3f804f3b3c7d6802c894210a77ca4edd7a3798625df7b394e61e000514d79be2

Analysis

user interaction
yes
max time kernel
38s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AngryGoyII.exe
Size 68.0MB
Sample260719-dcs2ysc13y
SHA256 3f804f3b3c7d6802c894210a77ca4edd7a3798625df7b394e61e000514d79be2
MD5 39bac34fa951dd267e9be2064b19ae8f
SHA1 11001b7267af177a1aaf997e05d79e515ca9d612
SHA512 542e3d230cf09fcd1236775b0dc950c3679aae60c58f65a5d6d5331d52c874980483660bfd8e125049a2908a36dc29ec39a18a43ff19bdbfa2aae47e578703ee
SSDEEP 1572864:eHwwJcZOsWGH0WEbKaQchFkWW7GNVwq7c6ZQ4BA9eiAVHPe3+:8VgDUWEbKmW7G5c6Z1ALAhG+
TLSH
T180F70136BF5288CAD97C4031BF5C1FB2119064564646BB331BB1C134BEB728D69EEEA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2392	powershell.exe
1620	powershell.exe
4092	powershell.exe
4576	powershell.exe
4332	powershell.exe
1292	powershell.exe
360	powershell.exe
5428	powershell.exe
2228	powershell.exe
3152	powershell.exe
5672	powershell.exe
4576	powershell.exe
4332	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3268	AngryGoyII.exe
936	winsvc.exe
1392	AngryGoyII.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\.co7248.tmp	AngryGoyII.exe
File opened for modification	C:\Windows\system32\.co7248.tmp	AngryGoyII.exe
File opened for modification	C:\Windows\system32\winsvc.exe	AngryGoyII.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5428	sc.exe
3772	sc.exe
3240	sc.exe
4432	sc.exe
3140	sc.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2384	taskkill.exe
1320	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3268	4740	AngryGoyII.exe	90
PID 3268 wrote to memory of 936	3268	AngryGoyII.exe	91
PID 4740 wrote to memory of 1392	4740	AngryGoyII.exe	93

C:\Users\Admin\AppData\Local\Temp\AngryGoyII.exe
"C:\Users\Admin\AppData\Local\Temp\AngryGoyII.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\AngryGoyII-ae63988c6a887608\AngryGoyII.exe
  "C:\Users\Admin\AppData\Local\Temp\AngryGoyII-ae63988c6a887608\AngryGoyII.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\winsvc.exe
    "C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\AngryGoyII-ae63988c6a887608\AngryGoyII.exe"
    3⤵
    - Executes dropped EXE
    PID:936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2228
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"
        5⤵
        Launches sc.exe
        
        PID:5428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1620
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure winsvc reset=0 actions=restart/0/restart/0/restart/0
        5⤵
        Launches sc.exe
        
        PID:3772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "start" "winsvc"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3152
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" start winsvc
        5⤵
        Launches sc.exe
        
        PID:3240
- C:\Users\Admin\AppData\Local\Temp\AngryGoyII-c760881781058eac\AngryGoyII.exe
  "C:\Users\Admin\AppData\Local\Temp\AngryGoyII-c760881781058eac\AngryGoyII.exe"
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Users\Admin\AppData\Local\Temp\AngryGoyII-e8f73c3517bc572d\AngryGoyII.exe
  "C:\Users\Admin\AppData\Local\Temp\AngryGoyII-e8f73c3517bc572d\AngryGoyII.exe"
  2⤵
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\AngryGoyII-168c7066ba1276e3\AngryGoyII.exe
  "C:\Users\Admin\AppData\Local\Temp\AngryGoyII-168c7066ba1276e3\AngryGoyII.exe"
  2⤵
  PID:5780
- C:\Users\Admin\AppData\Local\Temp\AngryGoyII-fb6fd4348f689036\AngryGoyII.exe
  "C:\Users\Admin\AppData\Local\Temp\AngryGoyII-fb6fd4348f689036\AngryGoyII.exe"
  2⤵
  PID:3780
- C:\Users\Admin\AppData\Local\Temp\AngryGoyII-2fb8411cc5b6e0aa\AngryGoyII.exe
  "C:\Users\Admin\AppData\Local\Temp\AngryGoyII-2fb8411cc5b6e0aa\AngryGoyII.exe"
  2⤵
  PID:3188

C:\Windows\system32\winsvc.exe
C:\Windows\system32\winsvc.exe
1⤵
PID:6004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4092
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"
    3⤵
    - Launches sc.exe
    PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5428
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"
    3⤵
    - Launches sc.exe
    PID:3140

C:\Windows\system32\winsvc.exe
C:\Windows\system32\winsvc.exe
1⤵
PID:5272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\system32\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\Temp\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "taskkill.exe" "/F" "/IM" "winnet.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5672
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM winnet.exe
    3⤵
    - Kills process with taskkill
    PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "taskkill.exe" "/F" "/IM" "wincfg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1292
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM wincfg.exe
    3⤵
    - Kills process with taskkill
    PID:1320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "New-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\"" "-Program" "\"C:\Windows\system32\winnet.exe\"" "-Action" "Allow" "-Direction" "Inbound" "-EdgeTraversalPolicy" "Allow" "-Enabled" "True"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

