Files named ntpwedit.exe

38.10.83.238 · ntpwedit.exe

/mrebello/Publico/

Brazil · OPEN IT SOLUTIONS EIRELI

Yara lsadump From Florian Roth by Benjamin DELPY (gentilkiwi)

Download archived sample
The password is "infected"

SHA1: 8c0873c5e681fd44ca1bb5f2a930f89315940603
SHA256: e8eba1de1ca941e125f6de7fc5a074ab3754788ad80f73a11dee1ccd14a7cecd
application/x-msdos-program
59.00KB
2017-09-26 17:18:06 +0000 UTC
143.137.142.3 · ntpwedit.exe

/mrebello/Publico/

Brazil · Companhia de Informatica de Jundiai - CIJUN

Yara lsadump From Florian Roth by Benjamin DELPY (gentilkiwi)

Download archived sample
The password is "infected"

SHA1: 8c0873c5e681fd44ca1bb5f2a930f89315940603
SHA256: e8eba1de1ca941e125f6de7fc5a074ab3754788ad80f73a11dee1ccd14a7cecd
application/x-msdos-program
59.00KB
2017-09-26 17:18:06 +0000 UTC