71093c605425ab52f87e722a4885ac0baeb3d01a469ec7c9c9271ce46fb4d36e

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_083d4a3a112e57f7aaaad60adf55df97_elex_wannacry.exe
Size 4.8MB
Sample260802-d85evsswg1
SHA256 71093c605425ab52f87e722a4885ac0baeb3d01a469ec7c9c9271ce46fb4d36e
MD5 083d4a3a112e57f7aaaad60adf55df97
SHA1 d0d46c02671ea2486ed2c5f410344a1706bf0f85
SHA512 891bd9d890c9520193981944ead5c90b651efa0c6b1a0cd8471e560335846574f79cba62572db5c62bfb55094a0ba91ec996ebccf7eb79baf175379fccaa7d9a
SSDEEP 98304:6SrDO+hHUNkQ31QNpn4iEOcPoAsYePROszczZU0bmyknyyCMAB:lXzi5k4i8PuYePoszczZU0blnyCMa
TLSH
T15A3633F011129BA0C257B134D8A32A30E1D49F7FAD68927F98D4AECA73775C2A4245F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence privilege_escalation stealer

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 15 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1BFC932ABDFB83F6\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe"	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1BFC932ABDFB83F6\KEX_StrongVersionSpoof = "0"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1BFC932ABDFB83F6\VerifierDlls = "kexdll.dll"	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}\GlobalFlag = "256"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\UseFilter = "1"	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1BFC932ABDFB83F6\GlobalFlag = "256"	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1BFC932ABDFB83F6\VerifierFlags = "2147483648"	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}\VerifierFlags = "2147483648"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}\VerifierDlls = "KexDll.dll"	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1BFC932ABDFB83F6\KEX_DisableForChild = "0"	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1BFC932ABDFB83F6\KEX_DisableAppSpecific = "0"	KexSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1BFC932ABDFB83F6\KEX_WinVerSpoof = "0"	KexSetup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1BFC932ABDFB83F6	KexSetup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
1096	KexSetup.exe
3172	KexSetup.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\KexShlEx Property Page	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\KexShlEx Property Page\ = "{9AACA888-A5F5-4C01-852E-8A2005C1D45F}"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\KexShlEx Property Page	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\KexShlEx Property Page\ = "{9AACA888-A5F5-4C01-852E-8A2005C1D45F}"	KexSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VxKex NEXT\desktop.ini	KexSetup.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}\ = "VxKex CPIW Version Check Bypass"	KexSetup.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}\ = "VxKex CPIW Version Check Bypass"	KexSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_083d4a3a112e57f7aaaad60adf55df97_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KexSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KexSetup.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vxlfile\DefaultIcon\ = "C:\\Program Files\\VxKex\\VxlView.exe,1"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AACA888-A5F5-4C01-852E-8A2005C1D45F}	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}\InProcServer32\ = "C:\\Program Files\\VxKex\\CpiwBypa.dll"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9AACA888-A5F5-4C01-852E-8A2005C1D45F}\InProcServer32\ = "C:\\Program Files\\VxKex\\KexShlEx.dll"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}\InProcServer32\ThreadingModel = "Apartment"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}\InProcServer32\ = "C:\\Program Files\\VxKex\\CpiwBp32.dll"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9AACA888-A5F5-4C01-852E-8A2005C1D45F}\InProcServer32	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AACA888-A5F5-4C01-852E-8A2005C1D45F}\InProcServer32\ThreadingModel = "Apartment"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vxl\ = "vxlfile"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vxlfile\shell\open	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AACA888-A5F5-4C01-852E-8A2005C1D45F}\InProcServer32	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AACA888-A5F5-4C01-852E-8A2005C1D45F}\InProcServer32\ = "C:\\Program Files\\VxKex\\KexShl32.dll"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vxlfile	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vxlfile\shell\open\command\ = "\"C:\\Program Files\\VxKex\\VxlView.exe\" \"%1\""	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\KexShlEx Property Page	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\KexShlEx Property Page	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\PropertySheetHandlers\KexShlEx Property Page	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vxl	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vxlfile\ = "VxLog File"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9AACA888-A5F5-4C01-852E-8A2005C1D45F}	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9AACA888-A5F5-4C01-852E-8A2005C1D45F}\InProcServer32	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\KexShlEx Property Page\ = "{9AACA888-A5F5-4C01-852E-8A2005C1D45F}"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\PropertySheetHandlers\KexShlEx Property Page\ = "{9AACA888-A5F5-4C01-852E-8A2005C1D45F}"	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}\InProcServer32\ThreadingModel = "Apartment"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vxlfile\shell	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9AACA888-A5F5-4C01-852E-8A2005C1D45F}\InProcServer32\ThreadingModel = "Apartment"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}\InProcServer32	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}\InProcServer32	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7EF224FC-1840-433C-9BCB-2951DE71DDBD}\InProcServer32	KexSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\KexShlEx Property Page\ = "{9AACA888-A5F5-4C01-852E-8A2005C1D45F}"	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vxlfile\shell\open\command	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vxlfile\DefaultIcon	KexSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	KexSetup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	KexSetup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1096	2152	2026-08-02_083d4a3a112e57f7aaaad60adf55df97_elex_wannacry.exe	89
PID 1096 wrote to memory of 3172	1096	KexSetup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_083d4a3a112e57f7aaaad60adf55df97_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_083d4a3a112e57f7aaaad60adf55df97_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\7z95DB8868\KexSetup.exe
  C:\Users\Admin\AppData\Local\Temp\7z95DB8868\KexSetup.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Users\Admin\AppData\Local\Temp\7z95DB8868\KexSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\7z95DB8868\KexSetup.exe" /SILENTUNATTEND /HWND:262574 /KEXDIR:"C:\Program Files\VxKex"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops desktop.ini file(s)
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CpiwBypa.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core32\CpiwBypa.dll
Size 7KB
SHA256 b440a7e1d2e2251aeed74db5b67b9c27ef72068fae42c67491f4d344b6886162
MD5 1dae43f4ea0e3e16fc09e8ae1a80af35
SHA1 428ccc68dc57672c291320f9b38eaf24bba76854
SHA512 5f0732656815f9cbfe5bbdf91d3d4ff6f0326bd407ad14ad0fd38cd7fd762d8e58fc477648244db9e205b6c4fcdfc23f2c15f32c28fe3aa4d57c6e04add10c50
SSDEEP 96:27+3SBfhW6jcTO1FTETbImaa3oQTJAg2gg/aplGde7xuQenmj7HcGD:n04TO7E6a35JAg2gg47OmncG
TLSH
T1F9E10A32FBD022B6D3A21F73DCAA3BA2186DF960367189CD53D940093811841A95CE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KexDll.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core32\KexDll.dll
Size 237KB
SHA256 c2ff2f0c4d7189c72911f205b1f27b1e2bc047283a5f28f1a605456b8016fcf3
MD5 d6c867584899da68de1dc0d893a6a9fc
SHA1 a46e6ec07c010d90bfee64b02533430b466f744d
SHA512 20429276f18c57e1f83181bbca9dc52a7adc200434195ffd9414b1e4ed504e71f0bad8510b6bb42dab644f6a6a1d238653ad733ca062c8bf509538e271c1ec4b
SSDEEP 3072:jDdS0dqclMzHOmlY9ZPmRwhHmQoTkMKG+SSuIoNY/7I:jxS0/D8iZewBSW/
TLSH
T16534DB1076ED202EF9677AB14FDED79DC32ABDE622B3963E1443310706919117BA3A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KexShlEx.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core32\KexShlEx.dll
Size 29KB
SHA256 edfd751db15d353d98720221f648fe626d2f108c4a00b68e4516b000dcb3e994
MD5 5b1261aa6af9b0a06d516dc5b68c7a04
SHA1 65547c836a95c5b02833b9bef2908eac59413e8b
SHA512 ff5bfdaed7266c0038d78a16a9387f29bd315340cc8c495b655f5be1d765be2c527cf7f30e26451004daf782fe2b31a36ecc415e85b02e862672de3e6cefa3b9
SSDEEP 384:Dc3rkkLGQevxPAAJ5YBJMqumZ74AFInisU48GYRhR6/sgSxeUauIzJRlF4eXl:DMTLGd4R0mrAix4FqXsfeauIzJRlF4e
