Overview

overview

10

Static

static

10

Supernova/...b0.exe

windows10-2004-x64

10

Supernova/...b0.exe

windows11-ltsc_2024-x64

10

Supernova/...1a.exe

windows10-2004-x64

10

Supernova/...1a.exe

windows11-ltsc_2024-x64

10

Supernova/...f9.exe

windows10-2004-x64

10

Supernova/...f9.exe

windows11-ltsc_2024-x64

10

Supernova/...8f.exe

windows10-2004-x64

1

Supernova/...8f.exe

windows11-ltsc_2024-x64

1

Supernova/...a0.exe

windows10-2004-x64

10

Supernova/...a0.exe

windows11-ltsc_2024-x64

10

Supernova/...b4.exe

windows10-2004-x64

10

Supernova/...b4.exe

windows11-ltsc_2024-x64

10

Supernova/...fc.exe

windows10-2004-x64

10

Supernova/...fc.exe

windows11-ltsc_2024-x64

10

Supernova/...70.exe

windows10-2004-x64

3

Supernova/...70.exe

windows11-ltsc_2024-x64

3

Supernova/...ac.exe

windows10-2004-x64

10

Supernova/...ac.exe

windows11-ltsc_2024-x64

10

Supernova/...9a.exe

windows10-2004-x64

1

Supernova/...9a.exe

windows11-ltsc_2024-x64

1

Supernova/...e3.exe

windows10-2004-x64

1

Supernova/...e3.exe

windows11-ltsc_2024-x64

8

Supernova/...8b.exe

windows10-2004-x64

10

Supernova/...8b.exe

windows11-ltsc_2024-x64

10

Supernova/...75f.js

windows10-2004-x64

10

Supernova/...75f.js

windows11-ltsc_2024-x64

10

Supernova/...fc.exe

windows10-2004-x64

10

Supernova/...fc.exe

windows11-ltsc_2024-x64

10

Supernova/...86.exe

windows10-2004-x64

9

Supernova/...86.exe

windows11-ltsc_2024-x64

9

Supernova/...c1.exe

windows10-2004-x64

10

Supernova/...c1.exe

windows11-ltsc_2024-x64

10

Resubmissions

23/09/2026, 17:04

260923-vledlayx6m

06/09/2026, 10:43

260906-msd3eashke

01/09/2026, 13:41

260901-qzhwqazepg

01/09/2026, 12:58

260901-p7y28szbqc10

18/08/2026, 20:05

260818-yt533azcke10

16/08/2026, 10:12

260816-l8ylbahj9t

15/08/2026, 21:01

260815-ztx8wstdla

15/08/2026, 20:42

260815-zhhdastyfv

14/08/2026, 18:02

260814-wmq98afk91

09/08/2026, 10:50

260809-mxkqrazta1

Analysis

  • max time kernel
    600s
  • max time network
    635s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Supernova/3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9.exe
  • Size 1016KB
  • Sample260626-rxt2mscs3x
  • SHA256 3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypykspapersistenceprivilege_escalationransomwarespywaretrojanworm

Malware Config

Signatures

  • Family: Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Detect Pykspa worm 2 IoCs
    worm
  • Modifies WinLogon for persistence 2 TTPs 10 IoCs
    persistence
  • UAC bypass 3 TTPs 19 IoCs
    defense_evasiontrojan
  • Adds policy Run key to start application 2 TTPs 50 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 6 IoCs
    defense_evasion
  • Executes dropped EXE 33 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 20 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 50 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Supernova\3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9.exe
    "C:\Users\Admin\AppData\Local\Temp\Supernova\3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\users\admin\appdata\local\temp\supernova\3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3592
      • C:\Users\Admin\AppData\Local\Temp\mutalt.exe
        "C:\Users\Admin\AppData\Local\Temp\mutalt.exe" "-C:\Users\Admin\AppData\Local\Temp\yqzqldlgrftlwzny.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:4404
      • C:\Users\Admin\AppData\Local\Temp\mutalt.exe
        "C:\Users\Admin\AppData\Local\Temp\mutalt.exe" "-C:\Users\Admin\AppData\Local\Temp\yqzqldlgrftlwzny.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:1812
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\users\admin\appdata\local\temp\supernova\3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:6136
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\users\admin\appdata\local\temp\supernova\3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:3556
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\users\admin\appdata\local\temp\supernova\3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:2752
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\users\admin\appdata\local\temp\supernova\3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:5968
  • C:\Windows\explorer.exe
    Explorer.exe
    1⤵
    • Modifies registry class
    PID:1628
  • C:\Windows\zugaytecqhythnesakf.exe
    zugaytecqhythnesakf.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5772
  • C:\Windows\bymiifssiburhpiyiurfb.exe
    bymiifssiburhpiyiurfb.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\windows\bymiifssiburhpiyiurfb.exe*."
      2⤵
      • Executes dropped EXE
      PID:252
  • C:\Windows\fyiawpyugvkdptiua.exe
    fyiawpyugvkdptiua.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5428
  • C:\Users\Admin\AppData\Local\Temp\oitmjdnkxndxkpfszi.exe
    C:\Users\Admin\AppData\Local\Temp\oitmjdnkxndxkpfszi.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1412
  • C:\Windows\yqzqldlgrftlwzny.exe
    yqzqldlgrftlwzny.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\windows\yqzqldlgrftlwzny.exe*."
      2⤵
      • Executes dropped EXE
      PID:1980
  • C:\Users\Admin\AppData\Local\Temp\bymiifssiburhpiyiurfb.exe
    C:\Users\Admin\AppData\Local\Temp\bymiifssiburhpiyiurfb.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5052
  • C:\Windows\mivqplxwldvrgnfudokx.exe
    mivqplxwldvrgnfudokx.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5344
  • C:\Users\Admin\AppData\Local\Temp\mivqplxwldvrgnfudokx.exe
    C:\Users\Admin\AppData\Local\Temp\mivqplxwldvrgnfudokx.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5572
  • C:\Windows\oitmjdnkxndxkpfszi.exe
    oitmjdnkxndxkpfszi.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5860
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\windows\oitmjdnkxndxkpfszi.exe*."
      2⤵
      • Executes dropped EXE
      PID:3264
  • C:\Windows\zugaytecqhythnesakf.exe
    zugaytecqhythnesakf.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\windows\zugaytecqhythnesakf.exe*."
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:3972
  • C:\Windows\bymiifssiburhpiyiurfb.exe
    bymiifssiburhpiyiurfb.exe
    1⤵
    • Executes dropped EXE
    PID:1644
  • C:\Users\Admin\AppData\Local\Temp\fyiawpyugvkdptiua.exe
    C:\Users\Admin\AppData\Local\Temp\fyiawpyugvkdptiua.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2432
  • C:\Users\Admin\AppData\Local\Temp\yqzqldlgrftlwzny.exe
    C:\Users\Admin\AppData\Local\Temp\yqzqldlgrftlwzny.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5044
  • C:\Windows\yqzqldlgrftlwzny.exe
    yqzqldlgrftlwzny.exe
    1⤵
    • Executes dropped EXE
    PID:464
  • C:\Windows\mivqplxwldvrgnfudokx.exe
    mivqplxwldvrgnfudokx.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
      "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\windows\mivqplxwldvrgnfudokx.exe*."
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:2092
  • C:\Windows\oitmjdnkxndxkpfszi.exe
    oitmjdnkxndxkpfszi.exe
    1⤵
    • Executes dropped EXE
    PID:3572
  • C:\Users\Admin\AppData\Local\Temp\zugaytecqhythnesakf.exe
    C:\Users\Admin\AppData\Local\Temp\zugaytecqhythnesakf.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5096
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Windows\bymiifssiburhpiyiurfb.exe
        "C:\Windows\bymiifssiburhpiyiurfb.exe" .
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3620
        • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
          "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\windows\bymiifssiburhpiyiurfb.exe*."
          4⤵
          • Executes dropped EXE
          PID:4692
      • C:\Users\Admin\AppData\Local\Temp\bymiifssiburhpiyiurfb.exe
        "C:\Users\Admin\AppData\Local\Temp\bymiifssiburhpiyiurfb.exe" .
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
          "C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe" "c:\users\admin\appdata\local\temp\bymiifssiburhpiyiurfb.exe*."
          4⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Adds policy Run key to start application
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System policy modification
          PID:5036
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1124
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2800
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4792

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Replication Through Removable Media

          1
          T1091

          Execution

          Persistence

          Boot or Logon Autostart Execution

          4
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Hijack Execution Flow

          1
          T1574

          Executable Installer File Permissions Weakness

          1
          T1574.005

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          4
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Hijack Execution Flow

          1
          T1574

          Executable Installer File Permissions Weakness

          1
          T1574.005

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Hijack Execution Flow

          1
          T1574

          Executable Installer File Permissions Weakness

          1
          T1574.005

          Impair Defenses

          2
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Safe Mode Boot

          1
          T1562.009

          Modify Registry

          7
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Replication Through Removable Media

          1
          T1091

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 4fdca9a87fd1863cbf896fbf826bf407784969606d76553d2e0a3c524787c661
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 850ec94a771d8dceab6fb93e863aa96b478c70ad287a1426686ab14e246adc67
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 2372992539ec78faa7bbff22ce90c0bc6871d080f19bceaa5230629cad5b7ac1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 b65cea0f2c517e7ee11aa1fb64fee000e268fec6852488dbe4312e9e1573c1d0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 1e119139a20a2a4c71097689716f11a94f85d0b75f710c254a40e74f6cbc5a5c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 1d74d06fca5ac27ec9688e1a50efa8078868a2b72311073d367b24478146a1c3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 5c7347b490fb7cc369839dae7b03d6b68343d31f823ca595b0c8594cb48e4bc1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 761ff5226f7cbd66586377e48524f81314990a30ad9cd77a20c65e976ee6e888
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 fd22e108b402b29bbb77ae9980881dff2703021e989f79d62ce24114b1b64a93
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 d42d7aa49e309d16e0f3275bb6434077ac8f2350741df967655f85555bce5936
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 06e34d747a738931fc09b40c294311c940b2884e763eeca6b4f380c42b2186d9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 7d9cb66317e96f5a96c21259d26acea9d00ea368fb019b72eb196dc3f922b662
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 acf98db7710e63191c17a78ea892ae866741e142e2a56647690420b45477284b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 1ae1e55ba28959b2675de99c9af05ad29d06dc782b992bc80076db0d92f0a27a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 08625b371c57c3289ef4bf5d51aa21e0835cf5dbee483ae3da42de20b3bf4bf6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 f5a84da12ee747e9b53b012ada47c68451469380b4776714a31282d426e8e96d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 cca4bfdaf87371b5c2273f6bfc2b83035cb57e61e65970e5c7dd36277152c1e9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 cf3995dec3604423bd3400758e4f3ea50106ef75b0ca0b647537a1b0fbf26722
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 1bd20b11fbdf5e876b58b3ec29c662b813eed7aa60a13a2de84bc3e12437cd22
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 0e3dc3cb52d5ddb8b7942121f7ed0ab66c34a9f7d10284144600bd8f788cc4af
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 241e93264de1cc4509fdffc7053d55008ba69b2d89e0f82d93c2d79bcbf0758b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Program Files (x86)\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 df5eb7610c78e483d56903fc6c67de342b6ea0d298c4039dbcfca67a2501dddb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 607B
          • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mutalt.exe
          • Path C:\Users\Admin\AppData\Local\Temp\mutalt.exe
          • Size 712KB
          • SHA256 f331a0cd7e00de6c227096fa8e9c4a0e4dc681dfc16334c4f28d518f6fc71738
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mviomvbbwfs.exe
          • Path C:\Users\Admin\AppData\Local\Temp\mviomvbbwfs.exe
          • Size 320KB
          • SHA256 d6994e73fb83550d50df8bc32ac094623be3f0e8a41352fc9d6d63c80abdea47
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Users\Admin\AppData\Local\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 c4ae08ec61bb618f0088f754be73e39456ac9409d7572a36a277ae3e3f2550f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dewwabswqnklfroiwmnff.kbf
          • Path C:\Users\Admin\AppData\Local\dewwabswqnklfroiwmnff.kbf
          • Size 280B
          • SHA256 0cebaa72a69dac23202cdb6584c4e2caa473afec6702815f579ea2cd12b65b43
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          yknynzbqvdlxczhmlmybmbnpejrzlqnv.zam
          • Path C:\Users\Admin\AppData\Local\yknynzbqvdlxczhmlmybmbnpejrzlqnv.zam
          • Size 4KB
          • SHA256 a9653295279e2179926252d8bfd95eebaadb1be63bf6fb34f551388048bfd36f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oitmjdnkxndxkpfszi.exe
          • Path C:\Windows\SysWOW64\oitmjdnkxndxkpfszi.exe
          • Size 1016KB
          • SHA256 3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          yknynzbqvd.bat
          • Path C:\yknynzbqvd.bat
          • Size 468KB
          • SHA256 f630facf10df73db748cbb3bfd4c8544adee9ed8c270e82c9d18219916feb8ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1124-269-0x0000020414110000-0x0000020414130000-memory.dmp
          Download

          memory/1124-236-0x0000020403930000-0x0000020403950000-memory.dmp
          Download

          memory/1124-252-0x0000020403B90000-0x0000020403BB0000-memory.dmp
          Download

          memory/1124-224-0x00000204001E0000-0x00000204002E0000-memory.dmp
          Download

          memory/1124-237-0x0000020413E20000-0x0000020413F20000-memory.dmp
          Download

          memory/1124-225-0x00000204001E0000-0x00000204002E0000-memory.dmp
          Download

          memory/1124-223-0x00000204001E0000-0x00000204002E0000-memory.dmp
          Download

          memory/2012-706-0x000000000DF50000-0x000000000E7CB000-memory.dmp
          Download

          memory/2012-394-0x000000000DF50000-0x000000000E7CB000-memory.dmp
          Download