Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

DFIR.exe

windows10-1703-x64

10

Resubmissions

08/03/2024, 22:18

240308-18e7asha96 10

08/03/2024, 22:11

240308-134byaha27 10

Analysis

  • max time kernel
    92s
  • max time network
    99s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/03/2024, 22:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DFIR.exe

  • Size

    2.8MB

  • MD5

    e372d1ba2d3a1936e3e8cdd3febf2038

  • SHA1

    06ed6e0be895945bc78adac9aa0283e50fc93349

  • SHA256

    137197636e52f813606d4d979a270447888336d3403d3c94fe39310a903a59f9

  • SHA512

    058da6b05b73ba3d0a72d9565d9e663cec8857da03f3361fd6b6557f181c000d7c9c9668fa46b609f1568bc77e4485e494aae825b5b33efed2c1bb3c93d87e70

  • SSDEEP

    49152:f5UX4uCXsw6rBbn0zdkfnDV/4TE6/lIKiebQ+LTq4ujYv9XiwuPNhO8NX:f5UX4JF6rBYzyfGTJ/lIVebQ+L2ZsVSR

Score
10/10
xmrigdiscoveryevasionminerpersistenceupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Contacts a large (40502) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • XMRig Miner payload 11 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Loads dropped DLL 3 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DFIR.exe
    "C:\Users\Admin\AppData\Local\Temp\DFIR.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc stop npf"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Windows\system32\sc.exe
        sc stop npf
        3⤵
        • Launches sc.exe
        PID:4328
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc delete npf"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4384
      • C:\Windows\system32\sc.exe
        sc delete npf
        3⤵
        • Launches sc.exe
        PID:4144
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Windows\system32\sc.exe
        sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys
        3⤵
        • Launches sc.exe
        PID:3712
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc start npf"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\system32\sc.exe
        sc start npf
        3⤵
        • Launches sc.exe
        PID:4604
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "netstat -ano | findstr TCP"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Windows\system32\NETSTAT.EXE
        netstat -ano
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:660
      • C:\Windows\system32\findstr.exe
        findstr TCP
        3⤵
          PID:1196
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:2780
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:1400
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:2196
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:3496
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:644
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:4608
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:504
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:1088
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:648
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:884
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:2348
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:1920
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:4184
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:2832
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:3788
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:3416
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:4128
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:1664
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:3076
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:3860
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
        2⤵
        • Modifies registry class
        PID:4112
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1652
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2652
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4920
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2372
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4668
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2852
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1420
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1112
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:784
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4016
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4336
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2688
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:660
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1400
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3936
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:208
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2400
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3004
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4948
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1184
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4708
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk"
        2⤵
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4972
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          3⤵
            PID:784
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A259C93FD491F89DF7AD81ABA2A49ACA --mojo-platform-channel-handle=1620 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              4⤵
                PID:4604
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FEE5DD332E4F41B07EF0DF3F0F22B422 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FEE5DD332E4F41B07EF0DF3F0F22B422 --renderer-client-id=2 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job /prefetch:1
                4⤵
                  PID:1444
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=99A4CC0DE293C2C6BBEF5536D47DFE31 --mojo-platform-channel-handle=2224 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                  4⤵
                    PID:2424
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2D7EC55EB58EB598B324BFAE9797000E --mojo-platform-channel-handle=1844 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                    4⤵
                      PID:1196
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=694130668592A20D08838505EFCB3D47 --mojo-platform-channel-handle=1600 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                      4⤵
                        PID:696
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:3292

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\t77sme\WinRing0x64.sys
                    Filesize

                    14KB

                    MD5

                    0c0195c48b6b8582fa6f6373032118da

                    SHA1

                    d25340ae8e92a6d29f599fef426a2bc1b5217299

                    SHA256

                    11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                    SHA512

                    ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\t77sme\config.json
                    Filesize

                    1KB

                    MD5

                    8afbb1177ab70f9d24dacd22a6793ee4

                    SHA1

                    b7ba0a4bd964868922143bedb93470202c0bfef4

                    SHA256

                    54f0d371f9918c81e3ce7a557d6da1ac4639995c5a6e409822f0e496d3a1d290

                    SHA512

                    2d05fb6e7e39b499b27aed4a7adf77fce1dcedc335d969be157dec91a78ed7b839ba50887d5a6de1b6f3635ae7d35dc6cd1ec064590ef76fe3ae8443fdaa5624

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\t77sme\kthreaddk
                    Filesize

                    2.0MB

                    MD5

                    a7013a2c7fd3a6168a7c0d9eed825c32

                    SHA1

                    a3b6cf6090a425466606125aa881fdf56c1c2a67

                    SHA256

                    a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd

                    SHA512

                    e2e6e447806adb5d27c77f8dc32772fc49ba5532e255e1a38e92a404efccbc8f3d820d4d674a51968e5c3c1079cb834253232bf13e6ff9d437c7d0e2551ba49d

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\Packet.dll
                    Filesize

                    105KB

                    MD5

                    899a5bf1669610cdb78d322ac8d9358b

                    SHA1

                    80a2e420b99ffe294a523c6c6d87ed09dfc8d82b

                    SHA256

                    ab3cce674f5216895fd26a073771f82b05d4c8b214a89f0f288a59774a06b14b

                    SHA512

                    41f2459793ac04e433d8471780e770417afac499dc3c5413877d4a4499656c9669c069d24e638d0aaf43af178a763acb656ffd34d710eb5e3c94682db1559056

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\wpcap.dll
                    Filesize

                    361KB

                    MD5

                    a672f1cf00fa5ac3f4f59577f77d8c86

                    SHA1

                    b68e64401d91c75cafa810086a35cd0838c61a4b

                    SHA256

                    35aab6caaaf1720a4d888ae0de9e2a8e19604f3ea0e4dd882c3eeae4f39af117

                    SHA512

                    a566e7571437be765279c915dd6e13f72203eff0dc3838a154fc137ed828e05644d650fd8432d1fb4c1e1d84ee00ef9bde90225c68c3ca8a5da349065e7ebfd6

                    Download Submit

                  • memory/4044-94-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-10-0x0000000001AF0000-0x0000000001B0F000-memory.dmp

                    Filesize

                    124KB

                    Download

                  • memory/4044-54-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-0-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-101-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-138-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-139-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-165-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-181-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-182-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-183-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download

                  • memory/4044-184-0x0000000000400000-0x000000000152F000-memory.dmp

                    Filesize

                    17.2MB

                    Download