Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

80f45f70d6...93.exe

windows7-x64

10

80f45f70d6...93.exe

windows10-2004-x64

10

Resubmissions

26/02/2025, 07:01

250226-htjbasxjv8 10

25/02/2025, 04:05

250225-enxd7atjy7 3

25/02/2025, 04:00

250225-ekttwssqy6 10

25/02/2025, 03:40

250225-d79cessjs5 10

25/02/2025, 03:10

250225-dpfmdszpw9 10

25/02/2025, 02:49

250225-dazrqaym19 10

25/02/2025, 02:42

250225-c61hfsyj15 10

Analysis

  • max time kernel
    899s
  • max time network
    847s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/02/2025, 03:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    80f45f70d66652a814a2784f3e3da3d304a2e3466bda889791a5de0117862593.exe

  • Size

    767KB

  • MD5

    d7b952b18e2fba388e8ae076488af9e2

  • SHA1

    20a1a5c98e93b87d58d8c6ddbe2450f657e59113

  • SHA256

    80f45f70d66652a814a2784f3e3da3d304a2e3466bda889791a5de0117862593

  • SHA512

    5777c6ff439a89d1571b3104b3fc9b43e5392cecdcd2c8100019582bfb383328648ef86735dbda8e15270f0853bff3ea9864f26a7f9c40d016269e417aa2f04f

  • SSDEEP

    12288:7GqN/XdctpVtkMtsyDqBQ0tA3nyF0Fh0zJmViYV5yvQX05oWI:lNcBtkUqBQ0tknx5yIXgoWI

Score
10/10
jigsawbootkitdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Jigsaw family
    jigsaw
  • Renames multiple (2012) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables Task Manager via registry modification
    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 20 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Sets desktop wallpaper using registry 2 TTPs 20 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80f45f70d66652a814a2784f3e3da3d304a2e3466bda889791a5de0117862593.exe
    "C:\Users\Admin\AppData\Local\Temp\80f45f70d66652a814a2784f3e3da3d304a2e3466bda889791a5de0117862593.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Users\Admin\AppData\Roaming\mtrmbr.exe
      "C:\Users\Admin\AppData\Roaming\mtrmbr.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mtr.exe
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mtr.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:2744
        • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
          "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\ProgramData\Microsoft\Windows\Start?Menu\Programs\StartUp\mtr.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:908
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mbr.exe
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mbr.exe"
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        PID:2096
    • C:\Users\Admin\AppData\Roaming\dt.exe
      "C:\Users\Admin\AppData\Roaming\dt.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Users\Admin\AppData\Local\Temp\dt.exe
        "C:\Users\Admin\AppData\Local\Temp\dt.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2908
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\D549.tmp\disable_taskmgr.bat""
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1436
          • C:\Windows\SysWOW64\reg.exe
            REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2924
    • C:\Users\Admin\AppData\Roaming\bg.exe
      "C:\Users\Admin\AppData\Roaming\bg.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2920
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
            5⤵
            • Sets desktop wallpaper using registry
            • System Location Discovery: System Language Discovery
            PID:2652
          • C:\Windows\SysWOW64\rundll32.exe
            RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2208
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2912
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
            5⤵
            • Sets desktop wallpaper using registry
            • System Location Discovery: System Language Discovery
            PID:2764
          • C:\Windows\SysWOW64\rundll32.exe
            RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
            5⤵
              PID:2860
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2380
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:2888
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2780
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1916
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:2680
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2724
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1356
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:2700
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2852
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1892
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:2328
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1848
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2028
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:2792
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2796
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:408
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:2464
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2776
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1080
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:2732
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2684
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:588
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:2864
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2572
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:680
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:2884
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2772
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
              PID:1600
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                5⤵
                • Sets desktop wallpaper using registry
                • System Location Discovery: System Language Discovery
                PID:3004
              • C:\Windows\SysWOW64\rundll32.exe
                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2728
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1544
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                5⤵
                • Sets desktop wallpaper using registry
                • System Location Discovery: System Language Discovery
                PID:2100
              • C:\Windows\SysWOW64\rundll32.exe
                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2588
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1664
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                5⤵
                • Sets desktop wallpaper using registry
                • System Location Discovery: System Language Discovery
                PID:2788
              • C:\Windows\SysWOW64\rundll32.exe
                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1708
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
              4⤵
              • System Location Discovery: System Language Discovery
              PID:696
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                5⤵
                • Sets desktop wallpaper using registry
                • System Location Discovery: System Language Discovery
                PID:796
              • C:\Windows\SysWOW64\rundll32.exe
                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1032
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1780
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                5⤵
                • Sets desktop wallpaper using registry
                PID:2192
              • C:\Windows\SysWOW64\rundll32.exe
                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1136
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2236
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                5⤵
                • Sets desktop wallpaper using registry
                • System Location Discovery: System Language Discovery
                PID:644
              • C:\Windows\SysWOW64\rundll32.exe
                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                5⤵
                  PID:1852
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1004
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                  5⤵
                  • Sets desktop wallpaper using registry
                  • System Location Discovery: System Language Discovery
                  PID:2644
                • C:\Windows\SysWOW64\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1996
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:356
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                  5⤵
                  • Sets desktop wallpaper using registry
                  • System Location Discovery: System Language Discovery
                  PID:2692
                • C:\Windows\SysWOW64\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2640
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1560
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                  5⤵
                  • Sets desktop wallpaper using registry
                  • System Location Discovery: System Language Discovery
                  PID:2120
                • C:\Windows\SysWOW64\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2576
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Roaming\restart.bat" "
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2980
            • C:\Windows\SysWOW64\shutdown.exe
              shutdown /f /r /t 1200
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1760

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.rubly
          Filesize

          160B

          MD5

          580ee0344b7da2786da6a433a1e84893

          SHA1

          60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e

          SHA256

          98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513

          SHA512

          356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\D549.tmp\disable_taskmgr.bat
          Filesize

          109B

          MD5

          3fc537b642d3756646715325299c6367

          SHA1

          0a6b4d2012d44fe631dd8bf56da001bfd04b99bb

          SHA256

          708511c356493e41ca103db51b8df3fb57898ddb2bb7cf4f11560facde9425ed

          SHA512

          7a290cd5a44ac4ba51d5b8ab6ea7bd2f2c392a1237c8b923267d524b2ab92e532e3c27dd21d96c3e89c5b84060f0e8ee2a4d9e59e21cfc8c3e15322c5334d064

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\bg.bat
          Filesize

          147B

          MD5

          308060ff726cb2be6ee2023c1b2a401d

          SHA1

          e616761e6026cd0de0111c0fa1da49c248138182

          SHA256

          0c0760682d75388a03cc7ba621d338871fc66e17f6d82c8b5147371cb7ce9a47

          SHA512

          382b42ea9d652c02adf879145a897fab94d729c85b491c6099a5cd91b8bf3249ff9d5c536033263f5d78881f42776a1a5c28dd17285b830b577aaadc813355ad

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\bg.bmp
          Filesize

          37KB

          MD5

          889074311bf2b2985e461c4aa4971ed2

          SHA1

          3d89a7b1a7fd4aced01d840102bbbb6877a0702e

          SHA256

          1dd0f0c3dc81a7a202ab34b00fb1581d76d10d514859e9efee7701de1e5824f8

          SHA512

          2340fd94bedb01af0550dbc5e98bf60357c13b097d91a41f52d0ffdb5da40c21f579aad28faddbd6746846cc8a87604823411afded0cd45c7d8e7f5dc7859855

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\run.bat
          Filesize

          418B

          MD5

          be7966cbf9d04a6300febebc0802fd36

          SHA1

          53d3b879f6213dc614fe777e6f91e4e944b81948

          SHA256

          f7bdf62e1e46336cbe0f25681a5ac643d59e6fb4cd69bf55c0b2d5da746ca59a

          SHA512

          2d28d835c11c46a725576371d698b96101e6be9f3a5f41ec0e88800745c5b790106e2e30fb4bfae00e24d53bdad4c9ccd70b0fcc9480ee23c3ed2d5fc1d93841

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\container.dat.rubly
          Filesize

          16B

          MD5

          8ebcc5ca5ac09a09376801ecdd6f3792

          SHA1

          81187142b138e0245d5d0bc511f7c46c30df3e14

          SHA256

          619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880

          SHA512

          cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

          Download Submit

        • C:\Users\Admin\AppData\Roaming\System32Work\EncryptedFileList.txt
          Filesize

          189KB

          MD5

          0f67288d5b65a7c73dd8a4a8b866f399

          SHA1

          395f4e1ab8b2f8a1365589f2ae54dfb55cdebf39

          SHA256

          3b3efdccbba91f46eed1da28e3dcc24ddc00ee65ff424d6b74d2da7788fe9a4d

          SHA512

          a52e948969c077108af1237908bcbe9d339169e8f3fe623dafa81fb023ee5c5c549a2ea7744b486fa21cfc868554821f3f5cb91cda84481e18c03533f44391f6

          Download Submit

        • C:\Users\Admin\AppData\Roaming\mtrmbr.exe
          Filesize

          410KB

          MD5

          2aeb6b2b282f21a87b38989750c5271b

          SHA1

          2482c160b146a5a5710135497ec2218e728c4fc0

          SHA256

          6474f5643f4ce5e6d58daf25c90ccd3ce0149a335fc1a1e0490afb3d458478a1

          SHA512

          1883e705fff13fdade6bf3bfa77bb126bdf94af84c8299d18b6d7077a954a01aabd5907fa9aa02150fc46d25a90dc87a8115e812d30af375ec2b7612aa8a74d0

          Download Submit

        • C:\Users\Admin\AppData\Roaming\restart.bat
          Filesize

          24B

          MD5

          b1e5726bd11a59cf5ab2f3a655108569

          SHA1

          1e2499ead1ff24d61363cdfe9d19707bfdc01f83

          SHA256

          77a9c6aa0dc9979f56ddaac475e1ef31462edc559b542763cf94e658be9de8ac

          SHA512

          4b67b8c7efa5a47a59ebbaf0cf9e8c14c6ecccd4d7cd4f6e7e9f748b89927a6cc0b739064adb29bf43131e6b2e0784f8b01c5ff894a4f598f51f6208309c7072

          Download Submit

        • \ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mbr.exe
          Filesize

          47KB

          MD5

          e5717d5aa01c544162c615e3f2c41453

          SHA1

          e6179b61da625f17ee0f3aa24e89180812118893

          SHA256

          a1daae6000b449a8a5364dd281cd5c1bc91f31feb7ec6879eff510707eda7e67

          SHA512

          9c104f6f0624088e82475a215a62445bedf4b8440a3e56965714297642f4fccf9ce5d5e6d43e389d050de47cd32597783c2e0690ff7ce80c8c604ead21b7b806

          Download Submit

        • \ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mtr.exe
          Filesize

          105KB

          MD5

          d124bb6a1419c81a887317e08745147c

          SHA1

          f23ed76aa5abae4216d9eb1b09ba7adc1e5f5a24

          SHA256

          8ee82ce37b327e425d74018dc6451ea2a3a52df86559e3f45ac7b8bbaf552326

          SHA512

          c1a1ba64836e356959f27c1e82aa142b29aece359c6a4125a049c17edd5d73b5221bc6a2db8f9e4115da58b0e647e54e08d2b01da393b8aedc91602f53aeabe0

          Download Submit

        • \Users\Admin\AppData\Local\Temp\dt.exe
          Filesize

          25KB

          MD5

          5e46ffab95250291c5410237340b9439

          SHA1

          dc2afa42285590e315bac889fdcf3e2236fe9ea5

          SHA256

          08373ea2c1bca3f832667dd9fa6ba51af4c5ddabbb1492b5ba887c36850ac5ee

          SHA512

          2a5debc880692ba90a1abbfd79faa57bdf7e2bbb11881ec677c07702cb9e34775f1516616bee3140a596d272b2e218ecda9858812a64c498033811d03b91005b

          Download Submit

        • \Users\Admin\AppData\Roaming\bg.exe
          Filesize

          343KB

          MD5

          19ed87e5bf49f790025490e8368b1ec5

          SHA1

          1936200fcbd3c6f9b27a5c58c5e95b76b5c46371

          SHA256

          372d505837d53fdf76d62aa6e1adbf2c9a30bab0efa9e2ae6248bb3bcc1f4ff9

          SHA512

          edfce1b54104687f00bbdb2691f3808c83d0cc5c2d9e48ef2c5931404b06094c4554b10857ea55f9dd0d6e2826713fe42aa66ed4cf363b4f688b8831883f8662

          Download Submit

        • \Users\Admin\AppData\Roaming\dt.exe
          Filesize

          328KB

          MD5

          79466f9bb9e981220a43897d33e57d1e

          SHA1

          159af42edf25c9b1ce42a8aac06571ad4a46cc9e

          SHA256

          77fe524e36d99865c5c1e12ed9d8f128f3366a6772c2fdf2533821079b5422fb

          SHA512

          b039d46aa7e777b715d673b7d69a41dd56d16aceddcb3d0c2b9c9e81ab48fb6923517f668becedbcbf90cde1f32320994bc7051f86579f6c486c68de2d8b2d16

          Download Submit

        • memory/2096-104-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

          Download

        • memory/2296-91-0x0000000000D00000-0x0000000000D10000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2296-99-0x0000000000D10000-0x0000000000D20000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2296-100-0x0000000000D10000-0x0000000000D20000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2908-136-0x0000000000400000-0x0000000000410000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2908-105-0x0000000000400000-0x0000000000410000-memory.dmp

          Filesize

          64KB

          Download