df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6.exe
Size 2.7MB
Sample260428-rrj99aev3p
SHA256 df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6
MD5 c7430d9fa2d746fa570f6d347d159676
SHA1 a35f85efb906e54e979a804a710d8d91a8831eaa
SHA512 d90b8230069f6d46c16be98dac60f7369902d87cda9b6df8c6500082308060d89f6f6a205839354174c0e1233325e8bcbfeafd927bd068d46b1fa4a74c0d8b57
SSDEEP 49152:h7EO4ne43/3qedS+OSwUf1XxirtwYrxBZa6s9X5LYMpEd+CG6EdLpq3:hune4v9URST10aOxnav9KjNApq3
TLSH
T187D53321B3D7CE6AE7758236D43793F21263E73495D0B9EA02507B6EEE34A904536B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1452	ImageToPDF.exe

Loads dropped DLL 3 IoCs

pid	Process
1292	df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6.exe
1292	df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6.exe
1292	df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ImageToPDF.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1452	1292	df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6.exe	80

C:\Users\Admin\AppData\Local\Temp\df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6.exe
"C:\Users\Admin\AppData\Local\Temp\df6e5f951a094ad24e6610801abd30fa412faccdac0e0418791b672793d31de6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\ImageToPDF.exe
  "C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\ImageToPDF.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaF9A4.tmp\LangDLL.dll
Size 5KB
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaF9A4.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsaF9A4.tmp\modern-wizard.bmp
Size 51KB
SHA256 a7b2f12e01cbea88d4f645f797f2ca6107d76ae13cd1be6dc532b759bfe0d925
MD5 9e4cd80a60db6947642677bf31a10906
SHA1 feedc432df18b13ffba2b7478347d885861701fa
SHA512 a02ae76b7a5df03a149a0b9c9efd314b8646b829b930233d0cea8b619b21720b383f92be95838310e7f1c4183d256823a96e48866b65ac7d2141ed4254ae471a
SSDEEP 384:0b5ZBhNII36iwq7VzVpaHsA2vxM+5GVTfoeydiszl:2XR360JzVpaHsAI75GRfovcs5
TLSH
T1EA33E9F46824BC2D936CCC29C115EF8896D910B2FF9040B7703EA6954ADD2A91897FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaF9A4.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImageToPDF.exe

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\ImageToPDF.exe
Size 5.5MB
SHA256 995ca855f78225f107b8b07b3c19e62d01c50c616919e0a15028fe42129f44c6
MD5 f39a31c6988d30f658cca44b777129f6
SHA1 ff908e7ac4db413954f9a1f0a60081e44ab872ad
SHA512 b0cc2e38ff599ffea7f176e15e1a4ee7c837583c5fb1eba4b1af013ffeef9455258c9d90b31e4823e783a2b85f83c80d87d3f6783cf03e6771dfde0dd1a7c7a2
SSDEEP 49152:ArD0j4axUC6+tUa+zXsS4m8CVelgutAwRPdhBDM0R2jK/ecQ43qc2RAGYTUIRbAJ:AXVyUCXIXt4dCVplwR17LR2O/x2RABN
TLSH
T132467DA2B681C437C1B317768C56D6F9562FFE301E2075CBB6A42F8C6F76690B429183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.bmp

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Languages\English.bmp
Size 274B
SHA256 767604ca0a59033769c86ffe2aec80b8521dc3fbbd84e2314c4c2f14f4312bf4
MD5 7cd509a7a42d61d64207aef88b680cf3
SHA1 367d3c50e862cb242b9950537e8a95df0f83213f
SHA512 5bcadd8666cd5dd1f2be71d16572b3be2b08df79e7a2f6872a9410f46243955d7f34e6e73e327fa6705a7f1a6b4e65e3a0cb4ef679a907c6b66c43b948dccc27
TLSH
T153D0C25B213AC413E45544304C93EA7639183EEE9F0453027DA1FB0E29B659450697DD
MD5 SHA1 SHA512 TLSH

Submit Download

English.isl

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Languages\English.isl
Size 3KB
SHA256 c5bccee5a72c19669dec9ff1b59b82eeb93411d36b54bb1263f347407c639a8a
MD5 c8c3852aa4405c4b3c035e24df70172f
SHA1 1be56b63e9a63a64e4bc6f4201d80ad27331fe65
SHA512 c9c11193386d2138d3e191097be9f6e70c7293c901942bc0eb54e5ce126d26ac1a42e4ac5ca32b79fec3e368ee0962c06a2b02e22eb809ebdb39924c7a707d2b
TLSH
T10C613F584C525933D5C7A66733D3E842FB71DB8E08A42B4B3149B08F22E174CC1BB6AE
MD5 SHA1 SHA512 TLSH

Submit Download

French.bmp

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Languages\French.bmp
Size 274B
SHA256 5c5e69f5e2ecb62687ceafdce034cc65c3457863dcfb3f1e86540b2046a0984d
MD5 6832dcd93f3f6a5dbe80b5f9b45f003d
SHA1 c2c80b289e3b199085b01562edafbe0c8cb332b1
SHA512 3c59311f3b8acecc050ae37cb15c4af0414080b41b21763dc056308400113fd25349129781329ac755102f5ae6b453e863165c58aed0c0b2c3a987dd3a5c8336
TLSH
T1BED0C51E23348023F04110F489D38FAC39347CCEA8C4910E5EA39A8E29E270A2F4B4ED
MD5 SHA1 SHA512 TLSH

Submit Download

German.bmp

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Languages\German.bmp
Size 274B
SHA256 35c7a2681726a9fdd3313c3f4fbe2e7977ae6f5ba87a5244086e7d37bbac9b6e
MD5 5a797e1dded63421dfa2873433d07fc9
SHA1 581c832fb13982d0cf5f667499f4721252de25a7
SHA512 ac309053589c25630b27bdb822d3d8828ff4094c495cc51d684519f4e5c5b3f8ed61ea22bb847563f5621f9d76d24009ea92c129053619e49e0d8a443a2bc57d
TLSH
T18ED0C27B1135CC13F42170304403BA753D14EDCEAF0813424D629A1E2CF15C5107939D
MD5 SHA1 SHA512 TLSH

Submit Download

Italian.bmp

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Languages\Italian.bmp
Size 274B
SHA256 5949342ffd6d76eb51390b8ce8def2bb337419ada7c6689833856635898a6139
MD5 e200315c3992a55075e313f7839c3f00
SHA1 3de5ed01274ab64b50fb8325cbc78c64230da7d3
SHA512 679d933dabb80f590f06e1a4dfef567eb74a8c473329e1252498470632257a2b77340f39a538f70b0028073ed0e366477959d478f0f6e549759bcfc050f91ea7
TLSH
T17FD0B1FE233CCA1FE40200308883EE7A39122C4EBB0003024FE3DA0F38AE584204939D
MD5 SHA1 SHA512 TLSH

Submit Download

Japanese.bmp

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Languages\Japanese.bmp
Size 274B
SHA256 26e22936a9b40a04b76de990920c2b5723cde8e89b6a2859d7155b854411ed5c
MD5 f2b2b3c4b11aaa1d3f09a9770116969a
SHA1 ca81cd3aef6db61fc58eae6f4fb94249409a46d8
SHA512 295ff2b41b712b6257886cf3f91696ad63ae1f01a44aaa1b6a87889ba1d5de815b9447d6cf6cc6762d04c14c37521ed54cb685d1f8f176fb6306cbba63a17fb8
TLSH
T187D0EA523138C033F60605348CD3CA7839563D4EAF406506BEA2BB1F7CB691420690DD
MD5 SHA1 SHA512 TLSH

Submit Download

Lug.idx

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Languages\Lug.idx
Size 63B
SHA256 ea6392de50368a0a36ed2347425eb25d9c96279239cbbcb186977582159eeace
MD5 7b8e7300cc2d621becdccee2c7c4c30d
SHA1 46789e409c2846e1ab2b8b3b4e961cde1f324c78
SHA512 08275708efdf00a1545d25ff5f7b56393d1a63fdb7131f578078cb840968d2d743b1a177b4f632f1d63d16db73419f6593ba9dad35bb2aa0e0abe86e8a15f8f9
TLSH
T1A5A02200CF0028A2002C800CB00380E08BC22EE800A3328302EB22080A02CAC3A00A20
MD5 SHA1 SHA512 TLSH

Submit Download

Portuguese.bmp

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Languages\Portuguese.bmp
Size 274B
SHA256 6bdb95ffcb2784c255eec3318bdf2c40e70a3de10c4e6f3de768df6fcc5c76ad
MD5 596a2c1680f9dd1d54575ff290865954
SHA1 1b233530ab967633953d573f9d7de7c446349d93
SHA512 10db7728cbf7b8b9576bce1ca896e84e16f866d21f2449dbd3daec4b70ed9e7a7f213e0a3c550c14e01cb9813d5f8786bbf9ed082c96cccd34fc4d05efa0eb4a
TLSH
T1F1D01232233441D7E00312738C53ABB979602CAEAB0806374EB3DE3E2CF06D4101D48D
MD5 SHA1 SHA512 TLSH

Submit Download

Spanish.bmp

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Languages\Spanish.bmp
Size 274B
SHA256 8436d6b9ea271305ad5a0413009a9d8064b1d8a2fad4f1d13eca8ceaedcaa8de
MD5 d82e196ec0d1898e62889a5b4e93bd72
SHA1 8445c425f2de531d15f06b2162947bb1528d458e
SHA512 d95896dfb0824386d33259a1154720ce19add0d5695e1ec072cffeb0b660f3761664a65c291c7f82f660c524330882d5024227301e2c0a462cf886f2d31efcbb
TLSH
T14FD0C9BF1130CC03E032A0308403BE7A39182EDE9F0463024DB19E0E2CB25C5104938C
MD5 SHA1 SHA512 TLSH

Submit Download

Options.ini

Path C:\Users\Admin\AppData\Local\ZXT2007 Software\Image To PDF\Options.ini
Size 206B
SHA256 8e7ce80e6f43ca7bb30dcb6780639cddc2ab2503a3262b8a7c05fd4c0f162568
MD5 2d328013ce5fea75029f1bd88f28d711
SHA1 2e5a915ed8d8a28b052a703d293fe60635ffd963
SHA512 66911e45be7a96e9db0bdca1f041a787c0a68097c46584e6fa97d3094a8b968c2759f87acdb3087c5d363dd60215eadd6123e09a54bac758f196fed843d36d71
TLSH
T181D02202811BD01D861A289F2CA0028038DC3084768ACE94A7E71C422E1EC7B281A28C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1292-14-0x00000000009E0000-0x0000000000B2D000-memory.dmp

Download

memory/1292-57-0x00000000009E0000-0x0000000000B2D000-memory.dmp

Download

memory/1292-47-0x00000000009E0000-0x0000000000B2D000-memory.dmp

Download

memory/1452-58-0x000000000083F000-0x0000000000840000-memory.dmp

Download

memory/1452-59-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-70-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-71-0x0000000001040000-0x0000000001642000-memory.dmp

Download

memory/1452-72-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-74-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-76-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-78-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-80-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-82-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-84-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-86-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-88-0x0000000000400000-0x0000000000998000-memory.dmp

Download

memory/1452-90-0x0000000000400000-0x0000000000998000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads