Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 11:58

General

  • Target

    NiggerDick.exe

  • Size

    3.6MB

  • MD5

    edcd9b037986143a8bad4985bf0e661d

  • SHA1

    aa7ad22502f138c9ef68b6e66f50999ed94c7276

  • SHA256

    e65878b615947fcf75baee636c9a2012e28873beb43b8b0250bd9af4b11339ba

  • SHA512

    3f62163ae6bb81dc59e23c6ad5192de1fd0bfe7e6e85e4420119e314b48c7431bdd368c841f802c858aee67a45b88959ce32f961de9a8e965cc47cf7b946ea9c

  • SSDEEP

    49152:8F24+xNyKwdkMRcHwK5+MdqUolO+r8tEAmafrP4iUUYJETGXP6XA:8F24gNyKw6MpMdqpfrjgUi2ETGXM

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 4 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 14 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 50 IoCs
  • Modifies data under HKEY_USERS 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NiggerDick.exe
    "C:\Users\Admin\AppData\Local\Temp\NiggerDick.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Local\Temp\rig.exe
      "C:\Users\Admin\AppData\Local\Temp\rig.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2320
    • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
      "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2908
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2992
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:536
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2940
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2972
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /main
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\SysWOW64\notepad.exe
          "C:\Windows\System32\notepad.exe" \note.txt
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2348
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:736
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:275457 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1652
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:472089 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2648
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:472110 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2504
        • C:\Windows\SysWOW64\taskmgr.exe
          "C:\Windows\System32\taskmgr.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1664
        • C:\Windows\SysWOW64\notepad.exe
          "C:\Windows\System32\notepad.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1584
    • C:\Users\Admin\AppData\Local\Temp\32.exe
      "C:\Users\Admin\AppData\Local\Temp\32.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Users\Admin\AppData\Local\Temp\32.exe
        "C:\Users\Admin\AppData\Local\Temp\32.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2372
  • C:\Windows\SysWOW64\colorercaching.exe
    "C:\Windows\SysWOW64\colorercaching.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Windows\SysWOW64\colorercaching.exe
      "C:\Windows\SysWOW64\colorercaching.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:1056
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x5c4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    157082b65ad9c3f8dc7e23e0f0fe38aa

    SHA1

    a008731e3c20d507458ea6fa5d063a78a0a12d8b

    SHA256

    fc88707e5e8307869688fb96bdec9e85d630c5bea3eabbef0df67d7989fe1ad2

    SHA512

    fbb691afdef2fbedd432a8c84c0e0766534b626094d0dc96724d0c3e4e3d3047b596b409a85b33096e47f53efed5d8ad74a752569367751682916cdac85da145

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_6FECED388A0018EC91E0052A44417642

    Filesize

    471B

    MD5

    25896e222f5514fca82f66dacd2daaf8

    SHA1

    37b8a261af87de05afca4c1149c8027a01c88322

    SHA256

    06704b0c124973002bb187fe80cae31528c62d2348d3a3a83c1a11ef7538acb3

    SHA512

    a3337ae86d4a7244fbb346f44760ea5feea1421eda2fa25524039dee4917902f9dc8cc62b55a134c8a20453beab407ef5b10ceebb4a10906e1a86730d871533f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    fbdcf0314c61c9f8e44d47ab5e798dec

    SHA1

    b63437765c0ff9828b3bfa8d82b09a52b72b88ba

    SHA256

    82fdfa2c1deb7a535b40551f1f20e5052000aa7f03d99402142a7ec0c7cf6985

    SHA512

    cba1c7f254fa6e3ebfd3f875709a8430bde54e3e40e5c9f36d6c7c2eae2b77e6feca9e7ae3b1c1ed67d388fe5dc2efea9788b3397b5428a7a425fe1603315c68

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    9f80d96e07317f49f5766caf259ccd8b

    SHA1

    84fe35697ce3decd8a95f939f045c6253a0428be

    SHA256

    7020f4274c1d1a7dbb9a9d2ac1b1defa264c4660332903e9a33fef210538397a

    SHA512

    8e05e48872990653bd8a5e8ec51888eb1a1e5e0d15ef0846eb98f8bb1b8c54f0e419978f11148971372138f350f05943b6661eea9461453188c38997992470dd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_6FECED388A0018EC91E0052A44417642

    Filesize

    406B

    MD5

    04a62b88bc5e54374dda46f2d4c22505

    SHA1

    00563a87cdee2600ae5f1f20e56411b9345baca0

    SHA256

    9c0615c1142ed789e3947b05508f6097954957e4f8fdd780d910440944fb4d99

    SHA512

    0d2dea756da1a6036e600ea67124035782f5d9c232ae847ec876690def195dcdddd979b3ca08025f6c33cfd2f82ee87f6788b0af31e3ce0103b56fdc2e04b198

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c9982dfabab58a27cbd21d1d4570389f

    SHA1

    a9b7e78faa7714ff97500ef5b1bf222634222c3c

    SHA256

    fe833177ff750d7a413213975bc30323deee129155cfcd6d5c7cc933f2d424f8

    SHA512

    5525597725350aa6b3768fbaf863caf37880c5e51285da7f7cf125fbbae98ca6d1e967a804b82d5c45722a64cbc0004cf846d84996f75d2e17832a4b7eda9790

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d00bc56bb715c977923c8bda61abdbac

    SHA1

    6edaffd11808218c12e65433221a546e994fd352

    SHA256

    3cd9b2e8d602e9558b505ddc398472f119deac398ccb6a3377569fa2c1685da5

    SHA512

    1741f02a49734ae0ac103f7e78c8da0feae2175ec3ad6f840fde77d2d10a8dc166b18364fde18bc271bc07ce763374c7d4cea5952629f5c4ee85714daf5939c3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d78061ef10393f12a78d5814dcf4ec25

    SHA1

    bf5e677f1353d3fcfc63413c8080e5fa7788762c

    SHA256

    775e7acf1cb284b4ab2a52ec687b4c1c66e238124b022f04596eef7752091755

    SHA512

    2e60c5da23ba2f5253874aaeaa33d39ca6cb4df5652b61c37d13e05d97ee1cea9fca6fb931ad4dd87d53657ac32acb13f4c5b2b73307d692ec577d710679dad9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e55a97a18383fd054301e8ffaa2379d3

    SHA1

    41b13e77f1c62b1e48c28355e6ef88a43123f401

    SHA256

    8742f5c809a517372f72c16fcbb11e09115a18ddbd4a91167944811e0375c95e

    SHA512

    a95f4bce096f94ab5f685d5fd432eb9f3767347cecc1788413526d0e486b72d82f2ff1680864f3913e8e51f65f13dac0b3619062d8ccc1b11544e5d1cbdfaca4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    76457c6168b378721855f5de6043be92

    SHA1

    6c6e558660bc922ea4566c728dc7a399dfb42bb4

    SHA256

    0ea110765f5acb92cdd157cc24716785a49bf68b0268b70b43111ca22c614d6f

    SHA512

    b90a5181ea79c2a3a08c0804eeacef3f0198295d80f010950c174de1550a406768dfabcef096ba73193152220aafdb32471490e9be261e8c8ba7f0b1ebb263b3

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DRZZVUJP\www.google[1].xml

    Filesize

    95B

    MD5

    cf0c5fdd471f2e829ce33b9e942cbcf3

    SHA1

    37b694432cdb13efb90f97e43c783c8a6c1a94b5

    SHA256

    8017e03e7f85969d791cc5ec1c68b034ff5fe8662ed762439b7b7659e63f200c

    SHA512

    f228884c0a0197e40fe96ca37026118ddaa09ff74e0b2460276a971ba96006390708e5e03f17ac857cb7e0c6d91627d843e802ad61f534fb34ec295fd46fa2e6

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ljg9kkp\imagestore.dat

    Filesize

    5KB

    MD5

    65b0608d8a5c484012f2c9697a971d8d

    SHA1

    a1f8dd83231018f3838a421788381d34d027a1ef

    SHA256

    bed990744295505fe94f967ba2bc8b3102b5a452ddaa7a7873d1a9582a492c8a

    SHA512

    abb535b290cc86ee1266667437d8a92618a9e5bbc14ed82b2c96bbecaf9192823e1b8120ec5f1c494af3020c6ad0092ca98b56b968904eb10530782dda7261bd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\FkNC3QKrILcGiXc94rAauJyMGAHApQ6hAvp8TCXOiCY[1].js

    Filesize

    24KB

    MD5

    e073ab2d33b1bfeec8a8f5f05d071129

    SHA1

    b5bc61b7253c1f91fc6c60625a08d14edc2322d6

    SHA256

    164342dd02ab20b70689773de2b01ab89c8c1801c0a50ea102fa7c4c25ce8826

    SHA512

    502831cebcefb1e09863689742720de1e655ddff4754cda498ee79a40413d82b3c95967b204f7c5e672f4b80445cc73955e7ab5c404de816bf232d00f21893c6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\KFOmCnqEu92Fr1Mu4mxP[1].ttf

