e4e9d56f2b714b4194e23446bced79a29018b15e5832424f51fbfce718eb49b6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 537KB
Sample260510-pg7lpaa19n
SHA256 e4e9d56f2b714b4194e23446bced79a29018b15e5832424f51fbfce718eb49b6
MD5 18b69de00d1b3e749b0c1f8ddcbea71c
SHA1 3ad299a40c5679b9865f402e6869dc6a7eee64af
SHA512 5d2fa8cb5207f10da63e7d651fd88f41b2ef6cd8c986c7c22e737c8adae3255644827dd8d3e6321e4a9657efc97b0c3316c8f61ca2d6cee084bdbab2e62c64bf
SSDEEP 12288:z7DnfAuCL5CZ7HUqQ5G6QepUn0Kh0oeMb01JQntLOCTMfAgD:z7DfAN5CpJJ6tGnQoemTiAs
TLSH
T1B4C4E41366D8BCB8E17216706B7797E1977EFC201B30C58F22C0155DAA7C9C2BA31B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 8 IoCs

flow	pid	Process
6	4036	dfsvc.exe
6	4036	dfsvc.exe
6	4036	dfsvc.exe
6	4036	dfsvc.exe
6	4036	dfsvc.exe
6	4036	dfsvc.exe
6	4036	dfsvc.exe
6	4036	dfsvc.exe

Loads dropped DLL 10 IoCs

pid	Process
4036	dfsvc.exe
4036	dfsvc.exe
4036	dfsvc.exe
4036	dfsvc.exe
4036	dfsvc.exe
4036	dfsvc.exe
4036	dfsvc.exe
4036	dfsvc.exe
4036	dfsvc.exe
4036	dfsvc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Dingo Flat Rate Tracker.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\ding..tion_a62c864579510f = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\ding..tion_a62c864579510fd8_0001.0000_481f5923b7f4c71a\reference!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_none_e51ba0ae7e7720ab\SizeOfStronglyNamedComponent = c13c000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding...exe_a62c864579510fd8_0001.0000_none_29ad848d95e9bd12\DigestValue = e1a4578eacc0be73d041d0319e376597a37b9a88dc8ac690ec5473301c515b3d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8\DigestMethod = 02	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8\Files\LiveCharts.dll_f1b1127bfde4e59d = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\itextsharp_8354ae6d2174ddca_0005.0005_none_a4c24704ee778e26\identity = 697465787473686172702c2056657273696f6e3d352e352e31332e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d383335344145364432313734444443412c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e\itextsharp_8354ae6d2174ddca_0005.0005_none_a4c24704ee	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\guna.ui2_8b9d14aa5142e261_0002.0000_none_778ad9ed0b8c8f34\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\ding..tion_a62c864579510f = 68747470733a2f2f64696e676f2d666c61742d726174652d747261636b65722e70616765732e6465762f44696e676f253230466c617425323052617465253230547261636b65722e6170706c69636174696f6e2344696e676f20466c6174205261746520547261636b65722e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e34362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d613632633836343537393531306664382c2070726f636573736f724172636869746563747572653d616d6436342f44696e676f20466c6174205261746520547261636b65722e6578652c2056657273696f6e3d312e302e302e34362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d613632633836343537393531306664382c2070726f636573736f724172636869746563747572653d616d6436342c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\newt..json_30ad4fe6b2a6aeed_000d.0000_none_88c266d3abb85860\DigestMethod = 02	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e\nhunspell_1ac793ea843b4366_0001.0002_none_de34e0ed786	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\itextsharp_8354ae6d2174ddca_0005.0005_none_a4c24704ee778e26\SizeOfStronglyNamedComponent = 95a9270000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\guna.ui2_8b9d14aa5142e261_0002.0000_none_778ad9ed0b8c8f34\SizeOfStronglyNamedComponent = 968b210000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\nhunspell_1ac793ea843b4366_0001.0002_none_de34e0ed7860f6d3\identity = 4e48756e7370656c6c2c2056657273696f6e3d312e322e353535342e31363935332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d314143373933454138343342343336362c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\ding..tion_a62c864579510f = 680074007400700073003a002f002f00640069006e0067006f002d0066006c00610074002d0072006100740065002d0074007200610063006b00650072002e00700061006700650073002e006400650076002f00440069006e0067006f0025003200300046006c0061007400250032003000520061007400650025003200300054007200610063006b00650072002e006100700070006c00690063006100740069006f006e002300440069006e0067006f00200046006c006100740020005200610074006500200054007200610063006b00650072002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d0031002e0030002e0030002e00340036002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0061003600320063003800360034003500370039003500310030006600640038002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d0061006d006400360034002f00440069006e0067006f00200046006c006100740020005200610074006500200054007200610063006b00650072002e006500780065002c002000560065007200730069006f006e003d0031002e0030002e0030002e00340036002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0061003600320063003800360034003500370039003500310030006600640038002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d0061006d006400360034002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\newt..json_30ad4fe6b2a6aeed_000d.0000_none_88c266d3abb85860\identity = 4e6577746f6e736f66742e4a736f6e2c2056657273696f6e3d31332e302e302e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333041443446453642324136414545442c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\live..orms_0bc1f845d1ebb8df_0000.0009_none_8c935b0abf44a1ce\identity = 4c6976654368617274732e57696e466f726d732c2056657273696f6e3d302e392e372e312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d304243314638343544314542423844462c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\live...wpf_0bc1f845d1ebb8df_0000.0009_none_14969fd7ad35d8d3\implication!ding..tion_a62c864579510fd8_0001.0000_481 = 68747470733a2f2f64696e676f2d666c61742d726174652d747261636b65722e70616765732e6465762f44696e676f253230466c617425323052617465253230547261636b65722e6170706c69636174696f6e2344696e676f20466c6174205261746520547261636b65722e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e34362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d613632633836343537393531306664382c2070726f636573736f724172636869746563747572653d616d643634	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8\implication!ding..tion_a62c864579510fd8_0001.0000_481 = 68747470733a2f2f64696e676f2d666c61742d726174652d747261636b65722e70616765732e6465762f44696e676f253230466c617425323052617465253230547261636b65722e6170706c69636174696f6e2344696e676f20466c6174205261746520547261636b65722e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e34362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d613632633836343537393531306664382c2070726f636573736f724172636869746563747572653d616d643634	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_481f5923b7f4c71a\ding...exe_a62c864579510fd8_0001.0000_none_29ad848d95	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_481f5923b7f4c71a\ding...exe_a62c864579510fd8_0001.0000_none_29ad848d95 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8\identity = 4c6976654368617274732c2056657273696f6e3d302e392e372e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d304243314638343544314542423844462c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8\DigestValue = 9fcf89837b60f69c1c501e4cfa4d2860887afd0b8f325803367e795a4e3bc9ca	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding...exe_a62c864579510fd8_0001.0000_none_29ad848d95e9bd12\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\ding...exe_a62c864579510fd8_0001.0000_none_29ad848d95e9bd12\lock!01000000da5d580ec40f00009c1300000000000000000000 = 30303030306663342c30316463653037376238383030343865	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\ding..tion_a62c864579510fd8_0001.0000_none_e51ba0ae7e7720ab	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\live...wpf_0bc1f845d1ebb8df_0000.0009_none_14969fd7ad35d8d3\identity = 4c6976654368617274732e5770662c2056657273696f6e3d302e392e372e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d304243314638343544314542423844462c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e\live...wpf_0bc1f845d1ebb8df_0000.0009_none_14969fd7ad = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e\syst..lite_db937bc2d44ff139_0001.0000_none_94396159ef = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\guna.ui2_8b9d14aa5142e261_0002.0000_none_778ad9ed0b8c8f34	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\ding..cker_a62c864579510fd8_0001.0000_none_0c77b2bda9264df5\implication!ding..tion_a62c864579510fd8_0001.0000_481 = 68747470733a2f2f64696e676f2d666c61742d726174652d747261636b65722e70616765732e6465762f44696e676f253230466c617425323052617465253230547261636b65722e6170706c69636174696f6e2344696e676f20466c6174205261746520547261636b65722e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e34362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d613632633836343537393531306664382c2070726f636573736f724172636869746563747572653d616d643634	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\syst..lite_db937bc2d44ff139_0001.0000_none_94396159efbaf615\implication!ding..tion_a62c864579510fd8_0001.0000_481 = 68747470733a2f2f64696e676f2d666c61742d726174652d747261636b65722e70616765732e6465762f44696e676f253230466c617425323052617465253230547261636b65722e6170706c69636174696f6e2344696e676f20466c6174205261746520547261636b65722e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e34362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d613632633836343537393531306664382c2070726f636573736f724172636869746563747572653d616d643634	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\live...wpf_0bc1f845d1ebb8df_0000.0009_none_14969fd7ad35d8d3\DigestMethod = 02	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..cker_a62c864579510fd8_0001.0000_none_0c77b2bda9264df5\Files\Dingo Flat Rate Tracker.exe_abdd8752b18003 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e\guna.ui2_8b9d14aa5142e261_0002.0000_none_778ad9ed0b8c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\live..orms_0bc1f845d1ebb8df_0000.0009_none_8c935b0abf44a1ce\DigestMethod = 02	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\ding..cker_a62c864579510fd8_0001.0000_none_0c77b2bda9264df5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..cker_a62c864579510fd8_0001.0000_none_0c77b2bda9264df5\DigestMethod = 02	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e\itextsharp_8354ae6d2174ddca_0005.0005_none_a4c24704ee = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\live..orms_0bc1f845d1ebb8df_0000.0009_none_8c935b0abf44a1ce\DigestValue = a5b61c1726304e6b72e09a0f35ddbf52f89a75a4e28e6ed098c8d1df6081b4ad	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\newt..json_30ad4fe6b2a6aeed_000d.0000_none_88c266d3abb85860\DigestValue = c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\nhunspell_1ac793ea843b4366_0001.0002_none_de34e0ed7860f6d3\DigestMethod = 02	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\ding..tion_a62c864579510fd8_0001.0000_481f5923b7f4c71a\appid = 68747470733a2f2f64696e676f2d666c61742d726174652d747261636b65722e70616765732e6465762f44696e676f253230466c617425323052617465253230547261636b65722e6170706c69636174696f6e2344696e676f20466c6174205261746520547261636b65722e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e34362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d613632633836343537393531306664382c2070726f636573736f724172636869746563747572653d616d643634	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\live...wpf_0bc1f845d1ebb8df_0000.0009_none_14969fd7ad35d8d3\identity = 4c6976654368617274732e5770662c2056657273696f6e3d302e392e372e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d304243314638343544314542423844462c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\syst..lite_db937bc2d44ff139_0001.0000_none_94396159efbaf615\identity = 53797374656d2e446174612e53514c6974652c2056657273696f6e3d312e302e3131392e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d444239333742433244343446463133392c2070726f636573736f724172636869746563747572653d616d643634	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding..cker_a62c864579510fd8_0001.0000_none_0c77b2bda9264df5\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\nhunspell_1ac793ea843b4366_0001.0002_none_de34e0ed7860f6d3\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\live..orms_0bc1f845d1ebb8df_0000.0009_none_8c935b0abf44a1ce	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\ding...exe_a62c864579510fd8_0001.0000_none_29ad848d95e9bd12\SizeOfStronglyNamedComponent = 48c5020000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\newt..json_30ad4fe6b2a6aeed_000d.0000_none_88c266d3abb85860\identity = 4e6577746f6e736f66742e4a736f6e2c2056657273696f6e3d31332e302e302e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333041443446453642324136414545442c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "0"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\ding..tion_a62c864579510f = 680074007400700073003a002f002f00640069006e0067006f002d0066006c00610074002d0072006100740065002d0074007200610063006b00650072002e00700061006700650073002e006400650076002f00440069006e0067006f0025003200300046006c0061007400250032003000520061007400650025003200300054007200610063006b00650072002e006100700070006c00690063006100740069006f006e000000	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Dingo Flat Rate Tracker.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\ding..cker_a62c864579510fd8_0001.0000_none_0c77b2bda9264df5\Dingo Flat Rate Tracker.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4036	4648	setup.exe	79

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

python.ico

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\ding...exe_a62c864579510fd8_0001.0000_none_29ad848d95e9bd12\python.ico
Size 766B
SHA256 2e7402ed1683a751bb5222a0379e5d8a50e3467e35c0d0d35b2a3cca645372dc
MD5 fc2a98f8a8428a9a6d5579c79a94fbd8
SHA1 5a43595d92ff2e5ab3efa2df1a0643a27c09cd1f
SHA512 fe9ecd2b045670d16ab305e5f6ee943d99b4da320be5d23cf5be9a0fd35ed17a58c7479b23d27fbfa64a8dde3df2911fd1738ce46c772e6f55d4072c8cfccc88
TLSH
T16E01BB6766A47C12D489047384CB8AF444691C9ABFC9FE43756C7A4D2DA7260E807147
MD5 SHA1 SHA512 TLSH

Submit Download

Dingo Flat Rate Tracker.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\ding..tion_a62c864579510fd8_0001.0000_b1951520e2abbf9e\Dingo Flat Rate Tracker.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

ding...exe_a62c864579510fd8_0001.0000_none_29ad848d95e9bd12.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\ding...exe_a62c864579510fd8_0001.0000_none_29ad848d95e9bd12.cdf-ms
Size 23KB
SHA256 954047aeb5bf7e74391b0bb173a40c070b2464ff6b024fe1cc6bfb847639c2a5
MD5 1a9297ada60768c27f6b299d214c5c7e
SHA1 ce1abfd5b5bb26acf0c15bf4d72447d0dabd06e4
SHA512 603a10a832a69222eece4993acd905c382497e811f750d5624b53cd94db0d4acc0985eb1b5a9d95f0896c0e8c6ff611bcb5dd293e6aac56b18ed36f1bbdd2ea8
SSDEEP 192:dRWgWed8eldzVUeGRtGdsNV7qf40ATHP2oCJL2oUq/s1CeEZYArmWtBf:dRW9WxoI8VyAYJ+q/4CecYAFBf
TLSH
T159B2C409B7D1C967D5121673CCE2C3E1B33ABDE54F53534B38463B9E6A726C89823618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ding..cker_a62c864579510fd8_0001.0000_none_0c77b2bda9264df5.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\ding..cker_a62c864579510fd8_0001.0000_none_0c77b2bda9264df5.cdf-ms
Size 10KB
SHA256 5e9d7155004c6646bc9c4ab6f30e75419869bfe0c513433808c2fc4c400462a0
MD5 739d2c7fe46adc6fd46f6318b8f46e5e
SHA1 6ad3062533052b91b02259bfcbad4f34387809d9
SHA512 8574e64de27a3d095c7ea9ee85b2e280e1da943d2c1f7f50a10fab28727b11966a0b38dc6bd2401ad7d431fa91927dc275b3d518d1c0694c07c20b949e91eda2
SSDEEP 192:QT5CznY2qUzLJwbBfheV8vpuC8Dn1/cLU5Gt/XB:LzY2qU+heV8NLU5Gt/B
TLSH
T178324312B2D4DD5BD4A84A33ACDAC6EDB36A7E82DE43470771C4FB0F36326E52212241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ding..tion_a62c864579510fd8_0001.0000_none_e51ba0ae7e7720ab.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\ding..tion_a62c864579510fd8_0001.0000_none_e51ba0ae7e7720ab.cdf-ms
Size 9KB
SHA256 a62f082d1e926f824d6376b8fdc71cf908106b39634c13d4dbd31c30a8a4c7ff
MD5 3289d2c4417fbe8d8e28f8a157611d9d
SHA1 8afabe2c90587e8487e69cb57c49582fc2a81cd6
SHA512 0eb29215f076f4f76d01fe64fd2fd94f419773f0fcb84e3c434cfa6852e7d051cfbe7e9d80b0bf463cb2740b93f8415de6ad97b8373b054bb2e2ab19f5df58be
SSDEEP 192:WzY0XxHEz42f78AnPf09lQbP2oQL2oUmlmCRmJt:WUzD7pnaQC+mlJRmL
TLSH
T1CC121C81BB90D903E11AA633DDE2C7E67637BCDA4E46C34B7445BB5FB931A888C43251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guna.ui2_8b9d14aa5142e261_0002.0000_none_778ad9ed0b8c8f34.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\guna.ui2_8b9d14aa5142e261_0002.0000_none_778ad9ed0b8c8f34.cdf-ms
Size 5KB
SHA256 bc4c63b453af47bc7fe5bb056080d1693a4cb229c64439a48240686997a4ef07
MD5 cb40a508b9c2d9f4211956c9f2819c03
SHA1 f7e454fab5337571031274769a3bc482909d3aea
SHA512 77a9cfc256c65777d0a66fe4eac7fd04c7cbff689c8b84b5df8d29f87afb086cfa398595aa56f4cb3203977ac08ee6cd1d5bb14a8e98e91312b58b1bfd871673
SSDEEP 96:BLOheV+WwgngVLc9x0GhODno8iXubqe1a/tiFFOjg:RJhiLc9Xc+IUMug
TLSH
T133B16701F244CA17C4680B339CDDD6EDE2A83E8BDE43075776D4BB6F7A32296E212154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

itextsharp_8354ae6d2174ddca_0005.0005_none_a4c24704ee778e26.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\itextsharp_8354ae6d2174ddca_0005.0005_none_a4c24704ee778e26.cdf-ms
Size 4KB
SHA256 a73e3c50e4c2ecc7bd1d67af48a1506d5a3ed48e7f5c1576de4fbf2cfebce478
MD5 f1df2638d4132c203e678cd950493853
SHA1 21ecb03dcaad54dea2bb9b06175a937329b63456
SHA512 4e2310a7e23cd2d323c2e4480b5554e249bcd6bffe01dd4fac94e1e12f915873c9d41fe781e733036a903d4ecead127d29fc4c0ec2d4eb475f38af66415a566d
SSDEEP 96:d6r52BMDf01eV+WwHD5Pclkab0j8TvNu2hPdwJwk4ow:de248KJQPclkaprYa
TLSH
T11FA10B427340CD23C87806339CA8D2DEA7697E83DE42530FB1C4BF1F763329A9A12259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

live...wpf_0bc1f845d1ebb8df_0000.0009_none_14969fd7ad35d8d3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\live...wpf_0bc1f845d1ebb8df_0000.0009_none_14969fd7ad35d8d3.cdf-ms
Size 5KB
SHA256 21f39856def5cf2026fdfb27421397d085d09d31924935c3bf973ca0c8b36b86
MD5 f83170e8b768aa34e0f26a2de3b420e4
SHA1 1958fad93da6a54584f09c664c5844628efba5c5
SHA512 45e315d39fbb68c3af14a5d9c6febbc6fe39242c9383bbb409e8fb41a438ebcb5a6fc3f14e4ab208374ad1a38ab4c0ceba4fe4a2f5e0786ef8464ad9d8f1fdd6
SSDEEP 96:6fg24q9eV+Ww1ySBSqynSL/aVK/zlwSSPbfPGkFx5DLN:AgnJyYqySzagqXOS
TLSH
T139C1A902F240DA53D4A90B33AC9DD7EDE2A57E86CF030B477AC47B7F3232696A612145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

live..orms_0bc1f845d1ebb8df_0000.0009_none_8c935b0abf44a1ce.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\live..orms_0bc1f845d1ebb8df_0000.0009_none_8c935b0abf44a1ce.cdf-ms
Size 5KB
SHA256 1d06d39c987469b9dfa08f0e6f1e416494f05175b796def5ba93a23c3911f56c
MD5 515549cfacbb536c883efa4f3228c38b
SHA1 604e2788c450a16d0403668281ba42f466c44c1f
SHA512 3dcdb22e937e3f957714a95388c76b95ab15f6bc28876f8b7f5c94152ed9b35c00562ef88a692bb01fdb967039d38f67e91cbcd76251a554fb69d7541a8847de
SSDEEP 96:ie0H2Hd2fneV+WwMFxwrOr2W3lRoiZUv6kjLp2wf:CHZAJhxelm/ijLf
TLSH
T1A6B15502B290DE6BD4A90633ACC6D3ED6626BE93CE03070774D8BF5F7A326D66106155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\livecharts_0bc1f845d1ebb8df_0000.0009_none_96334df34c9bffa8.cdf-ms
Size 2KB
SHA256 d45b6acbf8180e36669a47e3cf6688ed9c7f52910eb00bb93655dcdd175c5879
MD5 8964e8c22f057db35f6482aef381f757
SHA1 f25fbca23d75b851f3ef80a6e983baff48aac18f
SHA512 3228e7a8600883500bb1a772b7ca4f2a42585470133a6f1164acf6ac8fa23372cc226bee5aa20d7211dfdd389f1d8ebc3ba7bf4dce16891f183f2be1b4e6c2cc
TLSH
T10F518602B680DA67D56A0633ACD6D2EA73727E83DF074307B4C0BB2F7A766D55902065
MD5 SHA1 SHA512 TLSH

Submit Download

newt..json_30ad4fe6b2a6aeed_000d.0000_none_88c266d3abb85860.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\newt..json_30ad4fe6b2a6aeed_000d.0000_none_88c266d3abb85860.cdf-ms
Size 4KB
SHA256 d19bfd706b559af6c7b67dd31e7e36a16864c162dafd3ccaeabedd3479fb824c
MD5 285263b4d1426e7ab907868a5c55a5f0
SHA1 066449a8b9227b03db0d33fc36ca0a0a5cd2304b
SHA512 53607c109b427ecc7ded49d35ffdc58e07a1c130772762362ae36eb304825f88c541affec07cccd820e7275535ec814bf313fce6fda7027d898f1d380176ecc1
SSDEEP 96:nyPUayKTrjeV+WwlQ035GFlgCkdNE0rbBm1A3zLPLcZ5nLT6c:9ayeAJK3el7kdq0HeszLBc
TLSH
T193B1FC017380DA5BD4BA07335C99C3ED77A57D87CE02564BB0D87F2F7A332A64522264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhunspell_1ac793ea843b4366_0001.0002_none_de34e0ed7860f6d3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\nhunspell_1ac793ea843b4366_0001.0002_none_de34e0ed7860f6d3.cdf-ms
Size 2KB
SHA256 5d39716d52ea5825487de672d59914a61d37abf79c2802303ca0d371459c63c0
MD5 8e382d3c77ab4b7f6da50f5a4e2e834c
SHA1 e6db9ab8a9555705dc18113e404059730c24b0e5
SHA512 b8fa32ae655d7a173c9d088cb558cb7ed437a06748a198291a94e78db582b8ffb7aaa9ef74a64559e38bedf9d8abbb0b7b3f69d8d2345a78ff5b7a35afabb09a
TLSH
T14C51EC11B244DB5BD5AD0633ACE5E2E972657E47DF06830374C07F3F2A7A6E84A01216
MD5 SHA1 SHA512 TLSH

Submit Download

syst..lite_db937bc2d44ff139_0001.0000_none_94396159efbaf615.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B0QJW0KR.WZR\MLM1BAA4.1LE\manifests\syst..lite_db937bc2d44ff139_0001.0000_none_94396159efbaf615.cdf-ms
Size 3KB
SHA256 69c2f6dd0b235d282396034a2a3c9bb017d9d4abbf32daaf1d2cc8e83782aab0
MD5 a8fdee44e1fefbfdd0ecf717ffda76b6
SHA1 2a74d0cd469097dddb09c42d24fea0412999edce
SHA512 5068ba3fd4671bbb15aeb8e1431d17cd2753c7ebeb4f4007fed130f3940848d4b086ae36f247e5d329dc073601da8bb5d18e8c83142b291a2b28c0e9fcfcfd57
TLSH
T18271FC01B780DF17D86806336CA9C6DDA3B67EC3CE42830B79C4BF6F7A32AA59521145
MD5 SHA1 SHA512 TLSH

Submit Download

REKG5HH0.4C9.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T5VOAYNG.QPO\REKG5HH0.4C9.application
Size 5KB
SHA256 91d6102313a4584c146709071c63ef66bdeca77c5eb7a0d6cbeb7b3895888cc6
MD5 03f11a3acfbf6a0626101adaeee13d4f
SHA1 9f762066cce4bd35ee148c43bfbe72bfbd50b1b7
SHA512 91ac17fbfb5200ad656f4c2cc89b6aaf61f4af01e0e05b60c379cfdc78252b3fc9f8dbdbb40485efe67b7290cd8b3be418bbcd58e68375d6951dfc2e9809f3b7
SSDEEP 96:0WLwO9Zc5YrHbcX0dzR0qfHPkwzC/c2onmOTlYaEUEFMjK2onYqOB2ouH7bBDA:fywM0R02cwzCk2o30bZ2oYL2oUlA
TLSH
T111C1C65DC8C8D801F215E9707BF2E5135A9626F780EC4089BE9A8D9EDF40AD5C5423FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dingo Flat Rate Tracker.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Dingo Flat Rate Tracker.exe
Size 5.4MB
SHA256 a324491dd3ce087eff1e2d87a11653697c938885a99ce29a8082798d03b347b2
MD5 61e9fbf5c6c258a9eddc37670f301575
SHA1 18b1edd8aa40efee1049288ce2d36ad06f13d665
SHA512 07002e8af5353f7e3585dd1d7bbfb009d37e2686497e5b29b1bef87e084a3fc7407e3b254bd369eb73e8f2a934e3cf08a0473c5e1b6423045c58962aafbec615
SSDEEP 98304:0PpZzeijq6JgdYGMVGw44zeijq6JgdYGMVGw4Nplpo:0hpjq6XVGlajq6XVGlvXo
TLSH
T18C4612B4BB987136D9ABE1B30A154160BF33F051D23BF148B98561CA539BBC06BB8753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dingo Flat Rate Tracker.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Dingo Flat Rate Tracker.exe.config
Size 1KB
SHA256 93d67ac03c68f0178074ab05d9cf108cd9b469647bb8f40e6c59773a0d17159d
MD5 9396dd2e162eb2f2aed598d19198b66e
SHA1 fbefb0b96a40c7dcbbd5ca605ed51834e86bab07
SHA512 408939d72838b41fa63895bdccb85186fd71788abb0d3f0a67ebde50a1925124444b0694ec4cabd8b9dcd4ed9d374af082e18ff02cdefce5b5e5b410d2bad6c2
TLSH
T1EC41E1323EC5DD5A99300E07FE31DC81EA69024B5685088970EF013BCFA3C9A9B670E3
MD5 SHA1 SHA512 TLSH

Submit Download

Dingo Flat Rate Tracker.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Dingo Flat Rate Tracker.exe.genman
Size 4KB
SHA256 67b42a4b11f5976b8658a495d6a265734ee12b78a5dd35e429e09b197b40ae85
MD5 a3019e72a077e464285c1558af1ec8dc
SHA1 5a6f9a965281ae3b49373cd20d7fa0b9ec50d4df
SHA512 668fc4af01246880b1645463c003cc53a7d75fcd7927960f7a10531a37514aa8551ebab8ae80e353cd4f832f5591b05f80782041a8fa912702293644bb1b7a82
SSDEEP 48:3FYZ8h9ovhgTJOMkElog5M4pARcM9JpujBxfvGHU4bPIjCVdVEVTo:1YiWv+VV+/H9aV4XH1
TLSH
T1DC91820681C8EB650F3306D2BEEBE470D79E4723598E1947B059AA8BCF2D996474B037
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dingo Flat Rate Tracker.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Dingo Flat Rate Tracker.exe.manifest
Size 14KB
SHA256 e1a4578eacc0be73d041d0319e376597a37b9a88dc8ac690ec5473301c515b3d
MD5 204be02cf06ad2773871ad5474256310
SHA1 a38c2bc5312fcfbec45bdf3963f364a3a89b416c
SHA512 6ae2d570ac9973e895fd21659ec2c9630c5933260993420efedf192bc0e25b61412a654348a0a9eb43df66f5f6b9d0a2fa454063b6a7d4e74d93a74a19adaa3a
SSDEEP 384:r/yUc5tunz2X4AvJHrdTRzpiGEb+y4H/nvwsnVi+m:Ldc5tunzn4JrBhUxCZfYsnc5
TLSH
T13A62A685C8F4ED11A30281E0BFF299266E456B7342AD008EBD5E19DEDF45588CB933F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Guna.UI2.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Guna.UI2.dll
Size 2.1MB
SHA256 063dec2b1892076dbc8903451da8e47cbf231ae7e3d53bbe7885acd97fa5a23e
MD5 4755f470dd4290368204af1914d0c454
SHA1 cabe1fc2ab668c7181447e8f18f962bee70df030
SHA512 10125d73dcd03d535fe0ed2088e17708979f6d754aa6f77b5eab8b40fbf5c207bb957a113f3e011ce3bfbffd9ebeb2cf5285c8666249df5e6f8265e6a7ff2271
SSDEEP 24576:3sPK9HKYAdprmgWp3Kw8HdgBk1pkXTEzLM1uUr+IS/bmlGYbTCTxZmxVCFdHQ/js:8Pm3QgYkXTEzLM8Ur+XKTaZ8VCFA4
TLSH
T188A50A147ED4EB27C16FCE33D5E25011E2F1E5A32AB1EB0E76D35768184234A788636E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Guna.UI2.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Guna.UI2.dll.genman
Size 2KB
SHA256 a2c84aefc82498ae4d4fbf14e758ead3e961900ef26eb43e6e5cbc799fcefc81
MD5 450b966de522c370cc4033e82302838e
SHA1 7a8d41819ca2313679819fd2d9a452d627bead76
SHA512 089fe8cf9141c163cca1087ae562bbca72faa7934298b5c4fce305f9ad801e652584cc59fe73ec6bfb304b97167b53657834b83ac2b7d90b01a718c835b5f1e0
TLSH
T14641B31181C8FA650F3306D2BEEBE471875E4723188E194B74A9998FDF19A96474B027
MD5 SHA1 SHA512 TLSH

Submit Download

LiveCharts.WinForms.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\LiveCharts.WinForms.dll
Size 19KB
SHA256 a5b61c1726304e6b72e09a0f35ddbf52f89a75a4e28e6ed098c8d1df6081b4ad
MD5 76c775d09b24798f6923452e920979b5
SHA1 3fe2c79512a0d1153fb07f6640b27106c90d333e
SHA512 eacc093f8ac9401f617df7e07fd68a8a0f1f03aa150283de67ad8c338fcb1520b0f07335547cf533a646ff95f239c92b029f952a706e736bcd9508817c9be0f9
SSDEEP 384:F5gNA4m0NkdPbJfGZLifwdNqF8vLvTjzHEhZFUPOxFBVGquJpQ76RqMm:F5gNnrNklJfGZLiAw27jrEhZFyYMm
TLSH
T197925126DB64C13CC7AF0EB8F8931A210570CB067693DB4E1D14F4DA8C63756BAA7297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LiveCharts.WinForms.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\LiveCharts.WinForms.dll.genman
Size 1KB
SHA256 0bc490608394c24a2480ff6f647e5e1c958084927027d36a9f680dca292e8e3a
MD5 6138b8df369577528662ed26b3df3330
SHA1 4e7072d39ddff7db60b60346b21217e0b08fec82
SHA512 fe2e84b04cf0ce9018030da22c62b497849a3506e9521c66c12093814cae7c3bce9fa73b5f00c1ec4ec836ad5d691a9670b065d8674006562a794e0a267663ba
TLSH
T1BC41E40680C8EA650B3346D2BEEBF470D75E4733598E1D47B069A98FCF2DA92464B037
MD5 SHA1 SHA512 TLSH

Submit Download

LiveCharts.Wpf.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\LiveCharts.Wpf.dll
Size 212KB
SHA256 1bdbb1b5c1a50653e5c26161e9b7c03edc518721a6e10ea180a84049d967106b
MD5 e924f79f0b5f3e79c98477d75831813d
SHA1 64f71e20e1953b13c771d8a8e63549ad6d64216e
SHA512 063e9bdbdaf0accb46cef5fdb98b30a97b8a6ba097a80d43a9799ff73e820d1c56d41ca9f71d94497736e3def7fbd0109db4000ab1d9e46cdc96357bf3e15fd1
SSDEEP 6144:d/vd0eaDQcUc0GkiTV3bkACA3AloBtefVt+aA2xgKPo1zlW1w:vaErjGkiTV3bkACA3AloBtefVt+aAGBF
TLSH
T1992408B82368CDA9CBAF0675D011251043F19E676EE1CADAEDC090FE5F4BB4386425B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LiveCharts.Wpf.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\LiveCharts.Wpf.dll.genman
Size 2KB
SHA256 c80e60e2b2c3cb586be7cf6097bdafc35d2a9f68f31fbf5c61e12d211bbdcd28
MD5 1eca117d0bb703dc25330cf140875881
SHA1 5ee086a068ef238ab5822936b44a1a14852e8e09
SHA512 e44cab7c127b5ae091da8f145043242f9bbbca64428cfd1cfcd69f7c63de8fcc6e1f88738ac4b883a9c1a40a28bb7481a71391f5843266faf8f8ff32df8454b9
TLSH
T1E041C40680C8FB660F3306D1BEEBF430D79E4723598E1D47B069999F8B2DA96464B037
MD5 SHA1 SHA512 TLSH

Submit Download

LiveCharts.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\LiveCharts.dll
Size 148KB
SHA256 9fcf89837b60f69c1c501e4cfa4d2860887afd0b8f325803367e795a4e3bc9ca
MD5 9642899636959b7fc89bf34a8b998a90
SHA1 479a0254d1c9e5565c7d861bb77f54b7eae50c96
SHA512 435dccb57ff3e9d0663770768c866838b19fbaa5b8e79de0ca111d9c73276f016e016d1d268f72cf3435ecac122039764fada952e1a4f68f368b492bb866c9a2
SSDEEP 3072:saegvMNVoz3Vlw6/R3z3MV1IdJJGVKWHC2KdxFFT9lzo:VFJlwYMVWY65z
TLSH
T1FCE33A1D7358C776CCDE6E3EE020482147F3E14AF6C2DB9A9F817CEB2913B898645562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LiveCharts.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\LiveCharts.dll.genman
Size 1004B
SHA256 4c1220d77694900585f7dc6c7d6a71f07692add9839a80b725d7a82bece53079
MD5 50ef3e57ebc8a3f58bb438f53d004116
SHA1 b4d5ca720650b951d9c8fbc416ce57178d024a82
SHA512 3bbfd52f32a0331589d78bc7716a96a38a4467305165ceb92840f2e180d84daa8318ec986c2d8e2ec2b569c05833f41e3a3bf872b50b8609240d76a4ded89698
TLSH
T1BE117401C1C8FA2A1F3346D1BEE7F431835E4733088D094AB4A8699F8B1EA968603073
MD5 SHA1 SHA512 TLSH

Submit Download

NHunspell.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\NHunspell.dll
Size 31KB
SHA256 dfb27a7bf4a42ca74b79ae4fe61d6afd57f3f59acbff04372b469a6bd493d377
MD5 6c44b58041666bae4a4fe2cd8782fa3b
SHA1 c1d03fef2c6be05f2be8e2216cbf1b837b2a3abf
SHA512 3c00e51e4725df355722ae329e8eea33c95ee82693ceadd4a4511b33384fb2348662f445b28aa64a9f3fd065b8ac144a4f1f1697fbc901eb4b19c5d3bd53513b
SSDEEP 768:ajeOtVbzUyHZxVmwazwWKOwwwwWw/1au0Y3VX:dOzzNZxVILJ0Y3VX
TLSH
T1EEE2080623DC937FDBFD0BB6FC3152050271E66A5E23DB0A188B206A1D5BB809565B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NHunspell.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\NHunspell.dll.genman
Size 826B
SHA256 6bcb15a3a2060347f9d7bc1525871b387fd08646abb1f754a0b7aae03206fcc9
MD5 ba079044effe9ca150e352f4ce765752
SHA1 e2823d3aefe2acaaf45d091a72183c72fcfcdc32
SHA512 863550363b9e044bb9d7cf0e5cad4f382432a5dd4251a62d1fa8589de73b0285a1b767352a99d7331df9b69a0f811f014063d6f0af57e998a8cea12d0af160ef
TLSH
T18D016B0081C4FA271B3342D1BEE7E421935D572708CD494A70756C6F9B1EED68683177
MD5 SHA1 SHA512 TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Newtonsoft.Json.dll
Size 695KB
SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
MD5 715a1fbee4665e99e859eda667fe8034
SHA1 e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA512 bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
SSDEEP 12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
TLSH
T112E4284123F88F2BE19F7B35B4704A1947FAF91796B5E78F5908D9A51C43B818E803A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\Newtonsoft.Json.dll.genman
Size 1KB
SHA256 6e10ea9db6a797f9a78cc0303829953d680657c056db31665d7b2fc5c69d1c35
MD5 b1dca46549b0fe81d73a4a262219fe19
SHA1 c3ed598b7f90c88fd8b03590dc6fe95f4b81cf95
SHA512 e2e9e3a7e3c2d382da57fbc1e010b4d686fabf66893c608a5cf521ec90a71a7e0ce48ebaf40b7f9767f38cf575875ca6db3d02e0d71dd0fafb8211194f67067c
TLSH
T11041140280C8FB760F3316E1BEEBE421979E4727148E19477469698FCB2DEA24747037
MD5 SHA1 SHA512 TLSH

Submit Download

System.Data.SQLite.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\System.Data.SQLite.dll
Size 2.0MB
SHA256 c12b6f3fce47437a2d04e77b035aae285e471b26f5b4454ed815d644c1ff4261
MD5 23c97ea6992e15b3c9f9cc2a24633342
SHA1 6fd11a1325f37f71eca10d8da401a93c9f618f05
SHA512 d884b978eaebd2f255e2cbbf7b4153ac4f27f707e9d5bd1d8ab3192f2ae6485598c48d42858a4b88bfb63b4108cc2997a5e02c8540deec88932a78b7e5fbf06f
SSDEEP 49152:SQuPRwh/iqy0/NVPer7X5glYaUROPzdo:SQu3AQqygz
TLSH
T1ACA59D47B3E801A9D1BB9278C5A75607EBB0B0160374A7DF64E446AA2F13FD1077B329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Data.SQLite.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\System.Data.SQLite.dll.genman
Size 1KB
SHA256 e75289415ead3868d5426daabeca219d4895c7f297b209367e66db0baabba159
MD5 65a3411278a942a50ada8ada3962d3b5
SHA1 b3d6cec4cfe54f0f5d50b98740cd30b9157ed33b
SHA512 de30673200404ee20dc2fc47e102aa69b7b81e0a240c3e489850daa1d495adde57123f798094d34ee5074b8287a10738a68572f4506e8f3f8d5ef8f5b4d6a9d4
TLSH
T12C21220181C8FB7A0F3306D1BEEBE461875E8723148E194774A9699FCB19EE68647077
MD5 SHA1 SHA512 TLSH

Submit Download

TFRT_logo.ico

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\TFRT_logo.ico
Size 137KB
SHA256 073251d2b3968368f64359228cec870f12d9e3e1d8d64050747252905d5c1305
MD5 8b1f32d323966677c28512ab0f7a8fd3
SHA1 9fe824d1644074c4a7366c6c4bc174bb53cb1140
SHA512 aad162965acac79c21f6f126307924193c60d019beaaee130fa51fa63053938b333a2f9357e226047dcd01f37262be9bdfc10dbd89fe547e5b76ccca4f856f02
SSDEEP 3072:7nSWcTH6jija8bdx/XTsJNuKeprGlmNLCKXvkHGJ/wJoLHB1mkp+3y:7S0GZ5tT0NuKemmlbXME/wkHB1mkp+3y
TLSH
T160D3130C742811A8EB76B4D59238EF74ED923099EC37537564910FA699FF08074BEB8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

itextsharp.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\itextsharp.dll
Size 2.5MB
SHA256 2b7d6afcff85f529b968bfecd8a1f35612281b913c9b450469331edd2051c109
MD5 7406e36a768e1bd36a19c79e5a0ebd4f
SHA1 315ba19be03148e57ed2a36cc00178e86059f978
SHA512 715c281461247af07dfe223a48261826e1e0ffee5d104434e0585dacf0a2de404efd1ce31674165d5d2abe9e3b1be34c08e53ff6497982efcc82c93f771cb96c
SSDEEP 24576:mbxtY1IMr8qOpmdByweqobc/ha3xRVxrslQK8zMgO3V99/ULzW/hYPOCBJoyq1eT:yxtYR8fGkyVQK8FpJoyq1epmf9jEH3q
TLSH
T189C5392C33E99611D61B09BA80F3462352F5FA179BB37B0DA1FC7AAD0D83B90C915563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

itextsharp.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\YL3RZTTA.DXT\97V37Z66.GQ7\itextsharp.dll.genman
Size 1KB
SHA256 b148d77b3a182170afbff9d3d637dadaa43136766834a6edceccebdd8d286d0e
MD5 5b10c8e0d56a8c2e662bff633876bea5
SHA1 d1598ef5214c2e3d82f0e0f1bab0ae855cf39546
SHA512 9bf2dd94010f3dbe81479448304f152ff7c24452ee338355f884681398b1bf476d1e98266d2d871254f317492146f767ece46c55d80208da34ab6cedceb1446c
TLSH
T11E31F60281C8FB660F3306D1BEEBE431879E4727148E194B74A9999F9F1DA96874703B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4036-51-0x0000027B5B510000-0x0000027B5B71A000-memory.dmp

Download

memory/4036-65-0x0000027B5B800000-0x0000027B5BA7C000-memory.dmp

Download

memory/4036-107-0x0000027B3D5D0000-0x0000027B3D5D8000-memory.dmp

Download

memory/4036-108-0x0000027B57720000-0x0000027B57732000-memory.dmp

Download

memory/4036-109-0x0000027B3D510000-0x0000027B3D520000-memory.dmp

Download

memory/4036-90-0x0000027B5A210000-0x0000027B5A21E000-memory.dmp

Download

memory/4036-83-0x0000027B5B470000-0x0000027B5B522000-memory.dmp

Download

memory/4036-78-0x0000027B5A210000-0x0000027B5A21C000-memory.dmp

Download

memory/4036-71-0x0000027B5B740000-0x0000027B5B95C000-memory.dmp

Download

memory/4036-106-0x0000027B3D500000-0x0000027B3D50C000-memory.dmp

Download

memory/4036-59-0x0000027B5BDC0000-0x0000027B5C320000-memory.dmp

Download

memory/4036-11-0x0000027B3D0F0000-0x0000027B3D0F8000-memory.dmp

Download

memory/4036-43-0x0000027B5B300000-0x0000027B5B33C000-memory.dmp

Download

memory/4036-37-0x0000027B5AA10000-0x0000027B5AA3C000-memory.dmp

Download

memory/4036-18-0x0000027B5A230000-0x0000027B5A280000-memory.dmp

Download

memory/4036-12-0x0000027B57770000-0x0000027B578F8000-memory.dmp

Download

memory/4036-13-0x0000027B3D510000-0x0000027B3D520000-memory.dmp

Download

memory/4648-15-0x0000000000810000-0x00000000008AC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads