dbf13a20fc8a6ed7d68167f9109b8bf0aab59a31e62e226e6f027be514dbbe87

Analysis

max time kernel
105s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250610-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250610-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
30/09/2025, 19:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup__en.exe
Size 10.0MB
Sample250930-xw995asyhy
SHA256 dbf13a20fc8a6ed7d68167f9109b8bf0aab59a31e62e226e6f027be514dbbe87
MD5 91e5d6f4154a2a6e57d37cffb253bb5a
SHA1 6e87a0ab5f701c64f437f71436cb4b1222e7d295
SHA512 fd253d7da7c1fa4694a33e7aca691c9110acfc080afcb87aa8e46567d8d5f33d0aff49b3d55a6ad5d3963be2bd557b3c26dc71f35b62c2a5b0a4ddcad03633fe
SSDEEP 49152:sowv4j3WlhuHvfMsYFuWWFGs0862RB+awx:sZvjhunMsYFuvFGrP2RYd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4784	Calling.scr
5452	Calling.scr

Loads dropped DLL 1 IoCs

pid	Process
3856	Setup__en.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4428	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4784 set thread context of 5452	4784	Calling.scr	98

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ByePlanes	Setup__en.exe
File opened for modification	C:\Windows\GrenadaExcessive	Setup__en.exe
File opened for modification	C:\Windows\AccomplishedReservoir	Setup__en.exe
File opened for modification	C:\Windows\WagonProjectors	Setup__en.exe
File opened for modification	C:\Windows\CompanyOpenings	Setup__en.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup__en.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
5452	Calling.scr
5452	Calling.scr

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4428	tasklist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr
4784	Calling.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 2620	3856	Setup__en.exe	82
PID 3856 wrote to memory of 2620	3856	Setup__en.exe	82
PID 3856 wrote to memory of 2620	3856	Setup__en.exe	82
PID 2620 wrote to memory of 1224	2620	cmd.exe	84
PID 2620 wrote to memory of 1224	2620	cmd.exe	84
PID 2620 wrote to memory of 1224	2620	cmd.exe	84
PID 1224 wrote to memory of 4428	1224	cmd.exe	86
PID 1224 wrote to memory of 4428	1224	cmd.exe	86
PID 1224 wrote to memory of 4428	1224	cmd.exe	86
PID 1224 wrote to memory of 4752	1224	cmd.exe	87
PID 1224 wrote to memory of 4752	1224	cmd.exe	87
PID 1224 wrote to memory of 4752	1224	cmd.exe	87
PID 1224 wrote to memory of 656	1224	cmd.exe	89
PID 1224 wrote to memory of 656	1224	cmd.exe	89
PID 1224 wrote to memory of 656	1224	cmd.exe	89
PID 1224 wrote to memory of 996	1224	cmd.exe	90
PID 1224 wrote to memory of 996	1224	cmd.exe	90
PID 1224 wrote to memory of 996	1224	cmd.exe	90
PID 1224 wrote to memory of 4784	1224	cmd.exe	91
PID 1224 wrote to memory of 4784	1224	cmd.exe	91
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98
PID 4784 wrote to memory of 5452	4784	Calling.scr	98

C:\Users\Admin\AppData\Local\Temp\Setup__en.exe
"C:\Users\Admin\AppData\Local\Temp\Setup__en.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd < Retrieve.adt
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4428
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4752
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y Odd.adt *.*
      4⤵
      System Location Discovery: System Language Discovery
      PID:656
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "arcade" Knight
      4⤵
      System Location Discovery: System Language Discovery
      PID:996
  - - C:\Users\Admin\AppData\Local\Temp\524810\Calling.scr
      Calling.scr I
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\524810\Calling.scr
        
        C:\Users\Admin\AppData\Local\Temp\524810\Calling.scr
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Calling.scr

Path C:\Users\Admin\AppData\Local\Temp\524810\Calling.scr
Size 1.1MB
SHA256 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb
MD5 7ac9278876c83c9b597fae68acb6fbf9
SHA1 18150c9b96bffd20c8203ff98a4fc153929bc2c9
SHA512 ddcedf90c53c148d85e36e039fc25712e242e9256ea8791d6cc15bb862b6b85a19a5583b5554f1afda9406affc4e953c4f8a2ddad6fe4d959a9fd5395dc870ee
SSDEEP 24576:r2XJHqX/Rr2YU9EPqYlsgSsJbD1tiP4+kUrp5B:yZql2nuxlRV1t1YrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\524810\I
Size 991KB
SHA256 10d1f2f2c2b3500076b4c2c926337be64b24d203c6a51c66de0c0e520d461b42
MD5 73160977e42a7b7c7aad2f3fb1e562d9
SHA1 95f709ef6d39ab00ba4cf89908a34e3f3ad02cd9
SHA512 07804ee2d9f0197e203ad81a245e4625c076b124871e7a84155ee69c9977bd0278352e831e2ace6a6ff1d2ecda5f287a4e7bb622fc5de76ca3bb09814764e79b
SSDEEP 24576:A3xy/sxgToeC3Wg3j4/8UoU5eXjqh7F4/BQ/4WmB33e87:7/IgceeWg3kuU5eXWh7F5AWO3eY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afghanistan

Path C:\Users\Admin\AppData\Local\Temp\Afghanistan
Size 140KB
SHA256 1c1179d035bb02c9c9986bfdad892b602da8e05abf0fc07be960230e42bf1406
MD5 ed897c5520154c7f496ddad799b8b3d7
SHA1 05c5fce9866b4a79874ee3cd389bbb37d7a81592
SHA512 73535f7972547f12bf77c15ea4c22ccb3b9ea442639faa0f9961225a8377055954aa1c3dc106b7047592229a1320b2f9e2ba086da0ceb71dd95fdb7f87ef8414
SSDEEP 3072:QeooL4x7KBgtEnsjAZNL1iBZ4trwnNX51zt2wQGqK:xoonCJXJrqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Became

Path C:\Users\Admin\AppData\Local\Temp\Became
Size 52KB
SHA256 09ce1471251226c68bde22c7fbd410fbdfddeff2b1d84dd5c10d801c32e8e2da
MD5 6411b0234413a562b8c462d395cffab8
SHA1 d9f63db9b0de7bba2eced4b4b6fd2aac88ab9509
SHA512 db1870b64431762d848589b06f24a5d993363d59133860dc6ca27b3bf2811b69393ed6ce6340a21521e476a1ba058d9b944c35e9d84f82b4bcf1675936d6fae3
SSDEEP 1536:h/29GTnb+aTOpA0KOWZ59Dqd2LoanG5YhV:hKenii0yD1LoanUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Branches.adt

Path C:\Users\Admin\AppData\Local\Temp\Branches.adt
Size 290KB
SHA256 e169712b2c9c4165a50daac30bb724850e6cbdcbb0b7ca8f04181931877bdd01
MD5 67e09b850e3c4e09d8709fa03c0c13a7
SHA1 9cd6d19f4c7cf868f3e720324b938c85d4931cfc
SHA512 799c970f11f51530e265c7d42f8b8004b31731cd7ebb9a3129413734d439ca69bee968acc226bd88e9acd21f124064b362d5a32b041de64910f8be4f1f05c97b
SSDEEP 6144:A5qlwxM/YTcQECRQYmwUtOuxeZPcM9QRtBYy7WliN91Safzxg:A3xONTzxyZUM9QR3NjN9Ma7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Constitutes

Path C:\Users\Admin\AppData\Local\Temp\Constitutes
Size 69KB
SHA256 459ef80e8eadcfa470499d3805c648d4711715c4bf86859e3bfdf9efa36df67a
MD5 f21999eaaa6d303c3a649969cdb26c1c
SHA1 a865313f53f6f9a5c2b484ef76f2bffad0692602
SHA512 7ecb425133e95d72b62759c8d707bdfca23ac3055f56e0d55e0ecb5112a5528bda5a92307176384ca4b3d61d8bfc90d236cf24c30e2b4be3a6089d692e9448f4
SSDEEP 1536:7THdToONU7DYrVMvAS8W+ogxSOaSUHPljMWsUvNFk5RM+:v9TvNU7DYrVUhijUvlgTRM+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daughter.adt

