Analysis Overview
SHA256
dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a
Threat Level: Known bad
The file dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a was found to be: Known bad.
Malicious Activity Summary
NetWire RAT payload
Remcos family
Remcos
Netwire family
Netwire
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
System Location Discovery: System Language Discovery
Enumerates physical storage devices
NSIS installer
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V16
Analysis: static1
Detonation Overview
Reported
2025-04-20 20:33
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-04-20 20:33
Reported
2025-04-20 20:35
Platform
win10v2004-20250314-en
Max time kernel
59s
Max time network
59s
Command Line
Signatures
NetWire RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Netwire
Netwire family
Remcos
Remcos family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\RxWindriver.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\Netframework.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\RxWindriver.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Netframework.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdaters = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97028583\\WQMVJK~1.BAT C:\\Users\\Admin\\AppData\\Local\\Temp\\97028583\\suwbmcn.eme" | C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdaters = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02611875\\DHIDHB~1.CMD C:\\Users\\Admin\\AppData\\Local\\Temp\\02611875\\sktfl.wts" | C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1916 set thread context of 6128 | N/A | C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat | C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe |
| PID 4480 set thread context of 5284 | N/A | C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd | C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\RxWindriver.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Netframework.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe | N/A |
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Users\Admin\AppData\Roaming\nb673-full.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe
"C:\Users\Admin\AppData\Local\Temp\dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe"
C:\Users\Admin\AppData\Roaming\nb673-full.exe
"C:\Users\Admin\AppData\Roaming\nb673-full.exe"
C:\Users\Admin\AppData\Roaming\RxWindriver.exe
"C:\Users\Admin\AppData\Roaming\RxWindriver.exe"
C:\Users\Admin\AppData\Roaming\Netframework.exe
"C:\Users\Admin\AppData\Roaming\Netframework.exe"
C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
"C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat" suwbmcn.eme
C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd
"C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd" sktfl.wts
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\97028583\WQMVJK~1.BAT C:\Users\Admin\AppData\Local\Temp\97028583\suwbmcn.eme
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\02611875\DHIDHB~1.CMD C:\Users\Admin\AppData\Local\Temp\02611875\sktfl.wts
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | nvdiedico.knowsitall.info | udp |
| SE | 198.167.194.117:3297 | nvdiedico.knowsitall.info | tcp |
| US | 8.8.8.8:53 | wire.mine.nu | udp |
| SE | 198.167.194.117:9702 | wire.mine.nu | tcp |
| US | 8.8.8.8:53 | dico.is-a-hard-worker.com | udp |
| US | 8.8.8.8:53 | roxy.is-by.us | udp |
| US | 8.8.8.8:53 | nicholds.dyndns-web.com | udp |
| US | 8.8.8.8:53 | nvdiedicozeus.dyndns-web.com | udp |
| US | 8.8.8.8:53 | nvdieroxy.servebbs.org | udp |
| US | 8.8.8.8:53 | nvdiedicob.is-a-chef.org | udp |
| US | 8.8.8.8:53 | nerverdieorcus.is-a-doctor.com | udp |
| SE | 198.167.194.117:3297 | wire.mine.nu | tcp |
Files
C:\Users\Admin\AppData\Roaming\nb673-full.exe
| MD5 | de277032de998ff27f75e0cbfb4b7b6b |
| SHA1 | 9d88f2fa882e9c22a353e13387bd7f7005ade51d |
| SHA256 | 47297aac91fa6670efb15c70c80e99656b3fbc5598c2e93304225bbbe6f1a266 |
| SHA512 | b1cb388f356e929c8bde60770e8a0404f0c4c39b724004fd80001a5f0637e892991cc4c0a807cb8358fa0bdbe4cf9819ece0a5ab9503d0103f08d32e7e4d2514 |
C:\Users\Admin\AppData\Roaming\Netframework.exe
| MD5 | 6b60dfc1c2ff57eb2a32423995c766e8 |
| SHA1 | adcd8abb899c4e009216384dcf1f54ed5ba52819 |
| SHA256 | b21f28cf27f33b0ef78a2b1a5040f48fe8a13e5553ee870b1a77d8aefc7aa81b |
| SHA512 | 7d303c9eb3953173694ac6a87aa5dc4eeb1a21ed480a48e776dfbec5822468bcec84ccece786ab7a3483a3e4e4824462444535d23bf23e42cf67bd4a5707cb0b |
C:\Users\Admin\AppData\Roaming\RxWindriver.exe
| MD5 | d323f3245223177b63de1ecbe3f47663 |
| SHA1 | ed7c2f0a5bd951b946a471cc7d5771ce6a5f61dc |
| SHA256 | f82e132f601da9270a40d268809974af7aa406a75e2fa63075a9c3fa3e35673c |
| SHA512 | c3b7a7e6b0b95e3ef3cc9766430596d812ce5844ed45c0ad016b6998aa4e7e71602cf2f4b16100aac4406bef2255f5c88354b87cc3cfbfbace50b06974ec9d79 |
C:\Users\Admin\AppData\Local\Temp\nsr7030.tmp\UserInfo.dll
| MD5 | c22c9d7b6937b8960fba4c8a145076b2 |
| SHA1 | 2e45c2dd6e5132a942fe940dccdaf771e0f9e81e |
| SHA256 | 510e466a715933499fb9d5a1753b483826b2bf89161b9d466dd2ad7e52ede2fc |
| SHA512 | b3b93fb97bc0d16ac35a1f0e877bcf42324e19d21839b025329d1b27d8e96bc9c0cbde0a8d60b23fd0c864f62e3c287461108c6abecf53ac488de1fc16b47d6e |
C:\Users\Admin\AppData\Local\Temp\nsr7030.tmp\cpudesc.dll
| MD5 | d25102051b33f61c9f7fb564a4556219 |
| SHA1 | c683964c11d5175171bd009cb08f87592c923f85 |
| SHA256 | e58e5d1d8da2ea526d0d754b4faad3773021166b0720723efb7b30f1f5075398 |
| SHA512 | 8828eec31926251d7e51b5bf1050c3519c9b7fca4f978fb6ee0bf18f9642c3460687f10ff79e5892100ecadbf49725711567c348e1dfccb3644bd9ef992a92f0 |
C:\Users\Admin\AppData\Local\Temp\nsr7030.tmp\System.dll
| MD5 | 3f176d1ee13b0d7d6bd92e1c7a0b9bae |
| SHA1 | fe582246792774c2c9dd15639ffa0aca90d6fd0b |
| SHA256 | fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e |
| SHA512 | 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6 |
C:\Users\Admin\AppData\Local\Temp\nsr7030.tmp\LangDLL.dll
| MD5 | b26b412d9f1050ad53f663c972fdcd9f |
| SHA1 | 7bc4ed444f3f8fd14c2c36784d828175bace8c17 |
| SHA256 | 70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a |
| SHA512 | ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46 |
C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
| MD5 | 71d8f6d5dc35517275bc38ebcc815f9f |
| SHA1 | cae4e8c730de5a01d30aabeb3e5cb2136090ed8d |
| SHA256 | fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b |
| SHA512 | 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59 |
C:\Users\Admin\AppData\Local\Temp\97028583\nrveb.msc
| MD5 | 8296a539bec586333a216bca6dba8bbd |
| SHA1 | 696098c5bde90f2fda807dd7b42a744ee55965a7 |
| SHA256 | aa05bf9b4485d0cc21eb8881828136cca038ce7676bd1aa0e3df2bd60e80efc1 |
| SHA512 | c31cc0466f549e42672fe4d5aa9c8a24383210a6db1e4d141678170666711b3b9dec3d9400e7c18c8e2c5710ca7d2c859597ccefd04d8b2fecd44424428585e4 |
C:\Users\Admin\AppData\Local\Temp\02611875\jalabegr.txt
| MD5 | 6f3aa0896874ab108c07673ff22978bd |
| SHA1 | 787c20c688a551560c1119581da7bcc1aa754dad |
| SHA256 | 8f3c8402a49c242cad6162f1c4f178cd7d2c7aa23bb34fea473144f2e3c438af |
| SHA512 | 28e403c1373c8c282ed57a034b25a258503caf669669aaf7bd869db340be8120f910724c79ceb8a0f010a9d58cb4000e4cd932b223df69c3b7bef3194bceea34 |
C:\Users\Admin\AppData\Local\Temp\nsr7030.tmp\UAC.dll
| MD5 | 4814167aa1c7ec892e84907094646faa |
| SHA1 | a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee |
| SHA256 | 32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822 |
| SHA512 | fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067 |
C:\Users\Admin\AppData\Local\Temp\nsr7030.tmp\nsDialogs.dll
| MD5 | b3070cf20db659fdfb3cb2ed38130e8d |
| SHA1 | aa234b0620bebddde1414ff6b0840d883890b413 |
| SHA256 | f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0 |
| SHA512 | 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1 |
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
| MD5 | 9d352bc46709f0cb5ec974633a0c3c94 |
| SHA1 | 1969771b2f022f9a86d77ac4d4d239becdf08d07 |
| SHA256 | 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390 |
| SHA512 | 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b |
memory/6128-321-0x0000000000500000-0x0000000001500000-memory.dmp
memory/6128-318-0x0000000000500000-0x0000000001500000-memory.dmp
memory/6128-317-0x0000000000500000-0x0000000001500000-memory.dmp
memory/6128-315-0x0000000000500000-0x0000000001500000-memory.dmp
memory/5284-322-0x0000000000760000-0x0000000001760000-memory.dmp
memory/5284-324-0x0000000000760000-0x0000000001760000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\nsr7030.tmp\InstallOptions.dll
| MD5 | 3e277798b9d8f48806fbb5ebfd4990db |
| SHA1 | d1ab343c5792bc99599ec7acba506e8ba7e05969 |
| SHA256 | fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c |
| SHA512 | 84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92 |
C:\Users\Admin\AppData\Local\Temp\nsr7030.tmp\GetFLE.ini
| MD5 | 2f1ef11d134be7ac487121b9ed3760c4 |
| SHA1 | c39445b7e188f003507945852e3c3930185d5398 |
| SHA256 | e506d0a5ada059b1203342677fdbc13d62724d65fd274eedefc721b85edb8e7b |
| SHA512 | 73805b81cffadc5e408d2c457a9d5d25cf0436edc53b115913ac685bfdf63e0c1f8f31d6fbb43d4635acf8dd643ca39b899c28cefe95d59b1650e49edec685ac |
Analysis: behavioral2
Detonation Overview
Submitted
2025-04-20 20:33
Reported
2025-04-20 20:35
Platform
win11-20250410-en
Max time kernel
0s
Max time network
62s
Command Line
Signatures
NetWire RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Netwire
Netwire family
Remcos
Remcos family
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe | N/A |
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe
"C:\Users\Admin\AppData\Local\Temp\dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe"
C:\Users\Admin\AppData\Roaming\nb673-full.exe
"C:\Users\Admin\AppData\Roaming\nb673-full.exe"
C:\Users\Admin\AppData\Roaming\RxWindriver.exe
"C:\Users\Admin\AppData\Roaming\RxWindriver.exe"
C:\Users\Admin\AppData\Roaming\Netframework.exe
"C:\Users\Admin\AppData\Roaming\Netframework.exe"
C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
"C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat" suwbmcn.eme
C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd
"C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd" sktfl.wts
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\97028583\WQMVJK~1.BAT C:\Users\Admin\AppData\Local\Temp\97028583\suwbmcn.eme
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\02611875\DHIDHB~1.CMD C:\Users\Admin\AppData\Local\Temp\02611875\sktfl.wts
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | nvdiedico.knowsitall.info | udp |
| US | 8.8.8.8:53 | wire.mine.nu | udp |
| SE | 198.167.194.117:9702 | wire.mine.nu | tcp |
| US | 8.8.8.8:53 | nvdieroxy.servebbs.org | udp |
| US | 8.8.8.8:53 | roxy.is-by.us | udp |
| US | 8.8.8.8:53 | dico.is-a-hard-worker.com | udp |
Files
C:\Users\Admin\AppData\Roaming\nb673-full.exe
| MD5 | 7216859ade4b53dd0e0ac198dc77ad90 |
| SHA1 | 1eaa7c4ac6db22a243ffbbf427239bf2b49983d7 |
| SHA256 | b080ec36636322a2fb71b5c7aabcea776ea16d989ff6d5ffe56e3547b1a770c2 |
| SHA512 | 4079bba09ca0f3a128630a1e73b7d546d2a344bd2a96518847f8d947e2ecf08cddfdd24fa9bc2d6819eaa4282a0f9e92b70ec457c8abe720673d03d50008a354 |
C:\Users\Admin\AppData\Roaming\RxWindriver.exe
| MD5 | d323f3245223177b63de1ecbe3f47663 |
| SHA1 | ed7c2f0a5bd951b946a471cc7d5771ce6a5f61dc |
| SHA256 | f82e132f601da9270a40d268809974af7aa406a75e2fa63075a9c3fa3e35673c |
| SHA512 | c3b7a7e6b0b95e3ef3cc9766430596d812ce5844ed45c0ad016b6998aa4e7e71602cf2f4b16100aac4406bef2255f5c88354b87cc3cfbfbace50b06974ec9d79 |
C:\Users\Admin\AppData\Roaming\Netframework.exe
| MD5 | 6b60dfc1c2ff57eb2a32423995c766e8 |
| SHA1 | adcd8abb899c4e009216384dcf1f54ed5ba52819 |
| SHA256 | b21f28cf27f33b0ef78a2b1a5040f48fe8a13e5553ee870b1a77d8aefc7aa81b |
| SHA512 | 7d303c9eb3953173694ac6a87aa5dc4eeb1a21ed480a48e776dfbec5822468bcec84ccece786ab7a3483a3e4e4824462444535d23bf23e42cf67bd4a5707cb0b |
C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\cpudesc.dll
| MD5 | d25102051b33f61c9f7fb564a4556219 |
| SHA1 | c683964c11d5175171bd009cb08f87592c923f85 |
| SHA256 | e58e5d1d8da2ea526d0d754b4faad3773021166b0720723efb7b30f1f5075398 |
| SHA512 | 8828eec31926251d7e51b5bf1050c3519c9b7fca4f978fb6ee0bf18f9642c3460687f10ff79e5892100ecadbf49725711567c348e1dfccb3644bd9ef992a92f0 |
C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\UserInfo.dll
| MD5 | c22c9d7b6937b8960fba4c8a145076b2 |
| SHA1 | 2e45c2dd6e5132a942fe940dccdaf771e0f9e81e |
| SHA256 | 510e466a715933499fb9d5a1753b483826b2bf89161b9d466dd2ad7e52ede2fc |
| SHA512 | b3b93fb97bc0d16ac35a1f0e877bcf42324e19d21839b025329d1b27d8e96bc9c0cbde0a8d60b23fd0c864f62e3c287461108c6abecf53ac488de1fc16b47d6e |
C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\LangDLL.dll
| MD5 | b26b412d9f1050ad53f663c972fdcd9f |
| SHA1 | 7bc4ed444f3f8fd14c2c36784d828175bace8c17 |
| SHA256 | 70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a |
| SHA512 | ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46 |
C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\System.dll
| MD5 | 3f176d1ee13b0d7d6bd92e1c7a0b9bae |
| SHA1 | fe582246792774c2c9dd15639ffa0aca90d6fd0b |
| SHA256 | fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e |
| SHA512 | 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6 |
C:\Users\Admin\AppData\Roaming\nb673-full.exe
| MD5 | e70213bdd7fba84b47a0fb7536411160 |
| SHA1 | b7c86bd575d3c16a0b549165945c223a2007cbe5 |
| SHA256 | 03b62040f94df47d33ca7d77e55c175d6402a3bf9ba5c9b52d2763da9ef1fda4 |
| SHA512 | f4981731b19a02802b2c8c3663c20852bbd2420af56accac7fbfba70136ec9ec8034cfdf85550b5686b3729bc7199fd90090989cf24eb77929085641536af892 |
C:\Users\Admin\AppData\Roaming\nb673-full.exe
| MD5 | a8a84f7f02f7cf9b3db6910de537b186 |
| SHA1 | 33ef8c6f2c2a107938652986feb3e870df87b678 |
| SHA256 | b2f4635408cde1bbf892074a1d3fe01d9f1141925b3f1bdea8c494084e696826 |
| SHA512 | 4526bf720a035bafc4a6f6b123efa3d82c997052fc5adf5ad17351ad47dc2ec5040c64f894d5b114d78a4ab9e42989d3fc7187c0ce4c73640461ca28f634302d |
C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
| MD5 | 71d8f6d5dc35517275bc38ebcc815f9f |
| SHA1 | cae4e8c730de5a01d30aabeb3e5cb2136090ed8d |
| SHA256 | fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b |
| SHA512 | 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59 |
C:\Users\Admin\AppData\Local\Temp\97028583\nrveb.msc
| MD5 | 8296a539bec586333a216bca6dba8bbd |
| SHA1 | 696098c5bde90f2fda807dd7b42a744ee55965a7 |
| SHA256 | aa05bf9b4485d0cc21eb8881828136cca038ce7676bd1aa0e3df2bd60e80efc1 |
| SHA512 | c31cc0466f549e42672fe4d5aa9c8a24383210a6db1e4d141678170666711b3b9dec3d9400e7c18c8e2c5710ca7d2c859597ccefd04d8b2fecd44424428585e4 |
C:\Users\Admin\AppData\Local\Temp\02611875\jalabegr.txt
| MD5 | 6f3aa0896874ab108c07673ff22978bd |
| SHA1 | 787c20c688a551560c1119581da7bcc1aa754dad |
| SHA256 | 8f3c8402a49c242cad6162f1c4f178cd7d2c7aa23bb34fea473144f2e3c438af |
| SHA512 | 28e403c1373c8c282ed57a034b25a258503caf669669aaf7bd869db340be8120f910724c79ceb8a0f010a9d58cb4000e4cd932b223df69c3b7bef3194bceea34 |
C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\nsDialogs.dll
| MD5 | b3070cf20db659fdfb3cb2ed38130e8d |
| SHA1 | aa234b0620bebddde1414ff6b0840d883890b413 |
| SHA256 | f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0 |
| SHA512 | 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1 |
C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\UAC.dll
| MD5 | 4814167aa1c7ec892e84907094646faa |
| SHA1 | a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee |
| SHA256 | 32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822 |
| SHA512 | fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067 |
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
| MD5 | 96c201253a2a277d7e6d40167548991a |
| SHA1 | f3b0e69f65e9a27a5af1d96af75f1a6a23cf77aa |
| SHA256 | 808aec47f908410c01f820683f1c33198e05525d159863925690fdeb319eac1a |
| SHA512 | 8c2af8688802019fd0c18fcd279ac3821caa0923631610589a6c23663d5200038ad7e3cfe698339ee92cf621ef4ffedf11bc5082cb6ed860eb955dfc60fdacc4 |
memory/3080-326-0x0000000000F00000-0x0000000001F00000-memory.dmp
memory/3080-330-0x0000000000F00000-0x0000000001F00000-memory.dmp
memory/3080-329-0x0000000000F00000-0x0000000001F00000-memory.dmp
memory/3080-324-0x0000000000F00000-0x0000000001F00000-memory.dmp
memory/3080-322-0x0000000000F00000-0x0000000001F00000-memory.dmp
memory/1984-331-0x0000000000900000-0x0000000001900000-memory.dmp
memory/1984-335-0x0000000000900000-0x0000000001900000-memory.dmp
memory/1984-333-0x0000000000900000-0x0000000001900000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\GetFLE.ini
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\InstallOptions.dll
| MD5 | 3e277798b9d8f48806fbb5ebfd4990db |
| SHA1 | d1ab343c5792bc99599ec7acba506e8ba7e05969 |
| SHA256 | fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c |
| SHA512 | 84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92 |