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
432	dswg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1144	2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe	28
PID 2028 wrote to memory of 1144	2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe	28
PID 2028 wrote to memory of 1144	2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe	28
PID 2028 wrote to memory of 1144	2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe	28
PID 2028 wrote to memory of 432	2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe	29
PID 2028 wrote to memory of 432	2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe	29
PID 2028 wrote to memory of 432	2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe	29
PID 2028 wrote to memory of 432	2028	b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe	29

C:\Users\Admin\AppData\Local\Temp\b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
"C:\Users\Admin\AppData\Local\Temp\b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe"
1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
  C:\Users\Admin\AppData\Local\Temp\b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- \??\c:\Documents and Settings\Admin\Application Data\Microsoft\dswg.exe
  "c:\Documents and Settings\Admin\Application Data\Microsoft\dswg.exe" b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e
  2⤵
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe

Filesize
768KB

MD5
2a7a3a8f016fba41d92070eee333f97e

SHA1
7545e28936ac8a169f384084c8fda7200f565a6d

SHA256
6429ea6f4f3beb2bf732b30b6688d9767a3dbfe82ece08f3b36feb229f6c0ac0

SHA512
5441065eefbec6f787781eb6873c47ba9c62b40c4ff5e9dfdaf86395d444934b9a0330d81401667ae1968c8d2778684a4bd159a3df33d015f91719ccfa562be3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\dswg.exe

Filesize
76KB

MD5
2ebb2a4399cbfd6ffec53e813f92f9b8

SHA1
f69b7fb9ce0b3092b5bd9e7dd33f4a91e4147598

SHA256
a1c88eed3e59f1a35371424cb3dfeadca168c0496ba0ff496d2c29062a18602b

SHA512
43e3d2ad40354838797a2cdc05c826d82d62bf6a8498604062a94b788bc8411c9887f23088e022ae3f4e7b8f72c373aa73b60fac66df270e950ba3c8e84302be

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\NIMDA ANGEL.bmp

Filesize
1.4MB

MD5
f0ab9bdc4f70586f552a42d60f7e96cf

SHA1
810424972df0090d9dd41223bd182e30b59faaae

SHA256
efc01ce7690a1a45fe37cdc8a807430c4ff2f5a12c4edacacf6c4b02e6704df2

SHA512
ab32c7e558f1bc5ee315a50384c8be16938426d9700d130c25ea6e00e1d3a18ec528ce9b61b0bb6ee862b1d3b57536a1a6def195e7464d3d12fb0503e59a9374

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\dswg.exe

Filesize
76KB

MD5
2ebb2a4399cbfd6ffec53e813f92f9b8

SHA1
f69b7fb9ce0b3092b5bd9e7dd33f4a91e4147598

SHA256
a1c88eed3e59f1a35371424cb3dfeadca168c0496ba0ff496d2c29062a18602b

SHA512
43e3d2ad40354838797a2cdc05c826d82d62bf6a8498604062a94b788bc8411c9887f23088e022ae3f4e7b8f72c373aa73b60fac66df270e950ba3c8e84302be

Download Submit
\??\c:\windows\Desktop.ini

Filesize
127B

MD5
8052b40f98237069a82665e8e410104a

SHA1
3036d150d270117154f87834fa3bb06410b6ee47

SHA256
107ea9afadb0dd5adc3ac7e41520d4d65530da78cf86c70bf225572c0d1a4329

SHA512
a6e77194678ffb3b8844628e98562f644a58ba04661477a7cdc6cfabd0fba8d71fbff60f621a1b3bc7949a983b0a29df689c4a5b6b838e757b047a020dc56631

Download Submit
\??\c:\windows\SysWOW64\XPs.ini

Filesize
1.4MB

MD5
9deb008192c430c143014b74e118496a

SHA1
9bea77324bdcda49be0f35326bb8f39ccb2e1559

SHA256
958df7273152cf2534f63f8f3f52afb86fc6d040768d0d5dc4a2e6ab62126563

SHA512
94b5d1af87d839189dde43f1a28d7b87b631ae6f397aaa31cfbe4a0d2e7177c76f5fb34fca1080bff30a875017290074bc8246b629498277798e6f4e3f782fb3

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe

Filesize
768KB

MD5
2a7a3a8f016fba41d92070eee333f97e

SHA1
7545e28936ac8a169f384084c8fda7200f565a6d

SHA256
6429ea6f4f3beb2bf732b30b6688d9767a3dbfe82ece08f3b36feb229f6c0ac0

SHA512
5441065eefbec6f787781eb6873c47ba9c62b40c4ff5e9dfdaf86395d444934b9a0330d81401667ae1968c8d2778684a4bd159a3df33d015f91719ccfa562be3

Download Submit
\Users\Admin\AppData\Local\Temp\b50330e478d8f64d2bcfe0dcc5594f9e18d993308c44fed9d94b04eb8e40e60e.exe

Filesize
768KB

MD5
2a7a3a8f016fba41d92070eee333f97e

SHA1
7545e28936ac8a169f384084c8fda7200f565a6d

SHA256
6429ea6f4f3beb2bf732b30b6688d9767a3dbfe82ece08f3b36feb229f6c0ac0

SHA512
5441065eefbec6f787781eb6873c47ba9c62b40c4ff5e9dfdaf86395d444934b9a0330d81401667ae1968c8d2778684a4bd159a3df33d015f91719ccfa562be3

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\dswg.exe

Filesize
76KB

MD5
2ebb2a4399cbfd6ffec53e813f92f9b8

SHA1
f69b7fb9ce0b3092b5bd9e7dd33f4a91e4147598

SHA256
a1c88eed3e59f1a35371424cb3dfeadca168c0496ba0ff496d2c29062a18602b

SHA512
43e3d2ad40354838797a2cdc05c826d82d62bf6a8498604062a94b788bc8411c9887f23088e022ae3f4e7b8f72c373aa73b60fac66df270e950ba3c8e84302be

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\dswg.exe

Filesize
76KB

MD5
2ebb2a4399cbfd6ffec53e813f92f9b8

SHA1
f69b7fb9ce0b3092b5bd9e7dd33f4a91e4147598

SHA256
a1c88eed3e59f1a35371424cb3dfeadca168c0496ba0ff496d2c29062a18602b

SHA512
43e3d2ad40354838797a2cdc05c826d82d62bf6a8498604062a94b788bc8411c9887f23088e022ae3f4e7b8f72c373aa73b60fac66df270e950ba3c8e84302be

Download Submit
memory/1144-60-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download