Overview

overview

8

Static

static

3

Adobe_Acro...8A.exe

windows10-2004-x64

7

Adobe_Acro...8A.exe

windows11-ltsc_2024-x64

7

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ay.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ON.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rk.dll

windows10-2004-x64

3

$PLUGINSDI...rk.dll

windows11-ltsc_2024-x64

3

$TEMP/$R0.exe

windows10-2004-x64

1

$TEMP/$R0.exe

windows11-ltsc_2024-x64

1

$TEMP/$_65_.exe

windows10-2004-x64

1

$TEMP/$_65_.exe

windows11-ltsc_2024-x64

1

$_34_.exe

windows10-2004-x64

1

$_34_.exe

windows11-ltsc_2024-x64

1

CBBackupPlan.exe

windows10-2004-x64

1

CBBackupPlan.exe

windows11-ltsc_2024-x64

1

CBFS6Net.dll

windows10-2004-x64

1

CBFS6Net.dll

windows11-ltsc_2024-x64

1

Cloud.AzureClient.dll

windows10-2004-x64

1

Cloud.AzureClient.dll

windows11-ltsc_2024-x64

1

Cloud.Back...ge.dll

windows10-2004-x64

1

Cloud.Back...ge.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/06/2026, 00:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Adobe_Acrobat_en_installer_o_backup_v8.6.0.338_oid595f2f7b-2721-4965-9a47-5884cf68f0d0_bidSEEzazG0BU6CB6wd37dv8A.exe
  • Size 24.8MB
  • Sample260620-arftdsdx51
  • SHA256 f11345c8996c1750815b1d25269ca69c7b3a931ebfb244cd85c23b299d92fdcb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Adobe_Acrobat_en_installer_o_backup_v8.6.0.338_oid595f2f7b-2721-4965-9a47-5884cf68f0d0_bidSEEzazG0BU6CB6wd37dv8A.exe
    "C:\Users\Admin\AppData\Local\Temp\Adobe_Acrobat_en_installer_o_backup_v8.6.0.338_oid595f2f7b-2721-4965-9a47-5884cf68f0d0_bidSEEzazG0BU6CB6wd37dv8A.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:6776
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C move /y "C:\Users\Admin\AppData\Local\Temp\install.log" "C:\Program Files\Performance Interventions, Inc.\Online Backup\"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5488
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /u "C:\Program Files\Performance Interventions, Inc.\Online Backup\Cloud.Backup.RM.Service.exe"
      2⤵
        PID:4228
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /u "C:\Program Files\Performance Interventions, Inc.\Online Backup\Cloud.Backup.Scheduler.exe"
        2⤵
          PID:1276
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Program Files\Performance Interventions, Inc.\Online Backup\Cloud.Backup.config" /grant *S-1-5-32-544:(F)
          2⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:7140
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Program Files\Performance Interventions, Inc.\Online Backup\Cloud.Backup.config" /grant *S-1-5-32-545:(RX)
          2⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:5944
        • C:\Program Files\Performance Interventions, Inc\Online Backup\cbb.exe
          "C:\Program Files\Performance Interventions, Inc.\Online Backup\cbb.exe" saveappdatafolder
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5208
        • C:\Program Files\Performance Interventions, Inc\Online Backup\cbb.exe
          "C:\Program Files\Performance Interventions, Inc.\Online Backup\cbb.exe" verifyFileSignature -f "C:\Users\Admin\AppData\Local\Temp\Adobe_Acrobat_en_installer_o_backup_v8.6.0.338_oid595f2f7b-2721-4965-9a47-5884cf68f0d0_bidSEEzazG0BU6CB6wd37dv8A.exe"
          2⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          PID:1856
        • C:\Program Files\Performance Interventions, Inc\Online Backup\cbb.exe
          "C:\Program Files\Performance Interventions, Inc.\Online Backup\cbb.exe" oci -csid "" -dn ""
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3652
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /u "C:\Program Files\Performance Interventions, Inc.\Online Backup\Cloud.Backup.Scheduler.exe"
          2⤵
            PID:5176
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /i "C:\Program Files\Performance Interventions, Inc.\Online Backup\Cloud.Backup.Scheduler.exe"
            2⤵
            • Drops file in Program Files directory
            PID:1284
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /u "C:\Program Files\Performance Interventions, Inc.\Online Backup\Cloud.Backup.RM.Service.exe"
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2724
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /i "C:\Program Files\Performance Interventions, Inc.\Online Backup\Cloud.Backup.RM.Service.exe"
            2⤵
            • Drops file in Program Files directory
            • Suspicious use of AdjustPrivilegeToken
            PID:3828
          • C:\Program Files\Performance Interventions, Inc\Online Backup\Online Backup.exe
            "C:\Program Files\Performance Interventions, Inc.\Online Backup\Online Backup.exe" /createeventsource
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4460
          • C:\Windows\SysWOW64\CMD.EXE
            "C:\Windows\system32\CMD.EXE" /C ren "C:\Program Files\Performance Interventions, Inc.\Online Backup\install.log" "install_8.6.0.338_20260620012731.log"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:6116
        • C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.Scheduler.exe
          "C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.Scheduler.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:6620
        • C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.RM.Service.exe
          "C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.RM.Service.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2704
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
            PID:4908

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                Cloud.AzureClient.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.AzureClient.dll
                • Size 352KB
                • SHA256 9ece6b28a1501bc7ff7844a0acf65bf6019abdda840972b6e3d1456486f9755a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.Backup.DiskImage.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.DiskImage.dll
                • Size 1.7MB
                • SHA256 9717af8637e6be30134b499ecd79d4e9682706d8d1c9d124288b3d6d4233eac5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.Backup.Engine.XmlSerializers.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.Engine.XmlSerializers.dll
                • Size 4.7MB
                • SHA256 6461c52b7b85a5cc399ef44daa9f047b399faf3f14dd4aa6892cfe9bdec6ffb8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.Backup.Engine.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.Engine.dll
                • Size 5.3MB
                • SHA256 33feb1de0be3c1dfd0eb90f70093b42b63b3068b75b3af07e623137fbb45d197
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.Backup.RM.Service.InstallLog
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.RM.Service.InstallLog
                • Size 385B
                • SHA256 9be32799c1f9b5be8804c71243e66a6bc1b0f4aeb61ca15427cf0ebed6c834f1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Cloud.Backup.RM.Service.InstallLog
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.RM.Service.InstallLog
                • Size 1KB
                • SHA256 692c00acb2bf39d477cc486cdfbd34b5c4e64edf80528f8a0eb3f817b5385f5e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Cloud.Backup.RM.Service.InstallLog
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.RM.Service.InstallLog
                • Size 2KB
                • SHA256 95f55448894514cc26f3fc923ecd2ace971a747b97f18570413e483d0f9f9e82
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Cloud.Backup.Scheduler.InstallLog
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.Scheduler.InstallLog
                • Size 382B
                • SHA256 11b96059dd1de57792103d2aaeed8aa346e6fb2f8aecf08f0879a5f9be8f91ff
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Cloud.Backup.Scheduler.InstallLog
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.Scheduler.InstallLog
                • Size 1KB
                • SHA256 97a9f994ba86d46e3df044cfc05df9cf50d228001a085b341d1e609a68908cd1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Cloud.Backup.Scheduler.InstallLog
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.Scheduler.InstallLog
                • Size 1KB
                • SHA256 5d10d4dd7c6caf1b3ab23f22a37ab0e3bb93b661d581a302518400f0392d421f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Cloud.Backup.Scheduler.exe
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.Scheduler.exe
                • Size 148KB
                • SHA256 fdf4acc5ea068208009dbdb0c5d95bbc79ea8c5a712fd60f3093a013c6a04118
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.Backup.Scheduler.exe.config
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.Scheduler.exe.config
                • Size 3KB
                • SHA256 79afa985f39394b142b044f4eba76a2fa6153ce8aa1b0bb9b76326c9fc043a46
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Cloud.Backup.VM.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.VM.dll
                • Size 373KB
                • SHA256 8574fb3c79d24234a691f94a91ea096042d03c6d6b090f607843944aa1dd099b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.Backup.config
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.config
                • Size 387B
                • SHA256 17cc63d30edc860441f5747590b0971b7d67242ef1132645c5a207bb64451552
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Cloud.Backup.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Backup.dll
                • Size 311KB
                • SHA256 923169932e79848bac79be60e8a1866d95441904991d9b5b68328663f430644a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.Base.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Base.dll
                • Size 1.4MB
                • SHA256 020e3fe23371e2350ccc05572499d12b7fae9bec5d76750cafb8e0a74549d668
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.CbfsInterface.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.CbfsInterface.dll
                • Size 63KB
                • SHA256 50f52b74dd614f19310b9b5767ad7518266d2299f5bc2eb52daa9e0a053a4f1f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.Client.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.Client.dll
                • Size 1.1MB
                • SHA256 501ead96dd039be25f790f760b1ba1e97884d666ef62cff1b5086085713b9b4f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Cloud.S3Client.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Cloud.S3Client.dll
                • Size 1.1MB
                • SHA256 c227baf457f462cfc67ddfb1dbc29e1b80316bf58978497ae1a4330d44266001
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DiskAccessLibrary.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\DiskAccessLibrary.dll
                • Size 273KB
                • SHA256 13a3ba8d52fb800f1a0f4f371ad994b9070966596355272fe1f5164cc55a0063
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InstallUtil.InstallLog
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\InstallUtil.InstallLog
                • Size 379B
                • SHA256 b9f78a720e20a113ad6125632f2e6080040008b113fdb6019e76ad6a9cac6ae7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                InstallUtil.InstallLog
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\InstallUtil.InstallLog
                • Size 2KB
                • SHA256 4ed9610619681806d29b7e38d4ac61c00cbe3b6e8d9ca950150d63c49c8e0906
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Newtonsoft.Json.dll
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Newtonsoft.Json.dll
                • Size 695KB
                • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Online Backup.exe
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\Online Backup.exe
                • Size 2.6MB
                • SHA256 42400a7e092c84a29ad7f5c29c8f4cbff8e825f0940ba4951fab5f536c703d43
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cbb.exe
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\cbb.exe
                • Size 657KB
                • SHA256 32f01d317287c9eedb2eb53ae627bcc7971881a5648066647fb3f869f552ce70
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cbb.exe.config
                • Path C:\Program Files\Performance Interventions, Inc\Online Backup\cbb.exe.config
                • Size 2KB
                • SHA256 8135e6e81640baf6d5b3444ced0a440221e13a8e36e6cc89c313736e3f69183f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Task Scheduler.log
                • Path C:\ProgramData\Online Backup\Logs\Task Scheduler.log
                • Size 3B
                • SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
                • MD5 SHA1 SHA512
                Submit Download

                Task Scheduler.log
                • Path C:\ProgramData\Online Backup\Logs\Task Scheduler.log
                • Size 785B
                • SHA256 1a0932acb9172fafe66520775312ef5cf7f34ee775b35ed87b620a41529a5aa3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Task Scheduler.log
                • Path C:\ProgramData\Online Backup\Logs\Task Scheduler.log
                • Size 2KB
                • SHA256 97cc4a7ba6924ef7a921f03d480b1a936946a9cea082c59db87ddad3dfa587e0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Task Scheduler.log
                • Path C:\ProgramData\Online Backup\Logs\Task Scheduler.log
                • Size 3KB
                • SHA256 e8f0e7d3b2dd21f0ca68387db287b27d9e6f3def136cb4a77dde0eda5741a074
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                cbb.log
                • Path C:\ProgramData\Online Backup\Logs\cbb.log
                • Size 540B
                • SHA256 2284e6d1a5c4e5c57305fa76056fffe37941ebb5fcf68065585e88ee37b5e0cb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                cbb.log
                • Path C:\ProgramData\Online Backup\Logs\cbb.log
                • Size 847B
                • SHA256 0db1ac89437d52c9fea85e4e4fa76486b320cc2177aa432af6d29798f0fb85bd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                cbb.log
                • Path C:\ProgramData\Online Backup\Logs\cbb.log
                • Size 1KB
                • SHA256 25f458f5e964b1c367b9bbe6836c68b473e587283cad4bc306b01fb00d6c49bf
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                console.log
                • Path C:\ProgramData\Online Backup\Logs\console.log
                • Size 462B
                • SHA256 de0de779f50c8a4dbf7325150ccd18d8c2b203a225a409e6150a045d9fbd8c07
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                rmservice.log
                • Path C:\ProgramData\Online Backup\Logs\rmservice.log
                • Size 458B
                • SHA256 1dc21038756d7bcf42a426c4cd50781b439beda9d930f4f4337f823d77da472b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                rmservice.log
                • Path C:\ProgramData\Online Backup\Logs\rmservice.log
                • Size 2KB
                • SHA256 d393493da87e43e2091466be496d1518a58deeebbd0097170c6be1230f11c6af
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                rmservice.log
                • Path C:\ProgramData\Online Backup\Logs\rmservice.log
                • Size 4KB
                • SHA256 5fdc1181b67d51d245043f57533e222553dcfb802b52108fe61119eedef8a21f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cbbackup.db
                • Path C:\ProgramData\Online Backup\data\cbbackup.db
                • Size 520KB
                • SHA256 3ac11e742a1d2987ce81f82f2e0f38cbcb0e3dae7667a96aba496539b2caf3cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                install.log
                • Path C:\Users\Admin\AppData\Local\Temp\install.log
                • Size 19KB
                • SHA256 26566b4437a5ef043e6567954009b3a19193876e6791e6cd15508c69f73d984d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nsdA6ED.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\nsdA6ED.tmp
                • Size 44KB
                • SHA256 a60ceffc3841de22aa7b41d93b222d4c3f3f49fa31586e86a964cdc40430ebf9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                INetC.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\INetC.dll
                • Size 21KB
                • SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InstallOptions.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\InstallOptions.dll
                • Size 14KB
                • SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                System.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\System.dll
                • Size 10KB
                • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                UAC.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\UAC.dll
                • Size 17KB
                • SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ioSpecial.ini
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\ioSpecial.ini
                • Size 741B
                • SHA256 d7c1c7d40bf5000174697c2776d409726350303e3619bb75b52bed51b9dd3661
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ioSpecial.ini
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\ioSpecial.ini
                • Size 660B
                • SHA256 ee240703de8ef3e1ad2772321bbc404bda58cab5144e043495486da4fdba3b57
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ioSpecial.ini
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\ioSpecial.ini
                • Size 682B
                • SHA256 3ec8988704ba2ff9605f1cad86dffc554f2be14ec780007514e2235f87ac7b89
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                modern-wizard.bmp
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\modern-wizard.bmp
                • Size 150KB
                • SHA256 fbec5dfc6532218c49374ee1607058acd72c0c9d4418fe5e60f0b7935d0d6eab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nsArray.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\nsArray.dll
                • Size 12KB
                • SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nsExec.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\nsExec.dll
                • Size 6KB
                • SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nsJSON.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\nsJSON.dll
                • Size 21KB
                • SHA256 15b527ac5d224b2b684ef07fecd6d71d61f05955e3a2bd3dd1de6378e927b3f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                processwork.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsg943D.tmp\processwork.dll
                • Size 231KB
                • SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1276-687-0x00007FFB834F0000-0x00007FFB83E94000-memory.dmp
                Download

                memory/1276-205-0x00007FFB834F0000-0x00007FFB83E94000-memory.dmp
                Download

                memory/1284-616-0x000002257FC30000-0x000002257FC42000-memory.dmp
                Download

                memory/1284-617-0x000002257FE30000-0x000002257FE6C000-memory.dmp
                Download

                memory/2704-757-0x000000001A6A0000-0x000000001A6AC000-memory.dmp
                Download

                memory/2704-934-0x000000001CC30000-0x000000001CC62000-memory.dmp
                Download

                memory/2704-764-0x000000001AB70000-0x000000001ABB2000-memory.dmp
                Download

                memory/2704-933-0x000000001B450000-0x000000001B45C000-memory.dmp
                Download

                memory/2704-936-0x000000001CFF0000-0x000000001D056000-memory.dmp
                Download

                memory/2704-937-0x000000001D440000-0x000000001D81A000-memory.dmp
                Download

                memory/2704-938-0x000000001D060000-0x000000001D09A000-memory.dmp
                Download

                memory/2704-939-0x000000001CC70000-0x000000001CC97000-memory.dmp
                Download

                memory/2704-692-0x000000001A520000-0x000000001A582000-memory.dmp
                Download

                memory/2704-691-0x0000000000BA0000-0x0000000000BBE000-memory.dmp
                Download

                memory/2724-657-0x000002E410490000-0x000002E4104AE000-memory.dmp
                Download

                memory/3652-568-0x000000001BE30000-0x000000001BE52000-memory.dmp
                Download

                memory/3652-567-0x000000001BE80000-0x000000001BECA000-memory.dmp
                Download

                memory/3652-565-0x000000001B7E0000-0x000000001B7F6000-memory.dmp
                Download

                memory/4228-569-0x00007FFB834F0000-0x00007FFB83E94000-memory.dmp
                Download

                memory/4228-204-0x00007FFB834F0000-0x00007FFB83E94000-memory.dmp
                Download

                memory/4228-197-0x0000018CB1D70000-0x0000018CB1D7A000-memory.dmp
                Download

                memory/4228-196-0x00007FFB8367F000-0x00007FFB83680000-memory.dmp
                Download

                memory/4460-776-0x000000001CC50000-0x000000001DB34000-memory.dmp
                Download

                memory/4460-755-0x0000000000410000-0x00000000006A2000-memory.dmp
                Download

                memory/4460-789-0x000000001BE80000-0x000000001BE96000-memory.dmp
                Download

                memory/5176-579-0x000001BFB0430000-0x000001BFB0458000-memory.dmp
                Download

                memory/5208-486-0x000000001BD90000-0x000000001C2E8000-memory.dmp
                Download

                memory/5208-500-0x000000001C6D0000-0x000000001C72E000-memory.dmp
                Download

                memory/5208-490-0x000000001C2F0000-0x000000001C4A4000-memory.dmp
                Download

                memory/5208-498-0x000000001C4B0000-0x000000001C562000-memory.dmp
                Download

                memory/5208-492-0x000000001BA70000-0x000000001BB88000-memory.dmp
                Download

                memory/5208-502-0x000000001C570000-0x000000001C5D4000-memory.dmp
                Download

                memory/5208-494-0x0000000002AD0000-0x0000000002B24000-memory.dmp
                Download

                memory/5208-488-0x000000001B950000-0x000000001BA6E000-memory.dmp
                Download

                memory/5208-496-0x000000001C970000-0x000000001CE30000-memory.dmp
                Download

                memory/5208-482-0x00000000007A0000-0x0000000000848000-memory.dmp
                Download

                memory/5208-484-0x000000001B6C0000-0x000000001B824000-memory.dmp
                Download

                memory/6620-717-0x000000001C9D0000-0x000000001CADA000-memory.dmp
                Download

                memory/6620-742-0x000000001C8C0000-0x000000001C91B000-memory.dmp
                Download

                memory/6620-631-0x0000000000DC0000-0x0000000000DE8000-memory.dmp
                Download

                memory/6776-84-0x00000000029F0000-0x0000000002A31000-memory.dmp
                Download