    Filesize

    34KB

    MD5

    372d0cc3288fe8e97df49742baefce90

    SHA1

    754d9eaa4a009c42e8d6d40c632a1dad6d44ec21

    SHA256

    466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f

    SHA512

    8447bc59795b16877974cd77c52729f6ff08a1e741f68ff445c087ecc09c8c4822b83e8907d156a00be81cb2c0259081926e758c12b3aea023ac574e4a6c9885

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\api[1].js

    Filesize

    870B

    MD5

    e9dec22fcfdf664ec4fa785cc2d8317a

    SHA1

    65b176ba5ab9cac538af82ea4f580c3bf22d0305

    SHA256

    0f0a70b4ff4a326079d0a1063ae8905940ca4e2529ba64169d42952966f9f693

    SHA512

    5781361dd03e3a896504f1c8776a9d862ecd103c67925ae0762fd32128a29730887b336fdf2e4dc2ab5f28bf8a84f1e8a98f94ec7d38191044a56251a29d0b55

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf

    Filesize

    34KB

    MD5

    4d88404f733741eaacfda2e318840a98

    SHA1

    49e0f3d32666ac36205f84ac7457030ca0a9d95f

    SHA256

    b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1

    SHA512

    2e5d3280d5f7e70ca3ea29e7c01f47feb57fe93fc55fd0ea63641e99e5d699bb4b1f1f686da25c91ba4f64833f9946070f7546558cbd68249b0d853949ff85c5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\favicon[1].ico

    Filesize

    5KB

    MD5

    f3418a443e7d841097c714d69ec4bcb8

    SHA1

    49263695f6b0cdd72f45cf1b775e660fdc36c606

    SHA256

    6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

    SHA512

    82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf

    Filesize

    34KB

    MD5

    4d99b85fa964307056c1410f78f51439

    SHA1

    f8e30a1a61011f1ee42435d7e18ba7e21d4ee894

    SHA256

    01027695832f4a3850663c9e798eb03eadfd1462d0b76e7c5ac6465d2d77dbd0

    SHA512

    13d93544b16453fe9ac9fc025c3d4320c1c83a2eca4cd01132ce5c68b12e150bc7d96341f10cbaa2777526cf72b2ca0cd64458b3df1875a184bbb907c5e3d731

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\styles__ltr[1].css

    Filesize

    55KB

    MD5

    4adccf70587477c74e2fcd636e4ec895

    SHA1

    af63034901c98e2d93faa7737f9c8f52e302d88b

    SHA256

    0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

    SHA512

    d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\logo_48[1].png

    Filesize

    2KB

    MD5

    ef9941290c50cd3866e2ba6b793f010d

    SHA1

    4736508c795667dcea21f8d864233031223b7832

    SHA256

    1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

    SHA512

    a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\recaptcha__en[1].js

    Filesize

    531KB

    MD5

    2ea96f82197c227ad3d999f6a6fcf54d

    SHA1

    dc1499948a1822d16cab150eaee16f4ab8c028d8

    SHA256

    e1d667d61bb50e0a815101a7d0d7f379b7219776fee856eedbe965a049db8d44

    SHA512

    dafee1d415487b796e02ef295073382aac48ac76e90c749028a9241bd44ec04ec2ee34163b8177f94d01e9e9d87577ec34c18d780a9f17b80923106d992749a9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\webworker[1].js

    Filesize

    102B

    MD5

    487a5328afcf6c20ddc11ca1b46a4a44

    SHA1

    f37e030501a0a3ff828bef96481ac1c71043999f

    SHA256

    de9539c3628315c1a7d33dc3e09dd75767bce3868c188cdc7c90ff207da0fec3

    SHA512

    71e22ba1a7bcab2f7ddce3153eee1cd961de32a9000c94a59f097cecac9918e94b4cfbd944081a1df4a594f20193bcb39fa7323b3e519e5d5956c342908dc53d

  • C:\Users\Admin\AppData\Local\Temp\32.exe

    Filesize

    1.2MB

    MD5

    568d17d6da77a46e35c8094a7c414375

    SHA1

    500fa749471dad4ae40da6aa33fd6b2a53bcf200

    SHA256

    0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615

    SHA512

    7beb044f8bd366350b267c0fedc8466d2c5fd80b0f791f5697ce4577edced36b668401fd48df90b6c4ced05247d990c5e739e7232a2dcfc059dcc0c6a79d9427

  • C:\Users\Admin\AppData\Local\Temp\Cab1D03.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

    Filesize

    14KB

    MD5

    19dbec50735b5f2a72d4199c4e184960

    SHA1

    6fed7732f7cb6f59743795b2ab154a3676f4c822

    SHA256

    a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

    SHA512

    aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

  • C:\Users\Admin\AppData\Local\Temp\Tar1DA2.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\rig.exe

    Filesize

    2.4MB

    MD5

    570a9cc9fd20159e92707abe69676299

    SHA1

    864cb610c0c80cf8ff00fd4aaae9b05fa63fd990

    SHA256

    ba52bd426e17cf8902ae05eb8caea7e0510d668db97dedd2cabcd1dc5a06063f

    SHA512

    ba11d2e1888f736d1934e78db6397ae04ea49422beb7392575422ea51cd459ac9b0c8a274397ab828792728364d145c16fc2390242a17a56a8ad02fa4c580f92

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K46VZU3Z.txt

    Filesize

    125B

    MD5

    56d169201f7d5b1633a07d7990bdd96f

    SHA1

    9ddb35168cbc28024cc04a32ffa32778543822da

    SHA256

    c357603801bdb6dd752eba3ebdb3eaedca481e3573cad4569045eaf6e8a85e2d

    SHA512

    f10fbdae86d696a3cd3b0cb2d7f4a0bca8967b8ecfcdc4812ea8608ee6bd885b698b6435c904f84863c4b434b8b93d925da0eca5c0ad6e5f41f9791bb7b34da5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TNY5J3YS.txt

    Filesize

    123B

    MD5

    7243d167f28400309c79e585e7dec4eb

    SHA1

    7a931f887cd050d40857a04c6cce739fea8cad5a

    SHA256

    a09772dfc61f0c6b0a898d3775d72af92ce040b8897ad8d52bef30ccfe41a3f3

    SHA512

    a1858297864688714e95af0c60326af5bd4f4d3372a41f232ba6915ca86a8cbf25a32c49130c14c3a952bd9d86a61420cc02f8e88b4f127decccb9a14765d724

  • C:\note.txt

    Filesize

    218B

    MD5

    afa6955439b8d516721231029fb9ca1b

    SHA1

    087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

    SHA256

    8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

    SHA512

    5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

  • memory/1056-60-0x00000000003B0000-0x00000000003C9000-memory.dmp

    Filesize

    100KB

  • memory/1056-56-0x00000000003B0000-0x00000000003C9000-memory.dmp

    Filesize

    100KB

  • memory/2304-0-0x000007FEF5723000-0x000007FEF5724000-memory.dmp

    Filesize

    4KB

  • memory/2304-1-0x0000000001210000-0x00000000015B2000-memory.dmp

    Filesize

    3.6MB

  • memory/2320-35-0x00000000004D0000-0x00000000006BF000-memory.dmp

    Filesize

    1.9MB

  • memory/2320-38-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2320-40-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2320-44-0x00000000003C0000-0x000000000090D000-memory.dmp

    Filesize

    5.3MB

  • memory/2320-36-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2320-361-0x00000000003C0000-0x000000000090D000-memory.dmp

    Filesize

    5.3MB

  • memory/2320-79-0x00000000003C0000-0x000000000090D000-memory.dmp

    Filesize

    5.3MB

  • memory/2320-78-0x00000000004D0000-0x00000000006BF000-memory.dmp

    Filesize

    1.9MB

  • memory/2372-33-0x0000000000300000-0x0000000000319000-memory.dmp

    Filesize

    100KB

  • memory/2372-29-0x0000000000300000-0x0000000000319000-memory.dmp

    Filesize

    100KB

  • memory/2372-61-0x0000000000400000-0x000000000052A000-memory.dmp

    Filesize

    1.2MB

  • memory/2616-50-0x00000000003B0000-0x00000000003C9000-memory.dmp

    Filesize

    100KB

  • memory/2616-54-0x00000000003B0000-0x00000000003C9000-memory.dmp

    Filesize

    100KB

  • memory/2876-24-0x0000000000280000-0x0000000000299000-memory.dmp

    Filesize

    100KB

  • memory/2876-20-0x0000000000280000-0x0000000000299000-memory.dmp

    Filesize

    100KB

  • memory/2876-28-0x0000000000260000-0x0000000000279000-memory.dmp

    Filesize

    100KB

  • memory/2876-34-0x00000000002A0000-0x00000000002B0000-memory.dmp

    Filesize

    64KB