ac7e1c55a2bb1cc3b41c1ce2b5c6c510e2c4d474088e95e1a49b4d690d54c4bd

Analysis

user interaction
yes
max time kernel
150s
max time network
160s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/07/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pluto Temp Spoofer.exe
Size 190.9MB
Sample260730-3b2p5sstdt
SHA256 ac7e1c55a2bb1cc3b41c1ce2b5c6c510e2c4d474088e95e1a49b4d690d54c4bd
MD5 ea8dec43d9fb8ca4b6752e7dc63c7b3a
SHA1 29842162a12af99a4ec9cfd79d0a33fe040f5304
SHA512 65abc810f623eb7c404cc7b57c7e13de91a07bfce7ee1080028ed221716f86aff2f139d4397cd58923a86264bbbb670a4203d5195b6c18cf6d1b9aef39def03c
SSDEEP 3145728:H1Q3zLQ/rD5cDxZMkJ8zXEy2/JftdRo/yWUju1Q3zLQ/rD5cDxZMkJ8zXEy2I:2jk8z8Ay4PdRo/yWQdjk8z8AyB
TLSH
T1AFA833544EA419D5EB81CB788786E157C3F6F54DEF0CCDEB920247FA4F0E9A052B0A62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	Pluto Temp Spoofer.exe

Executes dropped EXE 7 IoCs

pid	Process
2668	lcb_spoof_crack.exe
1000	lcb_spoof_crack.exe
3764	icsys.icn.exe
3768	explorer.exe
3976	spoolsv.exe
4436	svchost.exe
2880	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	lcb_spoof_crack.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lcb_spoof_crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings	Pluto Temp Spoofer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3768	explorer.exe
4436	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4216	wmplayer.exe
Token: SeCreatePagefilePrivilege	4216	wmplayer.exe
Token: SeShutdownPrivilege	4212	unregmp2.exe
Token: SeCreatePagefilePrivilege	4212	unregmp2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4216	wmplayer.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
2668	lcb_spoof_crack.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3768	explorer.exe
3768	explorer.exe
3768	explorer.exe
3976	spoolsv.exe
3976	spoolsv.exe
3976	spoolsv.exe
4436	svchost.exe
4436	svchost.exe
4436	svchost.exe
2880	spoolsv.exe
2880	spoolsv.exe
2880	spoolsv.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 2168	908	Pluto Temp Spoofer.exe	82
PID 4216 wrote to memory of 3552	4216	wmplayer.exe	85
PID 3552 wrote to memory of 4212	3552	unregmp2.exe	86
PID 908 wrote to memory of 2668	908	Pluto Temp Spoofer.exe	89
PID 2668 wrote to memory of 1000	2668	lcb_spoof_crack.exe	92
PID 2668 wrote to memory of 3764	2668	lcb_spoof_crack.exe	93
PID 3764 wrote to memory of 3768	3764	icsys.icn.exe	94
PID 3768 wrote to memory of 3976	3768	explorer.exe	95
PID 3976 wrote to memory of 4436	3976	spoolsv.exe	96
PID 4436 wrote to memory of 2880	4436	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\Pluto Temp Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Pluto Temp Spoofer.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\Pluto Temp Spoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\Pluto Temp Spoofer.exe"
  2⤵
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack.exe
  "C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - \??\c:\users\admin\appdata\local\temp\lcb_spoof_crack.exe
    c:\users\admin\appdata\local\temp\lcb_spoof_crack.exe
    3⤵
    - Executes dropped EXE
    PID:1000
- - C:\Windows\Resources\Themes\icsys.icn.exe
    C:\Windows\Resources\Themes\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Modifies visibility of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3768
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3976
      - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        6⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2880

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 9ac7abee770f335d0392a2b578e37226e3ed9366bbb0a631c4f0dd1200ffcb2f
MD5 93ba8c6f7b32549a8b98488a897dfb23
SHA1 afe63bc4b118cd4732e948a33b7239ac6507ab99
SHA512 751e1c5aa2607b96fe52e65d0bed062283d8da43de5e581f92b05d5980d89fc3c55e014c0ecbdc501102ef9276e3485de9fab0c85c9fdf41e27c57c2cf036d7a
SSDEEP 6:ZltA+1E3+e9XplsklxIlzUWA8uI10cAe:T1E3+e9XwklOlzUd8X0
TLSH
T19D538C00E2204123C820837BE4DA0B47B324A0260909AF0B502962380C031E728A00A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 8df13b2768e19e052fee43784f08ea898f9a3fc3e005375300f92ff209cd5c9a
MD5 650d616701718fe71f9c304bd75eafa1
SHA1 4f880c17a9ae4f5a16333b46259d6e6ce998acd4
SHA512 643ceda8e20b9208442dbb2b7b4f5a458716a684a0b2c71bbcad5408b17d3dc0c45029d24c368ad3a2633680d0ce9f3d7cccc1f507d6b3f93e8cb7fbe55f105f
SSDEEP 768:X0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbam:5ZP2tFP3vqY8YqEMKTaBacg
TLSH
T198257337D190B0C5CE2C7171E9ED8F09BA23B10B11A052465FF8A57A7A633D98D1B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcb_spoof_crack.exe

Path C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack.exe
Size 7.7MB
SHA256 c18160d02ee53d22242a534ba6a419baeb05d8193358110fae682dc408bd824c
MD5 6d2a43f7968244ed116f8a83a9021339
SHA1 adbc6f5a4ed8db905364ff2f0a9d747dfe6ba66b
SHA512 7492a756e2782b5aade62b4867ebfa5e6f4ca0df3b15be082e4c97b9db2489b15eb8fc5e2856ca353d1b7a73cfe72c30f70e142fb9644b05a8024dcffd317511
SSDEEP 196608:BkbgJsau4PqC1qLAgz27O7PNYODgH0ZW0dTqnc52b:WbgFu4PqC1qLAgh71rzZJ2ncC
TLSH
T15286E046A3E101F8D5B38238D45A431BF7B1741907719BCF32D44A522F63AE2AE7E729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcb_spoof_crack.exe

Path C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack.exe
Size 7.6MB
SHA256 c38ce83359b11c63b187f1fe5d3c3a8ef2eac3377d67eada3299758f24d33cc5
MD5 c5c7253e68ea5d96ad86b7a99c465386
SHA1 1f6197326f53c231929f90b01d0afae65ae75c6d
SHA512 bf4221643f50ea2b9a3fd84e7c49219178f4e6d63b8f9e6505b512277534df945d7f0527d793981e37440abffdd78d93d04ac6a69532a64dea94a4e7e54355c9
SSDEEP 196608:BkbgJsau4PqC1qLAgz27O7PNYODgH0ZW0dTqnc52:WbgFu4PqC1qLAgh71rzZJ2nc
TLSH
T1F086E146A3E101F8D5B78238D45A031BE7B1741907319BCF27D44A522F63EE2AE7E729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 f7b0308911abb97ec66b9b853f5f55def69cf711f097704142ce257f754e3c4d
MD5 0d3c072dab68eefc259a00160e7189d6
SHA1 2d119f67f014f472912362ca5f701b7fda1fca66
SHA512 c27932d226e1b0cafbb257d22d5cec6506715b04057f8903168037ba66990e80fc78447dd92cab871756da7c8c7924c2909f30fcf43831572824d080986702ee
TLSH
T1C6212C570A8DA8B1CAA103F31DDC8A2573B7C7CE47A4D496B28DD43E4C0216D6B3E56D
MD5 SHA1 SHA512 TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 c50fbd0f2dee8afc7c0688a1edd78dd3cd2189da740fc6f579083f0975620892
MD5 00d47023e1bcc55683e5331e0053c042
SHA1 743024cd272620435fa3d36782167c3f15ea39cd
SHA512 28008d9d132bd949302cfff19ddd816c392d26adbd6fb658823faf13c3d49ed0ca75789c6c1a0d535f40409c10c9927c14b9d3ac8ded240c3a6edbb954e0ffc4
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVX3:UVqoCl/YgjxEufVU0TbTyDDalR3
TLSH
T18FD3E823BE5064AFD85286F02CA5DA7DB6664E351FE1DC077292BB0127B568372F130B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 f3166d575472c82f10b4712a3ec751b9e22271261b332d3ad8887407f8b05501
MD5 6a6b6d2f5f95d868dbe654d9b031e8c8
SHA1 cc6e12bc485aa306bd0b9fee8949de1acf647e13
SHA512 9fa8ec9372e62a0710f2447c31ba4c805284dec790c16d20b3052638597644493f61c9746cca0a54230eb7d9e707f5c8f7da01da7c224e812767060cbaaaac08
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXF:UVqoCl/YgjxEufVU0TbTyDDalRF
TLSH
T1DED32A237E90443BC42187F168B5EB6DF9266E3607E0AD177292BB0175B668376F120F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 e4230ae5238aa3c7c03c99515a88b145bbe6e3ad28e6175609dde10ece72903f
MD5 6d51369ae4c00af048ac58e87bdcc3d2
SHA1 13dfe7758a1e224066e9caa544df3f18a2cccd45
SHA512 132a7b4caf43ccc1e2dbd9b8b124113eb141e968b1f14a479c68ac9bf9fd63d895f31426f65961790e77f6f3fe36bf9b21bda19e9676c5e96318e03b52ac519f
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXmwwwwwwwwwwwwv:UVqoCl/YgjxEufVU0TbTyDDalR2
TLSH
T1FDD3F727BE20502ED8118DF63879EA3EB9655E361FA2AD077252BB1135B5143B2F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 b28c09db267eb466e981a9bdcf53bb72279faad6cab8b1ee075f035a91eb3642
MD5 f26c20973fbe4c0b057e77f2bfcb5f77
SHA1 0510e202b31c0f39b8ce4bf22b56259717c48c7b
SHA512 ed75ab40ad2326c9d26916fd2d60f26cf3d980eb7e68b7781451a0d35c3d1bafdf36d31a51865b5af05d4dd848ae7c0caf4fe3503114150a3aff426c4de4577e
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVX5:UVqoCl/YgjxEufVU0TbTyDDalR5
TLSH
T16FD33937BE45642ED85285F128A0FBAABD161F351BA1AC4733A6F72538B110779F120F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2668-57-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2668-86-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2880-110-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3764-112-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3764-77-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3768-114-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3976-111-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4216-62-0x0000000007A10000-0x0000000007A20000-memory.dmp

Download

memory/4216-69-0x0000000007A10000-0x0000000007A20000-memory.dmp

Download

memory/4216-68-0x0000000007A10000-0x0000000007A20000-memory.dmp

Download

memory/4216-63-0x0000000007A10000-0x0000000007A20000-memory.dmp

Download

memory/4216-64-0x0000000007A10000-0x0000000007A20000-memory.dmp

Download

memory/4216-65-0x0000000007A10000-0x0000000007A20000-memory.dmp

Download

memory/4436-115-0x0000000000400000-0x000000000041F000-memory.dmp

Download