Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 09:18

General

  • Target

    66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe

  • Size

    196KB

  • MD5

    66fb1bb18e75f0bb0bca89d55afb0ec9

  • SHA1

    52b7f47a3ad12580434f956b21f98547a886284d

  • SHA256

    db2725ac686e28562c27ef88699ede3bb5dc3cdd58644cf2cb7bd02bb8d36680

  • SHA512

    b3541098cf04bdb3bdfec69981e79848afb4da6b1cebc19dfc75dfaa6ba5266c0a6cee180052380c37f6bc4d1c58e47a829f9df5f4c3cd974df3a83b569318de

  • SSDEEP

    3072:1uwTNLvIi99v3kaVfH3b52iOXbbx16B0YMr/F3VvZqsmGqOHXIFBjm1/cY7Kx:PRvpVz5OXp1Y0YMr/FFFm1sUYWx

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 12 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 10 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Users\Admin\AppData\Local\Temp\inlC13F.tmp
        C:\Users\Admin\AppData\Local\Temp\inlC13F.tmp cdf1912.tmp
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_lk_file.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:840
          • C:\Users\Admin\AppData\Local\Temp\lie8C2B.tmp
            C:\Users\Admin\AppData\Local\Temp\lie8C2B.tmp
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2632
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_rlh_tmp.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:844
              • C:\Windows\SysWOW64\PING.EXE
                ping 88.99.00.00
                7⤵
                • Runs ping.exe
                PID:1108
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\MICROS~1\NTUSER_LOG.hta"
                7⤵
                • Modifies WinLogon for persistence
                • Modifies visibility of file extensions in Explorer
                • Drops desktop.ini file(s)
                • Modifies Internet Explorer settings
                • Modifies Internet Explorer start page
                • Modifies registry class
                PID:272
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://tc.92mh.com/
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2808
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1560
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Users\Admin\AppData\Local\Temp\kilA4AB.tmp
            C:\Users\Admin\AppData\Local\Temp\kilA4AB.tmp
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:916
            • C:\Program Files\Common Files\19920306.exe
              "C:\Program Files\Common Files\19920306.exe"
              6⤵
              • Executes dropped EXE
              PID:1100
            • C:\Program Files\Common Files\920306.exe
              "C:\Program Files\Common Files\920306.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:788
              • \??\c:\program files\frfwoscpug
                "C:\Program Files\Common Files\920306.exe" a -sc:\program files\common files\920306.exe
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:984
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Windows\SysWOW64\expand.exe
        expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"
        3⤵
        • Drops file in Windows directory
        PID:2888
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\66FB1B~1.EXE > nul
      2⤵
      • Deletes itself
      PID:1052
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:552
  • C:\Windows\system32\attrib.exe
    attrib +s +h "D:\RECYCLERMD4"
    1⤵
    • Process spawned unexpected child process
    • Sets file to hidden
    • Views/modifies file attributes
    PID:3024
  • C:\Windows\system32\attrib.exe
    attrib +s +h "D:\VolumeXX\desktop.ini"
    1⤵
    • Process spawned unexpected child process
    • Sets file to hidden
    • Views/modifies file attributes
    PID:1420
  • C:\Windows\system32\attrib.exe
    attrib +s +h "D:\VolumeXX"
    1⤵
    • Process spawned unexpected child process
    • Sets file to hidden
    • Views/modifies file attributes
    PID:1628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\frfwoscpug

    Filesize

    24.2MB

    MD5

    2ebc555f24de2388b726c6e69d30f3fc

    SHA1

    2521743cc5bf3229284bf5ec179115eaaede7b39

    SHA256

    7dddbda0745f9656adfe7dff4097fbceaf22e2578db9ad9cbc0b6f34e1c79f61

    SHA512

    1d20b0be837e269d71854cf674969591b4364f5cb79e433079b945630e8e5ee83fe2855158c9109e6c6424761b9e3f10d01a571edcc59a098b4b653170585467

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9874f901d0a5e9e3160dc9408a89a699

    SHA1

    20da0c198efae5cb162c77003e1007c198adc54f

    SHA256

    fd5d8d52e058a539d9869c95c9c50f0439a3ce867e7cb4006b6222b055fab7f9

    SHA512

    92c8403615d7f3b291808a1c3e9c2bfa7886fb721f4e2288820bacb907b3f1fba720010be5674de44775944ece667f52e8c5dbed7725e51b4423dc4647c653ce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1ca9fb6c6a2ae35f6f109e23eb7d8461

    SHA1

    62bcccf6e6f86b3852ae8425a04c2616dd088377

    SHA256

    f2551a9f1dacc3daf97ed7b520cccf26be70dfbd948559976a27fd036aaa2d68

    SHA512

    a6300edfe6904e4272450eee16fb6ff8a4151bf21f9fe4a23ecc5e99385838823f4f9dea59f1e5c842ea8d21f7c454159c59de682f01adb1ba62bf975d1f1ca7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    31c527aec78094b041d2260913705cf3

    SHA1

    3d625e9865016c7c6a0e5ccf1e8d265dd2a668f6

    SHA256

    16b2ed2647bbf72aeb26258e209c8b2f5e37d3b8ac4f436158015722732652bb

    SHA512

    90a3b6e2823d80b2b03adf671e29c00d356ef7225a366ce872c93c9bce4e3cd0d47ba6e2b5c5540cd6e85dbe384258116cc01f343a441a4900fa59e3d424e26d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4194445b2a51dc5bf04be4e0d52b67ee

    SHA1

    107b6e1f8713fc492da05b17e8fa1fb3175f16b8

    SHA256

    479f09cc5ab1a58bd7ee6b80f83c03ded341437cb7c06e02abf4f34967e76636

    SHA512

    1f5cc2dade63a070384da29c383118fa2abf30f202f66304f9d604568faeefe02a9319cb2f4a464aa48a894da6cc384ae7d9a68eee90867f6f27d7df450cd109

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    90dec120a3b3906871dcd0e0d325d0fd

    SHA1

    5dee640d162a1aafd411c08b60d079bd41903251

    SHA256

    4613f13f7e7cb802c948bc90cdaafbd4877a97cd93da507081fe77edf589a564

    SHA512

    c20b25a9d8c381e9877ee83e1b898149f5b4bc38176b1263cb486ed2de7ff46cb01c98857a74fe5ce74b436569dd61092ea204ea999f686444ae00ff5480c59d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aacd677c45815cc8e3b16e7aadd59c37

    SHA1

    478e1b472fb7be0334fb5b34ef0287a45f7f5d56

    SHA256

    c280e2bb22ebb1b72abd05b37a19099e341794402dae5d9bf1297648ac3fd9bb

    SHA512

    63192b47c972f48f308b48b2086604dd6ebd2132e8f6a46aab723e962258bfff2e1eb080e9e437346ada821a3dd902b66352274b3bb95d8b29612b63630b4325

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7cdd46cabf2a80c38044bba0961c0d7e

    SHA1

    4c08a3e0303e9efacec87863aa37a4d413a968b8

    SHA256

    d57fdc90b829e661a5dc533c892e130cb689d78b1405cd982b21680cc32fc926

    SHA512

    9fcc770938db6c629d76293c7ac61ddf54d61ee484f69bb6e8ffab99363ea87fe143758d5ae16e01f7eba2f90c654f1c531839694cd5ac97b56dc557451be1f3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    678cbc1a39edc5bac1bf725a369da851

    SHA1

    4c70e70c2bbb1545eb0efc7d9786c24d617e80b8

    SHA256

    688f3402ffeab58523f7d4827b2e096c1889364f9df4586999079469aa70d622

    SHA512

    52616f3cb7f41ac7ffa9b43c7bc00eefed53f7d9d18e02391eaf058ac484a5022514c8583ccd1c344501fe20c822d3265c742c94a69be9553c866c5e573ec096

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3a9c4539d1a87476a658f64b96fa551a

    SHA1

    fef930f43ca1455c497df71294a7c1e81ed73095

    SHA256

    684138c66ea7500c131331cb6f97a0d8a27f8474e3cda15e24c1423413578903

    SHA512

    f0a8b3a9ccab59b07ed96bc46fb4f3a1ddc7fd2f72c931c0b7aca93066d6158df954d7e8cc4b740ba23ec094d4e67d93b755095f94e03ba18eb31124dba41a37

