Overview

overview

8

Static

static

3

d6ed06cae2...07.exe

windows10-2004-x64

7

d6ed06cae2...07.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    36s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 14:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.exe
  • Size 11.1MB
  • Sample260707-rt1d9afv2z
  • SHA256 d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 1 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 5 IoCs
  • Launches sc.exe 29 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 9 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.exe
    "C:\Users\Admin\AppData\Local\Temp\d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Users\Admin\AppData\Local\Temp\is-YE7SUA7WRD.tmp\d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-YE7SUA7WRD.tmp\d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.tmp" /SL5="$50284,10423372,893952,C:\Users\Admin\AppData\Local\Temp\d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4744
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" /F /IM Main.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1752
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" /F /IM aprocessbak.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3868
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" /F /IM gld-proxy-service.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3420
      • C:\Windows\SysWOW64\sc.exe
        "sc" stop WinDivert
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5772
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"STOPPED" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:5532
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"STOPPED"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1440
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"1060" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6012
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4796
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"1060"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6048
      • C:\Windows\SysWOW64\sc.exe
        "sc" delete WinDivert
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3268
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"1060" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5436
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2536
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"1060"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1488
      • C:\Windows\SysWOW64\sc.exe
        "sc" delete WinDivert
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1960
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"1060" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4544
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4752
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"1060"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1280
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" /F /IM Main.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3380
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" /F /IM aprocessbak.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1456
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" /F /IM gld-proxy-service.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
      • C:\Windows\SysWOW64\sc.exe
        "sc" stop WinDivert
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5760
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"STOPPED" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4492
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"STOPPED"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4968
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"1060" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5752
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:704
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"1060"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5892
      • C:\Windows\SysWOW64\sc.exe
        "sc" delete WinDivert
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1112
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"1060" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1896
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:5776
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"1060"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5840
      • C:\Windows\SysWOW64\sc.exe
        "sc" delete WinDivert
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5028
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"1060" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4100
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"1060"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4384
      • C:\Windows\SysWOW64\sc.exe
        "sc" stop AutoCopyBackup
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1868
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query AutoCopyBackup 2>&1 | findstr /C:"STOPPED" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Windows\SysWOW64\sc.exe
          sc query AutoCopyBackup
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1120
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"STOPPED"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2088
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query AutoCopyBackup 2>&1 | findstr /C:"1060" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Windows\SysWOW64\sc.exe
          sc query AutoCopyBackup
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1448
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"1060"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3924
      • C:\Windows\SysWOW64\sc.exe
        "sc" delete AutoCopyBackup
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:544
      • C:\Windows\SysWOW64\sc.exe
        "sc" delete AutoCopyBackup
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2756
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" /F /IM aprocessbak.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4856
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" /F /IM Main.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4772
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" /F /IM gld-proxy-service.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:2580
      • C:\Windows\SysWOW64\sc.exe
        "sc" stop WinDivert
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5048
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"STOPPED" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4068
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"STOPPED"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3552
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"1060" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3908
        • C:\Windows\SysWOW64\sc.exe
          sc query WinDivert
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2288
        • C:\Windows\SysWOW64\findstr.exe
          findstr /C:"1060"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4472
      • C:\Windows\SysWOW64\sc.exe
        "sc" delete WinDivert
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3432
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C sc query WinDivert 2>&1 | findstr /C:"1060" > nul
        3⤵
          PID:3284
          • C:\Windows\SysWOW64\sc.exe
            sc query WinDivert
            4⤵
            • Launches sc.exe
            PID:4916
          • C:\Windows\SysWOW64\findstr.exe
            findstr /C:"1060"
            4⤵
              PID:4792
          • C:\Windows\SysWOW64\sc.exe
            "sc" delete WinDivert
            3⤵
            • Launches sc.exe
            PID:5072
          • C:\Windows\SysWOW64\cmd.exe
            "cmd" /C sc query WinDivert 2>&1 | findstr /C:"1060" > nul
            3⤵
              PID:4920
              • C:\Windows\SysWOW64\sc.exe
                sc query WinDivert
                4⤵
                • Launches sc.exe
                PID:2536
              • C:\Windows\SysWOW64\findstr.exe
                findstr /C:"1060"
                4⤵
                  PID:4576
              • C:\Windows\SysWOW64\reg.exe
                "reg" delete "HKLM\SOFTWARE\WOW6432Node\GrandSoft\AutoCopy" /f
                3⤵
                  PID:2484
                • C:\Program Files\KeyLogin\services\aprocessbak.exe
                  "C:\Program Files\KeyLogin\services\aprocessbak.exe" --install --silent
                  3⤵
                    PID:5872
                    • C:\Windows\system32\sc.exe
                      "sc" create AutoCopyBackup binPath= "\"C:\Program Files\KeyLogin\services\aprocessbak.exe\"" start= auto DisplayName= "GrandSoft AutoCopy Backup"
                      4⤵
                      • Launches sc.exe
                      PID:3048
                    • C:\Windows\system32\sc.exe
                      "sc" failure AutoCopyBackup reset= 86400 actions= restart/60000/restart/60000/restart/60000
                      4⤵
                      • Launches sc.exe
                      PID:1232
                    • C:\Windows\system32\sc.exe
                      "sc" start AutoCopyBackup
                      4⤵
                      • Launches sc.exe
                      PID:2148
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:4300
                • C:\Windows\explorer.exe
                  explorer.exe /LOADSAVEDWINDOWS
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:5772
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                  PID:252
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1456
                  • C:\Program Files\KeyLogin\services\aprocessbak.exe
                    "C:\Program Files\KeyLogin\services\aprocessbak.exe"
                    1⤵
                      PID:3784

