3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b

Analysis

max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
31/07/2025, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe
Size 3.4MB
Sample250731-n2mxcawkv3
SHA256 3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b
MD5 8c3ceea3b691db5fb95a2eafb8d4d6ab
SHA1 23f41aee89765df74985c6cf1c1ca6e9ed24e4be
SHA512 3b2bfb208630b6ee493edc6983e44c3b61ecd398cbe1d00131b7c8506021a507309b98817db970bba905963ff99462f73951a28f5ec0c05525ceda8599bd44ca
SSDEEP 49152:q9cmN7aydjQ0UxNJT3fscY52VlBJXYfwEXBTb2y2meFldedaHrE76n5P/Afl:6wUjQ0UVEbkrBJXkB3D29ptHg76n5y
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	kvub.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	zyuc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe

Executes dropped EXE 9 IoCs

pid	Process
2188	kvub.exe
3444	zyuc.exe
3180	kvub.tmp
3884	uibv.exe
212	windscribe_checker.exe
5732	kvub.exe
4832	kvub.tmp
5532	uktnd.exe
5564	uktnd.exe

Loads dropped DLL 4 IoCs

pid	Process
4668	regsvr32.exe
5504	regsvr32.exe
1720	regsvr32.EXE
2004	regsvr32.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{24aefa2 = "C:\\ProgramData\\uktnd.exe /r"	zyuc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5840	PowerShell.exe
4060	powershell.exe
4768	powershell.exe
1816	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zyuc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kvub.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uibv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windscribe_checker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kvub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kvub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kvub.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uktnd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	zyuc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5504	regsvr32.exe
5504	regsvr32.exe
5504	regsvr32.exe
5504	regsvr32.exe
4768	powershell.exe
4768	powershell.exe
5840	PowerShell.exe
5840	PowerShell.exe
5504	regsvr32.exe
5504	regsvr32.exe
1720	regsvr32.EXE
1720	regsvr32.EXE
1720	regsvr32.EXE
1720	regsvr32.EXE
1816	powershell.exe
1816	powershell.exe
1720	regsvr32.EXE
1720	regsvr32.EXE
1720	regsvr32.EXE
1720	regsvr32.EXE
2004	regsvr32.EXE
2004	regsvr32.EXE
2004	regsvr32.EXE
2004	regsvr32.EXE
4060	powershell.exe
4060	powershell.exe
2004	regsvr32.EXE
2004	regsvr32.EXE
2004	regsvr32.EXE
2004	regsvr32.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeIncreaseQuotaPrivilege	4768	powershell.exe
Token: SeSecurityPrivilege	4768	powershell.exe
Token: SeTakeOwnershipPrivilege	4768	powershell.exe
Token: SeLoadDriverPrivilege	4768	powershell.exe
Token: SeSystemProfilePrivilege	4768	powershell.exe
Token: SeSystemtimePrivilege	4768	powershell.exe
Token: SeProfSingleProcessPrivilege	4768	powershell.exe
Token: SeIncBasePriorityPrivilege	4768	powershell.exe
Token: SeCreatePagefilePrivilege	4768	powershell.exe
Token: SeBackupPrivilege	4768	powershell.exe
Token: SeRestorePrivilege	4768	powershell.exe
Token: SeShutdownPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeSystemEnvironmentPrivilege	4768	powershell.exe
Token: SeRemoteShutdownPrivilege	4768	powershell.exe
Token: SeUndockPrivilege	4768	powershell.exe
Token: SeManageVolumePrivilege	4768	powershell.exe
Token: 33	4768	powershell.exe
Token: 34	4768	powershell.exe
Token: 35	4768	powershell.exe
Token: 36	4768	powershell.exe
Token: SeDebugPrivilege	5840	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5840	PowerShell.exe
Token: SeSecurityPrivilege	5840	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5840	PowerShell.exe
Token: SeLoadDriverPrivilege	5840	PowerShell.exe
Token: SeSystemProfilePrivilege	5840	PowerShell.exe
Token: SeSystemtimePrivilege	5840	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5840	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5840	PowerShell.exe
Token: SeCreatePagefilePrivilege	5840	PowerShell.exe
Token: SeBackupPrivilege	5840	PowerShell.exe
Token: SeRestorePrivilege	5840	PowerShell.exe
Token: SeShutdownPrivilege	5840	PowerShell.exe
Token: SeDebugPrivilege	5840	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5840	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5840	PowerShell.exe
Token: SeUndockPrivilege	5840	PowerShell.exe
Token: SeManageVolumePrivilege	5840	PowerShell.exe
Token: 33	5840	PowerShell.exe
Token: 34	5840	PowerShell.exe
Token: 35	5840	PowerShell.exe
Token: 36	5840	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5840	PowerShell.exe
Token: SeSecurityPrivilege	5840	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5840	PowerShell.exe
Token: SeLoadDriverPrivilege	5840	PowerShell.exe
Token: SeSystemProfilePrivilege	5840	PowerShell.exe
Token: SeSystemtimePrivilege	5840	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5840	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5840	PowerShell.exe
Token: SeCreatePagefilePrivilege	5840	PowerShell.exe
Token: SeBackupPrivilege	5840	PowerShell.exe
Token: SeRestorePrivilege	5840	PowerShell.exe
Token: SeShutdownPrivilege	5840	PowerShell.exe
Token: SeDebugPrivilege	5840	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5840	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5840	PowerShell.exe
Token: SeUndockPrivilege	5840	PowerShell.exe
Token: SeManageVolumePrivilege	5840	PowerShell.exe
Token: 33	5840	PowerShell.exe
Token: 34	5840	PowerShell.exe
Token: 35	5840	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4832	kvub.tmp

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 2188	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	85
PID 3668 wrote to memory of 2188	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	85
PID 3668 wrote to memory of 2188	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	85
PID 3668 wrote to memory of 3444	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	86
PID 3668 wrote to memory of 3444	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	86
PID 3668 wrote to memory of 3444	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	86
PID 2188 wrote to memory of 3180	2188	kvub.exe	87
PID 2188 wrote to memory of 3180	2188	kvub.exe	87
PID 2188 wrote to memory of 3180	2188	kvub.exe	87
PID 3668 wrote to memory of 3884	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	88
PID 3668 wrote to memory of 3884	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	88
PID 3668 wrote to memory of 3884	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	88
PID 3668 wrote to memory of 212	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	89
PID 3668 wrote to memory of 212	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	89
PID 3668 wrote to memory of 212	3668	3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe	89
PID 3180 wrote to memory of 5732	3180	kvub.tmp	92
PID 3180 wrote to memory of 5732	3180	kvub.tmp	92
PID 3180 wrote to memory of 5732	3180	kvub.tmp	92
PID 5732 wrote to memory of 4832	5732	kvub.exe	93
PID 5732 wrote to memory of 4832	5732	kvub.exe	93
PID 5732 wrote to memory of 4832	5732	kvub.exe	93
PID 3248 wrote to memory of 5532	3248	cmd.exe	94
PID 3248 wrote to memory of 5532	3248	cmd.exe	94
PID 3248 wrote to memory of 5532	3248	cmd.exe	94
PID 3444 wrote to memory of 5564	3444	zyuc.exe	95
PID 3444 wrote to memory of 5564	3444	zyuc.exe	95
PID 3444 wrote to memory of 5564	3444	zyuc.exe	95
PID 4832 wrote to memory of 4668	4832	kvub.tmp	96
PID 4832 wrote to memory of 4668	4832	kvub.tmp	96
PID 4832 wrote to memory of 4668	4832	kvub.tmp	96
PID 4668 wrote to memory of 5504	4668	regsvr32.exe	97
PID 4668 wrote to memory of 5504	4668	regsvr32.exe	97
PID 5504 wrote to memory of 4768	5504	regsvr32.exe	98
PID 5504 wrote to memory of 4768	5504	regsvr32.exe	98
PID 5504 wrote to memory of 5840	5504	regsvr32.exe	105
PID 5504 wrote to memory of 5840	5504	regsvr32.exe	105
PID 5504 wrote to memory of 3432	5504	regsvr32.exe	56
PID 1720 wrote to memory of 1816	1720	regsvr32.EXE	113
PID 1720 wrote to memory of 1816	1720	regsvr32.EXE	113
PID 2004 wrote to memory of 4060	2004	regsvr32.EXE	116
PID 2004 wrote to memory of 4060	2004	regsvr32.EXE	116

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Users\Admin\AppData\Local\Temp\3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe
  "C:\Users\Admin\AppData\Local\Temp\3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Users\Admin\AppData\Roaming\kvub.exe
    "C:\Users\Admin\AppData\Roaming\kvub.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\is-D2PIJ.tmp\kvub.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-D2PIJ.tmp\kvub.tmp" /SL5="$90244,2345563,96256,C:\Users\Admin\AppData\Roaming\kvub.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Users\Admin\AppData\Roaming\kvub.exe
        
        "C:\Users\Admin\AppData\Roaming\kvub.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\is-4UJGO.tmp\kvub.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-4UJGO.tmp\kvub.tmp" /SL5="$90110,2345563,96256,C:\Users\Admin\AppData\Roaming\kvub.exe" /VERYSILENT
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\9GoldenRod.pfx"
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\system32\regsvr32.exe
        
        /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\9GoldenRod.pfx"
        8⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\9GoldenRod.pfx\"' }) { exit 0 } else { exit 1 }"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -NoProfile -NonInteractive -Command -
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5840
- - C:\Users\Admin\AppData\Roaming\zyuc.exe
    "C:\Users\Admin\AppData\Roaming\zyuc.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\ProgramData\uktnd.exe
      "C:\ProgramData\uktnd.exe" /r
      4⤵
      Executes dropped EXE
      PID:5564
- - C:\Users\Admin\AppData\Roaming\uibv.exe
    "C:\Users\Admin\AppData\Roaming\uibv.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3884
- - C:\Users\Admin\AppData\Local\Temp\windscribe_checker.exe
    "C:\Users\Admin\AppData\Local\Temp\windscribe_checker.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\uktnd.exe /r
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\ProgramData\uktnd.exe
    C:\ProgramData\uktnd.exe /r
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5532

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9GoldenRod.pfx"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\9GoldenRod.pfx\"' }) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1816

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\9GoldenRod.pfx"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\9GoldenRod.pfx\"' }) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9GoldenRod.pfx

Path C:\Users\Admin\AppData\Local\9GoldenRod.pfx
Size 6.2MB
SHA256 d9bb34432d0525326ebab46266735242363b9b7059ba3f5f5e81deaa4f714804
MD5 aaa86ca4078377d3111e4a923a32912b
SHA1 ead4c253ec648a1a3951075de356302fa43dbab1
SHA512 83763c2310c1211d628c9e57501b95872cd2af6a11010d3d3d4ae8e119b89ad503dd6ab6a70f1afda74b391a2b0703d69eaaf89cfedbecef3084147c63bba791
SSDEEP 49152:Cm/2QVI6jy0akh57WmXsYYgtcMoKSjtYzP4gH/NEvKlADqdQJcEbU+OLVms:CMy0amD8nIuKv4gH/NEvuQJcsWLVms
MD5 SHA1 SHA512 SSDEEP

Submit Download

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6588a9379ea6c9c12f813490c8c2373f9a7b683c0ece24f543d7856708e0e43e
MD5 fe9675fde9d87fa41d5d569a3e5c4ac3
SHA1 5e1defefd0a725988c2fb7e4e4b20eb9e8fcec37
SHA512 81e1ba2b5c2d53211fa37a4ce6d615d2ed99a78d67eb27c12c7139500c20c68038c2b04a4d6dcf98f4b92549ff60dbe188394502acecb57150ae8b03b87e6131
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e
MD5 2ac3c9ba89b8c2ef19c601ecebb82157
SHA1 a239a4b11438c00e5ff89ebd4a804ede6a01935b
SHA512 b1221d29e747b37071761b2509e9109b522cce6411f73f27c9428ac332d26b9f413ae6b8c0aeac1afb7fab2d0b3b1c4af189da12fe506287596df2ef8f083432
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2afeb7db4e46d3c1524512a73448e9cd0121deec761d8aa54fa9fe8b56df7519
MD5 12c844ed8342738dacc6eb0072c43257
SHA1 b7f2f9e3ec4aaf5e2996720f129cd64887ac91d7
SHA512 e3de9103533a69cccc36cd377297ba3ec9bd7a1159e1349d2cc01ab66a88a5a82b4ee3af61fab586a0cdfab915c7408735439fd0462c5c2cc2c787cb0765766a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_vu4d3rqi.sly.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vu4d3rqi.sly.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-7S91K.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvub.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-D2PIJ.tmp\kvub.tmp
Size 728KB
SHA256 f91838fde79f347786a2a114ccb57bfa6086840d625b6ede208201a4709f3e7a
MD5 0ff35c336d28c82922f461e656df1340
SHA1 afda66f626cf24e61df91537adc20f154cd33e11
SHA512 9d1c357e44a339bd262939fad4bbfe2b9a485168070990744c6fbd9fa820acb4173bc1bbbe5883eb0b5a127e948a7b859de57608d3234b096ae33bf5c8fd0597
SSDEEP 12288:DRObekMtkfohrPUs37uzHnA6zg5cI5MpAHERDjrNyTeR0oUGOHtradNDEx9Wr:FObekYkfohrP337uzHnA6cH+iHEOWUG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

windscribe_checker.exe

Path C:\Users\Admin\AppData\Local\Temp\windscribe_checker.exe
Size 614KB
SHA256 4157ffc8fc2ef30116936a8292c714d89583f4103d17748db6e1f88c4cf155e3
MD5 4c1350219dddecfa4ec4d5cec1c85859
SHA1 78410c4291106f6cc64dd18fdfa64ef5bde4645d
SHA512 803a0fe4f1bbc95681a1899974e14782bd9534b189192a222ad48bd075130e80924d7c7a619bfe62f15d0a855584f6461a3d142a61c0f899c10ae2bc00ec7544
SSDEEP 12288:gw/nrN0N616FprtnuM0wBvZtOg5SbCVAf01V+9WnWi9G9rIange:xfm61EnuMvRt5msAf0mjPoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvub.exe

Path C:\Users\Admin\AppData\Roaming\kvub.exe
Size 2.5MB
SHA256 cdf5aa128d39be84e18b486d7bfa7bc11fc10fe5ee07879af92195ce31de945a
MD5 4c22f98575b14dbe2264882dece8b4ba
SHA1 9827bac1f8b0a75e75e8321a0fc848699c6f10a9
SHA512 8c67be90b13e334210ae1a0387f08601fa3af7fe4671fd98eb66e974349a7d5b94ca6bdf6777129f0172814a29a482951df9deea9f01aa3f9c79489b8539ddad
SSDEEP 49152:MaydjQ0UxNJT3fscY52VlBJXYfwEXBTb2y2meFldedaHrm:hUjQ0UVEbkrBJXkB3D29ptHy
MD5 SHA1 SHA512 SSDEEP

Submit Download

uibv.exe

Path C:\Users\Admin\AppData\Roaming\uibv.exe
Size 221KB
SHA256 3e1aa9a65ea9ac0969e5a881e20e45b54e91415001419be3958284adce179cae
MD5 85b2e82368001b942d67f5cba8611ed7
SHA1 2c633348ee775f27aaf20085e39fac61612dc102
SHA512 1fab7d9260d67be9bb466d254087f8dcb7d88d13a7476d3515f3a5595e623c2bd2a82864481487630d778d910ec96a9470e8d0224ca180f60a1b63bb77df76b4
SSDEEP 3072:15j76SvHoc773/Oyf054mxIOjAjSh/KxAC45GvVwZzr0TtuEaGWLjaF2rD2M870H:nBH+54m2OTpl5GvwzYR9INH/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

zyuc.exe

Path C:\Users\Admin\AppData\Roaming\zyuc.exe
Size 16KB
SHA256 1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a
MD5 6e8354adddf8bd54b877e2d1ea8bb0a8
SHA1 4e0cbc4dd051073489d4b6a0b40c651c28dad648
SHA512 8a1dfc16669b9b3043ad5256798b3fc6e2bbe1962cf7b4d5fb43e7df9603e7588327aec02b75492d2d3b83f8363ba03c3f5fe7d098dbb90905ced4a1267fde91
SSDEEP 384:wUk8UjsZY5GxE5Iu2bPQUd1sRwHQ3ArRK8:whee5GxEKbPQUdmPqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-138-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/1720-169-0x00007FF824E40000-0x00007FF82548C000-memory.dmp

Download

memory/2004-192-0x00007FF8252E0000-0x00007FF82592C000-memory.dmp

Download

memory/2188-19-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2188-94-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2188-18-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/3180-81-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/3180-48-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/3432-144-0x00000000026F0000-0x000000000270D000-memory.dmp

Download

memory/3432-146-0x00000000026F0000-0x000000000270D000-memory.dmp

Download

memory/4768-114-0x0000019B2D520000-0x0000019B2D542000-memory.dmp

Download

memory/4832-111-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/5504-140-0x0000000048150000-0x0000000048167000-memory.dmp

Download

memory/5504-145-0x00007FF825010000-0x00007FF82565C000-memory.dmp

Download

memory/5504-139-0x00007FF825010000-0x00007FF82565C000-memory.dmp

Download

memory/5732-112-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/5732-62-0x0000000000400000-0x000000000041E000-memory.dmp

Download