Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

0fc20e0a1b...58.exe

windows7-x64

10

0fc20e0a1b...58.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 18:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0fc20e0a1b084f412b1436a46fb618e38a45af6e35fd04e1216adc4101966658.exe

  • Size

    52KB

  • MD5

    2cd285151c06274a9cbec89f6a97e5a7

  • SHA1

    825592195c444e5642a7407c8147d372abf1b0fb

  • SHA256

    0fc20e0a1b084f412b1436a46fb618e38a45af6e35fd04e1216adc4101966658

  • SHA512

    fef1729c20e83ba465f3a6e7c45cf12d7decac722c078e6f2cc5163da6a7d37c6e9bca105274e437a8e0c39ea84aa57a451015804cbc18269c06e1b20474a6ee

  • SSDEEP

    768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1+33j5n/wZf2kfw:IzaEW5gMxZVXf8a3yO10pwZc

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 18 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 9 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 9 IoCs
    evasion
  • Windows security bypass 2 TTPs 45 IoCs
    evasiontrojan
  • Blocks application from running via registry modification 54 IoCs

    Adds application to list of disallowed applications.

    evasion
  • Disables RegEdit via registry modification 18 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Sets file execution options in registry 2 TTPs 18 IoCs
    persistence
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 7 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Windows security modification 2 TTPs 54 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 27 IoCs
    persistence
  • Drops desktop.ini file(s) 6 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 31 IoCs
  • Modifies Control Panel 64 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 27 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 63 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fc20e0a1b084f412b1436a46fb618e38a45af6e35fd04e1216adc4101966658.exe
    "C:\Users\Admin\AppData\Local\Temp\0fc20e0a1b084f412b1436a46fb618e38a45af6e35fd04e1216adc4101966658.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Blocks application from running via registry modification
    • Disables RegEdit via registry modification
    • Sets file execution options in registry
    • Modifies system executable filetype association
    • Windows security modification
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1616
    • C:\Windows\nEwb0Rn.exe
      C:\Windows\nEwb0Rn.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Sets file execution options in registry
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:224
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        PID:4584
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2200
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1760
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Windows security bypass
        • Blocks application from running via registry modification
        • Disables RegEdit via registry modification
        • Sets file execution options in registry
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Windows security modification
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2376
        • C:\Windows\nEwb0Rn.exe
          C:\Windows\nEwb0Rn.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Windows security bypass
          • Blocks application from running via registry modification
          • Disables RegEdit via registry modification
          • Sets file execution options in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Windows security modification
          • Adds Run key to start application
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1812
          • C:\Windows\nEwb0Rn.exe
            C:\Windows\nEwb0Rn.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:3392
          • C:\Windows\SysWOW64\WishfulThinking.exe
            C:\Windows\system32\WishfulThinking.exe
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:3184
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:5104
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4428
        • C:\Windows\SysWOW64\WishfulThinking.exe
          C:\Windows\system32\WishfulThinking.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Windows security bypass
          • Blocks application from running via registry modification
          • Disables RegEdit via registry modification
          • Sets file execution options in registry
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Windows security modification
          • Adds Run key to start application
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3356
          • C:\Windows\nEwb0Rn.exe
            C:\Windows\nEwb0Rn.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:1408
          • C:\Windows\SysWOW64\WishfulThinking.exe
            C:\Windows\system32\WishfulThinking.exe
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:3332
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2724
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3244
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Windows security bypass
          • Blocks application from running via registry modification
          • Disables RegEdit via registry modification
          • Sets file execution options in registry
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Windows security modification
          • Adds Run key to start application
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:3380
          • C:\Windows\nEwb0Rn.exe
            C:\Windows\nEwb0Rn.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:3980
          • C:\Windows\SysWOW64\WishfulThinking.exe
            C:\Windows\system32\WishfulThinking.exe
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:4472
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4644
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:220
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2560
    • C:\Windows\SysWOW64\WishfulThinking.exe
      C:\Windows\system32\WishfulThinking.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Sets file execution options in registry
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3712
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2156
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4848
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Sets file execution options in registry
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3864
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Windows security bypass
        • Blocks application from running via registry modification
        • Disables RegEdit via registry modification
        • Sets file execution options in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Windows security modification
        • Adds Run key to start application
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:3804
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3740
    • C:\Windows\nEwb0Rn.exe
      C:\Windows\nEwb0Rn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3648
    • C:\Windows\SysWOW64\WishfulThinking.exe
      C:\Windows\system32\WishfulThinking.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:4180
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2152
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3236
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3924 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3704

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Impair Defenses

    2
    T1562

    Disable or Modify Tools

    2
    T1562.001

    Modify Registry

    10
    T1112

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
      Filesize

      52KB

      MD5

      11702598235037a3ae8a60b1aa56263f

      SHA1

      57a0f22b04e7171c2a1c046fe929f26147c3710f

      SHA256

      e3539aa9ba6b17a29ff41c396971343a20f66a62a9bb6d205f78cc44d7bac79d

      SHA512

      163d6e78ce31dccd21c6038245cb91cb993588987584ab1e08ce78598b930862d931157892f78c750fda7e79644c13f2e3676569308b1e189320490bcb81fd9b

