072a6463f71cf233bcb0dd40bb572a1df620b0dbb7aa36fc84410790c032ff8d

Analysis

max time kernel
101s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
28/05/2025, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe
Size 1.5MB
Sample250528-wefhra1vcv
SHA256 072a6463f71cf233bcb0dd40bb572a1df620b0dbb7aa36fc84410790c032ff8d
MD5 dd8a4e3ce966744eebc8fc43a01ef3cd
SHA1 8c30951d64f18857f2d2bbfdb99fcb6bab3cc59c
SHA512 10a98622bab7a6cf96980810ec9ee0f371960e3c858f2b9164c4ba03a8086323a80cf225d303daa5a7a295bb08dca11ff16bb7478e4bceb38de717c23491a631
SSDEEP 24576:i0aaIq3fxbriprn8PbQFPDK3nGUy5HxZUh72PGO9dq5lC6b3yT986npLp/iN2xrd:iDmr88PK715HxZA7g9so6mT5z/vlR/r
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3512	Concern.com
5308	Concern.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2148	tasklist.exe
448	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3512 set thread context of 5308	3512	Concern.com	92

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SillyStatewide	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe
File opened for modification	C:\Windows\BoatingRevisions	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe
File opened for modification	C:\Windows\AdditionBoxing	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe
File opened for modification	C:\Windows\FlashingComputer	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe
File opened for modification	C:\Windows\GermanyAm	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe
File opened for modification	C:\Windows\JudgmentAmbient	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe
File opened for modification	C:\Windows\PossibilityKnight	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3512	Concern.com
3512	Concern.com
3512	Concern.com
3512	Concern.com
3512	Concern.com
3512	Concern.com
3512	Concern.com
3512	Concern.com
3512	Concern.com
3512	Concern.com
5308	Concern.com
5308	Concern.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	tasklist.exe
Token: SeDebugPrivilege	448	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3512	Concern.com
3512	Concern.com
3512	Concern.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3512	Concern.com
3512	Concern.com
3512	Concern.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 1476	248	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe	79
PID 248 wrote to memory of 1476	248	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe	79
PID 248 wrote to memory of 1476	248	rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe	79
PID 1476 wrote to memory of 2148	1476	cmd.exe	81
PID 1476 wrote to memory of 2148	1476	cmd.exe	81
PID 1476 wrote to memory of 2148	1476	cmd.exe	81
PID 1476 wrote to memory of 692	1476	cmd.exe	82
PID 1476 wrote to memory of 692	1476	cmd.exe	82
PID 1476 wrote to memory of 692	1476	cmd.exe	82
PID 1476 wrote to memory of 448	1476	cmd.exe	84
PID 1476 wrote to memory of 448	1476	cmd.exe	84
PID 1476 wrote to memory of 448	1476	cmd.exe	84
PID 1476 wrote to memory of 2392	1476	cmd.exe	85
PID 1476 wrote to memory of 2392	1476	cmd.exe	85
PID 1476 wrote to memory of 2392	1476	cmd.exe	85
PID 1476 wrote to memory of 5580	1476	cmd.exe	86
PID 1476 wrote to memory of 5580	1476	cmd.exe	86
PID 1476 wrote to memory of 5580	1476	cmd.exe	86
PID 1476 wrote to memory of 1048	1476	cmd.exe	87
PID 1476 wrote to memory of 1048	1476	cmd.exe	87
PID 1476 wrote to memory of 1048	1476	cmd.exe	87
PID 1476 wrote to memory of 5384	1476	cmd.exe	88
PID 1476 wrote to memory of 5384	1476	cmd.exe	88
PID 1476 wrote to memory of 5384	1476	cmd.exe	88
PID 1476 wrote to memory of 1648	1476	cmd.exe	89
PID 1476 wrote to memory of 1648	1476	cmd.exe	89
PID 1476 wrote to memory of 1648	1476	cmd.exe	89
PID 1476 wrote to memory of 3512	1476	cmd.exe	90
PID 1476 wrote to memory of 3512	1476	cmd.exe	90
PID 1476 wrote to memory of 540	1476	cmd.exe	91
PID 1476 wrote to memory of 540	1476	cmd.exe	91
PID 1476 wrote to memory of 540	1476	cmd.exe	91
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92
PID 3512 wrote to memory of 5308	3512	Concern.com	92

