Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    11s
  • max time network
    12s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 15:44

General

  • Target

    ST_External_Loader.exe

  • Size

    19.8MB

  • MD5

    9db1a30398521441b138523142a497c3

  • SHA1

    aa69bfad573aad9db5a7a626730dbe0b62455097

  • SHA256

    32ac64aad1c7b86f24b34ac815314b5ce085b698a8c07ca35a35b5b6e06ac935

  • SHA512

    2221440d675514fe5061da9dc2b3e3e47dec6240da31d36166b4bd946da7bd03871fbcb6c734777afc7cd22272a8cbdbf13ef929c98c22088190cfd5c06cf483

  • SSDEEP

    393216:s3VgprYo2N1J8nXzrorjPB4I44aqJsLIAazsNSNUy:85J8Dro/PBMsVsgNUy

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ST_External_Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\ST_External_Loader.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/staffbesting
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2656
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://www.staffbesting.store/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2444
    • C:\Windows\SysWOW64\drivers\vgk.exe
      "C:\Windows\SysWOW64\drivers\vgk.exe" -map C:\Windows\SysWOW64\drivers\vgc.sys
      2⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:1316
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:2764

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2cd27d87e9ef0708ddb4dfdcd7fb0803

      SHA1

      c1cb002be0ee2ab253f2ac163c0fd5e777d470a8

      SHA256

      2a0598ec721d87b88721ae76b3919b5e7c851229dc4e8cd572a1d65bc87ef5e5

      SHA512

      5c7ae015a9f9f7ec427967813b1bc5b1b785aaea1c2d4c255dbc6f47a52bab0941a3bb9d802e3fa3398644336d84dab37d39a4d40f7cebea9706de94b7de182f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e4ce2ae81e8aa53b51bd70a6e4eb7d50

      SHA1

      92d433f9d40fd7f5a2af97be4de29122d85eece1

      SHA256

      0d88d621f814ed040ad11c1f4cacffe773d79ba7e1b0cdc596a188317438db31

      SHA512

      d5bf7374dbace71a6b59456ba51d0269874384e5bb09532d45943ddf9ea2b114430688aec6c8bad828a75bf36919533d7ffe3466593da903094c00569dfdd366

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ac895c9144e4faa27029231f6a852051

      SHA1

      5febf3123a367ed70977bb060d381c5364c1cbe6

      SHA256

      30b0aec688aea3c2ba07ca9d50d20a1a26193fea61c56be70250eca2e7478196

      SHA512

      bf06dfdfc73a3d897b3e0e6721ba71a00deca9c6b643d0584942df968778f8d020d689310567534606b70bfcf1868c56e32f894f315986cd53cb6b4a9f35db8b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      89dddf617aed55a0164de2f6684496b4

      SHA1

      e89942f12b21040c539a61a66ead89ee12818c0b

      SHA256

      e2d56fc5d558f2306de86fcee58db846c6d7894ea1aceab4fc812b5914982859

      SHA512

      1b156263e5d4726eb9db795e2205b7c5473782ebc6c45da421f3f898c88d3bc6a94000f7890207115b508548dc0a496d60e7a10e3474928dfb2516555a893cc9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      73a8ce3c7b56b646c05572f73ff1235e

      SHA1

      3b973bd8006e45aed35f2a34f680ae1eba59897d

      SHA256

      0a38f2d8810040a4244e018fdd29a5eb412d14d16d0f0873e289f1ab3264b2d2

      SHA512

      9b241ff9a530d2d6f077f0a0dcc54411ec01be14af92fdcae525482a3b7f6a077253d28dd2e75019bead14c6417f65ff041426488abc55c6f3bcd4c37c6d1190

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      415defd81ee333dc02958dfbd381afef

      SHA1

      34f17f0f01aba1d7b03c9e2c6594f0410b1939b6

      SHA256

      62cd56452ba0719957ec4a79609bc987befa9ac93d4acacbb8475223914f9244

      SHA512

      836305d79207dad8d91a7a0a59ba0be3e9c3f82eee3752055f430e3a63da00aa0bd5acfc8c11123c24c6b7a68561b74985cc3a9f09d20efafb7d348973aa254b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      dc469d61c209c22d92672448facfe796

      SHA1

      fe2b19f6b52bb5675b5c72b2107dd5d8910ae5b6

      SHA256

      bca5ac498368a0c6f499fac9b714d9f39744aaa849c1b76276dd1bcf4663158d

      SHA512

      edf3f55aa14fb7d4d46b7faf9e2de08cbc901390976414f37a51890490b20d5b5b90b7db706904fec8db8e8f347acf5f9ea2ab7e7d56a75d0d5f0cbaf6d0121f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5ef393d718124a92626058425a76cd8a

      SHA1

      d78aa3d29b8dc6feca5765d0fe8edb330b168034

      SHA256

      83b2575208f8974fb5e29e6ff7f699251781ade72fd8a15c106ef8193e5840f7

      SHA512

      36874ca856849d04bf0106eebc7e8120959124d7b0a662161c7f560ad200ce3cd7ab23af09f8459db08ef0cea9c55cab4a427109ff1fb91ce5913cd9afc00eb9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9b40a4fce69b4e969b226bba08ba551c

      SHA1

      3ed5a63c3da341604b59bab3774f89eaf5e22d48

      SHA256

      5ecca4157985fb0198f6725abe1e471e9418f42028370b1b86fa859c7f9bf692

      SHA512

      8c4ffe273390cca98ddff9e933606ed1a10ec0ba370c33d7d63a05f5502faba19e83719687a53c15680e4eb298cf325460c297bdab7c191c77531c0e4159efa9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4ab46f4511139cc4c17f2177bd3da643

      SHA1

      4bf8f161c95115ffbd6774470e154fd9489737f0

      SHA256

      2bb8b5bf11a8a9cea55e2314f2ba787a570506802ffd23147d33599cbe7c0de8

      SHA512

      7e94ac7ed0d876849a43d33b2654fcaa9024384fd8ff825052f3da9fa2ee052396839113a9bc3893f5008720abdff33445e84b1216b64e64f385ad82fdcbbb00

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

      Filesize

      392B

      MD5

      6460aad8f1cbe1453a3ee4149a661115

      SHA1

      bc5e6822edc1af00b78af4b1d68a52d4512cee43

      SHA256

      ca247c2f0dddeb6d1b7800ca7de2a68d166f00dce4c18e21b8859d9f2d4dbfc2

      SHA512

      5b3de3585d0864dc0f107d507339bb9351e12684566b5e652b8c9facae0296c7a7a1da0150cd315d5ebb0b9a7ed357e01241a0d894edd23ce711e171090c90d4

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

      Filesize

      13B

      MD5

      c1ddea3ef6bbef3e7060a1a9ad89e4c5

      SHA1

      35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

      SHA256

      b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

      SHA512

      6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

      Filesize

      229B

      MD5

      3d57a04d1123454435b158fb72c9f128

      SHA1

      ce90f54e2312168e84d7644882cc9d6d81c25750

      SHA256

      a321d2f0d6cd312a8a15c734b51fe05c5f34ad3293b56ab8eb2c553c716b9531

      SHA512

      61f93c89d0b1db79c8860d2a6b7e78538fa3d9fc4ca7548f4792d04465eabe09f29ad12dc94b7dbcc991a22403481bc39c68409d8e57cfcfae2dbdde0012241b

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

      Filesize

      229B

      MD5

      eb7dba519ce14e1d80ebe106329f1b65

      SHA1

      f52d2376ef763ac7c6e9885c9a4712e909fbcb2d

      SHA256

      4fb7743c0b5f096984d7405fbeb7c4b1c7b899bfd556f389ad198dd3f7b1107e

      SHA512

      d6e396f034338a30ebbdb915801598717f0d4b11ba44e0e131291919069a8bbd210aad7f96a832165816ac42a5330cab3e5fa5d73e9348248c4c1a7ee2ba5540