TLSH
T1EAD20852A7FA6693F3F33B31BD747A615E3EBD202831C64D9786064E5831A41D928B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CpiwBypa.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core64\CpiwBypa.dll
Size 8KB
SHA256 16347103b8b6eb357f89cfc2181cf24b27f4506294e4a5a745cc8ff924028cfd
MD5 7465f050e97c7330b0f6fa111908a46c
SHA1 f8715fd1aad02ccf1e2e5c5f9e5fdb78b3ce3af7
SHA512 454ac7f6722b7c7e69933a957962ea5c5c42a7bd71b058a2c14fcfbd8bd3393f17aba0e3cabe0bcfb30d7e02260e1be91b39887533c7cb19f8a381259a568a7a
SSDEEP 192:0hRddFgesg5JOcgo+b4w4HZhlenHY8MOEPx3DTlrncG:0bNgesg549o+bR4HZhwDMOEhDxcG
TLSH
T13EF13B46A3F423BDF39B6635C8743601F238B42335811B4D52D465B63F32964E61F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CpiwBypaLdr.exe

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core64\CpiwBypaLdr.exe
Size 10KB
SHA256 094c5b191d4e6dc92cce2f36327773ad3716be7348f966ecc5b56eb830a15d39
MD5 8296d14551ae7086642388d955b17ea1
SHA1 023375174083bd59595254d98b19067251f2b25d
SHA512 ea74391f7b6e0e6081d47552bb504748cf7fddfdda171da7dab3924d2e0a18b04a54ffbe0e8c4e3c9f5aef3ef795b95a6a22728951a1c89e8315c75410e790ed
SSDEEP 192:u5lDvy9swZfNnFsInis4k5nevKedI6cr0yz:uqswnFsInisbFSInr3
TLSH
T1422209046BC3024BF2268B70DAF251C1AAFD79173593337FCBA054292E6664A9582FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KexCfg.exe

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core64\KexCfg.exe
Size 125KB
SHA256 6272005ce23fbf66e1bbbb9cb1cf1b2bb0a90dede2bbf9e9f9bac923cdea8fa9
MD5 0dfb4ec14ab6ba169457cadf5322b5ce
SHA1 f44f4cf8fbf26422b479019aa91c8feb7c0b032b
SHA512 497fefacd950e0e550cbf37512ab29ef18e8f1d000d601ca1cd13bf01edade7de38dd574dd1e34821e9e5004ce20b795b2e125c085ab8903a50bb17b5bc4c881
SSDEEP 3072:ZqRun43BTx+QbNXy/FO3j5ktaoGZtG9tGhuGNvGieG:k043BTwQbNy/FOF8rwcPia
TLSH
T170C34A0167F99258F2F7AB31EEB95A158A36BC956934861F12906E0F2F33710D960F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KexDll.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core64\KexDll.dll
Size 244KB
SHA256 2407192a943ead43ed98611f2efc33a00b7668554add8882debae8781e313fd7
MD5 d06dfd8303808663852e5094926cfb96
SHA1 6cdb8271dc31dcb4bfcbaa4e654672df37aaed89
SHA512 1bd21c5ee0daa645fc12905ac583dadb70085b4ea553514f6f37c3cd034410c230433cbcb3af9ae6ea9324b5278cf7383ab803959564ee6a38924a52c8c21ab5
SSDEEP 3072:vVdMbd21y3O4r76gdUf/hcOmwITksKW+tLKI:vVdxKr7hqpcA
TLSH
T136349A1576ED201AF866B9B1CFDECB9CC326BDF62223877E109361074651911BBB3A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KexShlEx.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core64\KexShlEx.dll
Size 36KB
SHA256 abe5541b0d372ce9c4ce08c989a7944f05e5066fe8ffe7d809f4f75150955e94
MD5 76ccb9f95ec782a45f922aaef41f4cef
SHA1 1c6a29a327215470476237f746f25074deb9b15a
SHA512 dbc3f1a028a8e36c69dfa4e50c7f9e425822458be9a8341b959ec6ddb82933cc0ca3f1cf3e9edb54954c6140973f00a87a4074c9437ad883dbb111666a00494c
SSDEEP 768:Yt52dWjfayxkfLy9/2oEGX88oacqBZmFw2dAiBYlK3MFZnRz6JRlF4e:YjZtxkfLw2oEGwyUBi9LnR+JRlF4e
TLSH
T140F21A0263F95198F2F7EB35DA765B05EA737C496831872D1390895E2F32B50E928B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VxKexLdr.exe

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core64\VxKexLdr.exe
Size 48KB
SHA256 9aa6174d8e49bcbcd50397f1ee76c4fe7a1c6e869e24fc151d38b8f2d9fc7ad9
MD5 64072ff7b954638017f5ad3fc220e236
SHA1 cabb8a106a14013cd35e0028101273d9d6009ba4
SHA512 a7837978b8f3c179605d7a4b002334cb9d82ebf9b3a87a51168e761ab0a898df3b91c605a77e02ecdf368ce0c88fa035ad634bfc8c4aa221f6f2c2da3e902b8b
SSDEEP 768:2DOxdJDX+KXQwu3SivYzoD1Uv5B+RkvTdi6szyhp1uyDgnsfNbREG:kskHrv3DyvL+EU6MkruyDgnsfNbREG
TLSH
T1E4231944F7E1DA89F0F29A30D972DAA888757C29B860472F63907B1F3D733809564B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VxlView.exe

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core64\VxlView.exe
Size 173KB
SHA256 53e6dd4b2517ef730eba52d0800d04cac5b8185fcda7a14bd649cc3382be6e0c
MD5 185b73ba0c0ac0b9480b86bd28ff9dc0
SHA1 6d82387f3d3a7960e0b78a634a69fd2d27508b40
SHA512 2c17380fd5ccd128a46a854077440b92edc6acca6398f2474c26ba877f55cd330b1ab360d51992f7127088b07e8e87d3fa76bcce03f15ba502f724ddeec68f8c
SSDEEP 3072:8c3J5JB1Xqx8+dcF1ajq1HUeK/W90kbGSMh7YSAguD+wi5eJ:8Gb6++dczxsNAMhUSA
TLSH
T159049D45B2D48598E5B19734C833CE914A71BC29DC21AB0F7784FE1F3D72743A91AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Application Compatibility List.docx

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core\Application Compatibility List.docx
Size 20KB
SHA256 387804134bf33b2d583a5fa75fdbe874553adfe9329d3844a686a8fee20aba1a
MD5 082c9773d22cf31258f1b7392221e815
SHA1 39b82a929782657649b486c23b13108664702547
SHA512 b2c3ce6bddaa22efe974974ab01429982d98d4ea43010f14174bd7e940f7d43d19abf0332a27188003f49359bddaa9ffeb9903eb24545306fb238753d7a50766
SSDEEP 384:tAQelTnsSnlFfYSEa+JkMxcxQqcGvArThio5u+kfEqYok:WDblFfYSEa+JHxce12ARiowNw
TLSH
T131A2BF70ED2EE017D19B82F95AB60F9EF63EE4929057C6333D4891D80A138B90F52A4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Changelog.txt

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Core\Changelog.txt
Size 17KB
SHA256 930ecaa64b8c91922fe334f8373c31688aac7e4882eabe0e0d5bd2314d0cab38
MD5 bf4dca01590fd362c833f8d83b5593e0
SHA1 f60a9b20799c183f196d4fea707740762fd30d0f
SHA512 0fa924eec5ba2f703d5789ed6e03289c976b52c224792778ffffaebfbcdff4ceed188e6217e41da54187572e1bdf9db9fa330a0c9acf60b470279fb6ac6fff2a
SSDEEP 384:1hVuTqN+S1gPcNS+9AyLS+gRMzE8MpABcK:ATmukNSeL6D8h
TLSH
T14C721C5627FA5204F6F36F8569B666700A7B7C46A97CCA8C128C104E1FF3A40D960FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxAdvapi.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxAdvapi.dll
Size 54KB
SHA256 ea817482ce287ac4533348e0b41d08e54746cec23859e3b292a8ddf81818cdd3
MD5 38a8eba1b0b19230621bba50961c8451
SHA1 f372d33000dad312584dfcd0a98d9d73ed5a8442
SHA512 46b1a10ca37a005a309155423bd16264f0e8d218670fb0a2efb565715aacf91ab79ac326c442c10ec5d68d91afffc7f48668bf2ac6d994fc7886fe63bf047e6e
SSDEEP 1536:Co1HLhax35JwfT7yOyqqfJxMSCk3rGWmEM:T1rhaU7yrLJxMSCk3rGWmE
TLSH
T1D843F81B754478B5FECD26FDA936933D3A70088C0C5ADB42AAC4E49AD5B0BC9633D9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxBase.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxBase.dll
Size 138KB
SHA256 1ed1771b3fcb0b2554e25ec96f22e14315ab0a13e88e04a2bbc6e57eb86ba91c
MD5 e902e49a9e6c87698eb79151fb0d6f57
SHA1 fa00d78e740acdf90a5bccfe6b11b2b7ad90370d
SHA512 2f6d7dd6385dff581a77fd31d26f77bad2397f2cf2d1a76c89eaf9854e6c14feaf6b952181c066fc7f7715da65c8388f7ee4afdd5b351fcaba967c6223f4050f
SSDEEP 3072:Gr75yg5MNzRs3wUN9q247ehwOZeTXyV1dZf+iLRVXojNs4dMqcaFpYmyMvpuw0lN:wFygv9DPQs4du9jySAaU
TLSH
T166D30A13F6D8F32BF88FEABB6823D0228AA284184536D86457D98B1DF8F7545C1AD351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxCom.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxCom.dll
Size 41KB
SHA256 9e801a853e9623834f77a0416806f73fe281ce2ef70ed94c2bbdb8cd80a1150a
MD5 a3c1cd34167ca7296b28a65ade6cdd81
SHA1 23be72438ba5535d10d3d68d29ed46c74a7b0e09
SHA512 935198eae37d79523e1e2cd2c97518acd91307cacb611a4ca9537dd6e43357c674baf9181ae13bc54ac4f04280dc7f9766ff82296bcff1a0bb76505cfc093b54
SSDEEP 768:PBOf5G2cJZoZZ/yD12b8YfiHnY4M1x8ovuZxlnF+mUX4YWWnOPWM00Da6I:PB451czoZZqD12b8YfiHnY4M1x7unF+z
TLSH
T11713F81276F6386DE96603F48F32F650E6E15CC64861D5391E88CFCF36F9252868A713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxCrt.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxCrt.dll
Size 58KB
SHA256 961248bb792e87dd6c3ef0bf5f89309dcbdec8a13a3f56a05cbc4fb25f3dff20
MD5 8d0182156af11ebb7aa5d4d35de74de1
SHA1 0908be164258ed36a92477f8a3e5d7f2c315c01a
SHA512 7547fe5d671ace26429e1bcd8fb536824dd1a30597a1598d45715409b06bfd189b9404877bb7b36ce527497874ad9b419676f37ab3fddb4d70efa4166448c600
SSDEEP 1536:4AyMmnrHr51F9wyVrx8oKWBXbo49UmGV36M3vM6QMj2ION25aYaQUKaP7di7CCiH:nyLhROKM//Fi5Fq4hroXfp9dme6nIQuK
TLSH
T10E43A2148EBDE417C4CE8333AD22D7B815D709C20DF2F31D4586FADC3589EAAA905A79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxCryp.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxCryp.dll
Size 23KB
SHA256 11d8bea96e5aa932185e31b8d3b8a83363e0e848637c0acd99b12a831d611845
MD5 9a9a66b04adb8cb4dafb5f35b206f325
SHA1 cbed86fce6391d2c2a80e59f07925a0f4da55252
SHA512 9a212b2b58046e0eca3c91a70275f5772fe8dbe75ff30def7b05587eecb0cac534e8aa60eb2007a782e5e317a157a07f00a18d4fb82ebd6df8c49a243e273883
SSDEEP 192:vPRBdIQCdFth4LnTa8XrHppJVSEyzCrcGYnMFzu6oQEHW2orsrf1FTHCqCLtE3m/:vPRbf2aVpSn6cXn7QARFdO9IwljPXR
TLSH
T15CB2B737B8ED1CF1EBCE5ABA6E33D40ECB6C2C68D462DF2C9A040A0B9CD619985155D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxDw.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxDw.dll
Size 4KB
SHA256 85a6094aaee3fdf4375be0a52227927da0b5eb59b0dcfd0a508624ba78749f36
MD5 1df1ddbe3d735b3c86a2316efb04d13c
SHA1 881c0018794ed9d5b991b788915c18f75096616e
SHA512 eebdd6a0a5cf581c046fb0c025665f7096b93098023a7291fd6582427a0b10d31cc89fd092f7276e0903dbd398bc9a867f5c42629df82e4d5dc34a862c79a6c2