C:\Users\Admin\AppData\Local\Temp\rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe
"C:\Users\Admin\AppData\Local\Temp\rusifikator-dlya-the-hunter-call-of-the-wild_patched.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c copy Roommate.xls Roommate.xls.bat & Roommate.xls.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:692
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- - C:\Windows\SysWOW64\findstr.exe
    findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 176152
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5580
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Modeling.xls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1048
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Explanation" Me
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Dp.xls + ..\Wilderness.xls + ..\Spray.xls + ..\Circle.xls + ..\Aggregate.xls + ..\Mpeg.xls + ..\Swiss.xls + ..\Leu.xls + ..\Controls.xls + ..\Quad.xls + ..\Powerpoint.xls f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\176152\Concern.com
    Concern.com f
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\176152\Concern.com
      C:\Users\Admin\AppData\Local\Temp\176152\Concern.com
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5308
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Concern.com

Path C:\Users\Admin\AppData\Local\Temp\176152\Concern.com
Size 1.0MB
SHA256 69d2f1718ea284829ddf8c1a0b39742ae59f2f21f152a664baa01940ef43e353
MD5 c63860691927d62432750013b5a20f5f
SHA1 03678170aadf6bab2ac2b742f5ea2fd1b11feca3
SHA512 3357cb6468c15a10d5e3f1912349d7af180f7bd4c83d7b0fd1a719a0422e90d52be34d9583c99abeccdb5337595b292a2aa025727895565f3a6432cab46148de
SSDEEP 24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\176152\f
Size 815KB
SHA256 0a012be5eae57518390a6f6b09d221edc2da9bee16df83798011976b22443f22
MD5 a46a979421b4b0f59d71adea4e5336c7
SHA1 73a47e10d1baef7402b9f07f7da919e94f284aae
SHA512 92b53529d5eab2f87217116fe3945c1c9c4eb73cedfb1c27e758a5a4fa0faadc9ff3bdf40c1ec75ecb73f48c5a4c792373e7198c7e4336ec0dd6e274475e242b
SSDEEP 24576:d7TRxFA1tx8pSB1iu5gHxPTlzE9zn6Y+wmC5P7:ZF8wu8p6nD1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aggregate.xls

Path C:\Users\Admin\AppData\Local\Temp\Aggregate.xls
Size 59KB
SHA256 6ed95df17ae5db6702c43c411a099e6196a771d1d6fd018518a01a130975fa67
MD5 cefe8871c340486821adc0b7c4e0d017
SHA1 edaa03add04739878e579c32c16c8b23b0c4c0cd
SHA512 154fce0b6f5e3aacf5082a5bbb43d2261fbeb7acb6036a3baa9c50cb885880761c9cfc83a78fba1d1229c9fca003faf0b0884350c71bd24b013fa4cfcd6b3393
SSDEEP 1536:aEkJHO3Em/u2vo1JuoP+TQ0my5MT03DNlozf9BhiYRW+5SxsRW:aPBNk3vEJbP+TQ0jA03B6zFBhjA8SxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Arctic

Path C:\Users\Admin\AppData\Local\Temp\Arctic
Size 111KB
SHA256 839bcf8a3ee7603309373791dd02dfe357388f6ae6831abc8588792509abe971
MD5 db03216c1d5fa3de9b401b8598be261c
SHA1 7ab5f935d5fdf6e09479524f34d50d2fe938aa5c
SHA512 a0a78ca47ca8624b009c1e82a1f096e9d3f85333269a6486c16f852c065ab0a9d953aa8b41042f82b27a4aa6cd3b50fa08b7eb5b032b9e2417be3cffb88974e2
SSDEEP 1536:4CMxrvTgarmecxrUctj1SgTONnDR6SBQHtHB3EYrDWyu0uZo2O:4CMxTTgarmecxokjqR6tH9BDWy4ZNO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Assisted

