5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
Size 585KB
Sample260531-kclffac13w
SHA256 5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885
MD5 12941380916655fb8f310df927997f41
SHA1 d30b95d0740664175414068b40a493bf0f1fab3a
SHA512 50602549b95141addd635579ad1fd48de0fd7bab9cd42ed05bdaeabb9f0e2fbc0bccb321838b8127f852f67f0e61a0e386dcc781c5df35f2ec3051c7b349a6d1
SSDEEP 12288:yLBWY+IfognxMEUWBsOB49u+9WbFx5DNMCsQvm9oHP6v:G7nfoS/BBAkdx5DaC7m9oS
TLSH
T13BD4E01176C1D431EA73147249B9DBB6892EB8310B2459DBB3C807FADB305D0A736B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4560	powershell.exe
4168	powershell.exe
4312	powershell.exe
4596	powershell.exe
2208	powershell.exe
2200	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4644	GGSafe.exe
4364	GGSafe.exe
580	GGSafe.exe
4740	GGSafe.exe
4680	GGSafe.exe
3804	GGSafe.exe

Loads dropped DLL 6 IoCs

pid	Process
4644	GGSafe.exe
4364	GGSafe.exe
580	GGSafe.exe
4740	GGSafe.exe
4680	GGSafe.exe
3804	GGSafe.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\yHYzM7LdqoynPAA = "C:\\ProgramData\\BIN\\GGSafe.exe"	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nn2hJz6NzpmvOAA = "C:\\ProgramData\\BIN\\GGSafe.exe"	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GGSafe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GGSafe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GGSafe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GGSafe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GGSafe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GGSafe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3300	schtasks.exe
224	schtasks.exe
1292	schtasks.exe
4108	schtasks.exe
1516	schtasks.exe
3684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
4168	powershell.exe
4560	powershell.exe
4312	powershell.exe
4168	powershell.exe
4560	powershell.exe
560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
4312	powershell.exe
4560	powershell.exe
2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
4596	powershell.exe
2208	powershell.exe
4596	powershell.exe
2208	powershell.exe
2200	powershell.exe
2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
2200	powershell.exe
2208	powershell.exe
4740	GGSafe.exe
4740	GGSafe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4740	GGSafe.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4740	GGSafe.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 4644	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	80
PID 560 wrote to memory of 4364	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	81
PID 560 wrote to memory of 4560	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	82
PID 560 wrote to memory of 4168	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	83
PID 560 wrote to memory of 3248	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	86
PID 560 wrote to memory of 3684	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	88
PID 560 wrote to memory of 3300	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	90
PID 560 wrote to memory of 4312	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	92
PID 560 wrote to memory of 4156	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	93
PID 560 wrote to memory of 224	560	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	99
PID 2020 wrote to memory of 4740	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	105
PID 2020 wrote to memory of 4680	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	106
PID 2020 wrote to memory of 2208	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	107
PID 2020 wrote to memory of 4596	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	108
PID 2020 wrote to memory of 4792	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	109
PID 2020 wrote to memory of 1292	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	113
PID 2020 wrote to memory of 4108	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	115
PID 2020 wrote to memory of 2200	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	117
PID 2020 wrote to memory of 840	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	118
PID 2020 wrote to memory of 1516	2020	5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe	121
PID 4596 wrote to memory of 3804	4596	powershell.exe	123

C:\Users\Admin\AppData\Local\Temp\5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
"C:\Users\Admin\AppData\Local\Temp\5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560
- C:\ProgramData\BIN\GGSafe.exe
  "C:\ProgramData\BIN\GGSafe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4644
- C:\ProgramData\BIN\GGSafe.exe
  "C:\ProgramData\BIN\GGSafe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\BXYNI\guard-main.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\BXYNI\wmi-guard.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4168
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn "SystemHealthCheck" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3248
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn "SystemHealthCheck" /tr "\"C:\Users\Admin\AppData\Local\Temp\5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe\" /guard \"C:\ProgramData\BIN\GGSafe.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3684
- C:\Windows\SysWOW64\schtasks.exe
  schtasks.exe /create /tn "vc2y2uN8WQUmKAAAAAAAAAAAAAAAAAA" /tr "C:\ProgramData\BIN\GGSafe.exe" /sc onstart /ru "NT AUTHORITY\SYSTEM" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\BXYNI\guard-main.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn "SystemHealthCheck" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4156
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn "SystemHealthCheck" /tr "\"C:\Users\Admin\AppData\Local\Temp\5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe\" /guard \"C:\ProgramData\BIN\GGSafe.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:224

C:\Users\Admin\AppData\Local\Temp\5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe
"C:\Users\Admin\AppData\Local\Temp\5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020
- C:\ProgramData\BIN\GGSafe.exe
  "C:\ProgramData\BIN\GGSafe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4740
- C:\ProgramData\BIN\GGSafe.exe
  "C:\ProgramData\BIN\GGSafe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4680
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\TDEPI\guard-main.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\TDEPI\wmi-guard.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\ProgramData\BIN\GGSafe.exe
    "C:\ProgramData\BIN\GGSafe.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3804
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn "SystemHealthCheck" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn "SystemHealthCheck" /tr "\"C:\Users\Admin\AppData\Local\Temp\5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe\" /guard \"C:\ProgramData\BIN\GGSafe.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1292
- C:\Windows\SysWOW64\schtasks.exe
  schtasks.exe /create /tn "benDVqbWLHa1AAAAAAAAAAAAAAAAAAA" /tr "C:\ProgramData\BIN\GGSafe.exe" /sc onstart /ru "NT AUTHORITY\SYSTEM" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\TDEPI\guard-main.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn "SystemHealthCheck" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:840
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn "SystemHealthCheck" /tr "\"C:\Users\Admin\AppData\Local\Temp\5fb1c06e5c3a5346fd699b66be15478b58b48ac30860d3053c356c10312de885.exe\" /guard \"C:\ProgramData\BIN\GGSafe.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1516

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3088

C:\ProgramData\BIN\GGSafe.exe
C:\ProgramData\BIN\GGSafe.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GGSafe.exe

Path C:\ProgramData\BIN\GGSafe.exe
Size 40KB
SHA256 0cae2f454b329fb40864c605c0e0175608fb64a971209cdf7c183b181377b11a
MD5 34ccdeda467d642278fe87adf167c2cd
SHA1 2d27bb29c213422b60583881a16953a734f50a07
SHA512 ecc24ecd830a99523c56020481d6d922e28fc496ce093641058ed8c2ce980d828d9d954c7fa99d3d9abc37213508cb0de4a40e88ed133ba1d4f22dcdbe3ace46
SSDEEP 768:xSseI055d5DYjBYdTd5zF4xfQ5hW2NRoMw:UJI055fYadd5zFxzhRor
TLSH
T14A133A825320A809D9AD5A70C856DEFA1B38DDCD6D440CCAFBB0E93B6F117619E3191E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.zip

Path C:\ProgramData\BXYNI\1.zip
Size 344KB
SHA256 c4621d19e9b19357f50b66036a3ee56a92e6f525618349839b173422ef4a4735
MD5 e5d77d1d3ab6c920281be2c605705c67
SHA1 7268064b07f1b813a2aed660a5b5058a179fc3cd
SHA512 2ac663b7c8bd67ebc441a899838c2165a77bc769aa694f683a58a80aa4421f531e05b505e96cbfc225cae09bcf07ba39b35b31416be9d91c51d863246a4d82ec
SSDEEP 6144:Lk2SLfIab5mfPq9yIPiVgVy2f1gKRX5m001Z5LpE0JT4lfaE9Qw9Mhv8:L7Ahm3qnA297RX5x01Z5lrxYfaE9p9Ma
TLSH
T1DA7423F1B1A59BACF071E4AB8F00CF77B47025835E18E53A93D7206F4D90BB0A546547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GGLoader.dll

Path C:\ProgramData\BXYNI\GGLoader.dll
Size 149KB
SHA256 c47856fdb03c8b0841c6daf9f7831b98e32f471960a94f0240f7096962a8600f
MD5 2652ed9720f0d334e22182562431918d
SHA1 c49a67a8aacc661af307ba52afd9dbb81ce92f11
SHA512 6b10d118f503a3323d74864e65a743eb9bdc94d61138db1b014e8f3ace304686d6e2d98e719ce797bc461ca73dc54e35b8a8fa08c7b213124402a4ab1b6b07de
SSDEEP 3072:hCAHnSq1PS62aXRY6S7pO8h57u5oR5b+yuCwgl9H5s9Fr:hVj1K620mpOSxSoac55s9Fr
TLSH
T1CFE38C41B5C0C076CD3F153098B6EBB50A3CB9200FA5AEDB73944D6EAE706C09775A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\ProgramData\BXYNI\config.dat
Size 245KB
SHA256 aa14fc639a554c6b934eaeac3095258ac6b546fa8d77bc3717ecd41a87299953
MD5 ba134ebf5058e09b3705c2323a82df66
SHA1 5911e1c69ae527b1fce881f0f86f09d34a797b34
SHA512 85970c4046cbbf23c79a6842104938dd1db559b17448a58daa1f33d16b0a4dbf54d526a0acb1995d514e6e7797c83d6957e65a42c54e61258733075604dcf634
SSDEEP 6144:Rk2SLfIab5mfPq9yIPiVgVy2f1gKRX5m001ZO:R7Ahm3qnA297RX5x01ZO
TLSH
T1313423F222AA856DB060E85BCE138F73706002D26E3CF17BD787217F59D0A38695E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guard-main.ps1

Path C:\ProgramData\BXYNI\guard-main.ps1
Size 1KB
SHA256 8a17a3f88a216e0ed9c7515594950359ac68caeed7a0d44cc9d3a622a952d5a3
MD5 16878f130d59442862bc00041d9a5ab6
SHA1 3069d7d8b985cfb583addfa5a3d6c5942281ad06
SHA512 625f2411ef0ba160fc175b9186711502a72dd49210be0e3343ef375dab6f4a30a1b9f2de40ba1f198a60016a76988794a1698df59c0121c6f69cd1e3a49acf26
TLSH
T102312349A514248243725B389DDE5B6EFF4A003F845B0A00B8FC82441F70A7547B6DC5
MD5 SHA1 SHA512 TLSH

Submit Download

guard.lock

Path C:\ProgramData\BXYNI\guard.lock
Size 9B
SHA256 fa191feb41742e1d763567c0c5a4a7eac7b5b0c95f6b15f3a260483bb57270bc
MD5 d5457a80eed9647363e1751dcec352e2
SHA1 d737a7982b8ba567fc359ff4a10dec3d9aeb095e
SHA512 e611792922b7aeeb02aed650bba99820dfd8ba5305fcf4fc79863831dc294d95ae2ca31e22f92fb8be9e6930eeeb0b608ac7f8e4cc939f9441fd8e613a8fdf07
MD5 SHA1 SHA512

Submit Download

wmi-guard.ps1

Path C:\ProgramData\BXYNI\wmi-guard.ps1
Size 710B
SHA256 1e5b042035a0a6503823c4824f17c5fd51e0fd11d7ee10b84acbdf7fadbfdb69
MD5 c9e46277a1983b81b7031ebfd7a15fd1
SHA1 5c1b4206dd767966db738e0d2bec557fa7a5542e
SHA512 75d93a242235c942c9681dc7996519626d31b4dce5adf7f08403451b8d29887ec84a109e08e2a27fe41d2e184208c7630090bf8d24ad04563435b46073a2da89
TLSH
T1E70144063B5031E3D37BCD07839B1B17DE1B60D3552B06126DD473444F30E02760946B
MD5 SHA1 SHA512 TLSH

Submit Download

guard-main.ps1

Path C:\ProgramData\TDEPI\guard-main.ps1
Size 1KB
SHA256 b65c2302855ee3c03bb23983e1130893c3eef149409d3ec6c18fa879e401c559
MD5 0a3ad7501bc8e0caaef5d44c2d5e4bee
SHA1 ddc726ec72ed51dd541e34c8557a741e07c0c45c
SHA512 f42e1ec1cd0dec228e07772f1fb23c67c8f4572b0afcb0206311b9fec509849a422782cf414e4618525b9de2b6f00955f2f53113d6f8d1104a91e684fd556e91
TLSH
T117312049A91824864372AB34ADDE5B6EFF8A003F846B1A00B8FC82441F70A7547BADC5
MD5 SHA1 SHA512 TLSH

Submit Download

guard.lock

Path C:\ProgramData\TDEPI\guard.lock
Size 9B
SHA256 16c20e4fce01850da904bd225e03bbfb3ecc350466437b7f75a4495f5f82f4ec
MD5 68d775db5955575695c570cbab5a15f4
SHA1 d38cc9f60755eecd205b7a4047e54084543dcbcf
SHA512 53e235143b35d40f0892711e715efc1796d15abddfb5955a9c95eb637adbb73bc41ba3a5aed4dcfd838e5de5ec3742917d67ef8432244fd45fc851624c23924c
MD5 SHA1 SHA512

Submit Download

wmi-guard.ps1

Path C:\ProgramData\TDEPI\wmi-guard.ps1
Size 710B
SHA256 3f954d042c72ca7246ac9dfe291beaef90bc99f5a034e9ce8d3fb17b28e08b8b
MD5 040058938e8d1cd674c3b0530c16bda6
SHA1 0c76f578e06df10465fcf47a02da5686b59a2744
SHA512 009fa37e1fa48a5b7b7605ed9537e2792f26feb9bc84a6aa720e393e89a51c03531a099df285c08765c8a7fd244b115738d5c7cf616ec5e8ca3950eed924892a
TLSH
T1D70110063B5421A3937BCD03839B1B16DE1B60D3552A06226DD433444F30E02664946B
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
MD5 e080d58e6387c9fd87434a502e1a902e
SHA1 ae76ce6a2a39d79226c343cfe4745d48c7c1a91a
SHA512 6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede
TLSH
T13D4159303121B5D80D435F5608286EC9A2FF474ABFAC9F5CB669221DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 32ea100a14307d5b926ac3acf46c6c95720c312470bf61843c772fe171eda17d
MD5 e59ff6060db35b67cd3bc3c7415a18e2
SHA1 7bdc749a4523eca1fc8a4be1cd4c40604b5549c4
SHA512 ca036f80c8ed515084dbd1bfec886ac207753cf4a9f55196ae48093ab9d3a9ea8bc04cb73a506a6ce337fb7a294962742f8a1fffa1ae73c467daaa591e64f5ed
SSDEEP 384:AM3H9kB1S1kpMLK7d6FRHEMEyHnnNXjs2lliQ6CqUb6x0zbQ5lbSsDb:Jq1Smp7d6RPEyNXj7viQ61Ui0XQ5AsH
TLSH
T16582B3AE714F22C3C8D52378E106054FE4F2DECD030E17D9BB2A5E7B8AACA5E516D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 a39c89238c003cd60039bdf1cd98528355da2be897dcdd7f1a73cc5069ffcbc7
MD5 4840b06398c0ef6dfc3e683be11b9761
SHA1 284d7a66f76944fc3409a1e1e7fe36ec6aba1a2b
SHA512 61a4aa4fbc257fedd9023c921d3df82feae7a972f246129289d8ab749174bba71d671d57169e09c0c15d3561c649d0e433ffa3e097c010595cddc40eceb4d3f2
SSDEEP 384:6QHoD1GACWcUKvRXa6RO/NTczH1jsanWrDwel++XVZXbhZE7JasOd3RC:i1jnKvRqPoxjmDweH3hZEos5
TLSH
T17D82096E626F029AF67256F484225B9FFEE095DFC3C484DE9750583800DB63244EA4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rpg5m2re.1jw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rpg5m2re.1jw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 8KB
SHA256 3993abc951870850e6e32dcebf1e9eba5de13866ba0f0ab7dde8202542569829
MD5 3a341f01c8d313c3e417049d49437fc7
SHA1 303b98974ac446c4608c28e610a96b0e33f3a948
SHA512 dc2c75a1fa15c9d168c8d01290c874c5f445738adcc3b7dafef290f6ebde21de6a095637db99066d827aed45a99ec9e0d4ec0e78cb7f5cc1a3a3bbac9c9f64ff
SSDEEP 48:rxhyqXy3VTJ70rJvUu8kEtJxucWuTJFQ9uMtl1gadRlTQt+iJquPGQetJjurTPxU:N45VFQNxEfnlFFQfldRZc+8WQefYEp
TLSH
T113020112359AAF27E048C233C9F3CA457B62FE83A9514D1F7E8A370B6DB18C0159979C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/580-179-0x0000000001F60000-0x0000000001FA2000-memory.dmp

Download

memory/580-186-0x0000000001F60000-0x0000000001FA2000-memory.dmp

Download

memory/580-187-0x0000000001F60000-0x0000000001FA2000-memory.dmp

Download

memory/580-189-0x0000000001F60000-0x0000000001FA2000-memory.dmp

Download

memory/580-188-0x0000000001F60000-0x0000000001FA2000-memory.dmp

Download

memory/4168-121-0x0000000005A70000-0x0000000005ABC000-memory.dmp

Download

memory/4168-90-0x00000000045C0000-0x00000000045F6000-memory.dmp

Download

memory/4168-113-0x0000000005560000-0x00000000058B7000-memory.dmp

Download

memory/4168-100-0x00000000054F0000-0x0000000005556000-memory.dmp

Download

memory/4168-99-0x0000000005480000-0x00000000054E6000-memory.dmp

Download

memory/4168-120-0x0000000005A30000-0x0000000005A4E000-memory.dmp

Download

memory/4168-171-0x0000000006A10000-0x0000000006AA6000-memory.dmp

Download

memory/4168-172-0x0000000005F40000-0x0000000005F5A000-memory.dmp

Download

memory/4168-173-0x0000000005F90000-0x0000000005FB2000-memory.dmp

Download

memory/4168-174-0x00000000070B0000-0x0000000007656000-memory.dmp

Download

memory/4364-86-0x0000000001BF0000-0x0000000001C32000-memory.dmp

Download

memory/4364-79-0x0000000001BF0000-0x0000000001C32000-memory.dmp

Download

memory/4364-89-0x0000000001BF0000-0x0000000001C32000-memory.dmp

Download

memory/4364-88-0x0000000001BF0000-0x0000000001C32000-memory.dmp

Download

memory/4364-87-0x0000000001BF0000-0x0000000001C32000-memory.dmp

Download

memory/4560-98-0x0000000005A80000-0x0000000005AA2000-memory.dmp

Download

memory/4560-175-0x00000000085C0000-0x0000000008C3A000-memory.dmp

Download

memory/4560-97-0x0000000005320000-0x000000000594A000-memory.dmp

Download

memory/4596-246-0x00000000062C0000-0x000000000630C000-memory.dmp

Download

memory/4596-239-0x0000000005D00000-0x0000000006057000-memory.dmp

Download

memory/4644-72-0x0000000001BE0000-0x0000000001C22000-memory.dmp

Download

memory/4644-71-0x0000000001BE0000-0x0000000001C22000-memory.dmp

Download

memory/4644-70-0x0000000001BE0000-0x0000000001C22000-memory.dmp

Download

memory/4644-73-0x0000000001BE0000-0x0000000001C22000-memory.dmp

Download

memory/4644-63-0x0000000001BE0000-0x0000000001C22000-memory.dmp

Download

memory/4680-223-0x0000000001B10000-0x0000000001B52000-memory.dmp

Download

memory/4680-224-0x0000000001B10000-0x0000000001B52000-memory.dmp

Download

memory/4680-222-0x0000000001B10000-0x0000000001B52000-memory.dmp

Download

memory/4680-225-0x0000000001B10000-0x0000000001B52000-memory.dmp

Download

memory/4680-215-0x0000000001B10000-0x0000000001B52000-memory.dmp

Download

memory/4740-283-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-200-0x0000000001C20000-0x0000000001C62000-memory.dmp

Download

memory/4740-209-0x0000000001C20000-0x0000000001C62000-memory.dmp

Download

memory/4740-210-0x0000000001C20000-0x0000000001C62000-memory.dmp

Download

memory/4740-207-0x0000000001C20000-0x0000000001C62000-memory.dmp

Download

memory/4740-277-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-278-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-285-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-307-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-291-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-312-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-309-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-308-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-289-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-319-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-323-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-322-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-316-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-315-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-284-0x0000000001C20000-0x0000000001C62000-memory.dmp

Download

memory/4740-281-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-208-0x0000000001C20000-0x0000000001C62000-memory.dmp

Download

memory/4740-282-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-279-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-276-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-275-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-274-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-273-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-271-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-280-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-272-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-266-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-326-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-325-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-324-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-328-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-329-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-332-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-335-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-334-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-338-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-339-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-342-0x0000000010000000-0x00000000100EA000-memory.dmp

Download

memory/4740-343-0x0000000010000000-0x00000000100EA000-memory.dmp

Download