AngryGoyII.exe

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\AngryGoyII.exe
Size 47.9MB
SHA256 288d839aa1d272e080fbb52ff715ce71f22f795e46225f2794a44efa50e0a8c6
MD5 d7dd891989fdb7b570afa6ab343c112f
SHA1 d985eaf6d60f56add3357e1dae587a86a311acee
SHA512 ec67100bcf0a60881426a6215a0e0d64fc7fe64b7a0239369d3e98cdc3434c0bb2d5f3786a2e371127716b0521981c9c7ff10913536c48595bb87e55a84a0ea1
SSDEEP 786432:XPFuDKw9v7KwDhMAZhi/2ahAZQrIgEwNFuiSRlpoAj0GxetnJ+wQgBycTQrKdDNo:+K6MAZhi/2MIFwNF5SRlzj0G4xQkycTq
TLSH
T112B73300FBE08E61D467043220EDAB6552AEE889D7BB63E352557DC84EDFEE05631B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultApps.xml

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\DefaultApps.xml
Size 6KB
SHA256 ca0fcc99f517e2d4d0a2f1bbcd254dc3d369d1d0d06431629cbb8c0827b34371
MD5 5fa0b53d52b55d3a933f2af24df7580a
SHA1 9d94c99aaf105c179d6d61762662aa2b6883322b
SHA512 b00d7acd515ed4db0c5e4715cf0edcbce35ac2ba9273948d697d3acf8ad9c620a634bdb54dd750b4963000c5c4ec59f16469a143a3e3f1796a933e67ef723c36
SSDEEP 48:cD9zmasFd7t4aDiLq0xQ+gQ+STyl/6d3b3eE7+HE7+HmRdtIPovVcjkLwv+ariQ6:WCUoPzenamcnquWfPfw3bdbGaE
TLSH
T179D1A6E15BC51CD6A35F99A3B78BD19D21AA406FCBBC2A00F0C3612EE51BB6C0777452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultAppsNew.xml

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\DefaultAppsNew.xml
Size 14KB
SHA256 69bb70836496d453033413285f37978fae0ace73596a59685d4988f2a964bda4
MD5 ac935163818db1b96b9d3fdc81187f07
SHA1 4f786d90b47f9efc981063d85625b6a0c5276b1a
SHA512 8836963a8d80f5ab1b66288612acda2e24297c76b214acba53bbb7cc04d7b45e596f5223cdba158dbcee8f3af90554f219244cdad652671192838b210eaf91a3
SSDEEP 192:/obm5Bg5Lm5xg50q5Sq5Hq5rW5tcdlZu5aWlClxFqHks51s5cd5ts5Iv52l3lNcR:u
TLSH
T1D9621A02B7FD1689F0F31F289A7B61690E7ABC694A3DC22D11616E0D5C61E50CC62FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JavaDeployReg.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\JavaDeployReg.log
Size 13KB
SHA256 a58ac2458ebe135c1adf708692d28e0ccd2b881e436ed7ba7c14c51cea5dedc2
MD5 1b81858883d13b69804eebb2987b2983
SHA1 8326702f9fe86ce03661606fe573ad1a79091ff5
SHA512 9da676e13593ff6bf2629a8f846f39d78fa4eb4ea67893178f010586464599bdfbab89cf3e4b423f6f28acbb51c4330ff3a8e5f642dcb4fbb0f6b030939e2958
SSDEEP 384:Tr6hsjrXXDkdOPOCpR6FNrtttttS9+nn+V:Tr6hsjrXXDkdOPOCpR6FNrtttttA
TLSH
T18452CDC124CF89F764629295CB322DF095D6B1E69B2B98053304DC787B08E465FAB8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20260709_142614767.html

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft .NET Framework 4.7.2 Setup_20260709_142614767.html
Size 93KB
SHA256 38f8bb75fd0d8a3da3cfd6038c499460d7c292ebb999953b123b14c1040b6b70
MD5 8b155e0b87ce12b65323abd8badfc5fc
SHA1 2cab38b18b8259ec1095845b6146709a7f6ae5fe
SHA512 ebb8d8993a0023655df6e385426db54dcdd3570b2de12b199328012d141f2f0930b7cb4c171e415f63f7221ee68debfcc9eaa4f1a092b4323264eefb28699ef6
SSDEEP 768:fdsOTLyUFJFEWUxFzvonspQaBeprZZbQ1:fdsWyUr+WUxpvonspQk1
TLSH
T10693C2577BE80155A4F3BF4DED7710251AB8BD865C34D92C13A08A5D0A92E24ECB2FF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653.log
Size 15KB
SHA256 ea41f361fe1ed764665a8050f4fd7040b605e312a5d6c3830f6b8b83a1c0d46a
MD5 50dd1e37cd468530bc80c77ac9b57c75
SHA1 feeef80eefb4677446163948f37b80f53aae0266
SHA512 958c0dfa6ed8bcd6d1b4156c0a0550e63a76645ea20327841bee751b655e2e5914c2d4bcaeab23bcea91ab731ad848f30740621d32c4e0526c7738a29575c8b6
SSDEEP 384:SYsVeBMIxjYOCmOC8VeakVoV/PVbl+2gW7HxClYfMMxCH:S7jtmtOeaGK/NxV8A8H
TLSH
T16362FFC768D963C92C70B6A6C56FAAFCC38BF486164418F06E93470D9392907FBD56C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653_000_dotnet_runtime_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653_000_dotnet_runtime_6.0.27_win_x64.msi.log
Size 551KB
SHA256 0e9f6e82ec6c3c02fcf945e3280ae83d74fc3b8b3f7b70f9099de83e05964ab2
MD5 da0ee0e2879244c9f466670b5d84c801
SHA1 a709df69baa8badb3a49183d1312698bc8442f2b
SHA512 700122a3f5bb73d5c55b5c017d641441165dde911753b382ca73cc2b49783af2a4ad437f03d9267f50eef41d2f0bc524fe6e9f36b721118e35e09cfe5f62ab14
SSDEEP 3072:GlyUjS19xzlz+QAd03/HMRJhOvVahCBqri8vJAnqGNxFrfmkcWKdVqqv3KGAAbpl:ajuxm
TLSH
T1C7C42729ABF80255B2B78E47EEF38416A476FD31AD39D90C1192424D0471E05F87FBAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653_001_dotnet_hostfxr_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
Size 95KB
SHA256 3147f7eaa90fbe85f92a43f545ea836e66a924f6a1258c4eedf99d73211e7509
MD5 ce4667c36052bf576a7ae2640b7ec186
SHA1 aec995a72154bfed68fa7c98524f5a04b0ec69a2
SHA512 faff789f33af46a2c3d835b2dfcd456f266d75e1d65e9521cd99e1375bebfc7a59880c47aa074adb2268bed719ae1aa00dc8006b40121e46d085eb7ad1139309
SSDEEP 1536:nL7Y/NyLOaQhKj+buhx5V+wRJZKCl7Dbh5bBceasUSmGMkajWvIR2b8:nwZjWvIR2Q
TLSH
T109A3085A2FF4010AB2F7DA479EB39422A573BD296976C50D25D2820D00F1904F9BE7EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653_002_dotnet_host_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653_002_dotnet_host_6.0.27_win_x64.msi.log
Size 105KB
SHA256 986140a93095b87d1cccdc91b8fa70adb8b8cb23afca0df310e6f4b972aa9fb3
MD5 23e6cf0990f9f6ee5e4de65545e0a163
SHA1 947d1e8128c497f32f905cb187fd4886f3bd1a5b
SHA512 b1190a803fb6a8cdb4bca35dac7d58e586bfa0032ad544bbbf9f39fa84baf1c3f96caeca204ce8bf6fa2641d93519ff6ddf5974c3e446250cc3082f0618d74b2
SSDEEP 1536:6d6pnIVIRdzpAdUru79p2E03VZ1DQaSyUfQmZH/76aqgEj/xDbDBXz0MV4PC:6POj/xDbDBXz0MV4a
TLSH
T166B31A2B2FF4010AB2F7EA879EB39416A573BD296936C90D21D2811D01B1904F96D7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142653_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
Size 847KB
SHA256 9169b040612fd34cd71d5795f7bc8a59363614d97e18783356d8163ebd5bd119
MD5 2e75f698e9f1d0565cfe2e5faf62657f
SHA1 f71b3209fda339586f851a8f5c04b064d9fb7cb4
SHA512 6f49c0d97fc35a58aaa1f66c704dc131a35f92db8582c349d0405c0629049171fc9e5dc1bb243d29b4d4fb9547f53bf3f9d0d229b31deced82244d612584ee0a
SSDEEP 3072:x0oEOjSUB5vS2FRMxhClWxTS+khy0Xh+KKH6cwKbM4mzy7rb1KzFjPyEv4FgCKSx:XjDLsHj
TLSH
T1DA05F829ABF80625B3F39F47DAF34416E436BD35AC39D50C1196824D09B1F04E87A7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731.log
Size 15KB
SHA256 934a2ab2a0c71c0fbbd3ff53a2412aa27a0ae93a453cc177bbed0b4b51430ddd
MD5 064e67f06e31c00f66a8fc5566cfd197
SHA1 4d3bfc7c3fb5f2a8908ad7ca3643af010f4d30ce
SHA512 901d877f8697f489dcb9f4fbc54ec768da20dbb1ec0c98bd9a0bd5c8888d91c1e84693f451637fd1d91b607b38bad77b921286017f634956348fdec5fc64fc1a
SSDEEP 384:p5StV/QXluuSPmWPmWVtjvVqVcCVSLhlcPWJ2mNCkjA2mo:LQ9eWeYtjtcck09RcRo
TLSH
T1C5628A807EAD57DA6C71B1B6C13EADE9C6D7B4C7560419B13AC20F099393802DBC96E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731_000_dotnet_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731_000_dotnet_runtime_7.0.16_win_x64.msi.log
Size 470KB
SHA256 3e2880faf74db987f52ca49cfa08297f51f574af247a3657e166405872e8764f
MD5 f43eaf5be6c29ee34fab343010e52a5c
SHA1 24489382ba93364fd6b2c393f7228185f2be3200
SHA512 df732f404fe47cd7e0bdefbe97cbb23b3ac1ff7860693a64fbbdb6138338de729ee0fc2a6f4dadf7aab72ce2062c62a3519e9c796b3befae9c1b6638dfcb9a1b
SSDEEP 3072:rMYCBGHSZt3njuFgSdqYhRnPLuXiNkZYVeja6J5BfIHtZqkGr63DCAmmnImuJOg3:qjSM
TLSH
T124A44C25AFF8021BB2F39E57DFF344165876BC36AC39C91C2091425E0471E05E9AA77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
Size 95KB
SHA256 714e8208ff4389d5d3a4dc8d5fcfbdc98551684cd5943122661082c39f48b9ad
MD5 a9b1ad3535e5d18e4c86e91c4ed648c7
SHA1 b22c43aff5098579f52b39aaf1956709c69e1f4a
SHA512 6a4e602b9d69503f5c50dbfc077325c77bdf47ab8706fb42a82306a5e9d7b6a57c7963ffb4e68a391fe9d28b9246cd719aa4d350e86cb6c16b71753f3ab2d405
SSDEEP 1536:oYfT3WwNkYS2gkSr+TNadv2hNZ5RucEnlt/FY+SIB8FloBkjn9DEoQR:o/ejn9DEoy
TLSH
T1CAA3E8262FF8010BB2B79A579FF71411A573BD2AA935CD0D2192860D00B2D05E9AD7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731_002_dotnet_host_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731_002_dotnet_host_7.0.16_win_x64.msi.log
Size 109KB
SHA256 a4cf4d17dd99f85f803c6e7488c6b55074a545b1406c97b6b4ebbe340221edff
MD5 3b132b84e758244e59c88e2da5b4c1d1
SHA1 a24abf4c279c4b280564a1fbffa2100b4efb32d6
SHA512 f6da1294d2d6a2eea2ed9cb01a267e2c415056b8ff60a2ed10d5be6225d3c880fa201493287cb307f960dfb71a748481592e16df45640eadb5200f1f912f6629
SSDEEP 1536:fNmiX4fubnJe+ZwbOJe95FspZp2CFLj7xm1OjY0VnH+O5xcjMoNvSTcHRk3JSr:f1ejMoNvSTcHRk3JO
TLSH
T1AFB3042A6FF8011AF2F3DA479BF744158573B92A9939CC0D21D2C60D04B2D05A969BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142731_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
Size 852KB
SHA256 86e7bc9d518ab6ad995ccbadccbdc98950f029ddd9d0a188149f39ac6fc4b137
MD5 c25615d3ed580ae6b38ac0dd1cd26b05
SHA1 3dad75c4eb11e96a41f2b1f3a55ff3ebeb14173e
SHA512 0341b02c6c91214392ea83e5da3c47b43d2d279295238d5f188cdf718b76e136640261420342701a5a05e4b61c24ff13f7bc77a057f5116abc47764c575713e2
SSDEEP 3072:Kbb9jxTxCXDnFuEGo9XrYZOJbeMwCRUFgEGz/M8UHAA4vKTj1DBBZ/HwVKITlZK5:QjlUE
TLSH
T1C405F725ABF80619B3F39F47DBF744169436BC2AAD38C50C1155824E09B2E05D8BAB7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809.log
Size 15KB
SHA256 e854b38a83bce13b7a615cd388232cb5920f7cec36d83852c5b91869dd826897
MD5 46b7d4259e74e830bf9b1f5e263e6b80
SHA1 bd43b2280009ae173e92e4b9a7ef18b393b71b83
SHA512 eebfb016098cfbda28fd2b910cdfa6b96b305fb1fc47e0b46f2c66c3fd692098739e2ceb6fa48541d9b6befabcb9084e0a03c795e2cbcd8f88ccee97285bd344
SSDEEP 384:kx/gGVsitX0gKNq2NqqVjPy7f96v77VUVS9IVwzIhXQfYtSQq3eXzgTQq+:kp2s2scm9GWMqdALVL+
TLSH
T1547224942EE993D03C74B26AC53EAAEDC296F085174468F07FB34309D7A240BEBD95D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809_000_dotnet_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809_000_dotnet_runtime_8.0.15_win_x64.msi.log
Size 470KB
SHA256 017826bffa13ccf1a1682632ca2b6e418dd944d37d279a2022109d6612d7e642
MD5 2dc92be245bcec2039f8a623763f7125
SHA1 6df046c3ba8666c10848153e0719a3eeb2c85646
SHA512 11e69287d196adafe1b6545c7248a9c683f16c61ce5fb67692a9a7b2929745f11878b370ec4d4c6bc66a23f0c582d42633125df7c0de5f04b0fdf8b3808ecdd3
SSDEEP 3072:Eu2/NtVLbkKEYNsqP1nMCQGEJ+j9DvwFa5biQGzkHz1bgFfwejMYdGa8L+FegOIv:SjjtSX
TLSH
T14FA43915ABF80216A2F39F47EEF34416A476BC33AD39D91C2092425D0472E05E97BB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809_001_dotnet_hostfxr_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
Size 95KB
SHA256 75615976cda0e356c24f021cbcb98362203314ca5bf93de8d711639a6cefb555
MD5 9f47855bc1ced6fc3865b3fd521f6f0f
SHA1 7b5b6be1ff2dcc4c2ab075924c21c4ea9b381e2c
SHA512 0fd7f20d85ce2bbee8b1266a388acfa9bb343b13579667086ee7531e29dd1a4b63904c44cd0329eebeeca557142fde74aa7103d46b312da211c471f14aa860c5
SSDEEP 1536:RYvXAdtrBXhPAWXK+syuFtzGTm4QmtMZN51zQaSC086UxG2JST0kUknuqEKwx8/8:RYvXAdtrSWwnsuqEKwxWjp9ZP4ypSYOH
TLSH
T139A3E61A2FF4000AB2F39B47DEF354166573B99A5A35D91D70D2830D00B290AA97DBEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809_002_dotnet_host_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809_002_dotnet_host_8.0.15_win_x64.msi.log
Size 109KB
SHA256 bffc988180f7e36b5a6a19d23956637ff8848d89a48535f3064abeb44cd2e3a0
MD5 f47aac0a2cd60e13bf916384b3334316
SHA1 721ace5ddea7c479b8c62c8f9f0309d092bfd89a
SHA512 d209d823ee1f4c32a2658e64688eb1e0ab3af3f88c80028d31f9fe901656f8017510d405c323cbe6f8f2b4a7718261fdd97c553e594a2146dff858c1f223fcbe
SSDEEP 3072:smsW+b97H0HAkzRwfIj0BBS8jAITFwqb4vG82/:bjq
TLSH
T1BCB3181A6FF8011AB2F39A879EF318165973BDA35D35D91C60D2830D00B2909A97D7EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142809_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
Size 849KB
SHA256 17cb2f92ce781c7123ddfed48983eabb48d30e031fd06e652e9a94189aaafa25
MD5 f9e7d903650d37c8411565951a3c2003
SHA1 e48d4d96df61bd215d005d5eb788b68c5a4e7a3c
SHA512 41ad349367b9a5c87494ae6f058299e7cb770738c6384756ec8bae93292ac9b13712428ea14652525feee9b5c59507afd744865201e399d7907f48bc68987703
SSDEEP 3072:Rywienx/gqgdqSDQzZbCkhFZsK0HeASo337jfAseu6DtQDR6u8CsaQX3QcdejEYB:Gj3f
TLSH
T114052915ABF90616B3F38F07EEF34416A476BD22AC38D51C1056825D09B2F09D87AB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OUTLOOK_16_0_12527_20482-20260709T1438060851.etl

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Outlook Logging\OUTLOOK_16_0_12527_20482-20260709T1438060851.etl
Size 912KB
SHA256 5f577368fba454812ffe835b70e6eb673107a269c40a3e665929caf4d1abf2aa
MD5 9a2108eb24f62e602994db2db141dd3e
SHA1 baa718f86f74b5232bf03ed9153383afeb84e539
SHA512 7ebff2379f2a80532115882cf299a33444aafd1733952e70ea4d051ffd86ca08c304c90464225e6494c665aea7ef733548558193d8c9a5496afa11c5d152b82f
SSDEEP 3072:x5aG1fVffuiRj2Dfn5lefexa6ukRWOv7j4Supr3txY77qE048+y8M/nnbzXG6418:aWYvy8+nnbzXmyof0
TLSH
T1E015B85A67F90215F5F66B392DFA4829C933BD622839D70D21913A1E0D31F91D8B0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firstrun.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\Outlook Logging\firstrun.log
Size 371B
SHA256 7035806bac2d94978c81eacf1fd0c49064966e7aa5bc79637ced6f40f5cd2053
MD5 0dfd7463fd67d832999523e8506edd5a
SHA1 ef5e5f834564a411e54ad4dcfbe81361496ca7a8
SHA512 0dcb508e09b04da1c60aa64b634b0c34c6b6d3f2184282487c05b49c6688cd71088641d8b963ffa86cecc02651f71a270b3899ae73ea0e4362780023de1b5dc9
TLSH
T13DE0D8EF485552BB8FB111E02429A77B2F55690E138DA0F7C21E3BAC16471984C7D813
MD5 SHA1 SHA512 TLSH