Path C:\Users\Admin\AppData\Local\Temp\Daughter.adt
Size 22KB
SHA256 727a49b6c2958227bd39fc35ff95dac9626ffb23027854a208886adbeed61542
MD5 a29e12a9207157da409a52c3a554af7a
SHA1 45c0d66424b51927aa6adde94d996c1676b9a785
SHA512 fb69b510dac109978c263f95b3d99ec8e2060b9378f9a31dcb531a71fb58315b4e34decfec85ebb89afb3e42f38f5df8259283f950d76b0a489e8eb4626254c0
SSDEEP 384:xK3iWt5sT+2Sbw7siwWb5DeI3BZ8XWWNUH4nS+HKVXc9poCcpci+YCfjU6XNFNHC:MSW3s7S6ssbwyBvl++M3/di+AyNbi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Diana

Path C:\Users\Admin\AppData\Local\Temp\Diana
Size 45KB
SHA256 b12c547040329ed6ab8ad5bcbf8009ab78c3848d91ec5060cea609dff493d3ef
MD5 1e9936e90b631fd398867f19c69194d9
SHA1 786588c9cdb899d17e34c70012566426b8d4ec88
SHA512 1534a292abf2f5c220a8f942dbce5ff3cb349c0e717fdd0fdb628463f695e33c16dc3c6956841617f6c87109709b7492fd458a3bb005b3b1935502d254b72cfc
SSDEEP 768:j8WBosd0bHazf0Tye4Ur2+9Bkk2TalOSVWV9+k:IWyu0uZo2+9B4u0SQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emacs

Path C:\Users\Admin\AppData\Local\Temp\Emacs
Size 128KB
SHA256 730045da8c241c892efcd3e3a80a3edd1d3d7a11d40e4ee38aa83da9af452073
MD5 ac40f45cc77ed07f30b3a7ae03bba7db
SHA1 2cb734710fb44b3d0c3d50e18f72ab8792633870
SHA512 d4f879246a666c9b074f646541c7199e6a1ae72277748e3a9007240d3f742d7775573c2e9ce6680b2ebe9dbc062353f2686be3f339dc9ca4c2d9927e168b4a49
SSDEEP 1536:5dvTcAXjKd1bS1wwQOchO+534IY1GsTrkerRIb+cgbrnoZwknr63EYrw:TId1bvhOYSQurhrRIb+c2oZxr6w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jordan

Path C:\Users\Admin\AppData\Local\Temp\Jordan
Size 116KB
SHA256 775c1e679784953c67b2ec613898902daa556fe03295888674854626b10eab4a
MD5 30a333cc4e24f74f0189f97471db14fc
SHA1 a9b72b355e908908b1fdedad8b05256cc8af34b0
SHA512 996ad09421c08776c2198e844832e66bd4234a2f57478cd6a58ceeecbe7172baa4f3662f9092b301d350d5e229be6e16db62afcdc6e30009d5625ecdbda60880
SSDEEP 1536:8upDK9q4Dw3c61RG31IzxsmSh50sYpwy8c1BY/6Qaa2W+GOq7owMa4Ip:8VAc6jG31IzxsPR1yciPWprowMk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Knight

Path C:\Users\Admin\AppData\Local\Temp\Knight
Size 1KB
SHA256 56545fc6b2ae89b273e76d188fcd46879e9541b598227733509de738a7c8b07a
MD5 88ffb5b239aba18d2e922c7bd8efb17d
SHA1 9ecd75e0cb331d5effb63220ccac5e822f5e1343
SHA512 f3c21e3f1ff74978c3c079c576a168aeafd854e89a001af4d4946f1bee4df5582603bb3535e5dfb054b595a1ad9f67b1ed80f0ff63055fc82105e891e6decbf2
MD5 SHA1 SHA512

Submit Download

Odd.adt

Path C:\Users\Admin\AppData\Local\Temp\Odd.adt
Size 533KB
SHA256 691434c04558c34dedc1c36e01a63199e74f808b36e3d09bf9965b9444f2f20f
MD5 0473065fc91daf72b389a0e58130f321
SHA1 634ea75a43fc34248f9ca1e8e4619e7fb5e2c5b2
SHA512 5f3117e85b08aca98f4b7e3eb47ca31262c7b5a86afef53fc0f7d010a978e932f3373105b15d8fe060c5faaa1da4c5ebb3d9d269e073b4b5a69e092e594d6137
SSDEEP 12288:w3uFQjmMgeIeECvG7JK2PlyEOcv8TY8k64RSEQS4Y0wHv:s5CMg1eE5VKQygUs8lHXE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Retrieve.adt

Path C:\Users\Admin\AppData\Local\Temp\Retrieve.adt
Size 8KB
SHA256 aefee92b46afc990e7032fbfce3b5ce5654b7e354c827c3e06e7a59c124cf5a5
MD5 4769d3479db6814c80336196a0128474
SHA1 02e52ee5e800b94abedfa96577259ba038e1af66
SHA512 5d7747851d33dff23fe967ddf6cf3cf1e05d637a55ebd498fbed5ca2cb8842c6fc2d23cf68e151443c108c18186a781e09b8d2808544da4140ec4b7b2637e2bc
SSDEEP 192:jDPMEuNfEMWkbmXOtxqNmNyJh5HyWzlaXibK6mIHO9:jDPdVkbRzqNmNih5HhzlaX4/HC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sewing.adt

Path C:\Users\Admin\AppData\Local\Temp\Sewing.adt
Size 243KB
SHA256 e7b583dd14b2e85dbfd118889b55f2785e203e2f65b7f0f08b521293a5c92e92
MD5 bac14e5d29da938823858608e1c02dc0
SHA1 50646e62a94b4b2935d0713a9f57bf2091e60d83
SHA512 87c4d09541116db9a3a4da27bb15924cd3f4256b499b09399abd410b27073cec0c6b6e3250fe504fa71d24ef823335e084b0009db990837faff94398f4e71995
SSDEEP 6144:mDEfhD3F+ki/B3g/stWo3PQbMffexbidevw7:iEfh7F1i/BQ/stWmB3ekdeo7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Substance.adt

Path C:\Users\Admin\AppData\Local\Temp\Substance.adt
Size 170KB
SHA256 14066cfa492d728b1b37f6e09f69ddffe08117f0dc1e7fc2083dc8eb4b883c9e
MD5 f01f1c4360ca8a7228dd276f04b93ebf
SHA1 36bf565d4a13e6592afe32baa5ff150d7e3aaa2c
SHA512 e158934eacac80c9427968ce1471caf8f502172e1647afee4d736e23fdb7c0c38d0adc2d46fe869f9dba49217256a51f9be36d5a1cd2becb930838fd3567ab01
SSDEEP 3072:5dV3bF12tjTG1BwhnnTPQ9EArxARLSe99QOVsmKB0a6yU31HOFP:5XbFctjTG1BinT4uCKLSeXQyv7yU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Valium

Path C:\Users\Admin\AppData\Local\Temp\Valium
Size 106KB
SHA256 c60faa34325b13c1cfc9f6cec1c3796d6fec8ca2171b3e0f17f436aabd4eff2b
MD5 644947153dddcfbc6e4f3480e7262a2f
SHA1 65f111a983da15f0a45afebca4e7f2a1c81c2c78
SHA512 b35e628fe54f969bd3a0e6cbb8db625d428f8a4a95b3058c1f5d0737ca5644500643c28ee2800a75ecb5a0c95f36f6faec9da28ce15fc314bda5f68666575a85
SSDEEP 1536:i1GsCPeFmHz1vNq8S4pG+3DY0kkraxjJ4AHol9dlefIQu5aAwurPy:iQm23DjOH4IoVcfIHaAtrPy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vegetables

Path C:\Users\Admin\AppData\Local\Temp\Vegetables
Size 97KB
SHA256 611a5f3c39d3de70a809a3fcd6d803b9fecaea8bd931499d5039d59e03ebce7b
MD5 feae28c923dda736ed6b55f36d282c99
SHA1 72d0e4ae686077b9fe60697d369260cde26edecd
SHA512 3408c55722e122d80386133486065a19e510602ec430f7287e568b1d48ceba230da217cb61a94c081a4a035ccaf265b77ecd4f8e589df7d238d1ce42c59ce488
SSDEEP 1536:AHHM/cZ+nVz1gNlySkcFs1dgebjpcU8VSCxAp1HElS4F1ZoLz3Bur:AhoVRgNkSXF/U8QCgh+qLzxa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Veterans.adt

Path C:\Users\Admin\AppData\Local\Temp\Veterans.adt
Size 266KB
SHA256 bcd73305cbc0a5854a9619d3b17fd32fda42210550927e5284b784f5b955e494
MD5 f0d2169eafdff791f32e554bbf41634c
SHA1 d9bbf1344dc01628811d9128667583df9307b2d1
SHA512 57163f3fe0688a7216b4dc1d4a3ef35c636f8d2928f8065d79a9f34d8079c0f48a67c1eca7ba06b23e00a40b65a261a77b84e22c508ac028911fc6aa0b966b5d
SSDEEP 6144:GBkGQB6C5QCndXvTVdEg1EgxRzeRnhbdXEh31Qv/jbGsqT49RZ:G+764QCphdEg3j4FdXE3UF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Warcraft

Path C:\Users\Admin\AppData\Local\Temp\Warcraft
Size 52KB
SHA256 e8f08362e0d8ed88a0a530447c3ebb7359fdf2bc880d0a64c955a18e20eb48ab
MD5 73c8e4f81762a3b0fe94f241ce85fcaa
SHA1 77269508e5cbd8d86c650eb48da0d9329d0d03e3
SHA512 ceccc8783fbe7f2fbc559ba276146f77ac9281ee72950ea322285c676e4fbe523b0331f7bc26d3f07c51ccabedb13588aba171e31e6a73d249b8a344f3dd234c
SSDEEP 384:ufU84444QnoooooooooooooooooooooooYooootooooooooooooooYoooooooooK:uSm1fBAGWRqA60TojLsyuR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Way

Path C:\Users\Admin\AppData\Local\Temp\Way
Size 131KB
SHA256 24ef8b390c6d6ffa3fb9d11d1fec877e7ba0a06e04268a93d10a3d064a7e4d9a
MD5 64bcbd208189e555fb590d46680e4290
SHA1 f25e8df95a54b3a09ebe22bc9c5f14fa86d8eafa
SHA512 8dee026d34b8fa931a174e606d1a0039f6970df574caf540ee649637eedd128a4734073d8f656997211cf27ba564b3b2387aa33f5dd2b4d75247907b8f46b708
SSDEEP 3072:fKz50/0DIPEXbeTjDiNyWEfGxciSvbDb4wo36sVtTq:Q505EXoiNy8xciSzn4w66snO
MD5 SHA1 SHA512 SSDEEP

Submit Download

West

Path C:\Users\Admin\AppData\Local\Temp\West
Size 144KB
SHA256 f60ebd13583bf7da55d7d0f77ff9737c00802eb69d47a751596070c2ef72f89f
MD5 8148a5b0d78f4dcfe3e5e9d4f2c1b211
SHA1 3eb5372750cbbe2ee59123badcf296107f290b95
SHA512 d9e57d1e3df8f4145cc69b962b4edcc6a8300fa00ab7cab383099b57b7f30785ee8ab929989bd28beceaa7e5c087c4720e263be09c379c4fb5c3ff5f9d797d97
SSDEEP 3072:NH04k5h6m/Fy0UhMsqu5OonZkFNrsjeinlsgIhs3kmTmwZDgGbDU:0Z/FfUhMsqu53mFxsjeilsgIhy4sDVbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp6C39.tmp\nsExec.dll
Size 6KB
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5452-77-0x0000025693180000-0x0000025693227000-memory.dmp

Download

memory/5452-78-0x0000025693180000-0x0000025693227000-memory.dmp

Download

memory/5452-80-0x0000025693180000-0x0000025693227000-memory.dmp

Download

memory/5452-81-0x0000025694D10000-0x0000025695110000-memory.dmp

Download

memory/5452-85-0x00007FF8A7CF0000-0x00007FF8A7FE6000-memory.dmp

Download

memory/5452-84-0x00007FF8A9D60000-0x00007FF8A9E1D000-memory.dmp

Download

memory/5452-82-0x0000025694D10000-0x0000025695110000-memory.dmp

Download

memory/5452-83-0x00007FF8AA1B0000-0x00007FF8AA3A8000-memory.dmp

Download