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    13ccba185ab1d8a25575f00125b16af2

    SHA1

    42e6a866bdb53831c2098ad16667351e0b877bf4

    SHA256

    8dc5eaee4ec041c419ca747fb30afb6866e893bf14bf0e2d0db1220f31f23912

    SHA512

    2ba3c0eb591b9bc2cf8c59e913c8af24827ba14e024929643229391afe4257c7f0e18d3f57304a6dc8d24f8b64971a49b0a650ce339e0d0063746f1a3ebb016a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    839c0211bf09e6033b503313d650d76d

    SHA1

    d6efd78a43b6f3c0d2733fdb01493db184a2e1ee

    SHA256

    4209437d9317e67d6cf12d1a9962561b711cc1b88da679d700af7a50dd558671

    SHA512

    bdca2887faaeb123a342c5c74cd1a19184b7bcfc8dd05b300b3fda60c61c93d721ffbed27be2d0a1f928739ecd79133134e931d0bdcfc29ef92f1e7380358e76

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3c6960838bdf0e00c93875b4f4144db9

    SHA1

    49ed84ea90d15c5e21a15f2ac580c4ff7c50c07e

    SHA256

    2ef34538aff34301334cf9084233b47e5a20fbd0cc998c91a8a37dfae7e7c130

    SHA512

    5d5d4627e77fbfe8856ef58363e3f61e720d74ba73abb218597f17ae655bc576107e59ddebc2f4c2627398d851ad9c2cfd12f813ee6737e3139d64e0562c338f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c1f8a3e2354dd07328bf9fc932e3aa4

    SHA1

    37cbd51d76f7f09eed22b1df9b9c81e7e3d9ac5d

    SHA256

    0572a0672057f4fde10f1f9a65ef3d90df5bf7d307423a9d5e214ff448921350

    SHA512

    154f33001ac44b684aa8c2bffc86894940b2af79bd1adbcd6885d144345e8d3968be3c9dde0d6e0ddb65dbb62ddf67c6bca7901e67c77f7c67a1040cedf35e2c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c676442aa46070bf4ad1fadb21315667

    SHA1

    a0312f85cb3025256820d9f2b0cec01bdb0edfd1

    SHA256

    2c89447c37eadb2f5e1cdcb3b157b934f4f14fae8efcb66ced835ff7046defa8

    SHA512

    d249dbb132a0b656d5843ab7bb80f611e0dcddaa4eda45d9b8ffc147e6ae8d51f54e7529ce6533b4f0c8d5ba39902703ba8989fd72fba72c0393513f9d6d8dc7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1fb0efabbe4d3b8be82a8e0688114e0f

    SHA1

    dec9b3b90952271fe0ca0811c68f1c14fdbab399

    SHA256

    e392ed431c54e9280e0864672e5575d1d339d596d1b773d54f9c9297361e2c83

    SHA512

    cf251aecd7dd18970e50e68036646f38d6746ea0d9e46127a5b5c6909707d96c33cf4056db70f54d36f130a7b2f76234e550861a34477f49ef816b025b814cb5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0402728975a607c12fec288e2a3b6347

    SHA1

    0741e39602b275651786aec7961dcb3f17ba2d1e

    SHA256

    aec09ecd23e7ef341bd6caf21cd161bb294cfeeb7e65abd1d1dc00cd645ab526

    SHA512

    be9f1e30f9301087c6726c6f196872785efaa7736f3a585955272554e5b023f160be1ec6b39b35a1307e51f987bba8d64c75044355b22e4ac1331af7012b1151

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    266e25738b8adc31483c37e8fb1e81ce

    SHA1

    33193b48030877fc59d248b605df596fb4096af4

    SHA256

    62ee73aaf546c5f6d4535dd73edf9a68b64a4cb1fea7c85a9ebbb834b9f2d1df

    SHA512

    e44673ec08e603b8e7c6f1270d7bb9c300ea2d6d3152a1fc759b804dc0cf917d50d6faaeccbbeaf02230d597443a71b3bdc9173eaaccfec8c3520be731718315

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    17278beccbbcfb4ead6329b86ee7ad1e

    SHA1

    aac5b37c445bbd9e27193a81a290709e16df9453

    SHA256

    699b60e62e9463700ab4a5c276e2356e4590457e7c918a99f97fe164cc3d0779

    SHA512

    a9f737f92a7fd24ff1e5111378829e8eddca9ea231646d6e3fb625f9e8b2b38990e6ee769382a8a8d554a7b66c080742914ec99eeeb8af2416ef7e1a22d15e38

  • C:\Users\Admin\AppData\Local\Temp\CabB79F.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarB81F.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

    Filesize

    766B

    MD5

    b69d002455f1a5a100e717a6a84ff991

    SHA1

    3a99b22845afb2132300095d84534e65823e678d

    SHA256

    c05465e73465c2d6addc7514ad50b517675ce26bfb1a4cad3d3b64b617940934

    SHA512

    1f2e36f1e8c6f66ba746a3450a9f5c07f300bff4682e32344541596b0bdae7e3f443f3e25deaa7936195c48642f9268e3a626a4018772417ce48d26e4f9d1505

  • C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

    Filesize

    57B

    MD5

    992342e0c40fb5198d006af557bb4c3b

    SHA1

    f61c605d63a4d5cef4bb97a30407e536c5fe2164

    SHA256

    5ce5d159402e3cca63eaffbf853954109e6b2e54bc829e3b2e9449e9990acc68

    SHA512

    84c0323a1bf02c0fccfbad452a96c24c4428e6e25daec4444ac3a180105673163e9c5db5d24eea8d95a068c3dba589db1d61fa30484f11f0397286da0944430f

  • C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat

    Filesize

    45B

    MD5

    92cf97f84f9d72c40b545fd34892c8f2

    SHA1

    c3d7d0dbd9f9aba840846bb3492a16217c5b7705

    SHA256

    24f47a172745f5704b2c99c40466067fb220c55ad8d9a652160fd71af28ed2d4

    SHA512

    af5bbf5db449acdeb03dab6ce08f9f1ef77bc6ecd035eb733fd8855c8c00e0e876b6e8b515d5ef57579e0f42c3f8664d08d02017f8eca475098508c30614abc6

  • C:\Users\Admin\AppData\Local\Temp\run_lk_file.bat

    Filesize

    45B

    MD5

    90a0d913607a67481d2b119e6e108ec8

    SHA1

    2008ab055006efa35af6c4afb7e994c269e35371

    SHA256

    ba9457e2f6a43fde58ba6f20e151e2d88d61eaa32be6f9e80a2cee49c346882d

    SHA512

    81b4a238a63da50d63f09ecd7569a98dc16ecaccf10cfd57c919e5abcd814b6135af8e98afc6114f38b9a83c46829396d198da97e65dfa5cfd07a5b0796cd393

  • C:\Users\Admin\AppData\Local\Temp\run_rlh_tmp.bat

    Filesize

    70B

    MD5

    edea5cd5060d69b6c558fea75e330a67

    SHA1

    929e7c5ca8c300a98ac6833d0e8fa912ca9fa5dd

    SHA256

    1ed1bc8bfd84479497b2c1e3d0ca1df56eb2f3d82a68862e8b50eead06889b39

    SHA512

    adbe14c811b915972709530049bb6934eacead6c5d19243ecea07abdd6c93aeede3fcae99f6419fb7ca1b2394dcef19e642be36f22c572de01b069dac2b4aa61

  • C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

    Filesize

    98B

    MD5

    8663de6fce9208b795dc913d1a6a3f5b

    SHA1

    882193f208cf012eaf22eeaa4fef3b67e7c67c15

    SHA256

    2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61

    SHA512

    9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

  • C:\Users\Admin\AppData\Roaming\MICROS~1\NTUSER_LOG.hta

    Filesize

    7KB

    MD5

    55409e8335285720e34eeb153fee993d

    SHA1

    51336bf33901c5a544387b8ae5fe3ca2f97f7db8

    SHA256

    90e0062b4e9e8dca75ff5f6792529075d2594e74fb4693ace0001fe226e6a42a

    SHA512

    1964296394ae968c3fdc5bbe9d808f2e51c45f5610d48f7db77d7ce70f9525290eede4f8411768825824131bfaffa43d4ccfb0fdfacd3c53ccd5458843d4049d

  • \??\c:\program files (x86)\winrar\formats\date\e%sessionname%\wsseh.cc3

    Filesize

    24.1MB

    MD5

    8340c238857b9e5cb09ce13bf36c408a

    SHA1

    46896130befd1a51f3167c5b083e55320e38cad9

    SHA256

    6f6cc983c050c3d5a27077f31d3873d3e094c3948c54ee4f4a6b155dbc5bd2e6

    SHA512

    5463a2228034ab71e1751f0f3f2b22a5e33a66cb1ea8c46877404e46acb91a6503789dffe68b570f56f5e7a6d38ace837d9b78adcf0583253c1bc847ea728c1e

  • \??\c:\users\admin\appdata\local\temp\favorites_url.cab

    Filesize

    425B

    MD5

    da68bc3b7c3525670a04366bc55629f5

    SHA1

    15fda47ecfead7db8f7aee6ca7570138ba7f1b71

    SHA256

    73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5

    SHA512

    6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

  • \Program Files\Common Files\19920306.exe

    Filesize

    24.1MB

    MD5

    a82f04d1fd1b6abb2ca8e94993851c1f

    SHA1

    1eb80cfbafa58610ba5f71098e8939f2aa18b4b9

    SHA256

    1e7c28e1212269aa32937edd00f03c82664cccd28bd896814297d135ea815a4e

    SHA512

    999890fa395afec55b4a4b0d091c635fff73d3c367b4fcdfb865d76cced4ed2726ac8cd75b3163ff577046275712b4b71046219293610921fb4b8493879210a6

  • \Program Files\Common Files\920306.exe

    Filesize

    24.2MB

    MD5

    66fca0dea236541aad7678c3f1f8e44d

    SHA1

    6e52b3a3ab6432ff82b6fbf4e37fa95da9612dbe

    SHA256

    2b35ada33435d7fa0151fa8520e53e30dbe61e9d34f1a4608f4000b1a2a5e78d

    SHA512

    fd59c6660bf764b2f9f1fbd0aaae907b5c68691ea8ee447dbf2e7565374806075a1690b4f95ea069f5bbe1d8dcf5c7db204506b97958d18abf10a77865fd8396

  • memory/552-581-0x0000000020000000-0x0000000020027000-memory.dmp

    Filesize

    156KB

  • memory/552-583-0x0000000000170000-0x0000000000171000-memory.dmp

    Filesize

    4KB

  • memory/788-571-0x0000000000400000-0x0000000000430938-memory.dmp

    Filesize

    194KB

  • memory/788-327-0x0000000000400000-0x0000000000430938-memory.dmp

    Filesize

    194KB

  • memory/916-575-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

  • memory/916-325-0x00000000002C0000-0x00000000002F1000-memory.dmp

    Filesize

    196KB

  • memory/916-324-0x00000000002C0000-0x00000000002F1000-memory.dmp

    Filesize

    196KB

  • memory/916-115-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

  • memory/984-576-0x0000000000400000-0x0000000000430938-memory.dmp

    Filesize

    194KB

  • memory/984-582-0x0000000000400000-0x0000000000430938-memory.dmp

    Filesize

    194KB

  • memory/1480-114-0x00000000022D0000-0x0000000002321000-memory.dmp

    Filesize

    324KB

  • memory/1480-116-0x00000000022D0000-0x0000000002321000-memory.dmp

    Filesize

    324KB

  • memory/2080-35-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2556-2-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2556-29-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2556-8-0x00000000006E0000-0x00000000006F0000-memory.dmp

    Filesize

    64KB

  • memory/2556-3-0x0000000000020000-0x0000000000023000-memory.dmp

    Filesize

    12KB

  • memory/2632-94-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2876-70-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2876-66-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2876-54-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2876-55-0x0000000000020000-0x0000000000023000-memory.dmp

    Filesize

    12KB

  • memory/2876-122-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB