Overview

overview

10

Static

static

10

2to1ep.exe

windows10-2004-x64

7

2to1ep.exe

windows11-ltsc_2024-x64

10

4363463463...63.exe

windows10-2004-x64

4363463463...63.exe

windows11-ltsc_2024-x64

10

Synaptics.exe

windows10-2004-x64

Synaptics.exe

windows11-ltsc_2024-x64

10

TsarBomba.exe

windows10-2004-x64

TsarBomba.exe

windows11-ltsc_2024-x64

cobaltstri...de.exe

windows10-2004-x64

10

cobaltstri...de.exe

windows11-ltsc_2024-x64

10

ed01ebfbc9...aa.exe

windows10-2004-x64

10

ed01ebfbc9...aa.exe

windows11-ltsc_2024-x64

10

random.exe

windows10-2004-x64

10

random.exe

windows11-ltsc_2024-x64

10

Resubmissions

27/09/2026, 14:21

260927-rn8hns1yhz10

15/09/2026, 11:13

260915-nbjf8sgj9y

13/09/2026, 12:17

260913-pfz58aba3910

11/09/2026, 14:17

260911-rltazathnb

11/09/2026, 14:10

260911-rgr74sw1hv10

07/09/2026, 14:52

260907-r8tv1sxvat

06/09/2026, 18:39

260906-xarwnaysdx10

06/09/2026, 18:38

260906-xadn2azgqc

06/09/2026, 16:17

260906-trmfqaxgkf10

06/09/2026, 16:09

260906-tl37aaxfma10

Analysis

  • max time kernel
    137s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/07/2026, 04:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    4363463463464363463463463.exe
  • Size 10KB
  • Sample260729-e8nb1sgn9y
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarepruebacosturadefense_evasiondiscoveryremcossalatstealersharphoundhacktoolpackerpersistenceprivilege_escalationransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

  • remcos

Version

  • 5.3.0 Light

Botnet

  • Prueba

C2

  • 192.168.10.1:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7OXI1T

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Family: SharpHound

    SharpHound is an open-source tool that collects Active Directory data for BloodHound analysis.

    hacktoolsharphound
  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 5 IoCs
  • Detects SharpHound hacktool 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Downloads MZ/PE file 7 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 23 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 2 IoCs
  • Modifies WinLogon 2 TTPs 3 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Costura .NET executable packer 1 IoCs

    Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

    costurapacker
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 11 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • System policy modification 1 TTPs 5 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\Files\EDMSLauncherSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\EDMSLauncherSetup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /F /IM EdmsLauncher.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1228
      • C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe
        "C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe"
        3⤵
        • Manipulates Digital Signatures
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies trusted root certificate store through registry
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Windows\SysWOW64\netsh.exe
          "netsh" http show sslCert ipport =0.0.0.0:15002
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4824
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" http delete sslCert ipport =0.0.0.0:15002
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2736
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" http add sslcert ipport = 0.0.0.0:15002 certhash = 873ba9adcf0babcf88bef9a12004a41ea9b49274 appid = "{9C2B08E6-A284-4B0C-A742-392C203C90F0}"
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4172
        • C:\Windows\SysWOW64\netsh.exe
          "netsh" http show urlacl url = https://+:15002/EdmsLauncher/
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2824
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" http add urlacl url=https://+:15002/EdmsLauncher/ user=OCPZFHHI\Admin
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2632
    • C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"
      2⤵
      • Executes dropped EXE
      PID:2540
    • C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1656
    • C:\Users\Admin\AppData\Local\Temp\Files\877901a58750.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\877901a58750.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4384
    • C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3108
    • C:\Users\Admin\AppData\Local\Temp\Files\google.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\google.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4492
      • C:\Program Files (x86)\GUMFBFA.tmp\GoogleUpdate.exe
        "C:\Program Files (x86)\GUMFBFA.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={F055F91B-BB9B-4663-B67C-722DACD82983}&lang=en-GB&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4052
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4368
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4040
          • C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:740
          • C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1468
          • C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4020
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMy4xNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjMzLjE3IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezI2MDFBRDU5LUFFRjEtNEI5QS05OTczLUFFOTUxMjAyODQ4NX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBQzFEMTI5QS01RDU2LTQ3RjctQkZBRS1BOTI1OTlEQzU3Qjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxNDEuMC43MzQwLjAiIG5leHR2ZXJzaW9uPSIxLjMuMzMuMTciIGxhbmc9ImVuLUdCIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7RjA1NUY5MUItQkI5Qi00NjYzLUI2N0MtNzIyREFDRDgyOTgzfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMjk5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:5048
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={F055F91B-BB9B-4663-B67C-722DACD82983}&lang=en-GB&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{2601AD59-AEF1-4B9A-9973-AE9512028485}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2052
    • C:\Users\Admin\AppData\Local\Temp\Files\mini_04.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\mini_04.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3316
    • C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Modifies WinLogon
      • Sets desktop wallpaper using registry
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • System policy modification
      PID:1072
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:4288
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4240
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:3956
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1940
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa3966855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:2692

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Event Triggered Execution

        3
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Image File Execution Options Injection

        1
        T1546.012

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Event Triggered Execution

        3
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Image File Execution Options Injection

        1
        T1546.012

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Impair Defenses

        1
        T1562

        Disable or Modify Tools

        1
        T1562.001

        Modify Registry

        8
        T1112

        Subvert Trust Controls

        3
        T1553

        Install Root Certificate

        2
        T1553.004

        SIP and Trust Provider Hijacking

        1
        T1553.003

        Credential Access

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Defacement

        1
        T1491

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GoogleCrashHandler.exe
        • Path C:\Program Files (x86)\GUMFBFA.tmp\GoogleCrashHandler.exe
        • Size 282KB
        • SHA256 617def10fb5cd04434532e2803f07489a82494f76dc177e0ce7e8c70f66729c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoogleCrashHandler64.exe
        • Path C:\Program Files (x86)\GUMFBFA.tmp\GoogleCrashHandler64.exe
        • Size 357KB
        • SHA256 e881b1e5151886d85d4a690b3b41cb3e5dfbd24759b660c3554187f66a3c0825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoogleUpdate.exe
        • Path C:\Program Files (x86)\GUMFBFA.tmp\GoogleUpdate.exe
        • Size 149KB
        • SHA256 542294724926b0e156224b9ebd33e6354d79da4c828fb52f7f4233df45e3f624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoogleUpdateComRegisterShell64.exe
        • Path C:\Program Files (x86)\GUMFBFA.tmp\GoogleUpdateComRegisterShell64.exe
        • Size 169KB
        • SHA256 bb1c60e4f365c2a13db9612dee6d46ce9b6a6bd42a9a7e650ba3b2e911957419
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoogleUpdateCore.exe
        • Path C:\Program Files (x86)\GUMFBFA.tmp\GoogleUpdateCore.exe
        • Size 587KB
        • SHA256 0853a5fb66ddb187947bf9a51789728b75e34885592f51c2bbbc583729b23e40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdate.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdate.dll
        • Size 1.7MB
        • SHA256 eaf6ede3cc4efb047cedad32a9b3c2a138ad872991e3bee4f66dd8fbe08133b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_am.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_am.dll
        • Size 41KB
        • SHA256 702b1f2b48041334b94e5529a27823518544fca6abd51f64c2d90c09685d3459
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_ar.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_ar.dll
        • Size 40KB
        • SHA256 b5e4b6bc7e821ec1c652557777e7f1a06156da6c411752e1e66f47e8b6bff3f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_bg.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_bg.dll
        • Size 43KB
        • SHA256 709d7d08dffc672ef3053e29fd86e86413af60ab41a43959b4108538819a189e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_bn.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_bn.dll
        • Size 43KB
        • SHA256 9465122ddaf8298cc8560a55d28952b0098eb7236cdfe52f62509a528f44dd26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_ca.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_ca.dll
        • Size 43KB
        • SHA256 411d01fa6bee8659ee2f7dc4975f33deaaead02d2f9c783e8adaf07a4a6333a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_cs.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_cs.dll
        • Size 42KB
        • SHA256 4afb1aa42cbc501b28e2f5b27db2552ab3445d18134ae643812fde5bbebd8414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_da.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_da.dll
        • Size 42KB
        • SHA256 21c36ff76333c7363bd62c76a136f841ae13a667691536e9bf3609e49abc6e27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_de.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_de.dll
        • Size 44KB
        • SHA256 e482ba26e04e59899c7140ab0f35d6ad233f5dfa001d0def9a29c131a731210b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_el.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_el.dll
        • Size 43KB
        • SHA256 0674cf0c9c0d30440ce548536a6f1b59f9250e4dc992c93249dabba34491a574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_en-GB.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_en-GB.dll
        • Size 41KB
        • SHA256 86af29e76c77093b312b4ff20eb330ce9806d76afc69f754e5eea90425430cbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_en.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_en.dll
        • Size 41KB
        • SHA256 1f2a19782eb0eee7d0820987a233947ebbc33abc6cc234cb74ddfcac3f901165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_es-419.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_es-419.dll
        • Size 42KB
        • SHA256 8a4acb09fb53d2846780f10bebdf95bb33eddc0dfcd18195be228b1211deb509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_es.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_es.dll
        • Size 44KB
        • SHA256 6a060c7a90a95f2cab5e111ded3d4f618c10a200cfc7dd1a0e5be5fe35d66416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_et.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_et.dll
        • Size 41KB
        • SHA256 6fcd31b49672cbca59062e90f36213fb99aef317fc1f12494e1715e5a591e891
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_fa.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_fa.dll
        • Size 41KB
        • SHA256 db059681f11fb56e46bb89f80330e02f95a09ebb30dd20c5f12156e92c0667c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_fi.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_fi.dll
        • Size 42KB
        • SHA256 1175be38d7adf1d26d7abae3704b488a4700e874149cbcab487e0343d26349ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_fil.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_fil.dll
        • Size 43KB
        • SHA256 c7174cae6039a1dd4a7de2603d10d610650984ea2f1020d6ecf04364e789eb9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_fr.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_fr.dll
        • Size 43KB
        • SHA256 78cde3ce8c755cf54f05103dcf4438bdeebe819573738678a8e8bb0850faceb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_gu.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_gu.dll
        • Size 43KB
        • SHA256 fd78649babc724f85e17e11d487d04812d83f70cd9fb45e2374360d779c8e5ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_hi.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_hi.dll
        • Size 42KB
        • SHA256 0ce08563cab2fd4050714d671b5d09b26e9b00dced01a1ccba031e301897b93f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_hr.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_hr.dll
        • Size 42KB
        • SHA256 816e024e0485983f6820fa54b1cb037ef875b8a98dd3e2fe2a5ea0771d0ff67f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_hu.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_hu.dll
        • Size 42KB
        • SHA256 dffa27c56881121fe57701373ffb27dc754450d880fdd5ead0d34360a188d361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_id.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_id.dll
        • Size 41KB
        • SHA256 8b41b93852cd849aba5c5751280edc01292f7fa74c7803ee280e1ee65d05886b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_is.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_is.dll
        • Size 42KB
        • SHA256 077ed1a8fb7ccaea614a4c80df3d7e7b140a94d650b2d22c2e827d175b033217
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_it.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_it.dll
        • Size 43KB
        • SHA256 fcbedf3497a065f616874e7d9868a0bc6c5a109ebeaa825a35a9c5ca92347e00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_iw.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_iw.dll
        • Size 39KB
        • SHA256 64b90c73bd24d247a3afbece81bd1c81b77ade6631dae71807b4b6fcb5c21da4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_ja.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_ja.dll
        • Size 38KB
        • SHA256 a851b4abd2e152c9743bf84d292a662bee0fe8d4080e13a62ac482f44ce67b21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_kn.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_kn.dll
        • Size 43KB
        • SHA256 fe3398258f7b32cf85c61a08e0bc90792fd111f0f30905457988c8bea5e98492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_ko.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_ko.dll
        • Size 38KB
        • SHA256 42cd719344a6084b697ecdad10893064ca0806c2a248ef11689c3212da5969a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_lt.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_lt.dll
        • Size 41KB
        • SHA256 886ca5ed38effeca6c91a29356f1240ecf6f2904769aee5dc6641cf6f3ccb021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_lv.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_lv.dll
        • Size 43KB
        • SHA256 5208f544888b471725e6347a40dc8639acac5ac8b530e848f7326d410fd0f4ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_ml.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_ml.dll
        • Size 45KB
        • SHA256 18e7dbb973d11d9f3eed7fc7ba73364904547431ce6d527dfe23baf6e3135a08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        goopdateres_mr.dll
        • Path C:\Program Files (x86)\GUMFBFA.tmp\goopdateres_mr.dll
        • Size 43KB
        • SHA256 c567185abfac41c2f72c22de2ee26d0dd8704109dd90f2acc527a61c8693138f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EdmsKbinsureLauncher.pfx
        • Path C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsKbinsureLauncher.pfx
        • Size 2KB
        • SHA256 d0df425208ff8854a32c1832dff221da092de504f50bcaaba0ef4a7ebfd151fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EdmsLauncher.exe
        • Path C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe
        • Size 77KB
        • SHA256 027b864df8b86669f2e1fd0b36b5e4f313899e13b0380e466e5edcfcb7b8dee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EdmsLauncher.exe.config
        • Path C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe.config
        • Size 1KB
        • SHA256 3349cb9330f9438186961dfa701899021cb534247f678668c8071f97c34542c9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EdmsLauncherCommon.dll
        • Path C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncherCommon.dll
        • Size 29KB
        • SHA256 4a3629ebd5d082a6ba8a3260d707657ae9778d43b3b8aa2475d43ba3fc6e9b62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ImgCore.dll
        • Path C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\ImgCore.dll
        • Size 251KB
        • SHA256 e9c6d2b54914eb1e2221670fdf13dc10034e9dee72e540fb2fd5c883f85a4bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        02.08.2022.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
        • Size 93B
        • SHA256 f6c3ff4eb732bce920840abe0c9ab582d1129ec5df46820ca5691bda41445b4e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        877901a58750.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\877901a58750.exe
        • Size 3.4MB
        • SHA256 fbf4ef28c4b49c6304d23a738afabf8981590eae8585834bf24e3c7e87163c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EDMSLauncherSetup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\EDMSLauncherSetup.exe
        • Size 586KB
        • SHA256 5ed4dbd102e247893dcd25869631c9a5aa3c7cc07a57ef9bffde95941560feb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NoEscape.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe
        • Size 666KB
        • SHA256 d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SharpHound.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe
        • Size 1022KB
        • SHA256 cc19c785702eea660a1dd7cbf9e4fef80b41384e8bd6ce26b7229e0251f24272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\google.exe
        • Size 1.1MB
        • SHA256 e0aec8d85a97523d72ef88049d9360d306544c5656d777efe437cb125b5415f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mini_04.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\mini_04.exe
        • Size 1.7MB
        • SHA256 d9b7003644fe59eebd75cd9f0b8364fd73230512e99f795fab8e2e0f93b8ed04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntladlklthawd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe
        • Size 3.1MB
        • SHA256 fdf471649ef052e9a1c5b1f10c7c15f43f6df548e3cad8299ff5317abffb3899
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prueba.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe
        • Size 429KB
        • SHA256 ae9384f6fc3fea2276f6897e910a5d5b7a3ad995420363788815e0754ff9469f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj5B7A.tmp\nsExec.dll
        • Size 7KB
        • SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ⒔ⴁᨬ౗᫹⟮ᱽ༹۰␝ௗఘỪତᢃ⁒ና⌨ᇍ╁
        • Path C:\Users\Public\Desktop\⒔ⴁᨬ౗᫹⟮ᱽ༹۰␝ௗఘỪତᢃ⁒ና⌨ᇍ╁
        • Size 666B
        • SHA256 8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1072-433-0x0000000000400000-0x00000000005CC000-memory.dmp
        Download

        memory/1072-797-0x0000000000400000-0x00000000005CC000-memory.dmp
        Download

        memory/1412-2-0x00000000056C0000-0x00000000056D0000-memory.dmp
        Download

        memory/1412-1-0x0000000005490000-0x000000000552C000-memory.dmp
        Download

        memory/1412-0-0x0000000000BC0000-0x0000000000BC8000-memory.dmp
        Download

        memory/1656-93-0x0000000000CB0000-0x00000000017ED000-memory.dmp
        Download

        memory/1656-91-0x0000000000CB0000-0x00000000017ED000-memory.dmp
        Download

        memory/1656-89-0x0000000000CB0000-0x00000000017ED000-memory.dmp
        Download

        memory/2540-80-0x000002009D750000-0x000002009D800000-memory.dmp
        Download

        memory/2540-79-0x000002009D6E0000-0x000002009D712000-memory.dmp
        Download

        memory/2540-75-0x0000020083110000-0x0000020083214000-memory.dmp
        Download

        memory/2540-78-0x000002009D670000-0x000002009D6A0000-memory.dmp
        Download

        memory/2540-77-0x00000200835A0000-0x00000200835B0000-memory.dmp
        Download

        memory/2540-76-0x00000200835E0000-0x000002008361C000-memory.dmp
        Download

        memory/3896-43-0x0000000004F60000-0x0000000004FF2000-memory.dmp
        Download

        memory/3896-49-0x0000000005030000-0x000000000503A000-memory.dmp
        Download

        memory/3896-47-0x0000000004EF0000-0x0000000004EFE000-memory.dmp
        Download

        memory/3896-42-0x0000000005470000-0x0000000005A14000-memory.dmp
        Download

        memory/3896-41-0x0000000004AC0000-0x0000000004B06000-memory.dmp
        Download

        memory/3896-37-0x0000000000280000-0x0000000000296000-memory.dmp
        Download

        memory/4384-413-0x0000000000560000-0x00000000011AF000-memory.dmp
        Download

        memory/4384-414-0x0000000000560000-0x00000000011AF000-memory.dmp
        Download

        memory/4384-102-0x0000000000560000-0x00000000011AF000-memory.dmp
        Download

        memory/4384-799-0x0000000000560000-0x00000000011AF000-memory.dmp
        Download