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

      Filesize

      229B

      MD5

      b5ae4ab2ce749cec4f25f08707ff1d77

      SHA1

      08b8507b4f96a3dde057dcf3ebe31246a88c921f

      SHA256

      d5932c586144fc6916c399773609adda58364a64360c22901d3f5eae3f093c3f

      SHA512

      d3d720b88ca68d712dc8d1fdc801b102586cd52663832cb11f14f81680c768268c8a28c2648adebc8e25ad483469a51c8fe866d55d2c442c75a925af1246a6d1

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

      Filesize

      229B

      MD5

      71c6fcbff0a3f3b575c0510ed2c20d69

      SHA1

      8fe3c052dd91a482af63eaa05cebf385792e70c9

      SHA256

      f25fa40d0e84df87d0f54cdc6f9aaf14a95cbc2624e9ef4afa31917e003258d1

      SHA512

      c4976c2d886ef1f056dba5e89634ae0069e2848ec7ff3b86ea4b2924e8b80a02edacab005fe6e1b86fc1e97546fc9eae44a19740652062c01e34b5152a65ccf3

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

      Filesize

      16KB

      MD5

      f20f072b0de4a1daab9841a223646581

      SHA1

      1f9b8cac47f47420bc90f6455db3f6611d994786

      SHA256

      d06998179a05ea15c8bf4a74605aa42a2107b14bb9b436a1e4a0cc9beae11220

      SHA512

      3eb112ee8d8704cfecce7640a504c1d21df752890c868525f365bfafeb2c1983695b8f1f90bfee829948ea114cb1d018ccd1de587ce3f4d5c20ed160c837b99d

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

      Filesize

      990B

      MD5

      6301bb0628ed7963cfe7c99161ea9ead

      SHA1

      b0d9940a48a999d91ebd16978ea89d4b59860300

      SHA256

      d5db0c00f1e02b43687e8a12c211c9319e9cf9435dd3f8407dd65bd311261d82

      SHA512

      beae100fbbb39acb0a3a1a14212a68d55c5572829c1f561a4aa23d274078730eeb39b63cfd8518524cd22fb02c2572d747fbba18b285ab61b011ddef6b21f997

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HOGAM2HX\www.youtube[1].xml

      Filesize

      990B

      MD5

      ac438557a2a63dc32ea28c422332cdec

      SHA1

      3f4739d9ca297944295ebbe3341c44662e2b3070

      SHA256

      e1794e75ee8b27b658d10557fdc2f6cc000f68af0d345de45517fd445c451d57

      SHA512

      7030b78dacc3f1e082bb2addd30c1433d15d86ac9ac0f9ddf78e4b7e126e68360722f5da871832a1027b9521e1e7f970ff3672ea0a23cba1ca774f54ede3f91e

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AD5DEDC1-28D2-11EF-BDE5-DEDD52EED8E0}.dat

      Filesize

      5KB

      MD5

      136c488f7175bd08a8a2c770acda6365

      SHA1

      da99ccc951e232c3fb930a7e9ffebb6eb81adf9f

      SHA256

      23c9f52f15cfd17641130790925e7bc778934645fb2b10107b7358eb61f18ffa

      SHA512

      60b895c3a46172bff2cc0b8b170194f2611f2201eee0768eccc39207f3b22a5deab79f95bec5d65ad6a45397107bb101c53752c9eca05a5abf4259853701c4bb

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AD70F8C1-28D2-11EF-BDE5-DEDD52EED8E0}.dat

      Filesize

      4KB

      MD5

      76a2d0a76af6eb0cfbc15604d7768e50

      SHA1

      4c55d6f20052dc5105bc085ff237007d6fcdffd2

      SHA256

      486828b03c43c729ff2b28bbba84315aaebeec8406d75e47ce17544224ef549d

      SHA512

      fc2840981969d668ae4260855671f8156c0d9bbd958f4c8ca2b2ac5ec67debca46bf712727b808077907b1482d628c70a383dcc8d6a5577f2fd8b6720f9bcb81

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9yhbznx\imagestore.dat

      Filesize

      24KB

      MD5

      690f5c4502f5efe80c191991c16f1edd

      SHA1

      536070ef1ad260b86b732a1f0747190a54cbead2

      SHA256

      e9abe928f946cbac721309e58689f0a758d327b40143b13d1fccc6928f4fc29d

      SHA512

      8a73debb641089e162c1f256cfb0f92a8f311e6dce312438af4297a6628b927b918058c8463475856ec0991bfeadba1f17ba8731fdad0ab41e74d8ba6dbd66db

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DODQ7AEY\j85XBmD3K-auBXRuR4gFy-YbXrRwDWE2e6ZsFqyJZWU[1].js

      Filesize

      53KB

      MD5

      c31f785afed7c3bd94e48286a26482ad

      SHA1

      f66156197cf74e58d6e0a327e8a1e6503fe63374

      SHA256

      8fce570660f72be6ae05746e478805cbe61b5eb4700d61367ba66c16ac896565

      SHA512

      8932b515493774d5587a01fe6d3fd08c404fdb694219898ee32a44ef00cd8773ceec0f46af1fb2834211a64a7eb698ed6d1ee7edbf70e80593997ce65113a6a7

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DODQ7AEY\remote[1].js

      Filesize

      117KB

      MD5

      a06822cee12b4c9e516d0725f8af8858

      SHA1

      b7f87f66d1fab21fb1091e00e23d4af5442dc66c

      SHA256

      07f6df6c6575d5c49957093ed7c3986e7036f6763dda0982972b6120bfe60142

      SHA512

      d15bcf19ebe7d980473a2254a5c2eba9c5c74cc77d8f721fd9efcb56b14dce255fed649a81a40892bc65e7794170384d0dae5cca13927a9b2a75761ff671c25d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M0DW1CQS\base[1].js

      Filesize

      2.5MB

      MD5

      4baef95dea52995a1695037852e4ea66

      SHA1

      8874e4883644a2e30e626a34becec8587577fc08

      SHA256

      b42cf83d76c3b2890a5beae078ac33ee3d054a31b9f47dc4f88cdc2086819d84

      SHA512

      4d26834698ae5e12b5327c903020c4ede8b6395d859fdb6c70a7d9f60c15958510c10a79908a96acda21966de6db8d2fa8f87a0265828e458abc65cff5162ef2

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M0DW1CQS\staffbesting[1].png

      Filesize

      3KB

      MD5

      e26a92140b2753256b8adf9b89431ccc

      SHA1

      2513f7bf45efef4b1c840d0fa154078d73c6e7c9

      SHA256

      d04c5b19b0828d10fbe26d975103bfac88cae393a3183a8e1355811b79309c2f

      SHA512

      d0361dbaff7ecd47f256c93498c79d5401a55697d5fbfb709a305d26e9d8aa35f479046509cf7c2eaf5bff2db86c7016dc1f70f4431eba560a61c89f7eadfd61

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M0DW1CQS\www-embed-player[1].js

      Filesize

      325KB

      MD5

      cda0f0a481eb90a8955774d5e1df7cce

      SHA1

      3c8dc861e58cbc351db0e37fb4e7358293786442

      SHA256

      ce00a615b58d37b039c143d5591834274b19791cb2dead45b64da43faef521d8

      SHA512

      7491386b3f756d046236d2b29d0648c313a38a8f4e9871335d27601a3a2c09fc9f0785e24cea570fc83352a0da45906379b0293e8b58fc7333096f1e3d0de51d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PJARS8CM\ad_status[1].js

      Filesize

      29B

      MD5

      1fa71744db23d0f8df9cce6719defcb7

      SHA1

      e4be9b7136697942a036f97cf26ebaf703ad2067

      SHA256

      eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

      SHA512

      17fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PJARS8CM\embed[1].js

      Filesize

      61KB

      MD5

      4fef9c1e099df4cfd80e218072e66566

      SHA1

      ae23566c37e802116d2a28d2cbca4989ca12949b

      SHA256

      af31d58709c4dfa933290cae1293deb05294f142746cf2e6aa74080860b68eea

      SHA512

      3c889874f7b8c380ec45d1168e3764b83c2ce7b95311b0f1b2e8b1d0977b254d46cb896e501ae0ba72959e7e9284b3b4bfa6448adbd989f9dc63707ce1fe29ba

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TNPG4FQ8\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

      Filesize

      19KB

      MD5

      de8b7431b74642e830af4d4f4b513ec9

      SHA1

      f549f1fe8a0b86ef3fbdcb8d508440aff84c385c

      SHA256

      3bfe46bb1ca35b205306c5ec664e99e4a816f48a417b6b42e77a1f43f0bc4e7a

      SHA512

      57d3d4de3816307ed954b796c13bfa34af22a46a2fea310df90e966301350ae8adac62bcd2abf7d7768e6bdcbb3dfc5069378a728436173d07abfa483c1025ac

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TNPG4FQ8\KFOmCnqEu92Fr1Mu4mxM[1].woff

      Filesize

      19KB

      MD5

      bafb105baeb22d965c70fe52ba6b49d9

      SHA1

      934014cc9bbe5883542be756b3146c05844b254f

      SHA256

      1570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed

      SHA512

      85a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TNPG4FQ8\favicon[1].ico

      Filesize

      23KB

      MD5

      ec2c34cadd4b5f4594415127380a85e6

      SHA1

      e7e129270da0153510ef04a148d08702b980b679

      SHA256

      128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

      SHA512

      c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

    • C:\Users\Admin\AppData\Local\Temp\Cab1DB0.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar1E6E.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Windows\SysWOW64\drivers\vgk.exe

      Filesize

      134KB

      MD5

      34cfbe3ff70461820ccc31a1afeec0b3

      SHA1

      5d32e91c039c9a6f723ba3c04c1179d02e6a0ce9

      SHA256

      6ebcc6896b243c761da4fc28a26249b0c146ae17aff7697c09bc447008e831df

      SHA512

      1ca4661be645e7e954d89c83f1fd126a5e936533052d4e330c9faccb83bb5942d28265375cee743e468b1625a0c1f10888e7957fe88c718e8501a86a78cdc06e

    • memory/2296-15-0x000000013F4F0000-0x0000000141582000-memory.dmp

      Filesize

      32.6MB

    • memory/2296-0-0x000000013F6D5000-0x00000001401C0000-memory.dmp

      Filesize

      10.9MB

    • memory/2296-1-0x00000000770B0000-0x00000000770B2000-memory.dmp

      Filesize

      8KB

    • memory/2296-3-0x00000000770B0000-0x00000000770B2000-memory.dmp

      Filesize

      8KB

    • memory/2296-5-0x00000000770B0000-0x00000000770B2000-memory.dmp

      Filesize

      8KB

    • memory/2296-6-0x00000000770C0000-0x00000000770C2000-memory.dmp

      Filesize

      8KB

    • memory/2296-8-0x00000000770C0000-0x00000000770C2000-memory.dmp

      Filesize

      8KB

    • memory/2296-12-0x000000013F4F0000-0x0000000141582000-memory.dmp

      Filesize

      32.6MB

    • memory/2296-14-0x000000013F4F0000-0x0000000141582000-memory.dmp

      Filesize

      32.6MB

    • memory/2296-10-0x00000000770C0000-0x00000000770C2000-memory.dmp

      Filesize

      8KB