b76c9825ac1788940f4998fb954101325b7804924a5f3cb2ce7d1e665be4457d

Analysis

user interaction
yes
max time kernel
748s
max time network
750s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Built_Stub.exe
Size 2.0MB
Sample260703-plcbcag17z
SHA256 b76c9825ac1788940f4998fb954101325b7804924a5f3cb2ce7d1e665be4457d
MD5 ac2b81512c3cb4fe87a6840392c9e331
SHA1 60fa358cdd37a5c173612a16d65ae970f1cc8de3
SHA512 5d163659cc236ff62bb6a14954d33714d171392027c8db4bb5423438e9c32e91eb50bc14905ac1c6f7e20bdc4d3a5df18d8b15bd9934b81594ed7944e18e0137
SSDEEP 24576:s5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:gno8haujVsPAB8KY2+Bz+2
TLSH
T1FBA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Built_Stub.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Built_Stub.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5076	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Built_Stub.exe
"C:\Users\Admin\AppData\Local\Temp\Built_Stub.exe"
1⤵
- Checks processor information in registry
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2616

C:\Windows\system32\CredentialEnrollmentManager.exe
C:\Windows\system32\CredentialEnrollmentManager.exe
1⤵
PID:6368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:7068

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5996

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:6272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3576

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CloseReceive.gif

Path C:\Users\Admin\Desktop\CloseReceive.gif
Size 460KB
SHA256 919d8b33badc2c5193f74bbbe7c82724cf07bc5b45d75863c1f4627228a8cc57
MD5 db2d265b160398210fbcf81c63134b3a
SHA1 12828e8cc7d2a0b0a05ce7238274fbdae25593b1
SHA512 c0389112688a8237b7951870dc1a978c95c3f24260540a9ae6fa55442cc1ab926f5fab7b0056999d42bdec863349ecec8569d214e7395c97aaa71a338f3cc031
SSDEEP 12288:BYkrcviZeOVGCqNhNOMUCFFK4yFLjQ/AqsOods:BYkrdYOzqrBUCFFKNFLj1Zvds
TLSH
T1A2A4230E8473EC5E151CD852AA638B5083AD33BB05477172663F1D2AD713F6D22E2A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectLock.vsd

Path C:\Users\Admin\Desktop\DisconnectLock.vsd
Size 557KB
SHA256 9940fdd195242f2fb73d22ff8e0ff818df89b679cdd517a6a1fade7748e14a4e
MD5 bd1576eef8f43944927a25feedb26526
SHA1 f5d47905bf27d5f2607cfb2dabf4c89aba2f75fe
SHA512 58fd78dfde71ce76cd6b3b7c461ae9d52b80b62d2b24f56f821a52eafea71dc034a866e510ac09b2b9808575773bba578205a4ce04cb2b0383cb21f93bf441ef
SSDEEP 12288:9PnpRf6GVQAni0E8xQLkP/SDE/M5oTjR3A2ze9mAMS3FbK:PRyGpi2akyLIbe9GwFbK
TLSH
T138C423FA8D24CC4E25D452D0570CC663D93CE27C29297BCA1F487D5E1B61E2BB98B236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectRegister.bin

Path C:\Users\Admin\Desktop\DisconnectRegister.bin
Size 363KB
SHA256 f37ceb806e9d4347e4cf0275714cee0f00bc1afefb38645e11ea070be15f831b
MD5 077f11154ae4ddf113f058a6f9342a02
SHA1 adf446bd8d73d369540922620cac66a795a9f3af
SHA512 6a4ec025e486eb102ab3ae35f1e32da7bee551dea8183a463022b6de1001c237ffbcbe7ea899a28a8dadce0bcf436568abc7c0cb0a88c1f17f870d6dc00ede44
SSDEEP 6144:3Nt7sKx3IzNxGw/RPgXWmEnnSqrmxUi6tm+mOmikxzmaFefCHz0emnSJb+wjZ:wzN0w/5GLS3rmxJ6UKmJxzmaMCHgez39
TLSH
T1B18423E5DE62B6900955450DDABDBA04049FC835A0E89807CFE4FD87FC876FCBA84B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditClear.docx

Path C:\Users\Admin\Desktop\EditClear.docx
Size 16KB
SHA256 a01cbf41bb83bddc4439669bbc06a4c51c712dc4ea82df9912bb607cacdde014
MD5 764196559ed341d30e9c8794db1ca791
SHA1 e151118c8066c35dadf3ef7c496dd7ca59aa5da9
SHA512 28d667a3cda25a3b5be746721196b378b3a9fd4e9167bfbef4e1ddc10655b63e365ddd338fdf723371ef579ca86df53e56f3ca1b1acc10a6e2988d03a24fc391
SSDEEP 384:aXS/jnkaYWHGEkVdNxt/ZtNNVNIFHDJTSk+hN:z/jk0mEk1xllNDItD6P
TLSH
T1CE72B034EB046930DEB3463DF01A22FBE465A14378421947305F9A8F925EFA5036B9DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableRestore.xlsx

Path C:\Users\Admin\Desktop\EnableRestore.xlsx
Size 10KB
SHA256 e130fe7281f69480313fc981c797608b2e9af65a2eb144dcdd58b76927e77ed3
MD5 54887195b2319e96de8fe9f967981307
SHA1 df98b6a26cfaafe48fee17c67105ba7e9ce416e9
SHA512 6cef00cba06b8535a691265b8522b23a30578eda4063e7676cc241efc1cb908008f966a9e49cf70f60572d8b51f8b476544051d5e8f25603893d6e85b9ddc4d6
SSDEEP 192:wc8mVPcy4b3UpDj16V29VtaFUlbVvevUqzQXpS0iEbnRApezGRaolW:wc3+B3gQV27+UlM9z6pJLZGRaolW
TLSH
T1CA227D1994268579D337C4BDD28914D1FA4D71805B027E9A2D30F27F678229B136F3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterMerge.vb

Path C:\Users\Admin\Desktop\EnterMerge.vb
Size 484KB
SHA256 ed67d7a6878c08f66e197f3dec3429c01d518259491186acbbe77fd5923f1b1f
MD5 eb4f7be769fff640cd252ed6850d5e3d
SHA1 b3cb1c989ec973a7d1b89f8938fc962d57d6d54e
SHA512 05572e5ca1282b3da295a4fcb8d5db90ce0e720efdd8835b05e13bafe61ae9a71697c333210c59b58c7a8aae77bc78c18717871394c9c47ac67f0b1a0047fd99
SSDEEP 12288:Xs/If+JwsBFwLFinz3ze/LOYUNnuB+dv4+zuLCsIp+T+UPkj:c/IfkJAinbK/LGnVpvsxlPQ
TLSH
T153B423A92716BF37B86F5557B44D7823E3F3E80066CD80267836068FBA6661F1606C73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandTest.ogg

Path C:\Users\Admin\Desktop\ExpandTest.ogg
Size 412KB
SHA256 ebd44a51bab8d296eaad9e10e2fa14d8e46ca95b9fbad328c05ca6b407166554
MD5 1842c2e2dcbf99f15a31c21d81633b2d
SHA1 4243a8a08f5d7d68c6170b23535f7ecb25304dbc
SHA512 573c2fe34bbc552e4af5211f493892f5e9730d81cb5d39af1b4eacdcd4221e9e0f40ba9bd4590b269adf3875d0bd12ea4c8be3ed498f51af121b28d1959206ff
SSDEEP 12288:5JkUoeN4RJ4zw8BpPl6c98S42anfDT9K927G:5iN4ECZl63S42arpK9b
TLSH
T1BE9423A46994F1A2DAFCF1E212BA8BC3F541FD02AA61D5344444BC8F7B4731A650AFDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportExpand.wmf

Path C:\Users\Admin\Desktop\ExportExpand.wmf
Size 339KB
SHA256 31a8957e6b4a649aaad334e80ad71eb2e5fb44c29fc0b01faea06a82c2b57591
MD5 48cad730a43e0daa92864da6624b1653
SHA1 d29340e7f803d3afb18b828d24c658c668784683
SHA512 9eb3cb52494287c09186aad225a777fcd78756a163475e5faa86734658ff259caeb7b3dde9a1d757bdec5a734779595b1adb26935390a6d1e8fffea4ed101afe
SSDEEP 6144:I+L+KhPGcqKmC3m1hyiZW+u8WzqHPdOmbpzI7ng7+OsqCgTu:xL+KRjqKmVyiUrzo9bOg7+Tqhq
TLSH
T1D07423F401960059DFF934CC3660D03880A33C4AF6A6B59297FF42C79865E5A6FE9ED2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatGrant.tiff

Path C:\Users\Admin\Desktop\FormatGrant.tiff
Size 727KB
SHA256 03fc18e50c1208610307efeb77baa5d197b71dc30adf2eba18a6f44764c7e2d2
MD5 d78248ca58518ad817b71892cc0df58b
SHA1 ab9bedf5e97fd589214c0f93da7d93706317c77c
SHA512 c6761c7b2056052dd4cbe217ea1483303ca92a1f70eac6618ed6852142444cf3513267dd818dfcd525c061b358ca625e1ae684f77134eaefcc9a5b4fbef2426a
SSDEEP 12288:MujGQyWt37Quv97WF3cnSMa289D+0icIkugklDf0UVpJWN3Frza:aTGQM9esnSMYD4nf00psN1rza
TLSH
T1D0F42312C58EBA9E015F996420247F897F35FD38ED6AE06602B247E935636B30D371F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetRestart.ocx

Path C:\Users\Admin\Desktop\GetRestart.ocx
Size 605KB
SHA256 62aee0b1b989c4ae06fdcb970f077bd4ace8c92a91282b17b6a8753fde0fee77
MD5 0adbeba83348d60c0482094f2d04e158
SHA1 5dbf3d5e756a30a56033e9bc961e1ea842494513
SHA512 67580aa24632522eca36ed6bf1479e6e1c64d9cc7b3333f267978a66b54949c70cb6e6d9759b15af4f6e385c984fbf873eb1cda86916d6de907fbdd381d79c5a
SSDEEP 12288:R+vEzX7PgCStl1OaSmjBArYEtzyub+D/LYOb1t4Zu7Bd99E3:YvEz7PgrtlP9HEFILYOH4ZuVTY
TLSH
T1CED423997177ECCE4B4D0C539A89D4B85C9B4A9CAE016C3B637A2E34214C63BCB095DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportRedo.mpa

Path C:\Users\Admin\Desktop\ImportRedo.mpa
Size 630KB
SHA256 08a4c5f822dfd11e0ace0b5fd9a7c267eb0f704c6b4e4e34785b2a3ee0bf538f
MD5 9a3040af9c3e8889e86d373c2e7548d7
SHA1 67020208caabca607120f17b357b0093a7f4c91d
SHA512 1cefbc89b14a9d2d87b26236bbf60d97d6347723d3d882d4dc298d972406437541bbd7308e56b3ad44bc656a148e5380ede2efc58db00dd3d244905b1a2eab51
SSDEEP 12288:ch2WXFHAGd4eoYSWi7jl3zpuZqTeY7Gi+IRAKciR:g2cFHL4SSBEajGnuAKciR
TLSH
T1F2D4231700DE52F375A8FBA3644BCF05A51CC2549A28AA5F57F7F86C2D52AACDC4F801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockPush.vdw

Path C:\Users\Admin\Desktop\LockPush.vdw
Size 775KB
SHA256 13d4dd5a381908094118826905fa5ade27a0c60356af598f208168cd0b550bb1
MD5 23820e242f7c477e0afb619c75ebff01
SHA1 58d1facd41e8bba0e9e1b519fdd052bc37dbdd32
SHA512 712370facb1d6ffe559d29dcf85a157bdb09a0e4f5aa5291beee31a81b8fa2d862ca91e86255344bd48dac543df9d89a01d656bc846855107594754fe2c77872
SSDEEP 24576:wixv5W3+fzKV3bEfyddouVq0/XlvEi0qzol:3x03Ia4yd+udclqzU
TLSH
T191F433DB1211F8AAF51DB1C859882A55F36F3DF54C3E921A5C8493624D2682DDFC3B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MergeRename.aifc