Path C:\Users\Admin\AppData\Local\Temp\Assisted
Size 50KB
SHA256 46d1859c5e061af73413e32ecc2ebc3856e8a327ee5215244810388d017cf740
MD5 6685a652e2658f5f0715d55f854eaaa7
SHA1 bc390c521d0f3dce0b1d0b03110a991237842cfe
SHA512 19a08b605992b331e982af50abe8e1d29790a180e5fc2b42044a455bafa8bb3e959ce51a9dc568f7cbd65dfda70fcd6cd8a9cae58644b06e033aa6181c13f4fb
SSDEEP 1536:6ZqH5SDYVWCW/iGlPDnHBJaekiGLc8WWUCr7f7:6Z6qYVWCWqGxhJQc8WIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Assure

Path C:\Users\Admin\AppData\Local\Temp\Assure
Size 114KB
SHA256 a05b937f0cf6f86c8bd1e930a1f2638b35444635f3182bb773ee3c4d7f449f28
MD5 3aa54a6d52d8f208a9424a069bd95c37
SHA1 043562a3036e2c8efe951ebe5426dbb0d842129b
SHA512 ed5b33b96af17584189b1a655bf8df78973068161501a9fcdf92b1ca828eef0a28519a87e9a5348038a606adf1c4befe0774032835d2e3a031f264b28042491c
SSDEEP 1536:8SnVrjwbd1mYNCqLzYXvUVoUP7TbF3CHQTYPV0fj++Evissa6C:8Snhw51mYNCeVlP7TbFSHQcqb+zisZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bangladesh

Path C:\Users\Admin\AppData\Local\Temp\Bangladesh
Size 137KB
SHA256 8eb6fdbbd4412b4cb6dd95647cbeb79a6d180e042342f57c0bdea0eda0409516
MD5 9364f2e6c476d6f933af67a8cc27b014
SHA1 9e25fce9c55219953e7106bd6457d09c156501c7
SHA512 1c087bec91fb1b7f29eca48afb62a488c340fc67ae9c594f988cae59c1e98198716a56134c6a3cb733dca693fa38bc1927708a83c797128f4010225fc046e441
SSDEEP 3072:NYiYDX4+EK+7LjKuLhg2IpWTqVblih/sBSDoY4BVv6kaAP:z+mNLjRJIpWTqZlCohddP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Circle.xls

Path C:\Users\Admin\AppData\Local\Temp\Circle.xls
Size 79KB
SHA256 1778358356632062f9e30295004b7ba126375851e0f5a5bffa7b836a42b6c772
MD5 aa55c410154a0f9ef798a0ef0610455b
SHA1 acf2b2fe7a204e03fbb43e639fcaab182cc59ae4
SHA512 c9efbc2f253bc848524282550286ac2e7e8bf8353e78d4a2754938ffceca4c661a314d9d205e53e25df5f16c668b2aab83cc724bb991decb46e153ddec6720af
SSDEEP 1536:RQn/UfQGBwK84cJaI0VYrNX/49YO9298MuCUdoYzrgUNt/em9bQFQ7:yCN5ZI0VONXAee2NUbzrBNcm9UFQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Controls.xls

Path C:\Users\Admin\AppData\Local\Temp\Controls.xls
Size 92KB
SHA256 a6f86b2d8633eb38c57f747b83fd988523e40e1cb33c71e2d735cee622e1957a
MD5 4feda41d320bebce492a92723cf289b8
SHA1 d46e1c46ce58f2d8d35ba0d4c27543368aff63ba
SHA512 909dfacd581b7e67a5aba8c9c7245d35fcde60446c3e4403a392b25e16d943573f2bc82caaed357aed1c7a0fb2eca8e70473fe885cfc9ecaceee0e78410b5dba
SSDEEP 1536:o+EzrwGuwGtMSteDMYVcjrHMBl0zyiG9mnS6CDyGKfG8cTLbwQQsvk6V4l6xm:ovzFIMS84rLMLvipUDbK+PXJQs86V4lJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Damaged

Path C:\Users\Admin\AppData\Local\Temp\Damaged
Size 88KB
SHA256 6c786c6770e6c5187be22ee0bd7848d457cdc24ba02423b6e7da2e0efc4a3a47
MD5 474f3d838c74457132e95bb3476c657f
SHA1 86c0d402781ad02f6ced1b95de5e0284bc7d207c
SHA512 81959a3d8628ea9eb1e2ec819ed5f36fd95ffef099130e1331aafce30cc8c49d3574e58700d1fc45040aa8f16cf23251e6d3b765bca8318b32be1fbae88cd817
SSDEEP 1536:LPzSoEjwhDkNJmcd6L+u7wpn+KP/UUQaRUerOwm7yNhbf731y/DOGf9mq:LvhDkNJmj+u7PKPcF7yDbr1y/DOIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dp.xls

Path C:\Users\Admin\AppData\Local\Temp\Dp.xls
Size 94KB
SHA256 35369135ed9e61c0e838e388a0b422cdbc50411f1bbd7f052c0110e5dfe8c7e6
MD5 2e6d485890e87232d9fb6aa78813eafb
SHA1 3c4bf5895c39d3801f48bc43765d3664f9d73f13
SHA512 ce41b699ae02525fd2a8af1c2a830f3025d5e58f1f6921519863fb93397ce45d3c7b96ac7893b8c664ffc5690c00429d63132a8c0cc954cf3fb02664a3ab60b4
SSDEEP 1536:NJFrGmICzQN0FJ6kjBslWsnx+xCLo0pIKNndR/zcOjZO5GgY8m:N2RCpJ6isosx+0PHR/zcGNJz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Explosion

Path C:\Users\Admin\AppData\Local\Temp\Explosion
Size 105KB
SHA256 235f9d68b78b17ed6f77bfe792d15d365d4bb19557551f5e6c5890440f9eb7aa
MD5 30ded98c139a63d2a06df62289f22b25
SHA1 34e0ba1065c019d7d425c32298258f5d3bc1afa0
SHA512 ee8b3d38417e444b8d632f7a8cf0a0fdf59b079cfadc05beb021328c7084b1894b342a1da5f798e4d0f5b52772cc433c0c825270576d82374c2f16d6a0f11e07
SSDEEP 3072:Vi2M0ML+LFvThDWChDiT03Q5RpyuDs1ZazbB:1VLFv1bV+t5XyuDsj8bB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Joins

Path C:\Users\Admin\AppData\Local\Temp\Joins
Size 124KB
SHA256 ae3f8107f115155bfce5d3d80c5f16461e2faaaa3f7e5123ebfafe705d34896d
MD5 a4a6a8541e12649a32cbe29b8f46526e
SHA1 d41adff4a414c9f1fb021bdd5106149fb7f410bd
SHA512 a8a97b78c35a8e90990814adc87a3e9d82169f18cebb8bbce711a1cfcfe97753a873ef0bf35c8f81e5c5b25ba9b27b3e17930db2c24343dd1c97b9b3d299edb6
SSDEEP 768:YuN+Pc/mex/SmKAGWRqA60dTcZApmpdpE0wJmZtIHNKtPtP3T1muOp9yjvN76a93:YujPtK6j6iTc1d3GKtPtPouAyjIQcno
MD5 SHA1 SHA512 SSDEEP

Submit Download

Leu.xls

Path C:\Users\Admin\AppData\Local\Temp\Leu.xls
Size 68KB
SHA256 2b6d5debce8b59caec609d12000aeb1c908203d7abfe42e0c2103b946c474dc5
MD5 42600413eb2fa01cace06892c16984fc
SHA1 1a57730346a40572a926ab12884572386f5f7410
SHA512 8749ea3d1709e4f9042769f1915c4a504c9de13fef72a36a56ab2d562d1c799708ff34dbf2b2aad9e2dc809d05f7d766a21aa34a657a44e4ff90140ad7919890
SSDEEP 1536:sx7v15sjlKSeDvpfHSQaNFzkCrMfNwfyYMMNPFdWrJY+:sSjO1y3zQCMfARborJY+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Management

Path C:\Users\Admin\AppData\Local\Temp\Management
Size 15KB
SHA256 cd654dca3e4ecca384fe1e0d20e3143b5f2d1695ea8375fef00d47320d9b2da9
MD5 2d223da182a95ad1aeec487a36405aeb
SHA1 bc5c3cfe3ecce932383c89078414b691f754c58a
SHA512 961bcdb9595c64860eef890b2528ba823ad69be85650194233287ee3bcb4b9edc233decf69763a68c11af4b61980cff5094d5d9114af4c0faa382d951f678dd6
SSDEEP 384:Itel9lS6AmYMIXs0EKd+VaeCVc6ov05MQ3R:59BS8VatzoA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Me
Size 755B
SHA256 4cf3ccb13dce9e71f884e871e8dea89bfeb60785369591d7181aeb1eade383bc
MD5 2ab460085cfbd39e1f9c6ec1a657e64c
SHA1 e63ab91260d21138b96d1c601586a83265acf58c
SHA512 53ec2310a9d423a6ab6e17120317f1b7a81f3d0f0e4054d7568f98a7b4e4f03747b77bb9e8cd50c7b6fe1c9c7a7eaf2699f1a7f0c1bac37d82e6597f5eca8a29
MD5 SHA1 SHA512

Submit Download

Modeling.xls

Path C:\Users\Admin\AppData\Local\Temp\Modeling.xls
Size 511KB
SHA256 91bbf6d615cb49ff6931f955edc051940ee5b7139e27d2ca391b362edba1a67a
MD5 e43fdeccc75ee2c62ef2367022bec2f3
SHA1 1b062c99db29bf5d961e234267520bb2040420ec
SHA512 c03773edcdf9e00d04136c6667475f9de6c471fa57853decd9c7f93643bfea896258a94393cb366b8d26a14c7fde4ec355d09b2edf892af9ee66f2894fa3b0da
SSDEEP 12288:+uzXxtEUf8VKO6vmQDFjmc/qgFoZ/LG0YCHCgLf2yE6p:TzlcQdmc/zFoZYcCgLTp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpeg.xls

Path C:\Users\Admin\AppData\Local\Temp\Mpeg.xls
Size 99KB
SHA256 0cd7c0850d3075777181efdfcdd45e62fd3fec295bf7588ee084f67c1b6647fe
MD5 76b9d70581ea2699f2970ce50318e4e1
SHA1 820d59d4d18853d2948963137df924c1ebe466e9
SHA512 cec0eff976034c9d6df7cddf7a00729c3ad43c20f97b3109dc0ac01be500a8e4b7ef1024dd95768fe24e20e20a65bd716913d17d9d32e51875802be8137bfa11
SSDEEP 1536:FyujtUyYUiLG02QQvcqhxKOqi2OBOcotCaqZjYV9uZVNxx91R/R0L+b11WBhnI8C:rtUyriy0QcOToSamjYOTNxxvtTDGh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Normally

Path C:\Users\Admin\AppData\Local\Temp\Normally
Size 88KB
SHA256 100c9574fcd62b7dbd730a6adca852cffa2771ef095b237da44e0ffcfed7d3d1
MD5 945d1b1e95210db7cb6fba540468f1be
SHA1 4c9b604192fec1e48d379a13de27579e5e790587
SHA512 30e26a59fcf835764197cd43f8f84a414649a0404a6f3f550764ce3e8d1ec4f3daa1902f2ddfc405e22442a59f26c88c27cdd634dffe750af86020ac92da9407
SSDEEP 1536:F2SAKaYIudg+Rv1sC5NrS9zBXnpoYSSGe/s2G9wwZSDQPXHU9:F2xKbI/+Rv1N5Nr09XpoeGY38sQPXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Objectives

Path C:\Users\Admin\AppData\Local\Temp\Objectives
Size 87KB
SHA256 ada8951c70e957f50132e21130e433451900e22950d16221ab1b7d21285aa572
MD5 cc5cbc29536b4d9a1dd959e505a728c8
SHA1 cb95664882fa7ec5c76536883c165f891ebd4801
SHA512 5cb1e5b783f78cc92080a3c3e67b38b39c0eec287f16f1fd3729e71726938bef93d5b743e591f050626a7766e153f7f204509ace8bc359c181506a9a0300d5f8
SSDEEP 1536:WMBYQqqGM/kz8p9t3qZbVouv8P1MYK+FP8I9vbJinuYZb8DYY9kf1f:WvDopuZbVlanK+FBUrgcYOf9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Powerpoint.xls

Path C:\Users\Admin\AppData\Local\Temp\Powerpoint.xls
Size 46KB
SHA256 b61a2918e8b719f46267dd6bb9a0be21d5ac8bd7e66008f8ca593e117b3811cd
MD5 ab0df5765d2984d611c79f3b8a9a5f79
SHA1 2da90917a90cb6a6b03b03396b30c69de1c7b505
SHA512 60b35b2e91cfb9953389115f65b5a0d30e9382b8849bf235e363372e5db114af5a796e3e37c118716bccef0a9259b21a27a62bf80acfeef523147ee1dbfed2cb
SSDEEP 768:J5kfaBjicwqsu5aRG1DTBtIMFsiFMbJCP3KuFGvatbs975r3Y3NNUiC4sg9E3CnT:LKaB2qLas1xtns1CvyiBuYLU6sNCnv64
MD5 SHA1 SHA512 SSDEEP

Submit Download

Quad.xls

Path C:\Users\Admin\AppData\Local\Temp\Quad.xls
Size 73KB
SHA256 e28c0f2195e6a89de3231eea2b09b210e02ffe5865db68b68e43727766aa6424
MD5 2f1260342196a1c9c8e6c9462e8a67d1
SHA1 af1910912a8d06d091cc73d791a767d858c9cf1a
SHA512 56f213ce4e030363729be41e8d638dc716e5de1e37f6bcac9504b5efdb8bae05e50b4847ee4a534410ca0170bdd79c6f0049bb602336de302e2e7113f4d39243
SSDEEP 1536:pk+ZRZeL9PY6wC0KKbHZKFDfyJh6A+SNiGUCOso7fH1ApQjKd:pkbZP1WZKFotozC5oJAW+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Roommate.xls

Path C:\Users\Admin\AppData\Local\Temp\Roommate.xls
Size 9KB
SHA256 38827a09173c94030d02a2d701ea95fa25cf0cf9c09c38d4a6c9c0e5dd7406fd
MD5 5ed56ef1b4649d49e5cbb70781f85437
SHA1 817c74f96cab60f3e8faf8081d07f51863b5b40e
SHA512 4306b00f71cb2bd89b0275581eaab1e4a401ec00c955e2f34e9f324ca546d85b554f5543701417891b5f4a8baad63f09f142ad7887ea58d1d282b5f2921f94a9
SSDEEP 192:Pcn7ZfLRfn7WQlCwD7ppmzrOvqqqMdCV5XyBcwjy:Pcn7Zjt7L11QX8qMdCyy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sacrifice

Path C:\Users\Admin\AppData\Local\Temp\Sacrifice
Size 50KB
SHA256 8ead6de90436ea2c94ba3c0f8befa35fd50448521f1ea3d91567a20083e151f0
MD5 eab9128be6fde46c726d0ee4ea6f626c
SHA1 1a9e1d9b260617c773d1bd960350bdb8db2a508a
SHA512 ced40b7b4dfabc7ee4200536dcc72afde921571531cb4ec845b6722cb3935363f45b1d6d9f3a0fa54d934e2b4578bd5c7068a8b7540cc57f9828f0b89c21a5d3
SSDEEP 1536:eUDxOLoV0f5lF9teOqAoNqyX7PXT+rzdV8:ePfXr8OqAoNqyXDz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spray.xls

Path C:\Users\Admin\AppData\Local\Temp\Spray.xls
Size 67KB
SHA256 6aa4450fdddfd79bf1886585d0da9bde587238a8d64b231759102f83570f07c0
MD5 3c5d1baf1151bef254a7f3e12a424def
SHA1 fc41e437d1a48c46e3747e972346bbce8fa9d834
SHA512 28cb4b2dc422059ab0f262ceb49335810868d22be6e4d352e1c33d388b0075e99fafbf184e23b42797ceee4f57f4b1b90e11df8c41dd7df12cae5ca05c5a3515
SSDEEP 1536:svHRt1zEy07nowKuDFbsHMk1sXCD7hajWp5iOBHlO:ExvgPnofeFosk1sXVKpQOBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Swiss.xls

Path C:\Users\Admin\AppData\Local\Temp\Swiss.xls
Size 87KB
SHA256 2674eb1593fed6c4058d234e5c5621cca2bc294d75a33839bdec3cf5780f3a79
MD5 599b28f460bc34eb16104791eda0d121
SHA1 30ad3e7adaa0da09f8ca65c57779c53afb6d29f1
SHA512 e8addf0a0e14430dc54fc4ec75b1428cbab02f226c10e4e2ab60c63d32eea6eac152286acbfe102a8baeada644f317558e146cdca37a13fcb7b4b200bcc7e484
SSDEEP 1536:8MFFXRiC15wEmGyHE84rl15WOCwYpMshqIMaqGyNeyEt9OJ61Dceg45nyfCf1zLy:FxiG5pyHQrbYpMcxtyNeyEvhcD9CftLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wilderness.xls

Path C:\Users\Admin\AppData\Local\Temp\Wilderness.xls
Size 51KB
SHA256 86cfd346cbb3363463ad94b2d1d1ceb53d1ced725093f7ffeaee5539173119ba
MD5 b1a58e59bcaa1bc9c676bb35de979caf
SHA1 65d383d9f243417799eaad2f161e63f912b14227
SHA512 6f13bd202ea3b269602698ad8447ccc9c07c9034792ea93fa7665690c077b62e6aed12012ea3e808efec27bb31edb7dd6096a71350a334d54be85d4e835f6a24
SSDEEP 1536:2GgDxaxPGG4Di7GQWBhrdi1i4OQNh1OT1:2lxaxPGOyvBXi1yQNbA1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Word

Path C:\Users\Admin\AppData\Local\Temp\Word
Size 70KB
SHA256 a299e21b54617bc413f450492d8eb3d7fad4ea08b8edf223815e17f2d8b8373a
MD5 5dfe52d9638a3734e8cf9b84e128a5a9
SHA1 3f628aab72f2987ec8194c7dde76c78c2cc11179
SHA512 a2ae53268e1d68352694ab445b5b1cd34f56686c182517cccdad3dbd61c52758d757d2a654f3305468b2b16f36c42279fbfb59d9acc9aeaf53a898a6669ea4f9
SSDEEP 1536:tJC98/bIbK5Zyh5GXpPb3b3r3ahHgYcMaO9mNOR:tkK0bUQhoX1bb3aZg3PKmNOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5308-294-0x00007FF902F80000-0x00007FF90303D000-memory.dmp

Download

memory/5308-288-0x00000156B6F70000-0x00000156B6FF5000-memory.dmp

Download

memory/5308-290-0x00000156B6F70000-0x00000156B6FF5000-memory.dmp

Download

memory/5308-291-0x00000156B8C10000-0x00000156B9010000-memory.dmp

Download

memory/5308-287-0x00000156B6F70000-0x00000156B6FF5000-memory.dmp

Download

memory/5308-292-0x00000156B8C10000-0x00000156B9010000-memory.dmp

Download

memory/5308-295-0x00007FF9016F0000-0x00007FF901A64000-memory.dmp

Download

memory/5308-293-0x00007FF904140000-0x00007FF904349000-memory.dmp

Download