TLSH
T10F81202363F9492BF09B1B7357634286627CBF24BBA1831D1D86061E2820267DC71F32
MD5 SHA1 SHA512 TLSH

Submit Download

KxDx.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxDx.dll
Size 29KB
SHA256 367a0f488d765faa8ef67cdb857d228c9cf299438e9a5a8d8d4b3cc2694fa533
MD5 92885e9664ce7c3a093cfc7dc2f69923
SHA1 4aa35ae7560850994f87d313dfa4ad60fa9258e0
SHA512 c79a95251612813a835a8e3b722e622964866e7fec88e44537965c630fc037de1afb85819eebcd60c9a812a99cd0c7592c295c210fea6e44d8ba1757c50a5425
SSDEEP 768:cCtYH2W8zUYuiXE4U852qdEa7we/qihvWOVOqwvIMuZs:8Wd5GqwvIMuZ
TLSH
T1ECD2526963F80D2FF4AB1F30AD7B11609A74F8A66438C69C5F56844D0DAFE848D25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxMi.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxMi.dll
Size 22KB
SHA256 9063f1c5bac6339014f64332e1f60e1978e7cc190011e508b897210afc059f60
MD5 0154e9d58b673925ac1348e2c4193e34
SHA1 7dd2bc312cc8324f9c3813b3f07719aa52ecd7d1
SHA512 0acd96103f4cdab51558f0cd878a2c951e720a0cae7902bb611db67e3c4cddadf6a41243cefa8bf79f817844caf87b6236d393faf8ce44e00dc317f706d5e00e
SSDEEP 384:aVImmhWGabnjxdmcOkBPTxsit5GNZmLcqbt94oNdu/ACKLulBCq:aVI0NbnjxdmcOkBPTxsit1XLuiq
TLSH
T18CA2B692BD9D0AA1FDE5AF3EB8708F1017F336674C119F0838B8AD594532AC5226D793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxNet.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxNet.dll
Size 36KB
SHA256 339a3c361d4262f689e3d2b1b4663b1f61d7a5459d98f36ae64ff678e99b5090
MD5 241eeef848d54163722318f620ef9e68
SHA1 b9bd7dbea6b23247edb666d18dd418fb00d2d1b8
SHA512 27a9bb959f63e37322ce57f9da9ce5a4eb32dd64877841c6c167741b30a5842bbc7084838b69c9948de6e4c55b72ba430ac1f2b4a3219bbdfcf66e9f0d90e14c
SSDEEP 768:u1FS9dxhWrqU4U15+cxKsmvoUSt+nHtATBs:u1Q9bhWtj5gHtATBs
TLSH
T1C9F2A216624DBD1BF865B73568331A924180E6894F399C37CE8E245B7CF263CE12D68F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxNt.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxNt.dll
Size 121KB
SHA256 bb3b78113ccbceee836d55759a219d0d6f6c1fb37a6d0122cb619fc19d69844d
MD5 a8e6526e69649b7c0e7df7b54f868be1
SHA1 f4721a3fdf1d9fa3f5a22b03a845791b0905c718
SHA512 6990182c4efe8602fffbce79b3517b96418f877f6c69279d8c9fa031c43cd0b021e9b06d51d02a4e1add6d5862460232f8240fdb9af127989c42f1dda7c44865
SSDEEP 1536:b1m/FLIBp4L13/AVjoTp5YT/iFQLHtlR/YA5qYcVVSqcS4sa6STVV2FI4QVHWBBr:beeBsGjbBlR/koasR9sMQw14j
TLSH
T1C2C3C66BB5095012F6DE43BE9A710EFD1FF04D0505EF8A315DCE89C84E8F588876B26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxSChanl.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxSChanl.dll
Size 54KB
SHA256 1210b097f61cd72989064e05e72475092aa626d7f4207585a525f54e6fd15ca2
MD5 922ad68d23f3a73145c32c42a021b46b
SHA1 63091b7960474f618657739a5ba8e5d0dee8ee03
SHA512 acef93fc7a2c41bc917e784dc94b5977be61ca1abc38bb6c73fa636e359eaaa2b99d304e2de8fc7b3d694b6ba8f183651a032f12e5f723ca4c1a232f8986a27f
SSDEEP 1536:27+JEujBRV1UUzfJ25BPOrfbhaHtTKlQn3SAJbxw3es84NwXt9e9fwXIMeZU3zvr:27+JEujBRV1UUzfJKB2rfbhaHtTKlQno
TLSH
T1C243E721B3C91431E3F31B70BAB022FF5A6EBDDC095999CE4C67518924E3B518E26366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxUia.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxUia.dll
Size 10KB
SHA256 b1d5107180c2ab249a94dd0bd36f1c87184c35019247778c26e44207c3eb167e
MD5 2c9b38fe06098a3cae12de3511ff4133
SHA1 a351407d593be5dc16001d977cb657d51366fc07
SHA512 2c9f76dbaf3d6b3b582cffeda2b7da6af7c4b77db82feecc7b74d447d8b33ef57e5e486a7902afcd9e303bdc956fa3e7517f2bee1871f98fdd539f4524bc897b
SSDEEP 192:kVPddw67D5DqsjfnRh+CgORObLhpqSl9C+CMF1vVi2kGJ:oTwK7+fvV2m
TLSH
T15822D095B2582DFBCA5F127FFDA56E06FDF809C7F8C6150A62125B78E4139608383136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxUser.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\KxUser.dll
Size 110KB
SHA256 be8eda44a8f16367abf0cc4f5e0f01e5643301ddf74693492e9b91abced9d217
MD5 da3b4504c807b02be935113054ed69be
SHA1 cb353381b3fbe9e1070b2a2d194ed881a2f61136
SHA512 81119438790d2908a59c26970d8095a975fb1e6b9ff3f642671468825b4f1537a831a393dea58a189a68dd9e3a2e6634a0b17eb7662eaf3f7a2f067f37e5b043
SSDEEP 3072:cL/NmNCJVDMZ8AcvejrC5xJ5nsH/vdZQEMX:c/JVDMSrxJ5nsHd
TLSH
T10DB38126F459301DCA9F3274BC21E6FFC59C5804FD2E86245B78B90ABD7617A072D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwrw10.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\dwrw10.dll
Size 2.4MB
SHA256 db6fd9ebe8594d36a71a29fe53c623daf6e3a8439edb6e84942a802094d6fcbf