Submit Download

USJNCXJL-20260709-1433.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\USJNCXJL-20260709-1433.log
Size 59KB
SHA256 12db08b440624d322dc6ca45a6eef214072ffa89c5b9e467e1612dc1ee62aaa1
MD5 d77e7d4bbece045290059b1b30cf07cd
SHA1 6117c134c9b60563bde99e9c794fb82304741bdd
SHA512 8617dd953a915f30a2010b504936276d14d24ef157ccaf946281bca69143355e2358bbe45fc247fcd2fe7185aa5864aa66489a80142a21efd4c087a49de60703
SSDEEP 1536:3Q/FKve7VoeXBWJT/gEQuEZCkqY8I5t9iYSWur8wSCap4vJ7/TY7b1ShbMmS6Msu:YHSegWD5t9ilo
TLSH
T18C5347285EE91256F2F39B8699F240A7AB767E677834DD4D20610F4E1427E027C60F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USJNCXJL-20260709-1433a.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\USJNCXJL-20260709-1433a.log
Size 149KB
SHA256 e4911e7c36034f5ba3ecb8f28b00f80eb36586a10f5eaa2d05ddb44fbb9daf33
MD5 2f35dcb55d4f3531753d59c3d397d727
SHA1 aab7865b0700ae8ee94d7652e7fd986ea03c5c53
SHA512 a3fca4b67e9a0d638f52e1271a10f544367422f1cedfee263cc8824250385d3406c7cc7ae77e24af8c675f6ed976dc47e2caf576ada190260741d6b53d8f3c78
SSDEEP 1536:p/FF2pQSF6Sa3dHSt0HBFZTxbqqHRSG8sJPzkHdrHVZBD9H2HBIHFI/+J4HDK/rE:h1gq04/o/H/4
TLSH
T126E337281EF90226B1B2DE869AF640639B72BE676831CD5D60910F4F0526D45BCB1F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aria-debug-3612.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\aria-debug-3612.log
Size 470B
SHA256 38636df4dacfd32813beea398753f2e1c4868fbfd62938bd402ec7d4c4828aae
MD5 15bf7291a3c0d0abf3de7558b06781d6
SHA1 4a09beafb9026b3bb94c80001e9882fef48a41ff
SHA512 6e69c18952dcd7a487219841fe7564ccd7a4dbe2eca5bfb09a13aa76a581e8c009dcf4f6f6fbb68c4ce585aad11fe40145cf0493e1238379833a43fc54155746
TLSH
T120F09E8A0A6B5C63C25B73B3B4638AD329D9D67FB2D04740895D532D10473C89247C80
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\cv_debug.log
Size 805B
SHA256 216cce406f5ec58ea4bc5db6277b7a6a5730fd539e4d522a9020586a16ce8db4
MD5 6f20f4ec5390df26151ab294c5f083ef
SHA1 582b9fa8083fd9be9a90d9421f31547ddd3b0ae2
SHA512 e9e33b29c2a2cb128a5094da819a2d89c7d2c5a4f443a19328a7506c69be4cd467e1fa7edefc6227e3a8654cf96a77bdfe80749ab424ae063c31a29ac31c2bd4
TLSH
T1FA01C8903921237B97D247E5D0660CD5A950B88A032B6AACDA4A6065FE6CEE1631E3C6
MD5 SHA1 SHA512 TLSH

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 a3a6d9256dd9b71c8e52573faff90eddb8f72027a69ea8dfb82f125e3bd7fa58
MD5 276ca0c48960948095049373ef277a4f
SHA1 5870e784eb2a76bb7bfff07287ee2f9e4488e455
SHA512 98be6f29a86e6838cf9b646575bac372c78d0c6cf036bbbc1182846983086d214083fe0cc85d82b0fe2cb03f8fad1500dc566832db85dd756ee3d9424cda7fce
TLSH
T1D32165C280CF68B9585282810D47ADE390961A455E4F29F1FB80B68D24430FE3AF7CE3
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredistMSI793C.txt

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\dd_vcredistMSI793C.txt
Size 426KB
SHA256 436ae45dc6251b784f27f02cfb96341d4a12b36cfbb3874b2430894c2a0ea06b
MD5 9bffb80f3220e0a78fcdc1c5fcc04910
SHA1 ae36daffd61db1aae171e3cf7dac495dd132a434
SHA512 3ede5e20cc5518c63942133a00115c5f8508772c40daa092476d2a3cdad1ac31581daae37212dee4a6ed0bbde4bfe30774d948602241a6fc826dae4dd004ec2d
SSDEEP 1536:vIgddYF34aOPSFOP/bP8EWmdY+cgxD2qyMj997s6rH3LeuoTSn8ykI3Pkmqv5Dja:1oAWjEv1Ls5DlIZ
TLSH
T1B4949D2A6FF50217F2F39B47DEB305125933BDA2E935C94C6190830D0562F06E979BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistMSI7967.txt

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\dd_vcredistMSI7967.txt
Size 415KB
SHA256 62180f480e83513f505c38ac9847afcbfc58f8ee7f1f7913ac622973a2a1e81e
MD5 067cdccdc4e9dac1c825c7e081791792
SHA1 6b21a649e99d47cdbffc4c04c520aeae773ce3a6
SHA512 a6103ad844841263708f19983fec7cafe892ae0b0a35a2c6dcd207e38e597214069613ea38d126062814c9501cd23ecde9780a039f509e21777db24531dbd059
SSDEEP 1536:g0N6k1nqkQjbhuH4n2MLu7ETkJKMrfD7USbBv7bYGYMrLw6WtVmT5IE3Zh5TSr9P:g09AjswRHHZcf/OLj
TLSH
T135947C2A5FF90257B2B6DB47DEF35412E8337D51A839C94D2192820D05B1E04E93AFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI793C.txt

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\dd_vcredistUI793C.txt
Size 11KB
SHA256 5614a5c909ad49c12b14f825599914a03fc3b5d3a93772dd96e436fa260fd20d
MD5 5f3f02da6d6dcec1a7871d3db415dfcd
SHA1 cd1c2c40ad5f57201de20df90d97a6e818766cbc
SHA512 106fc0c108e09afe45247e098773b20fb0fc4c2801d9cee05dcaf4e8d26bab751720b2aa336934576a132700e2bca4c09dd2d07291248af4dd4a36721b504bc9
SSDEEP 192:YS+HsFOUlCRQY/Jnhnz7nhnDMWHnhneBOR83RsU8ov:YS+HsFOUlCRQY/Jh3hDMWHhvKGov
TLSH
T160327C2F8EA51457F8B2DB4EECFA4112AF76B8405979850D60F4138F19B0609F9E13BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI7967.txt

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\dd_vcredistUI7967.txt
Size 11KB
SHA256 c4307b5d2c81b27946559013a64bb56efe9f45d58eeb2e6a452dc99a3bd9d2fe
MD5 a50f2a18447ddff0858d97a77189b7bc
SHA1 f0b2a85cfcfccb11d03ba0aecfb3981973b1bda3
SHA512 158a87f947b623fc4ca52a13f4a5dd14169b490be15fe36bc0617aff58b7b9b44a6f0b78d23b58391c722b0ad5fbec3f2abc960eef2f6c4f88c1af0864602d3f
SSDEEP 192:WLEAtyqjlYPq4B3nfnT1nfnNM4ZnNnsvg/8px6i8yf:ADo+lYPq4B3fJfNM4ZNxU0yf
TLSH
T1C732742B5BA90496F4B6DA4FE8FA4112FF76B840597D850E10F6138E19B0604F8E17BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3760c18-34c7-4c25-8490-c38e6a786620.tmp

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\f3760c18-34c7-4c25-8490-c38e6a786620.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jawshtml.html

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\jawshtml.html
Size 13B
SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\jusched.log
Size 163KB
SHA256 c4a449e986db81d545acb5fe9f5a3cab5508736c7878d6fb63a60e686c4e60fd
MD5 735c882f1124a07fd74f46968f1ce15b
SHA1 0fc10a04e4e69253c43091f1f41aedce336946f8
SHA512 935b22d108493ad215eccc99d96eda8784e5cc08c8460674ae644ec3810fd1534a12a682a9bb8cd77d3db09e5dfd86f61a215f9646d8d697f290ff49742a2582
SSDEEP 3072:cAXhBCbqoXVR8tUdOqlhsLUOaTtqq0uQs6muTgI5encgkV9F:pse4cgkd
TLSH
T101F32186846E45FF25238BD383795CA445A2354A975E891C33CFC6EA7681903CF2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mapping.csv

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\mapping.csv
Size 120KB
SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
MD5 d3186aada63877a1fe1c2ed4b2e2b77d
SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
TLSH
T11DC35121D2F6619CF5F3AF941AB41AA91E73FC16AD2DED9C0250620D0466E61DE31F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\msedge_installer.log
Size 10KB
SHA256 29ffaa659d471988f70cd1e6bc7dafa390d52e9e6ffbe66e6c0c247b5f98f5cf
MD5 f803d904a683a2cd17d6b0031a40f6a5
SHA1 bfb864e4f1560cf2adaf26db2931c5a7b3e652d3
SHA512 806b3f452499294125744d25b3f4ea77772a3998a456fa0d8da4f7441f8e7b93b5f0e820e02c5d6cf81f235bcc9b828c425801b01f36b35e15cf9c50a3d76e59
SSDEEP 192:cHOMoWKQtKvOBbmYxcUgNoboVS7FvO1QbY:woW9mtkWebY
TLSH
T1253203045B8BC2B12FCE71FA22173E5B95BA58CF86D5643262B9A413F0427F5127B0F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wctA286.tmp

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\wctA286.tmp
Size 63KB
SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
MD5 e516a60bc980095e8d156b1a99ab5eee
SHA1 238e243ffc12d4e012fd020c9822703109b987f6
SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
TLSH
T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\wmsetup.log
Size 697B
SHA256 94942b73dc9719405660a9f0d97977c4d47d61ad2c791da692dface7085d7839
MD5 def4a21f38b109f48c41dccda0192a97
SHA1 6c4999072e8604330788fe889e196ea1c4d22cff
SHA512 e6cb8b37e0440e539ab45d3f0678d46b943a5c5cbebed3fa8e8fbf22e667175338e9d12c2a25ff79bbb7d3856162830c9c99697149f2d0aa1fdb899c3a6f9d97
TLSH
T1C7014C974A0AE4F48D9297A369CC8E2673BAE7CF4394D026A389E455450913E233E07E
MD5 SHA1 SHA512 TLSH

Submit Download

~DF1E1A5F1214878ECD.TMP

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-30adaf33b87d9495\~DF1E1A5F1214878ECD.TMP
Size 16KB
SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
MD5 679672a5004e0af50529f33db5469699
SHA1 427a4ec3281c9c4faeb47a22ffbe7ca3e928afb0
SHA512 f8615c5e5cf768a94e06961c7c8bef99beb43e004a882a4e384f5dd56e047ca59b963a59971f78dcf4c35d1bb92d3a9bc7055bfa3a0d597635de1a9ce06a3476
SSDEEP 3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
TLSH
T19B7202427234D665D54809368D41D5CC9776BD00DE14D14375DA775F0A314E04454652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AngryGoyII.exe

Path C:\Users\Admin\AppData\Local\Temp\AngryGoyII-ae63988c6a887608\AngryGoyII.exe
Size 31.6MB
SHA256 9d4a7fe024a29ce940a47ace0772a1f1ec06058a1335d2c671cdca1bdf9bac55
MD5 283dc710ca4d3592ad1b5a0bd5f330d5
SHA1 47f8360e5e0cc6ef46f31481688a3a7510e77c22
SHA512 d5c70be2781525e4f8bd7c14da0cd7976de404af06b682c54fc35ed3d59d7eaea0853ad06a2352e9435a64fbeb2b60d5b8521b7f57ea54f4a27ba4bd1607d02b
SSDEEP 393216:GqNRTB3La1+NCTqfhmBrcmgZ7x2DbtxYMzGSvNQf/Jwcb:FPFLlmt5cm2NTSlQJwG
TLSH
T189771A2AAE5284D9DD6C51317F4C0AB223506466865B6F3717B1C230BE7B6481EEFEF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bo4zebft.5c5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bo4zebft.5c5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 14ecaa3e58b6427d9ccc16816031aa01815fb16693df1dd1781571c4ccf2376a
MD5 ff1052f6c9779ce2f790a9d3ec3fb71d
SHA1 7c6ae1ba0462425ce32eb523d90511feddabf84e
SHA512 c451bdd622081bfae58a8810af3a33b2c479fcea34b2f84ec708deeefa4c01f265830702dee68a6edaf045eed4ea2a2bbe7af3b818dff522b7d84ea992e750c0
TLSH
T121217933F3DC8695C899413A10CEAC1035BBCBDB419ECFDB6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1555da81205afbc486ff333eee3881b9612027ddd1fbf999cb393d61adcde347
MD5 6091709da9fa8ef7b683c8cee892374e
SHA1 5c36c2e8396b92317d03bcee15f0e9ff6ee70aaf
SHA512 c95745b6d3a3d3b3f717fdff650be2b6b6dd31c0313a29079872d9579af91337e68ee76275a8158695d95c63a0a0dffde72f3644e8ba4cdcac67f883432dd017
TLSH
T155216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 5ae279c55a4809e72d8985f4e7645181665d51e193800a96be8f3d3ba1ee642f
MD5 1405eef0ebe9ff070f65a9a0e8273624
SHA1 dd9e51355c2b86a698b606a322bdce24d4530069
SHA512 4ab73d6ee2dee099853868a9419ae972d6103927d8bf90e016551eacab4d55a7df35c59f3a80a8c851d5885e0dd49f9321d52f67998cc8c709240df477cb7edd
MD5 SHA1 SHA512

Submit Download

memory/936-4874-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/936-7393-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/936-2468-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/936-4887-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/936-7403-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/1392-4883-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/1392-6237-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/2228-4870-0x000001D76CFB0000-0x000001D76CFD2000-memory.dmp

Download

memory/2380-7411-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/2380-7410-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/2380-7396-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/2392-10888-0x00000295CEFA0000-0x00000295CEFBA000-memory.dmp

Download

memory/2392-10886-0x00000295CEA20000-0x00000295CEA2E000-memory.dmp

Download

memory/2392-10493-0x00000295CEC90000-0x00000295CED42000-memory.dmp

Download

memory/2392-10590-0x00000295CEA40000-0x00000295CEA5E000-memory.dmp

Download

memory/3188-14042-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/3268-2461-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/3268-2465-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/3268-1743-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/3780-12571-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/3780-13116-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/3780-13125-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/4332-8987-0x0000026350550000-0x0000026350602000-memory.dmp

Download

memory/4576-7418-0x000001CCC6240000-0x000001CCC624A000-memory.dmp

Download

memory/4576-7415-0x000001CCC6160000-0x000001CCC617E000-memory.dmp

Download

memory/4576-7416-0x000001CCC6180000-0x000001CCC6232000-memory.dmp

Download

memory/4740-7407-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-1510-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-2454-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-8640-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-14907-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-14033-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-12578-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-4869-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-7392-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-9937-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-2467-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-11915-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/4740-4885-0x0000000000400000-0x0000000004808000-memory.dmp

Download

memory/5272-7409-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/5272-13524-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/5272-7417-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/5272-14035-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/5272-7395-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/5272-10534-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/5272-7397-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/5272-7398-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/5272-12573-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/5272-9930-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/5780-9936-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/5780-10977-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/6004-12579-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/6004-5746-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/6004-9942-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/6004-14034-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/6004-7408-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/6004-9929-0x0000000000400000-0x0000000002399000-memory.dmp

Download

memory/6004-7394-0x0000000000400000-0x0000000002399000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads