90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc

Analysis

max time kernel
151s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Size

97KB
MD5

3e0280728dd451fac5adeaa605d26e74
SHA1

a04e9396763e76400d7abc276a0ed7de2d04dec9
SHA256

90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc
SHA512

880e1b92391d27f9aac3e18105fb821595d6a3f1652f8316fa11d7b690926e967a994ef4f44a773483ada12f6c5193aaa800c0ed1f46c78218a3800e848cf2f1
SSDEEP

1536:anqdu3abBGy3G8V0iuodPprBmh/F9hSNfWy:aqhMPsDrBmh/F9sl

Score

10^/10

evasion persistence ransomware

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	nizv.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nizv.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nizv.exe

Executes dropped EXE 2 IoCs

pid	Process
1712	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
1472	nizv.exe

Loads dropped DLL 3 IoCs

pid	Process
1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\Desktop.ini	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
File opened for modification	\??\c:\windows\Desktop.ini	nizv.exe
File created	\??\c:\windows\Desktop.ini	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	nizv.exe
File opened (read-only)	\??\K:	nizv.exe
File opened (read-only)	\??\M:	nizv.exe
File opened (read-only)	\??\O:	nizv.exe
File opened (read-only)	\??\S:	nizv.exe
File opened (read-only)	\??\X:	nizv.exe
File opened (read-only)	\??\Z:	nizv.exe
File opened (read-only)	\??\F:	nizv.exe
File opened (read-only)	\??\E:	nizv.exe
File opened (read-only)	\??\G:	nizv.exe
File opened (read-only)	\??\N:	nizv.exe
File opened (read-only)	\??\U:	nizv.exe
File opened (read-only)	\??\W:	nizv.exe
File opened (read-only)	\??\Y:	nizv.exe
File opened (read-only)	\??\B:	nizv.exe
File opened (read-only)	\??\I:	nizv.exe
File opened (read-only)	\??\L:	nizv.exe
File opened (read-only)	\??\P:	nizv.exe
File opened (read-only)	\??\R:	nizv.exe
File opened (read-only)	\??\V:	nizv.exe
File opened (read-only)	\??\H:	nizv.exe
File opened (read-only)	\??\T:	nizv.exe
File opened (read-only)	\??\Q:	nizv.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	nizv.exe
File opened for modification	\??\c:\windows\SysWOW64\XPs.ini	nizv.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	nizv.exe
File created	\??\c:\windows\SysWOW64\maxtrox.txt	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
File created	\??\c:\windows\SysWOW64\XPs.ini	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
File opened for modification	\??\c:\windows\SysWOW64\XPs.ini	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	nizv.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	nizv.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\Wallpaper = "c:\\Documents and Settings\\Admin\\Application Data\\Microsoft\\NIMDA ANGEL.bmp"	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\Wallpaper = "c:\\Documents and Settings\\Admin\\Application Data\\Microsoft\\NIMDA ANGEL.bmp"	nizv.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	nizv.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	nizv.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	nizv.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	nizv.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	nizv.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	nizv.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	\??\c:\windows\Desktop.ini	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
File opened for modification	\??\c:\windows\Desktop.ini	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
File opened for modification	\??\c:\windows\Desktop.ini	nizv.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	nizv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	nizv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	nizv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	nizv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	nizv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	nizv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe
1472	nizv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
1472	nizv.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1712	1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe	26
PID 1492 wrote to memory of 1712	1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe	26
PID 1492 wrote to memory of 1712	1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe	26
PID 1492 wrote to memory of 1712	1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe	26
PID 1492 wrote to memory of 1472	1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe	27
PID 1492 wrote to memory of 1472	1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe	27
PID 1492 wrote to memory of 1472	1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe	27
PID 1492 wrote to memory of 1472	1492	90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe	27

C:\Users\Admin\AppData\Local\Temp\90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
"C:\Users\Admin\AppData\Local\Temp\90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe"
1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
  C:\Users\Admin\AppData\Local\Temp\90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- \??\c:\Documents and Settings\Admin\Application Data\Microsoft\nizv.exe
  "c:\Documents and Settings\Admin\Application Data\Microsoft\nizv.exe" 90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc
  2⤵
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe

Filesize
25KB

MD5
8795c0339a7a7ee2c7a162f478b3e413

SHA1
8706dcf336076d47ebda7931351a466941cc4f00

SHA256
7adac90bdab7bb970b18dfd60c41d743f26bdbbc4de671776e9c10847aa76fa2

SHA512
c97889e9d0f70e215e599ab181c3cb33816f8eb6192c109fb7c306e1781dbf01684e7e33e77c742b97a0d84fbcb7eaa8008bc498613ae8270e8e9e74c1db6c7f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\nizv.exe

Filesize
76KB

MD5
31e48afa265e32da90f0097593fc20e1

SHA1
8e842f74b6606cf8cd5ab3ac06dc850c8eac02ed

SHA256
5517873d2e4fefcdac54f8c137d06a45834a78cfc25d1762224acd5b3ca8dbb0

SHA512
6fb29ceace35ec4f143743e1c3c1f63be43cade6c52fdd88c1d87dffbe42942ee744488110b15f5b8d165bbaac8394c4e34d1ae9717ac818f6b106e75ce8e774

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\NIMDA ANGEL.bmp

Filesize
1.4MB

MD5
29945fc440dac6b975e208b830701aab

SHA1
2c1a46eca9bed590d47ccbf4105b0ee11916190a

SHA256
2cba867f188fdb6bd091cb22ba403de57caae547a0c2020d13fb65202bca4837

SHA512
125d902b1e417caba781caf408af9fa0431ed9c5cab683aec1142d5df06e6b586775d81b3a1a0f7ff92bd72d22d373ead1996f48acbc4145fd1613d6ac2a9abc

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\nizv.exe

Filesize
76KB

MD5
31e48afa265e32da90f0097593fc20e1

SHA1
8e842f74b6606cf8cd5ab3ac06dc850c8eac02ed

SHA256
5517873d2e4fefcdac54f8c137d06a45834a78cfc25d1762224acd5b3ca8dbb0

SHA512
6fb29ceace35ec4f143743e1c3c1f63be43cade6c52fdd88c1d87dffbe42942ee744488110b15f5b8d165bbaac8394c4e34d1ae9717ac818f6b106e75ce8e774

Download Submit
\??\c:\windows\Desktop.ini

Filesize
127B

MD5
8052b40f98237069a82665e8e410104a

SHA1
3036d150d270117154f87834fa3bb06410b6ee47

SHA256
107ea9afadb0dd5adc3ac7e41520d4d65530da78cf86c70bf225572c0d1a4329

SHA512
a6e77194678ffb3b8844628e98562f644a58ba04661477a7cdc6cfabd0fba8d71fbff60f621a1b3bc7949a983b0a29df689c4a5b6b838e757b047a020dc56631

Download Submit
\??\c:\windows\SysWOW64\XPs.ini

Filesize
1.4MB

MD5
9deb008192c430c143014b74e118496a

SHA1
9bea77324bdcda49be0f35326bb8f39ccb2e1559

SHA256
958df7273152cf2534f63f8f3f52afb86fc6d040768d0d5dc4a2e6ab62126563

SHA512
94b5d1af87d839189dde43f1a28d7b87b631ae6f397aaa31cfbe4a0d2e7177c76f5fb34fca1080bff30a875017290074bc8246b629498277798e6f4e3f782fb3

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\90d7ed6f01d8f532b4952193a124ec7a81e3583a5edca568547bf1aa7df447fc.exe

Filesize
25KB

MD5
8795c0339a7a7ee2c7a162f478b3e413

SHA1
8706dcf336076d47ebda7931351a466941cc4f00

SHA256
7adac90bdab7bb970b18dfd60c41d743f26bdbbc4de671776e9c10847aa76fa2

SHA512
c97889e9d0f70e215e599ab181c3cb33816f8eb6192c109fb7c306e1781dbf01684e7e33e77c742b97a0d84fbcb7eaa8008bc498613ae8270e8e9e74c1db6c7f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\nizv.exe

Filesize
76KB

MD5
31e48afa265e32da90f0097593fc20e1

SHA1
8e842f74b6606cf8cd5ab3ac06dc850c8eac02ed

SHA256
5517873d2e4fefcdac54f8c137d06a45834a78cfc25d1762224acd5b3ca8dbb0

SHA512
6fb29ceace35ec4f143743e1c3c1f63be43cade6c52fdd88c1d87dffbe42942ee744488110b15f5b8d165bbaac8394c4e34d1ae9717ac818f6b106e75ce8e774

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\nizv.exe

Filesize
76KB

MD5
31e48afa265e32da90f0097593fc20e1

SHA1
8e842f74b6606cf8cd5ab3ac06dc850c8eac02ed

SHA256
5517873d2e4fefcdac54f8c137d06a45834a78cfc25d1762224acd5b3ca8dbb0

SHA512
6fb29ceace35ec4f143743e1c3c1f63be43cade6c52fdd88c1d87dffbe42942ee744488110b15f5b8d165bbaac8394c4e34d1ae9717ac818f6b106e75ce8e774

Download Submit