MD5 6c5038720a0242c4184168cb4f760a40
SHA1 3b5c5b63f2e5b40cb804be823c47cecfdb2c6b99
SHA512 c1b15ad7d3af1b45e13168ba6d311857e1b281c974fd52cf65a9350cf01482402b377e50cd42082b2f7e822e0f187467c7fe18121e61ae7bd080543087649f4c
SSDEEP 24576:4sZxBJAqqRwhbxrykUD8IxSCYW5C/R87pP9TQuW/uIxNpuZ/CBDv8G7lnvtYChjy:nSD53+v8Mm+jfrqIvw+O9umX/
TLSH
T1FAC56B23FA42C8B6D14E0231D80BB73E5B6D6625C721869FAFC4094CE9A17D15F23E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icuuc.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\icuuc.dll
Size 1.1MB
SHA256 7ccf66bd62b9c6ef3af583c558a604a91653eae8bd52646047efef753864f3f8
MD5 40e2d734687daf397d472b70fc305781
SHA1 c842369bc87c33002d58b214506489b882af6db8
SHA512 e99fe429c3c08b36aea2723b90dba3ef85f6f8adeb42dceca7cf7304bc0a13ef51bd64530a3d2000951e91ee7c70b4ff081bc5b096e00f27e500a7d376892d24
SSDEEP 24576:Qwp9Pvh2kkkkK4kXkkkkkkkklvhE6ScXkL2FCgd5UFzZyDn2Mj9YL3oWKsRh3:/FSqkL2B2MBbsRh3
TLSH
T117356D13FE83E037C4EB61B4467F6F25917DC9349F6181C34E989AF1A9A12D026783DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mshtmlmedia.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\mshtmlmedia.dll
Size 1.1MB
SHA256 da79b0569d0ad5b66f1d761490d4b406f591a65f3ba2049a8e9d0ea5c45a48cd
MD5 7c4ffbcf7898e55c3427de56acba0c3e
SHA1 ec3c3ae6bd0ddae2c62086bbe64771e9e78a1517
SHA512 35c3c4e29afa388e3c0a348bef68a314acc53ef8b3a9d26d53c7c6e9394dd6333bc452f8a15e67448e5039ad5a72c33472f87e4cc02e6cc0acc0da60e34afe59
SSDEEP 24576:8jKMlKCOStlXmYUpj/FLY9lru2Xgk41+pdZEhP:V4KCOSthmtdKpgNEpdZEhP
TLSH
T122353B31E78951B8CCA336F4AD2D3628D79D5E64079011C342E1D7E6B835BD32A31AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex32\ucrtbase.dll
Size 1.1MB
SHA256 c8dbd811bb85d7e17d457c7938c15ef39dbde395f82e967387e082f2c9860748
MD5 df160b9471e9ce9aa4efcfe625673310
SHA1 54d14ace2f00a93c28984a577ebb47929d29e3cf
SHA512 956af4328eaa55ca44d3c64aa6463f5e4d771d390afae0db9267df8267bad146177b9d7fdae817ec8aaba49d0bcada3f6d55cfa8bdefa9fa3610fc9c9353cd29
SSDEEP 24576:uWiJOihSAdUDRdwE0OBuE4N7qWkGA+g7lyD6ZQtnmcvIZPoy4c1cF4w+:9iJOihSlDxuNN7qLZyD6yt01c1+
TLSH
T1EE453A093585E0AEDC6D3679136BB522346C76924BB8ECC373840BE98E305D17736EDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxAdvapi.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxAdvapi.dll
Size 55KB
SHA256 c87b2b4d2bf750d0969ac882beeae7363469ca539d5b93056e8e63a780b53327
MD5 f9a746b3c71d16bb59b239454292f693
SHA1 0c1e93e28e275468a22658bc09b0483332a857b9
SHA512 37c898b05c19c0f8b7bce71e6cd1d890f9d6e78ea7084baf9e0bade3514c33df66c901b3d8f3de8fd978eaa3d9adc0837e1ba63ed8dafc3fe300df804ee0d3f6
SSDEEP 1536:XKpDd+ax35JwfT7yOyqSUJxMSCk3rGWAE:atd+aU7yriJxMSCk3rGWAE
TLSH
T1EA43F71BB54464B5FECD26BE9D37833D3A70088C0C5ADB46AAC4E49AD9B4BC9633D5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxBase.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxBase.dll
Size 146KB
SHA256 6fb063c523754e325eda21fe6850c0c2b1cf53858f4662ecd7e4581e6664544e
MD5 ab4d4c4c40b598557eb908bb1ca0a6ad
SHA1 528c9003d9a25d4f0e0052c4d7ddc89a0999bb5b
SHA512 f0073585b278a3d1d6ba0edcb8f4dc5562f1da624c0276709969b32e85032ab6cf9ae149f902466b94fe6fe725e44f559d618146b54b2adcfacf738a1d5d9b5f
SSDEEP 3072:WtOPMRMstShICgzP97ehwOZe1XyV4dC/+iLRVXoyL84dMqcaFpYmyMvLu4MlCGcp:WIP8tSKCg7kN84fu3QySAQU
TLSH
T102E32A03F6D8F36BF88FE6BB6423C02286B254084636996827C58B1EFDF7545C5AE351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxCom.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxCom.dll
Size 49KB
SHA256 3df664d3e735c32c41394dee1e59af72e67687a6b925e36962ac48b0d5da8058
MD5 3ad0fef7d8ac04821af7222d814df905
SHA1 0e5d36791ed6b5d678e6819733a4e48d6e336007
SHA512 206684023544315d983b883276f1e233dda79d066bfda64e7c0837d6641898b7bc812d4d0e6aa461314705d2bfe976d6d88630a570ca59865a202636ec97acc2
SSDEEP 768:/Ce8bfgaWvOZxyOoYezUImdpuX4YWWnOvW90/e3fMBwza:/m7ZWfOzbI8YWWh90/e3fMBSa
TLSH
T1F533D70A61F6646CEC9A42F48E36DB44EAF1ADC28C21D93D25418FCF3EF73624946716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxCrt.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxCrt.dll
Size 54KB
SHA256 503d29d4c71ed5db836ae039a6720c53a370b7248762c68ec4d8d4f33eb51fef
MD5 54ccdccad5f628a11a5b4b3f9c83cb38
SHA1 94e637216a824d3f0aa1793863a4802fd7be98ec
SHA512 4b589e09c88fcb046de0921211e93755a48efeaf49f86e1d921de9b3597a1da5293231238a83dff52f468bca1de717b59e6d6aa98d47bb191033ed96e3583dc6
SSDEEP 1536:RSEIXdhNa5gvTHZIE83Y88PSXe5UVmwuwd6CdvW6QMH8UVAogrjhWgCcAqjAFBKx:RSEQWr4ClbrcTjoehrwUw9dme6nIQhzH
TLSH
T15F4370109E7ED417D9CE8373EC6597B465D704D20CE2F30C4685FADC3449EABA908A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxCryp.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxCryp.dll
Size 26KB
SHA256 e9f1a5100fdd194a38bf5f9f3bfb4e1e64c33d01e122ef419185a9d1dec77089
MD5 920fa140f1e3533fd24818472a49472e
SHA1 cee106dd078389e721e45f8ac6f0faaad5ff900f
SHA512 d4bc83ddf400609085ea0d777abceefc40832f502fadd6e3c43df99dca7e662f74290ed58d198d703cf247102aec68b00af22b59d86083e936ec128f14b254c6
SSDEEP 384:/f2FjXYR3/s5nqVzPLqDLFQXRpdO9IwljWQWRS:3wjwhqfFQndFQWR
TLSH
T101C2EA27A8AC2CF5E7DE4B7EAD33DC0ECF6C78688022CF2D95044A1F9DD628991556D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxDw.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxDw.dll
Size 4KB
SHA256 0b0f2245bf39a74be653ade444bfd21b35b7535429b964943de3c42e827d727e
MD5 25cae9d580e05d8c57ad8779afbd45f5
SHA1 7b980a2a494ba2f2876410cd01bbd9dd97a79529
SHA512 50f131b805747876770c347194c265c0938f82950ccce3a4d8e3770a3dde06f103e8a56c1eca923431e4ab83c956e23f104eec8715570564294ddb0b317d5945
TLSH
T1E381442677F8583AF0DB0B760323824172787E20A7A6C31C1D86415D2822ADF5961F72
MD5 SHA1 SHA512 TLSH

Submit Download

KxDx.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxDx.dll
Size 31KB
SHA256 22544c5f0dab6f0b1fe40c044d710361f8f882c5fbd50c5c8a7938375d5e4ecc
MD5 75af95ebd8afa8dda34d0b0e4caf292e
SHA1 18247115ce406808aebb6b8c5bf49d93f124ee44
SHA512 0d7ea8942a6b2d6783fd906eccee6da12764d679dc5de7cf88d6cf3069e388f7a279af43114a912158d5c095c8f0c87db467132fa2c48428bf3667fa8fbaa974
SSDEEP 768:hnZdaE1hrU4uCXEYU8ZW69U6LCtY8GD7qihvWOViqwvIM0Z:N7B+0DuqwvIM0Z
TLSH
T13FE2836D23F8491BF4AB4F30ED7B0110AAB1F8966538D68C5B52849E0E7FE844D25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxMi.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxMi.dll
Size 23KB
SHA256 74a905bbea38fadbe543274b2df11186bbb2fcef710a73c0d2d31aff243ac8e9
MD5 aea6cd7edb884fe81e73b289a92c2c21
SHA1 1db4573a9d23123580be3c799e96943d4c3d330f
SHA512 5ec3edf316486aef72969fa81de8998f1d55bc3c0211ed3cf643b1b543078557a363bd80ed4fb153cd394ea3a5b9eb330da59b008c695b4cfb2819c7e4b7f7b3
SSDEEP 384:8WQ+lycNC+h2piAmcOkBPTxsitTu0GN7OZmLcqbt94oNdu/ACILvq:pQUJgiAmcOkBPTxsitTwVLvq
TLSH
T12BB2A582BD6D4AA5FCE9EB7DB8708F0027F336674C119F0838B8A9595533AC5222D753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxNet.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxNet.dll
Size 37KB
SHA256 597af12f9ab2f63987afa80e12d50779465c04a0c560c763db8816f1a69b89f6
MD5 b91a8950d5ea1bb40b29b4a96abd85c6
SHA1 95f1f02f9128c9f6fde7386b8ee2db5d03bae189
SHA512 7a6651c26c90572f8a06eed3db41a04096e7cd989b38f981e73520a7f488af1a7560ff6b2fd2aeef82bf8ca2f248069fba38cc552eab7bff213ba6f787bc2bfc
SSDEEP 768:muDjI9buu9azdjg6TS8cU15+cxosmvV0USf+XtA8B:Dfu9azdr9P5IZtA8B
TLSH
T1F7039246224DBD1AF869B735AA330B824190F5494F399C37CE9D245B7CF6638E12C68F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxNt.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxNt.dll
Size 119KB
SHA256 a610575fd8a601e80ab74781e77be2478a6bd0855df2ee35d9c3a4f8cb2db636
MD5 b84c8eeba14968d3488712e7cce33bc4
SHA1 1855b8227661b834b24e2792a58cec6f7a720f31
SHA512 13c4c6075574ed090de8c07499ad9ac0b5f498007b4fecd90e6f3f99c0870bb31ecb0d4bbe21af3e792793fc29720bf26ecdd0cd06a895f4602092ae72ac69aa
SSDEEP 1536:ujT/juWYpk2KRjUTpyYbl4pQXHvlR/UAtqYcTV4qOS4sauSNVV2F+4QVFWBBuUrf:w/rxj8FlR/uoasR9uMFg1Tj
TLSH
T1A5C3C56BB1095012F6DE83BE9A710EFD1FF04D4505EF8A365DCE85C80E8F5888B5B266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxSChanl.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxSChanl.dll
Size 66KB
SHA256 5335683a064292ed97fa669dfb0aa85f8e2fb2b6e94bed02c88fcd69c3d3af78
MD5 0289739244870d853fbf7bc5b73d3f12
SHA1 e8465d02cf7b09d4cec895bef02c1317423034b7
SHA512 8370cfec8b0282a1c846a29e7938081ba42f207d4287146cf76bc9c7e02791355ac9aef40b0b2d9c4942aaa6a678f7eb5148ce1733591a9fb7e02f8b09dad34c
SSDEEP 1536:hWmtnMYAATeyEialM0jWC3nqxf6MhqW2wK5saCBA:h7MOixa3CtWYwB
TLSH
T1E463F5213AD431F2F9BAE170DAB56967BE687C421C25E75F0C4502592F32F019E3A73A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxUia.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxUia.dll
Size 10KB
SHA256 b2af5dfec87c24c452e5cbf9acf1201abd8d9d1c7b1d726684a23800e60e3755
MD5 2a8b07049abd0988ead20ff51a523c7e
SHA1 2cd107dea20e5e75f961c1eddda2d1139256e383
SHA512 65f57f8bd679da9ae0eaa83f3c0faa007615e462b40fdf4f6f9ac48d7ac2882466dc886ba90d488e5f149894d276b5eda129c140047ab7a83b9f78fd52a913bf
SSDEEP 192:kygc8iyw67D5DqsjfnRh+CgOR321bLhpqSlZC+CMF1vVDGJ:ntewK7+xvVDm
TLSH
T11022FE91B2582DEBCA5F527FFDA56E06FDF819C7F8C6150A62129BB8E4135308383136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KxUser.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\KxUser.dll
Size 112KB
SHA256 4c90ff4983461bf32b396f2600675b45ee3cda46d4d567bcae6fff308aa0efc1
MD5 50ed682ea246aa79a05e00497163f77e
SHA1 994471b0d9f6ab2f585c96cc0b552df283c87ffb
SHA512 05cbef5a4e6d3f395c3dca401b50a4d44bfe5aa88ed7c0adbf0332677603fceb782adc4e7e3c4abf5ce530bc788ec391a684e16aa714a3b0f28712ac4de7da36
SSDEEP 3072:t4Q5UtShPzhh3IBjBC5xJ5ncH4BtqQExX:t75UtEhTxJ5ncHA
TLSH
T1B4B38326F418301DCAAF3274BD21E6FFC1AC6404FD1E86241B78B959BD7657A072D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwrw10.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\dwrw10.dll
Size 1.9MB
SHA256 ffec1381d353fcb6107ceb30c7947ea9c6793ca24770193088c4ba8ec7f1b4e6
MD5 a9eae5a352a7fafa418441c53eb6e810
SHA1 a9eda9313fa5fadcb34a27cf34e1a4fb670f5f72
SHA512 c71f2d8b924255d836a320ff69b045bcd493c288b4a24e8e525816f4de3a0369590d48e41a111fa114583e52ed279d55482542c441f5cfe001b91576071cc848
SSDEEP 24576:2Ll5hQwmucc5UHyO3JnIfjX0wG35MeFAzIB2A6klP6OqXO2FAwPE1D8BDGYO2m:29QA+3JnILjm5MEBz6kZ6PFAUI8sIm
TLSH
T193959D07F74945ADD2AAC034C5838A2BE771385BC331A69F3ED10269EE177B25A39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icuuc.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\icuuc.dll
Size 1.3MB
SHA256 5cfd8cb74998cbe70402dd6b137c714931ffb03e4439aa24c1c6c144202402ae
MD5 fb96578635db1cfc08871a599539349e
SHA1 db292004e507eff91322c0c78b9ed2987e7f0e2f
SHA512 4925295b4f2bd6565b6a0496d5754bf1526aa0df39120cdcbc567d1a299a71439b7bdf1f0ab5fc340003ab9d7a6fdd7dc33b791d1f9908eb6143636bcca3225a
SSDEEP 24576:LIuvV581CaFisqzXMmfkPts3xh2kkkkK4kXkkkkkkkkmA3oWk:iEaF16cek1s2
TLSH
T164555B53FB97A076C07ED13CD4B78B0AE2B2BC25AF728AC7059946292E237D4157D390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfdevmgr.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\mfdevmgr.dll
Size 1.3MB
SHA256 e185d05fc1774c4b9661121c49b33bfed5e824062a3749553b69064c982aa29e
MD5 2d2e9e696d872bb98c8ab73ce12f2a70
SHA1 437b14c163993be63f2a94f4c05146d6e6f7ab9a
SHA512 821ab2e89ec9d27b7193956225055ed446b53efdea886b331c63cb10a46267d5fe9143d547c4b2bf47cc92f3c951548b6033725c453b843e953d45850d7c491a
SSDEEP 24576:c0KZZnNdIZe1cbtXhOVOInpXEwxYrygvgBai6aa:lMRNdZ1cbpA1Xjgyeg1y
TLSH
T12A556D56A66C1096E2BBC1B8C5435B09D7F0381D2B518ADF21ACD52A3F13BF29E3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\msvcp_win.dll
Size 621KB
SHA256 2a7825c2925347e0cb767a0dcb611f3eb80d0f71cbec981069b227bdc7cb871a
MD5 ec9f1cdd909f7c0bae4db21dcd2033de
SHA1 4c2a112e048fc75cd4c581836356e881552c9be2
SHA512 924022bb40c542a3ff0d09da35b8156113a83336d57924888d921f070f6192d83fcec6b89bde89957731e55e41118ca2affeb5885541bd345da7857996c22fd5
SSDEEP 12288:KXTCudddboDSf8I+YQtAww7ZQEKZm+jWodEEVM6LZWPn:KXTC/Sf8IdQKQEKZm+jWodEEq6LZWf
TLSH
T1F9D42A26BB4D06B0D166A3BCA1C38706D7F1BC154722A3C7429BE26D1F6B7C56B3B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\Kex64\ucrtbase.dll
Size 1020KB
SHA256 de8d08d01291df93821314176381f3d1ae863e6c5584a7f8ea42f0b94b15ef65
MD5 2c8fe06966d5085a595ffa3c98fe3098
SHA1 e82945e3e63ffef0974d6dd74f2aef2bf6d0a908
SHA512 fb08838983c16082a362b3fc89d5b82e61ae629207c13c3cb76b8a0af557ad95c842ce5197ae458b5af61e5449cbab579f509fa72866308aa6fbd3d751522d0f
SSDEEP 24576:k1foGwlaDT2hOPk+j2ZXCE6ccJEsmxvSZX0ypCDb:kfoBRhOPfXiL/
TLSH
T1CF25AF64FA5C0AA5D57BE17CC95B550ED5B2780207708ACF03EA4BBD2E2BBD91637320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KexSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7z95DB8868\KexSetup.exe
Size 95KB
SHA256 2e07a1dc607be07e39c2445b26220468678f3461aa7e659633ea863c608c5823
MD5 2a0bcd5c2160c306b12103ad55b847c8
SHA1 37f5f16f23f0f2cd0b090856a760b12ed0a77b6f
SHA512 9d56f25c2da2ccdcfa2a2e2bc5a4fa424352d52e3a43c57f467db2ca14edb5921ffed8bf272ba20cff5f021838b557dabed19b90687a4ba1dc4bf6938485ce02
SSDEEP 1536:2/EPJ2XfQj4FoQXxdko2NWoUUELajQKkLajgnYuavpn8yEYAv9NEytLvejGwakhX:CEx2XfQ6Xxdko2NWoUU2ajQKkLajgnh
TLSH
T18593D4527BF90225F2F36F71BEB566715A7BBD629C38CA1E4380060E1976B11C960B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-172-0x0000000000420000-0x000000000043B000-memory.dmp

Download

memory/3172-171-0x0000000000420000-0x000000000043B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads