d91912b4b945e88e881e54573390e6723cfc41916b6546453b59e60f9beee337

Analysis

max time kernel
149s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2025, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Size 669KB
Sample250504-gspagsen21
SHA256 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
MD5 ead18f3a909685922d7213714ea9a183
SHA1 1270bd7fd62acc00447b30f066bb23f4745869bf
SHA512 6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91
SSDEEP 6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery persistence ransomware upx

Malware Config

Extracted

Path

C:\ProgramData\_readme.txt

Ransom Note

ATTENTION! Don't worry my friend, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-T9WE5uiVT6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 046Sdsd3273yifhsisySD60h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1

Emails

URLs

https://we.tl/t-T9WE5uiVT6

Signatures

Renames multiple (174) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\Control Panel\International\Geo\Nation	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3984	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\9e6ffc58-1a59-4eb6-9df9-f342707f958b\\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe\" --AutoStart"	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Drops desktop.ini file(s) 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	api.2ip.ua
35	api.2ip.ua
41	api.2ip.ua
12	api.2ip.ua
13	api.2ip.ua
18	api.2ip.ua

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral10/memory/2608-0-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral10/files/0x000b000000023fa0-11.dat	upx
behavioral10/memory/3492-16-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral10/memory/1068-26-0x0000000000400000-0x00000000004A9000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1332	2608	WerFault.exe	85
3244	2136	WerFault.exe	97
1156	1068	WerFault.exe	92
2232	1516	WerFault.exe	93
1696	3492	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2608	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2608	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
3492	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
3492	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
1068	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
1068	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
1516	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
1516	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2136	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2136	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3984	2608	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	86
PID 2608 wrote to memory of 3984	2608	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	86
PID 2608 wrote to memory of 3984	2608	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	86
PID 2608 wrote to memory of 3492	2608	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	87
PID 2608 wrote to memory of 3492	2608	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	87
PID 2608 wrote to memory of 3492	2608	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	87
PID 3492 wrote to memory of 1068	3492	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	92
PID 3492 wrote to memory of 1068	3492	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	92
PID 3492 wrote to memory of 1068	3492	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	92
PID 3492 wrote to memory of 1516	3492	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	93
PID 3492 wrote to memory of 1516	3492	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	93
PID 3492 wrote to memory of 1516	3492	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	93
PID 1068 wrote to memory of 2136	1068	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	97
PID 1068 wrote to memory of 2136	1068	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	97
PID 1068 wrote to memory of 2136	1068	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	97

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\9e6ffc58-1a59-4eb6-9df9-f342707f958b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:3984
- C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
  "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1068 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2136
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 1620
        5⤵
        Program crash
        
        PID:3244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1688
      4⤵
      Program crash
      PID:1156
- - C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3492 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1080
      4⤵
      Program crash
      PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 1620
    3⤵
    - Program crash
    PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1216
  2⤵
  - Program crash
  PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2608 -ip 2608
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2136 -ip 2136
1⤵
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1068 -ip 1068
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1516 -ip 1516
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3492 -ip 3492
1⤵
PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edbtmp.log

Path C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log
Size 1.3MB
SHA256 7bd4646090dff9875e08ea00e5727b11be19fcb850344856e66360c152835694
MD5 f782b09fd215d3d9bb898d61ea2e7a37
SHA1 a382348e9592bdf93dd10c49773b815a992fa7c7
SHA512 9342bd7a0cbabd7e699ea545897a6403371a0034e4bea067a9662dad9e492c5fa9b27efa4c850e1c001c79d6a76ffe0dacb6831010e41c8d5e2a92bd5b898606
SSDEEP 6144:O0xlo4/YXum3pTQSvQWYlFL9XZcykzCI0O:O0xloX+uQSJYFLZZc3CO
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet-host-6.0.27-win-x64.msi

Path C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\dotnet-host-6.0.27-win-x64.msi
Size 736KB
SHA256 f4f6d008e54b5a6bac3998fc3fe8e632c347d6b598813e3524d5489b84bd2eaf
MD5 c3c0fe1bf5f38a6c89cead208307b99c
SHA1 df5d4f184c3124d4749c778084f35a2c00066b0b
SHA512 0f3e96d16c512e37025b04ff7989d60126c3d65fe868dbcfbeae4dac910ce04fc52d1089f0e41ce85c2def0182a927fdcc349094e74cdd21b45a42fde7f01806
SSDEEP 12288:cNiw/dpqlbF07kw3jl2tBds5IBjxMbJxuz+N1qqjJ:cNiwFpEWl3CBdxqTm+f9
MD5 SHA1 SHA512 SSDEEP

Submit Download

vc_runtimeMinimum_x64.msi

Path C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
Size 180KB
SHA256 889217bcb971387bc3cb6d76554646d2b0822eceb102320d40adf2422c829128
MD5 b2e47100abd58190e40c8b6f9f672a36
SHA1 a754a78021b16e63d9e606cacc6de4fcf6872628
SHA512 d30da8c901e063df5901d011b22a01f884234ddddd44b9e81b3c43d93a51e10342074523339d155d69ff03a03a1df66c7d19e0137a16f47735b5b600616ca2a9
SSDEEP 3072:WZxYlh3FSSN9azsEb+9bxwurRgCiAcj59JfFCTqINhydGjLS:JFSSNkA0UxwurRgCittrd/INhyl
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet-runtime-7.0.16-win-x64.msi

Path C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\dotnet-runtime-7.0.16-win-x64.msi
Size 3.9MB
SHA256 50f268e3903c47b37d14bb4217681303756e7f4669488c7121d596767d14a220
MD5 3445d3a9808aef01c98cffca01cea79a
SHA1 a42a4ad264ab1c18f0b3c496a320832ef8a91f4c
SHA512 b146624507003db7a763a38d121d10a72b5469a1f87b12f528fa88f53a4282cb8195946fe98d1a20803b973fdd2201aa0b1c8e4aaba90554fdbda3f472eaa38d
SSDEEP 98304:zjnd3eUB8KIqYKQjgaMlIACC/aNgs83snRFGm1CW4mUcYE:/d3XBxIqtQjulIPC4IOkmHYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsdesktop-runtime-6.0.27-win-x64.msi

Path C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\windowsdesktop-runtime-6.0.27-win-x64.msi
Size 2.9MB
SHA256 ee04e87dad2a315ea4cbd63c9145b6bd23623d8ca77adc891e45f3ab0922dcdd
MD5 0ece2a7e64542969422b5731a576a84b
SHA1 0e188688c0f797f877d76f05d203568b50feebe6
SHA512 83ed25f3069f3b5b2f0440ecac82f4cd44b27db130ec4c2b1edea559f3865afe57fd110b86ef3265c242c7654009bede8c84232e42d87eee3c8029c0916b8c79
SSDEEP 49152:+ZQ6lvfh36pyI27kuRE+cz9dqmvPu7qyElf6J7NsVZ7vMTBRQMJtY05:OQ6lRKgI27kuG+a95Xu/WW7oZ6T7tY05
MD5 SHA1 SHA512 SSDEEP

Submit Download

_readme.txt

Path C:\ProgramData\_readme.txt
Size 1KB
SHA256 163ec5b903b6baadd32d560c44c1ea4dce241579a7493eb32c632eae9085d508
MD5 d75064cfaac9c92f52aadf373dc7e463
SHA1 36ea05181d9b037694929ec81f276f13c7d2655c
SHA512 43387299749f31c623c5dd4a53ff4d2eff5edfeb80fd4e2edd45860b5c9367d2767ae2ee9b60824b57301999dd2bd995b7d3bd5e7187e447aed76106272559d1
MD5 SHA1 SHA512

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 fb6a7c3edcd7b97fabc18855102a39fc4d6d3f82c0fdd39b1667807b71b9c49b
MD5 4a90329071ae30b759d279cca342b0a6
SHA1 0ac7c4f3357ce87f37a3a112d6878051c875eda5
SHA512 f0e206053d4369437c2c0f1f90f0fd03d631e4b9859d807049b41efde823d64cf4d75c28316d932360f7c03bd409e923c8bc2d4f5959361feacecfcf101ae823
MD5 SHA1 SHA512

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 530B
SHA256 6fb1b8e593cb0388f67ead35313a230f524657317ea86271b3a97362e5ec6ad9
MD5 1fbb37f79b317a9a248e7c4ce4f5bac5
SHA1 0ff4d709ebf17be0c28e66dc8bf74672ca28362a
SHA512 287e1d62c9ceb660965c266f677c467fbb997c2f5dcd1d63e185e266488aafc3489ac1d3feec81d10f01ce4a72e61a8bc4e124f137ce8675a220aa7797002e74
MD5 SHA1 SHA512

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 df6d759566b065e985ce9f04ed4720da5187a6365104e4defaa698cf72d12249
MD5 b5188718999cd05b6b48efd49b12b633
SHA1 22029164d1d0cc6659aa9d5af2cbda6f2f688114
SHA512 8641f8db745e4ba626038b57c413a01af162da44334cd308f1ea93a600bf34cf58ca60240185099987c827b72858079785f7be7104461e765ddc8aa50a9a922e
MD5 SHA1 SHA512

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 3524ff541c7049824f5648da573605a6aaebe9787e4186fde3f23d8eef730fc2
MD5 a1f9a8c6640031b13bdca3b43fe2ee90
SHA1 69f0f8387690345f2a4d4a5a83a0927e264d4a21
SHA512 26abce9f1196ee639e494328dca3b1c0e6df4c814421f5effa10ee3032c21542bf1795f0a4ec139671d82746a8317c91d4389d64c324b534d50a67001e590b07
MD5 SHA1 SHA512

Submit Download

5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Path C:\Users\Admin\AppData\Local\9e6ffc58-1a59-4eb6-9df9-f342707f958b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Size 669KB
SHA256 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
MD5 ead18f3a909685922d7213714ea9a183
SHA1 1270bd7fd62acc00447b30f066bb23f4745869bf
SHA512 6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91
SSDEEP 6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-37-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/1068-26-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/1068-27-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/1068-29-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/1516-32-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/1516-1203-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/2136-36-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/2136-35-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/2608-0-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/2608-13-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/2608-14-0x0000000000400000-0x0000000000476000-memory.dmp

Download

memory/2608-3-0x0000000000400000-0x0000000000476000-memory.dmp

Download

memory/2608-2-0x0000000000740000-0x0000000000840000-memory.dmp

Download

memory/3492-31-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/3492-22-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/3492-17-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/3492-16-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/3492-24-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

memory/3492-1205-0x0000000000400000-0x00000000004A9000-memory.dmp

Download