      Download Submit

    • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
      Filesize

      52KB

      MD5

      3729ba335b59870bf191517a13e0ed10

      SHA1

      83fad0c955b3e95b84d42fd5c316590d81b98562

      SHA256

      32d1ab87c9bd8c8a9fbcbd26c1a39ee5a885f73d49b3fdc242cba751f705159a

      SHA512

      49efe17807caf1aa89fc28f40936a939c1044e92ce2851d865c619c395b5f9e6faa27edce0bd54a27dc7c5d05275ad5812ebb0937501e9d913dae3f6b1dcac86

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      Filesize

      52KB

      MD5

      e7ba1286892f3bb1e41e650b900fbfe8

      SHA1

      0e5d0c52650bd96cb9f1ca51b2df0974f9b0c5b1

      SHA256

      eb30cdcf43f23b9b47b5a326d0128d8fe2ceba41deada08244ff97276c37da30

      SHA512

      c440e7800f9e91cbcd88fc89904af5a41ac3a1b23930394bab3902887d327488e61111fa9c011d73a82a090a0821ed5b51e73ac0cb7c852e228eb1ff954d74da

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      Filesize

      52KB

      MD5

      b9a57d20cd3f0241174267bbb1579be7

      SHA1

      bfb0232e3cce613449ae76845ce3b3a8f3b59b31

      SHA256

      178a93f0707dc6e8c7801819fffc846a2a396b82cee3898845b2c2e2f5be7501

      SHA512

      b25021b5d34773f7b155cfaae7e466945d77b5ee10875035695b9b7b1042dea992da057ad1815da08a7e3915ef3e2a6b50eff459b6030350a634dce08b479eb5

      Download Submit

    • C:\Windows\SysWOW64\JawsOfLife.exe
      Filesize

      52KB

      MD5

      eb8acdf6a9ebaa9967691d0b0011c69d

      SHA1

      a178db15f5674b7c99a333bc64f2a21bfcc3b38b

      SHA256

      8b951ed663807ec21716dff0de01fac57a4da746262c1b43493122dc9540d4e5

      SHA512

      24215bc99bf37edbc665a034ff4eaf5bb7ee51c2822ac46d96d680871826fb110e71568b15bdbb8d1444b5f8022b1696caa754880524d31dfd81aa25e58e6798

      Download Submit

    • C:\Windows\SysWOW64\JawsOfLife.exe
      Filesize

      52KB

      MD5

      9826f90ed13c329834d6cd34624f288a

      SHA1

      fd4824c94d9de24854b851a263675049e738cb03

      SHA256

      eddb2877853fbaa8375539fcb429a50c671b4aa240aad0111b8c8517d8bc9701

      SHA512

      dc1c6ce2b40853e53e9d027c054885f67e9887f0c1404b8268214eb930b5885fb9c7b35631bfa8e19c89d4b2b41c861bbc50d46e5aad69a4a2b472ba78623cf3

      Download Submit

    • C:\Windows\SysWOW64\WishfulThinking.exe
      Filesize

      52KB

      MD5

      dbc3e8dcad4c57448bc44abac228e54b

      SHA1

      4cee80b7b522ba4ac31d2b1b713ccf68418e6598

      SHA256

      9ec0541b77689064f614849f46087997ed1089808ad96c8034067b1f216e5484

      SHA512

      e4aac6ef152dcfc014e44a76806293fb5fa6678ebc2d350c8c22d0887e0a991814dab187604730d54d72608640cbefdd13c22b63a5474b916528faf71c38bc1d

      Download Submit

    • C:\Windows\SysWOW64\WishfulThinking.exe
      Filesize

      52KB

      MD5

      0b0545e693d4fd68cc606efe88d5e0b2

      SHA1

      e79c5308687b3244981586ddf2b5e94cadfab2af

      SHA256

      c782592af0a971c0b89d8a2218f434c2d041f9ee5cb762724fc5f84970d866f3

      SHA512

      a178e0d677d91c80e6cfd9582024aa683589fbf40ebd460dd1434b779c0e5fc0bfb14954746fd5bcda3933d9ba6ec937eda92524d61b6827be6617e4e30884dc

      Download Submit

    • C:\Windows\SysWOW64\WishfulThinking.exe
      Filesize

      52KB

      MD5

      2cd285151c06274a9cbec89f6a97e5a7

      SHA1

      825592195c444e5642a7407c8147d372abf1b0fb

      SHA256

      0fc20e0a1b084f412b1436a46fb618e38a45af6e35fd04e1216adc4101966658

      SHA512

      fef1729c20e83ba465f3a6e7c45cf12d7decac722c078e6f2cc5163da6a7d37c6e9bca105274e437a8e0c39ea84aa57a451015804cbc18269c06e1b20474a6ee

      Download Submit

    • C:\Windows\msvbvm60.dll
      Filesize

      1.4MB

      MD5

      25f62c02619174b35851b0e0455b3d94

      SHA1

      4e8ee85157f1769f6e3f61c0acbe59072209da71

      SHA256

      898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

      SHA512

      f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

      Download Submit

    • C:\Windows\nEwb0Rn.exe
      Filesize

      52KB

      MD5

      b11af912697a2adfad8acbd14676f9eb

      SHA1

      4dec0833866a6726c3ccfab9208b20e274ade127

      SHA256

      e057aa61b422a631dafc4736bef3d9bb14d3468b3e2118c058dff5d26acb405b

      SHA512

      1becf76a88d384e17be3703ec072fe6d8ab43ec36e3966b3be52ea4b6890d49729e68d39069a05204fc939b2cf76174ff550ae59921acae2168617e58df9ebbd

      Download Submit

    • C:\Windows\nEwb0Rn.exe
      Filesize

      52KB

      MD5

      dc091abf98f783293d38f222b4e28883

      SHA1

      f6a6d2e2cce9374c36210c340a49dceace65327c

      SHA256

      3cc14a986c58de975699bfd536a1ed22eb5682dee9a638bf1fc2227d45386936

      SHA512

      0d51d5b6ccb26036ffa7dcb256c336f64d8eaa681d620ac2e0e8be98f02bc758600bb2d2a26514ca8140a334050204710142ed942d36d1316c96b37b5dfca564

      Download Submit

    • C:\about.htm
      Filesize

      2KB

      MD5

      94c0c5518c4f4bb044842a006d04932a

      SHA1

      23d9a914f6681d65e2b1faa171f4cf492562ebdb

      SHA256

      224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

      SHA512

      79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

      Download Submit

    • C:\nEwb0Rn.exe
      Filesize

      52KB

      MD5

      6b7eeda6cae0ad0e05fdf4d71098bb56

      SHA1

      62fb3275e2b47b4a1d3e00a0feaa10a3ad894778

      SHA256

      d8fb0018b0e877b49403fcd6e4f68d83eed210a420fae729fc4939bec5e05cc6

      SHA512

      b84d7dec0ce5676d8495f114c55843c5d06ca6c8b3c57014be76159721cc82d28bcc33a29d159fdf07f42720765b392346160550db5d6335fa67aeff7eb0ac0c

      Download Submit

    • C:\nEwb0Rn.exe
      Filesize

      52KB

      MD5

      849907c9f1b64c6e71d485f2b023b89f

      SHA1

      02c1489a17e17894745fa5a310e9188bffa30b40

      SHA256

      422fab8bdb1d26c7e1766423007a20236a169f0ddce57afb0de7c6f08001474f

      SHA512

      a8383f65b5a0a0762e3c8fdb095dd869665addabefd530cfea73be6a7722b88f55f10e587611ef2033713468cb750ca940f17a54ba9e9a559cc1bffdbc3268df

      Download Submit

    • C:\nEwb0Rn.exe
      Filesize

      52KB

      MD5

      97cc10a65df157780e7c37c6a35a09a4

      SHA1

      9d6c079b3b196fc13fdcceea3c04f6de2304cdc5

      SHA256

      64feff78f789a06f87101d1804ad69814b689b8c5b9c91b1f2822b15e6c92421

      SHA512

      717ef582ba508bf24ce606559bdd8c2a93a35a8889dc4cea85f98753de6517361116e0e09cb2baab9a95cf0cf0678edee9822572ee4c19db93010c43a9f01cb6

      Download Submit

    • F:\desktop.ini
      Filesize

      222B

      MD5

      b78e2c99b0e66f6f6accbebdaa4d8442

      SHA1

      a546aaed8820b44437538600deba9d08a4a11ddc

      SHA256

      59e9ccbcb65a03c7965b93c758e4562ff8ddd5500b8ec1b66811f9b62744b2ca

      SHA512

      82d09d87f8dffbc9c261b8d9dc9437350638197430ecee513bf1803ad18db3b939c56141e970d0d9523c93befebd1e76743b860d9dfd2072280becdf5aa2fc6e

      Download Submit

    • F:\nEwb0Rn\Folder.htt
      Filesize

      640B

      MD5

      5d142e7978321fde49abd9a068b64d97

      SHA1

      70020fcf7f3d6dafb6c8cd7a55395196a487bef4

      SHA256

      fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061

      SHA512

      2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9

      Download Submit

    • memory/224-42-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/224-288-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1408-468-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1616-464-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1616-0-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1616-103-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1616-3-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1760-121-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1760-104-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1812-534-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1812-469-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/1812-378-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2152-409-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2156-254-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2200-122-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2200-94-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2376-533-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2376-410-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2560-418-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2724-527-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2724-520-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3184-479-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3236-412-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3236-417-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3244-532-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3332-517-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3332-470-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3356-535-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3356-394-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3356-499-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3380-402-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3380-511-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3380-536-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3392-466-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3648-396-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3712-49-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3712-298-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3740-125-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3740-135-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3804-325-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3804-289-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3864-313-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3864-110-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3980-502-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4180-405-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4180-398-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4428-519-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4472-515-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4472-503-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4584-92-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4644-522-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4644-512-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4848-315-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download

    • memory/5104-507-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

      Download