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          Main.exe
                          • Path C:\Program Files\KeyLogin\Main.exe
                          • Size 16.5MB
                          • SHA256 12e65dd9245ad447738b9b41218564b61c36adecb39c1624356c26416ddcc082
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          WinDivert.dll
                          • Path C:\Program Files\KeyLogin\services\WinDivert.dll
                          • Size 46KB
                          • SHA256 6110bfa44667405179c3e15e12af1b62037e447ed59b054b19042032995e6c7e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          WinDivert32.sys
                          • Path C:\Program Files\KeyLogin\services\WinDivert32.sys
                          • Size 74KB
                          • SHA256 4504edee4b3843bb804afeb99f9f73a245c6beebab51e294b40c9b6fd8e1ea2e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          WinDivert64.sys
                          • Path C:\Program Files\KeyLogin\services\WinDivert64.sys
                          • Size 88KB
                          • SHA256 66b458d7ad2ea9db7771f656892bf95a330cf243f4914cd01fbcdbd3b3eaacc3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          aprocessbak.exe
                          • Path C:\Program Files\KeyLogin\services\aprocessbak.exe
                          • Size 4.7MB
                          • SHA256 0ab98a8503b418643238bf06ff426c591be00195146dd494692be7a35e87c913
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          gld-proxy-service.exe
                          • Path C:\Program Files\KeyLogin\services\gld-proxy-service.exe
                          • Size 4.2MB
                          • SHA256 3724e8a28f60bf8d7bca745408594c9db68b4667333e74a5cb696f0af805395d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          unins000.dat
                          • Path C:\Program Files\KeyLogin\unins000.dat
                          • Size 11KB
                          • SHA256 68c2ccd642d65bb5ecac215860779364d7b6f2d4c67328ae9d9dd4064d78979e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          unins000.exe
                          • Path C:\Program Files\KeyLogin\unins000.exe
                          • Size 4.2MB
                          • SHA256 de2acc539f4079ede99ad60734cbea751fcd1b9ad3fbcd3eea5c493240728b27
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          update.exe
                          • Path C:\Program Files\KeyLogin\update.exe
                          • Size 8.3MB
                          • SHA256 b410024d1401c2f29011e4140d340823246362efbcd5447210d0abafc16816ac
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Uninstall KeyLogin.lnk
                          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\(Default)\Uninstall KeyLogin.lnk
                          • Size 878B
                          • SHA256 b3a7e69edcb155ce8bca2225c214886585e3f042b4522b99a19547ab522ad3cf
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          start2.bin
                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin
                          • Size 7KB
                          • SHA256 c02f6275d6464b6b4ba64da14cb7a8bf88f3d47a8293a847cef1b8068f98f201
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          prep_Activatable Class_Hermes_perf.cache
                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                          • Size 587B
                          • SHA256 b2209b771ee60d35244635ab8f98535ef42b3831cc6d543be82fcdb2195a3fb9
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          prep_Activatable Class_Hermes_perf.cache
                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                          • Size 599B
                          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          prep_Activatable Class_Hermes_perf.cache
                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                          • Size 595B
                          • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          microsoftwindows.client[1].xml
                          • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\KLK8AHCZ\microsoftwindows.client[1].xml
                          • Size 96B
                          • SHA256 8dd56e4359ddde0a44d18bdf8f0576496b86d9457241984eef0b1c52abc22138
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          _setup64.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\is-05CN4LHXV2.tmp\_isetup\_setup64.tmp
                          • Size 6KB
                          • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\is-YE7SUA7WRD.tmp\d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.tmp
                          • Size 4.2MB
                          • SHA256 c63d7c122ca4e048d3ec946d8fd16a7b7fe2b2496109722275323ffb79ff174e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          新云授权网络锁登录器.lnk
                          • Path C:\Users\Public\Desktop\新云授权网络锁登录器.lnk
                          • Size 836B
                          • SHA256 2f023a803a5c4bb12accc94e6c61bb6876c8b31d2b12846b57dc9b7d39232f63
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/252-76-0x00000273846D0000-0x00000273846F0000-memory.dmp
                          Download

                          memory/252-17-0x00000273801E0000-0x00000273802E0000-memory.dmp
                          Download

                          memory/252-54-0x0000027383CD0000-0x0000027383CF0000-memory.dmp
                          Download

                          memory/252-42-0x0000027383EB0000-0x0000027383FB0000-memory.dmp
                          Download

                          memory/252-41-0x0000027383A70000-0x0000027383A90000-memory.dmp
                          Download

                          memory/940-8-0x0000000000E40000-0x0000000000F29000-memory.dmp
                          Download

                          memory/940-0-0x0000000000E40000-0x0000000000F29000-memory.dmp
                          Download

                          memory/4744-10-0x0000000001980000-0x0000000001981000-memory.dmp
                          Download

                          memory/4744-6-0x0000000001980000-0x0000000001981000-memory.dmp
                          Download

                          memory/4744-9-0x00000000008D0000-0x0000000000D1C000-memory.dmp
                          Download

                          memory/4744-237-0x00000000008D0000-0x0000000000D1C000-memory.dmp
                          Download

                          memory/4744-12-0x00000000008D0000-0x0000000000D1C000-memory.dmp
                          Download

                          memory/4744-224-0x00000000008D0000-0x0000000000D1C000-memory.dmp
                          Download

                          memory/4744-139-0x00000000008D0000-0x0000000000D1C000-memory.dmp
                          Download

                          memory/4744-14-0x00000000008D0000-0x0000000000D1C000-memory.dmp
                          Download