Path C:\Users\Admin\Desktop\MergeRename.aifc
Size 751KB
SHA256 3cd3ba4208c37fecc9112b887e7ea65ed4a6bb031fa0898c0cc0acd59de4c417
MD5 b04715a4e6987f9c1aab11dacf57b2f1
SHA1 951313a8e8ccbd958afaf4b84e73f71cd0b3cf34
SHA512 a57fa94d2415a0d428bdaeecee0cb8f6969a58452f404f14e094bec52c8350ce0de228e7a20926fadcecdd80349100898c8484f2caac95f8f43c82839f2dadab
SSDEEP 12288:Fo9BsTSmN7LLU5763SA5CjvIbjgTT1ns7FBy3U5D1iF2WYaFNn9onQEBP8OU:FoHsT1N73rV5H4TZsek5h22baFPCQE2r
TLSH
T1ECF433CAAD150F49D241D6C11D4133EB52BDFE206F6B1BF0C71E072E6EE670AB09A985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountInstall.DVR

Path C:\Users\Admin\Desktop\MountInstall.DVR
Size 315KB
SHA256 d4e698ddb69e8d5619df4468ba40cfd3c2936e8678abbf225beaf95bb3ac6a58
MD5 9eaf6d2374f09a8a0dc9f669623fcd41
SHA1 8434721ab711fa4b007d88fd8c4b51fe713ef0f1
SHA512 df1f5b4c4955b3fd2305bd3027560cb0bae71263d665ef047d8be7444863efe77ebd651539ec5ff44985551989a3d2e050ad47d50fec6e0425828f3c5e7aec02
SSDEEP 6144:wDTv7fcnCYt+HfsCkPdJ1u06N7pX7LQ8svsGpXFUCTKTrF9h/o9Qa6JEUvBSEg/f:mHKCFrkPLM/N97LQlvDhTKTrFw9QXlpS
TLSH
T1376423459C580EAF752778EBB2D39A38B504EDF5E289E2EDA4CDF908F3411606C0A670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewLock.docx

Path C:\Users\Admin\Desktop\NewLock.docx
Size 16KB
SHA256 b824f39f9636ab0a8c8a5a1e1ba91d3edd7aa882bf280eedff3317c989879144
MD5 0f77d8bb7a235c1bf2e003827316c786
SHA1 bc68b58029c9fbbf0c797c2e7c7e3c501602d653
SHA512 9eedd7aa36046778d7d41820df45055ed51acec1f32f58125805026794044e99ae1d96e17c50c5dffe4833b1ec821dca3f96946f4c96d924a00e99063c1a6b1b
SSDEEP 384:aj1r31TeEjagY/CxpCKRjT3WPdNxt/ZtNNKFIFHDJDaIQues:cVDmgTRjLAxllNOItD0BW
TLSH
T15972AF35CB05B8B1ED43C5B6F16A20FFE62A11433943A583158EADCD1657F830397AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewStart.cr2

Path C:\Users\Admin\Desktop\NewStart.cr2
Size 533KB
SHA256 ebc942019086239c564d3bbbde4d7a7f9c93f0e1bd6873a6ca83792b0352d5b0
MD5 d8a9366e59ff0c6affb13373eb57b92a
SHA1 7895812d443dd16524abf2b9468001b4c4b7265e
SHA512 c7ece7801c30d9e8195d7c38ec5a889be828a6f1ae48326d07a10ad5e6c383d88e5e7307734c800cbc9ca6a45f701d661cdb0d28472c35cb72324be4dcd6b26b
SSDEEP 12288:di2u/xuu8qehc+zI9v7TyTVLxaHoTf3ZspzSgCsKIscwTclU6Ce922:g/8PhXQzWTbdfpsVJscwTCU1422
TLSH
T1B8C4239301AA16CE29A32021BB4911D2306AFA9A47757FED79433104F71738E5EEB4E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewUse.aiff

Path C:\Users\Admin\Desktop\NewUse.aiff
Size 654KB
SHA256 bdf902cb94453674ded1c03c8e815acbbd893494c8ecc10034b563bcc2913fac
MD5 8b2145cbab03e7baac83a7509340d9b8
SHA1 cd4d54cbed29182063ad7d4808ec94b01ff5b064
SHA512 d3a93ccaa44d598e592470eccc7050fba7c9c6c8c57854c94ac0278cf3d83e201fc4029a59a3a821aa310a93be55197a8a04693c965930948a48a53737fc1da7
SSDEEP 12288:fYIMlRjESDNmOrvJLmA2RLp3MAeS0SFNh+J2PmfEYx0UynTePTxIjyGFCBV6TY2:wdHj6OrMAA13ESf+wPuFaFTqKnY2
TLSH
T12FE423084761A2B3D5069B30978DFAC61532FE4B74865AE0BC5C561DDE2E2E27F43CE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenLock.wmv

Path C:\Users\Admin\Desktop\OpenLock.wmv
Size 678KB
SHA256 8a9518fc7ce61940a9a24e103a6df58966bbc24091076a17f641ff0681d2cecc
MD5 397eea164922a96f36e3681a1f370a9b
SHA1 fe51c4c7da90f29d23fc31a8d29c706e5a29c265
SHA512 760d9baef25c2b92223502eb1026163d12162dc3c4852c7ec8dbf8e0d4eec3af421451b691659be3afce412cf846d3bc10acb77b36364572edd6df4f0cf008b1
SSDEEP 12288:2eoUNdnpzlBmvSSZXZ0+Fi0LRbpECQybqcrCg2Il9bZ/cQEi54yooShboNh1RpMC:2eoUNdnphBmvlBa+FvRbq1y3+j29bZ0+
TLSH
T1CFE423AA3AE14B72158EA4C682DDE2D3589AB56D1D8312274F3DBC31137939A330DD7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameAdd.xlsx

Path C:\Users\Admin\Desktop\RenameAdd.xlsx
Size 12KB
SHA256 a1fdec0358c9718aca151300c83191016a198a1d2569b63c83fdffa4467a9ac6
MD5 853f6bb83a3e7d76db014a1d64e04a3d
SHA1 40c4c1daecac3b545ff3b9fae60568676014defe
SHA512 95325cee3c3febca839745748bb02caa990cc5c28af8ae3c8d7b5f9464f42f71e2f600ee7683a9c2b46ffa66ded0fa455847113a96d670b1c0926757c4ab5232
SSDEEP 384:wc34LbA3Im3LdUlM9z6pedpJXEIdETe5aSUao/:w1jUxxWpeD5EAETUaXf/
TLSH
T18E42AF3DD3A1C459C203D63F50CB49F1F05E5185AB82B99A3E04F58D1A435AB27AF29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestUninstall.vsd

Path C:\Users\Admin\Desktop\RequestUninstall.vsd
Size 508KB
SHA256 bf9ff141a969fa286376e5ea724ed768ddae95f0d59d98175c840403929061eb
MD5 ad7da6dfe823cf300e2087d4ec816306
SHA1 72b6fef3d4a287ab9718af3f5b918b48827ab247
SHA512 62f00f1fee8a69315c6d35317f0f4be167c0949fec456b48f5d40d322f84e12fe63096db851a052c523aef3145c2c2f8be6a5492183cc488810c6d7d073a00f9
SSDEEP 12288:DOqzaIYNQdvEVjb+3eL2RVEePKHmWcWwOSK8iCvEjJgV94XI:DzzafQdM9SeLIVEe+cw8VEjJgEY
TLSH
T17EB42367764D4238FC81A9E75562CB69EBB580305A5FFE4B4050319EBAC3FD2C17290E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetFind.xltm

Path C:\Users\Admin\Desktop\ResetFind.xltm
Size 896KB
SHA256 1d38676f84efb1ff48bf25868134868b1f00df4f02851e64ede120fd1d37f7a4
MD5 9d7517de26cd37e3cc5728ad3fcc8b60
SHA1 55a08e0ed4dea053feaa37915b2b03cfa15bb00d
SHA512 6a70a04c31ed7494c375fae3ede84869bcff6ef140432e7608607d2b2554b9e54e100f696c22d1885c92e64f1f8439d9d36308155a9827785013cdd755ee61be
SSDEEP 24576:68kfGD0bKZ7PlJM5JidZOAu4meWAK7ydRqrUC+X:4q0bK1lG5Jiqmu+X
TLSH
T183153302D1A825FB1D2FF985150C1842669788BF3C6F2F2B0F6D11952ECB99725F7B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendLock.docx

Path C:\Users\Admin\Desktop\SendLock.docx
Size 15KB
SHA256 7c64f58a79dd8217daa1c8edff8033e7957588da860bb137982dbc4c860bd9a4
MD5 2874ca679439b139cc842ba718b7e35a
SHA1 0c636318ef7994e0a9e4825cfc5c54aa8bf4b74c
SHA512 bbba60effe6dd78236e3b7e5326e0713cc060a3063868a98bfc4ffb74742d487bb3f0d12ed04ba69360b8c19d5d714728ebb615db8d63f23275476949bb6d556
SSDEEP 384:aoMUtVjb3ho/BdNxt/ZtNNaBSIFHDJqjSUvr:VMUKxxllNa8ItDgbz
TLSH
T10472AE30C4006471DBD38C7CF0A982F7E57D5843AB11994720CEEA8E426BFA31757A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetRevoke.sql

Path C:\Users\Admin\Desktop\SetRevoke.sql
Size 799KB
SHA256 52a4caa04168bbd7250c7025533fca5d7a4834b8db301af7fb977d64478975e3
MD5 2e7439bcfef7ab99f530dd2e3321b7fd
SHA1 312a0e99ec682fb6e7a0e85ea48c12a3fc7c5bf2
SHA512 4f7f160fc945a20d6d2b8403cd9361e779a05572de45afbdcae25f9107c962b3583da0cea2440ce6d4f5549685e36d7753a23d957735ddf4b695ec892404abb6
SSDEEP 12288:pQ5qykc5gyJY7d5MU7Z/CrForxOcof3lux2DL42ftiUMxVyc9xLtqjAUAR9luyjo:pQtxZYR+U7hxUQ2T1eu4LW0R9cyjSv
TLSH
T1A10533B2B7407A3D0856C3DF60AC23D42B14134A2D9FB3D1B60DA993365E919D7F34A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitResolve.js

Path C:\Users\Admin\Desktop\SplitResolve.js
Size 1.2MB
SHA256 990f3b6479b62b914d40f709ad5332ba5d609235f8408ed1b79024c8a4f8474a
MD5 b0d53f8fe1bfe8e3c764062a29b3b3af
SHA1 ae56abd6783f7ea2ccc3230344eed9d65d6bd81b
SHA512 ae933b9ce4f72727890eb24c31fccb43ee0058cdf82387833b756f5fea8e9f06dd20335789128bbab1258cf0a665072c2eafb1372eb22b0b0f07a6b98eb1a782
SSDEEP 24576:kdDtxDeTmmN/vvsTUGsut63reYagtmN39BHk3URVw77Xe0vP8nKVx/FLDMT:kdDtpSmmNXvsTUGvsbeY9mN3LoURKnXY
TLSH
T1BD453363E0143D38F5E807022EBD9CE6AD8B789294C6712FB484BDB3720D6394967DB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitGrant.aifc

Path C:\Users\Admin\Desktop\SubmitGrant.aifc
Size 848KB
SHA256 f7bf6114816fbc98b1f4280d689b6f05ff3e10402c7163d06cb63c26620709b1
MD5 2ae003c4da44789e3cb228e546782426
SHA1 822a3bb7a91877fb7f930f9dad0dfc1247f8eb0f
SHA512 026541c2974845601d5d1861c5e0bfec5c02a158cd8568fc0525856416bd858c7516b50426dcb375187a5f93c8f0c6669eff5652cb2468de019a075aff28dbac
SSDEEP 24576:n2kf7Xy4pT+HAqNPoxNVCVkJzqPDTqN65nX:n2kzXy4lsHepFqPDTq6X
TLSH
T1C005336DC70B2C8E733ABD3A3EC5E68017EBD130ADC9AD0CB541A150776562D93398E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestRegister.jpg

Path C:\Users\Admin\Desktop\TestRegister.jpg
Size 387KB
SHA256 8bbda4d26838c8ba962622ad2c5242d8ff6d11df6b74bb14c0627b93d0e7804f
MD5 76757232472d8fbf656830beeda7d9b8
SHA1 a7e62bcd32e9f32526b60f82bda9c845fc1d2fdf
SHA512 da5c4e616da5768bfa3b6a87ab1264bb888330fd0cc73f705966a145ad1d7eca197d2fa90e2b6297c1805336b29690c743450274fa8054c760bb7efb42feca1a
SSDEEP 6144:Jku0m8VMC0jjKmjmyjdD7gTtMCcIr3UEqzGJzlLQS2fYXoIitYKax6NuC0lBrcM:++UMCczqc7gpMU3UEjJlLkY4kTRzrH
TLSH
T1418423F75D3386B86341FC9BB7B874834D4732C1A9A3899143606A82C9B975D0BBDC38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockTest.html

Path C:\Users\Admin\Desktop\UnblockTest.html
Size 702KB
SHA256 0fd54b9b03572a72b8034efadd53c0b1a56243af78cc2ddf6aec51afe0ac966d
MD5 7a03c7fa673cafdcfc33fa92cafd6248
SHA1 e76234386b25d5fd47ee41f6feec29880a633675
SHA512 66874b0d3033bf5cbb85756fd955bb4061c7dd014d1dab7d90494a47e03e920e489b5a6138aecef83978498943cbfa7b2e3437b355891bf1ee6afeb15e6f00a7
SSDEEP 12288:POvBAJb64eReLCoSuaaPiFNhZpfcNlGPTqvC84EVwsvtx0yuF:POG16nLoSu2WX9xvQyuF
TLSH
T179E423B5417B83C922DAD0F5E039144AD5E6DDCE12A624F7B7CBD5E26B3C62001AC87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnprotectMove.tif

Path C:\Users\Admin\Desktop\UnprotectMove.tif
Size 436KB
SHA256 eb8ead0710fbfcf51b234c621c8c7be5a042aa266e0f2514639b3c16d6c8f4c8
MD5 a750573e56b24d0956a0ed5d471814b2
SHA1 4817c4fbb248e89892425685046dcf049e0d4eaa
SHA512 814e03573334c60688ca495a2bb1f190caaa1e9aba3b226d168931794eb08ebf05bb18fd539c7f3434a7683d3d2e2a220b568cdba70e5cf4b70e78da8614d4f4
SSDEEP 12288:HPd4tlrlGr9wiAK0G1md80w229SlWhxEzze:HPdEr6Z0Gf0w2chhF
TLSH
T15D942378B6D6326FB8DC166EE076F1843E39E8201C590E3C467C3F5D67C5B05A2AC266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishUnprotect.xhtml

Path C:\Users\Admin\Desktop\UnpublishUnprotect.xhtml
Size 581KB
SHA256 65e00b3c41d52725d664d1cd542c8c90c60f51743c53ff01dcb50602a7b38b30
MD5 c5e4d2d9a38c533d6d81441a42032c76
SHA1 85d4bef3594c9a97e87572f0f1fdc3ae6e355b8a
SHA512 6ce69e545e1d4e91c25d5c150139ca856f5255b5975fa966353e185a3c3638f5cec767697aafdb1b7a98e1da0f47ad85840ca228c59b549b602e104f9b450d2a
SSDEEP 12288:eTYDmCkm2j0UfV6KK2aGo1Vujg3c3YT6vhj1jQ+:j2j0Ud6KK2voejg3cIT6vhdQ+
TLSH
T121C4231DC23E42ABA452642D3A716F1F53FB8F0A935126688FE1D76D529E7B305FB400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UseSync.png

Path C:\Users\Admin\Desktop\UseSync.png
Size 872KB
SHA256 c271ce7d60f87c5aa4d666123982fe348602d56a0a553849da37f891a3c62a86
MD5 6e52a77f1663409ad8535ed6f9a335d0
SHA1 c9e8ba00213ea5bd0153051638481b1c3b0d82fc
SHA512 545a64306e8fb328f61d910b0d15f592686bd616d30313aaf54a3561c1866b10742614ca77e688f5c36b8fede6af0fd04ab34d506f950af61eb76761de12ae02
SSDEEP 24576:RuySQk8mHHslzhV+/bpDFi7g3aFFmyFFCmFKn1tj:Ru7Hslr+VDkDFlnK1tj
TLSH
T12815231097B9EF964FE9624F880F4B6BE3C55AB2EC0DF4E4EB88127D507F84116019AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WritePop.wps

Path C:\Users\Admin\Desktop\WritePop.wps
Size 824KB
SHA256 0039bf33c7d9a9a620883e155eb64c4c07e475e203a01e5c755e61642aaac362
MD5 aa2895d737dbd19e2273231849995004
SHA1 81a8144953bf68ec7eaef33e171024e76f63c65e
SHA512 7d801adaa241c06606528a1801461dd07166b16253204448072bcd41a28b51fa19c935e3f1f809f9e9adbade954e4f222a61dfa16c336d1a3a7f0d8bdc7d3bab
SSDEEP 12288:DdZHdmqe4+o+itTDKsgKqrpRL5PgFRuKtTF7VBi6RZrWLDjyOdFk:vgi+YQH1RFMhtJ7VBbRZrWLyOvk
TLSH
T17705337847009760A31849A27F1A2601BC573BF653C2CB7B347A6C628D72FE6D74DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 5e4765d6c1a31d0c670a19558717af7eebba387a180ee550cef390af7a8d98e2
MD5 6205584cb9c25c92c23458b845c440c8
SHA1 76939dc3f8f3100cfd54fb7f26c63a2198baccf7
SHA512 491d8446ef001b7c1431fe33f13ef5f273c105e6b41194728ad663dbc08bb5ecd08ae10bc269cee909cccf064e571acd737f01868f284bec2fd2ecd498647f60
TLSH
T1F141CE404EF61726F23399F75BF11922EB72BD51A2549E4F0148424B0D62B00ADA6F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 7038081bcc882f3aa9e44bbbfe7750edc62ec6a3259deac016292867450e2887
MD5 4c0b1dc2c912db13e907f29463f083ff
SHA1 17bde310d2f2ac98fd579057be4f6f79a6866947
SHA512 447b4245b0414dadfb3108b4fea20661b3611a7289923f4a6b6164f86c1813e4eedf243b8888cce34f3a183cd4ff492ebaedf125ef0fc004b96f86ab6643353c
TLSH
T167110C014FF20696F5F3C5302B7267239333FD02A266671EC18561D0493B320DAAEFA6
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 04aaa5161c0265c9eefd499d57072bb491df70f2f2e10508dcd3359e847161a6
MD5 60a92e36b77cbfea5a0cf048ba8555e1
SHA1 080dd720bb7fafaa846084d1a66c01d024ee9160
SHA512 c3dccb06742ef96255caaf5591c578bdfc463ea28bd6b2ebac81c515962146630b14a3a550f63ba3798f4941619d4108e4c72c0ff9d12a5c01ab7ce2b6871a3d
TLSH
T1CB417C017FF91B19F3B34A3169733B210F7BFC1395285A1E908552880CA59215ADDFB7
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 03fa01901177070dd8928edafaca124b3a784245ca29c23cc395b1a5fef8fec0
MD5 37c61535d90a36788af539d07469536f
SHA1 90ea2adccbca83ce2d6479233666dbb98c075b0e
SHA512 57ee5314ea72a3cf17c19eb82c3f09eeb09f1da642feab730e26940d01c9b8f13deaa0d1c347c054f0f608ac191ae7de70ec8d88639578779e05b895e8c48668
TLSH
T16C11D0113FE37F06F7A784F115320B244B36FC109695370E418261CB5C39601DB39B9A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads