Overview

overview

8

Static

static

3

kul.zip

windows11-ltsc_2024-x64

8

Resubmissions

04/08/2026, 21:50

260804-1p1nwsyxgy

04/08/2026, 21:05

260804-zxmxbsek5x8

04/08/2026, 20:44

260804-zjhqfsxyfs8

04/08/2026, 07:32

260804-jc2a8aak5v8

04/08/2026, 06:26

260804-g7g5qashqe8

04/08/2026, 05:59

260804-gprw7sxtbx8

04/08/2026, 05:12

260804-fvv1dawvhx8

04/08/2026, 04:41

260804-fa43jsv1aw8

04/08/2026, 04:22

260804-ezapkavygw7

Analysis

  • user interaction
    yes
  • max time kernel
    942s
  • max time network
    938s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 04:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kul.zip
  • Size 64.3MB
  • Sample260804-fa43jsv1aw
  • SHA256 50940d288c3208a33c1fbad7f122cd8d0671d08603d06598370adc8cc552de2f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionexploitpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 29 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\kul.zip
    1⤵
      PID:5724
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:248
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "expand-Archive -Path kul.zip -DestinationPath extracted
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2736
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\shutdown.exe
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:1904
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\shutdown.exe /deny Everyone:RX
        2⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4404
      • C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
        j\bin\java.exe -version
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        PID:2304
      • C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
        j\bin\java.exe -jar gang.jar
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5764
        • C:\Windows\System32\Wbem\wmic.exe
          wmic path win32_VideoController get name
          3⤵
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4708
        • C:\Windows\SYSTEM32\tasklist.exe
          tasklist.exe
          3⤵
          • Discovers running processes
          PID:3968
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
          3⤵
            PID:4892
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\microm\j\bin\javax.exe\" -jar \"C:\Users\Admin\AppData\Local\microm\gang.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4540
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\microm\j\bin\javax.exe\" -jar \"C:\Users\Admin\AppData\Local\microm\gang.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2688
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c start cmd
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4356
            • C:\Windows\system32\cmd.exe
              cmd
              4⤵
                PID:5812
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('what you doing hunny')"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5880
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:2080
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2276
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Drops desktop.ini file(s)
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2532
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /0
                3⤵
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:6132
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4832
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4496
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:4572
            • C:\Windows\System32\SecurityHealthHost.exe
              \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
              1⤵
                PID:5360
              • C:\Windows\system32\AUDIODG.EXE
                C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x0000000000000508
                1⤵
                  PID:1772

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Windows Command Shell

                      1
                      T1059.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      File and Directory Permissions Modification

                      1
                      T1222

                      Modify Registry

                      2
                      T1112

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Peripheral Device Discovery

                      2
                      T1120

                      Process Discovery

                      1
                      T1057

                      Query Registry

                      4
                      T1012

                      System Information Discovery

                      4
                      T1082

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 599B
                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_0vwyyg4s.u1k.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0vwyyg4s.u1k.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      gang.jar
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\gang.jar
                      • Size 23.4MB
                      • SHA256 98e7afec05dd1bde9286c3154bab1046a0562aaacaec6d67f2574efc4200b91a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VCRUNTIME140.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\VCRUNTIME140.dll
                      • Size 117KB
                      • SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      java.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.dll
                      • Size 144KB
                      • SHA256 67da6582a0f84242e05d0ed4b8fb4ff81ca96e45e3ade6573b7e3a23c1fa148b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      java.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
                      • Size 49KB
                      • SHA256 b3afe83e1ab067da4c56f1a7b2ba4c14ec832d694333f35b2b45178e9ac596ef
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jimage.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\jimage.dll
                      • Size 33KB
                      • SHA256 825f26dc5f32773722fc68565ecba76abd7928487a08c3403fdd2e0689f0bb51
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jli.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\jli.dll
                      • Size 87KB
                      • SHA256 8a838a176148e7651aa041c1f1f704176030de3f7dfd3cfbcc8fe0e6f148ce4c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jsvml.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\jsvml.dll
                      • Size 849KB
                      • SHA256 3b99eb724cbbc35da1c158cc68d94b65095eaa4c772d9a1ce86678c9f07cfb72
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      msvcp140.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\msvcp140.dll
                      • Size 561KB
                      • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      classes.jsa
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\server\classes.jsa
                      • Size 10.6MB
                      • SHA256 b1a653c410f6cba64fa236613714b6d487407ae19b1816ecfa39056da72811cd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jvm.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\server\jvm.dll
                      • Size 12.1MB
                      • SHA256 89c64a12328b82bbacdeafd0cbcabf175aeed0581f99fe0f737ddbd962c25fd4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcruntime140_1.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\vcruntime140_1.dll
                      • Size 48KB
                      • SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ADDITIONAL_LICENSE_INFO
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\legal\java.desktop\ADDITIONAL_LICENSE_INFO
                      • Size 49B
                      • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
                      • MD5 SHA1 SHA512
                      Submit Download

                      ASSEMBLY_EXCEPTION
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\legal\java.desktop\ASSEMBLY_EXCEPTION
                      • Size 44B
                      • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
                      • MD5 SHA1 SHA512
                      Submit Download

                      LICENSE
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\legal\java.desktop\LICENSE
                      • Size 33B
                      • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                      • MD5 SHA1 SHA512
                      Submit Download

                      jvm.cfg
                      • Path C:\Users\Admin\AppData\Local\Temp\extracted\j\lib\jvm.cfg
                      • Size 29B
                      • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
                      • MD5 SHA1 SHA512
                      Submit Download

                      ssc9665680815472540533.jpg
                      • Path C:\Users\Admin\AppData\Local\Temp\ssc9665680815472540533.jpg
                      • Size 140KB
                      • SHA256 60d52b3d84cd23af7fda63aaf15df44019a58fe17256bc915b2a3c74f5380695
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CheckpointReceive.bmp
                      • Path C:\Users\Admin\Desktop\CheckpointReceive.bmp
                      • Size 373KB
                      • SHA256 18927c4a8d09c343466e90b6be65e8feb7e61779707bdb795a201882450196ca
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CompressUpdate.xla
                      • Path C:\Users\Admin\Desktop\CompressUpdate.xla
                      • Size 305KB
                      • SHA256 ad03ba91726ad8793c4b6d61f82a95233ea7e14b72cfe1887e732dfb6ffeb6b4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ConfirmDismount.html
                      • Path C:\Users\Admin\Desktop\ConfirmDismount.html
                      • Size 271KB
                      • SHA256 2406e4213f6a07fe5a40b3be9910926b7ec244c6801b05af1816eff02302fedc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ConnectExpand.lnk
                      • Path C:\Users\Admin\Desktop\ConnectExpand.lnk
                      • Size 679KB
                      • SHA256 5db9a3c312768a7bded5b9b39ab3ad630783ca2f3f2bdd4bb5357b1b6562af6d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ConvertFromLimit.emf
                      • Path C:\Users\Admin\Desktop\ConvertFromLimit.emf
                      • Size 254KB
                      • SHA256 dece720dfbad3981fc6748e819e12aa8c3dae3e382b3a6a2e17e658e27e8dab7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CopySave.xht
                      • Path C:\Users\Admin\Desktop\CopySave.xht
                      • Size 933KB
                      • SHA256 2675224644f7fe232bd9521a30c28b9bdd5e7ac3b035999d91731eb8a56441ed
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DebugTest.bmp
                      • Path C:\Users\Admin\Desktop\DebugTest.bmp
                      • Size 322KB
                      • SHA256 96150b7cbb6b27754cac2da343468cb1dcaffccc4e1e65ac0a1a619139b6d72e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DismountOpen.vb
                      • Path C:\Users\Admin\Desktop\DismountOpen.vb
                      • Size 492KB
                      • SHA256 05d543cd2df276b2ef544621a8cbf2b7209c9ffa878188c173d43789f18d1477
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EditLock.ocx
                      • Path C:\Users\Admin\Desktop\EditLock.ocx
                      • Size 526KB
                      • SHA256 9749eb042f31b95107ddc987069850108b7862d20ba267367fb9163f10e09a3c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EnableGrant.bmp
                      • Path C:\Users\Admin\Desktop\EnableGrant.bmp
                      • Size 356KB
                      • SHA256 3bf1987e8ac2b5326315371bf0e7aa54b169e9513e843fb29b6a36c6a18f076f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EnableNew.mpv2
                      • Path C:\Users\Admin\Desktop\EnableNew.mpv2
                      • Size 509KB
                      • SHA256 da5d3a751ab50c3b3d3c79451ebc468f055b2856cd765ceea1f7c443c515057e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GrantSend.ADT
                      • Path C:\Users\Admin\Desktop\GrantSend.ADT
                      • Size 288KB
                      • SHA256 5ec7eef7913cfa5b9c40c7116d84905e502afb8f3e9c50563a285db56d2b2606
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      InstallMove.M2T
                      • Path C:\Users\Admin\Desktop\InstallMove.M2T
                      • Size 475KB
                      • SHA256 b88378bcfcfa1adf7ea24a39b223a720010c7a00dd2f5bc7b70ef667ec50d855
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      JoinSuspend.contact
                      • Path C:\Users\Admin\Desktop\JoinSuspend.contact
                      • Size 458KB
                      • SHA256 7a70140c1c2e44ac6495dc11e4bcf4c753c5bc994e2f42854acecad7384bb337
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MergeGrant.docx
                      • Path C:\Users\Admin\Desktop\MergeGrant.docx
                      • Size 424KB
                      • SHA256 42bb231538107b996042cfbfbc3781c3f0500570a1a5873e5bea58ac6193167e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ReadClose.ogg
                      • Path C:\Users\Admin\Desktop\ReadClose.ogg
                      • Size 339KB
                      • SHA256 407fc7188a92be2c12b24f0bf83c6d4ba11a8a4849ca845ab6f37a9e77853204
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      RepairComplete.mpeg3
                      • Path C:\Users\Admin\Desktop\RepairComplete.mpeg3
                      • Size 645KB
                      • SHA256 1223a501d2c5e61465bc1bda810b12ffadcec0278cc78a98a8c61bb3bab108e9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SaveGet.php
                      • Path C:\Users\Admin\Desktop\SaveGet.php
                      • Size 611KB
                      • SHA256 7b098dab79047ee833476c67c85bfed618f5a6bb0d87a41770572b183a37b789
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SearchBlock.pptx
                      • Path C:\Users\Admin\Desktop\SearchBlock.pptx
                      • Size 594KB
                      • SHA256 8596969b0197f16b9d5e0ee59d548e09cb45f56341982c6b347be0e8c9936692
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SelectPop.wvx
                      • Path C:\Users\Admin\Desktop\SelectPop.wvx
                      • Size 390KB
                      • SHA256 9fb5675b64961ad1e0c6c89cde057c01db5a45b41bb7de62f2c88b3389d4851a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SelectRestart.edrwx
                      • Path C:\Users\Admin\Desktop\SelectRestart.edrwx
                      • Size 628KB
                      • SHA256 906a341dd39e3c2ef9864a33f1cd1cbc79d5c1de91e4396b342ccc628b4cb44e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SendSelect.docx
                      • Path C:\Users\Admin\Desktop\SendSelect.docx
                      • Size 15KB
                      • SHA256 aa2ac03c4642bb435fae0b176b4709dde3c55dd7d82871f81e1fa344de6b26ee
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SplitInstall.xla
                      • Path C:\Users\Admin\Desktop\SplitInstall.xla
                      • Size 662KB
                      • SHA256 b338c28bc00e003eb7327c0d22d535e4d75ec1c2908713423cb4c3bdb57b0c95
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SubmitInitialize.jpeg
                      • Path C:\Users\Admin\Desktop\SubmitInitialize.jpeg
                      • Size 577KB
                      • SHA256 bbd5edd41d053d70fe08182c849c67ef02b5e890ff105d25dca3ad36fd4ec2bc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SubmitRename.vdw
                      • Path C:\Users\Admin\Desktop\SubmitRename.vdw
                      • Size 543KB
                      • SHA256 f501bf600b5c5afb96355b3899db620bef6f202212bb6f38db12b441a0cc7708
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SyncMount.mpv2
                      • Path C:\Users\Admin\Desktop\SyncMount.mpv2
                      • Size 560KB
                      • SHA256 8fc2ca96cb02746f6736cf95292da47aaea851ab85b337a7585f382235e0994a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UndoResolve.rar
                      • Path C:\Users\Admin\Desktop\UndoResolve.rar
                      • Size 237KB
                      • SHA256 400ad55c7bbde5e6136c7d1c96421fa1fa05eabdce85f219ec3df75dd8b4c621
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UnprotectBackup.potx
                      • Path C:\Users\Admin\Desktop\UnprotectBackup.potx
                      • Size 441KB
                      • SHA256 c68ba57261ed620e737e0c7550674b1d5e03d0a8fa96d0262c9f319c4b69a8fb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WatchUse.aifc
                      • Path C:\Users\Admin\Desktop\WatchUse.aifc
                      • Size 407KB
                      • SHA256 343d0ff292cea4eb6d1343a4926e8ed30682991f121dd12ce44d378a82404461
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Acrobat Reader DC.lnk
                      • Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
                      • Size 2KB
                      • SHA256 5b1bc9eaae5774d890a698df55a88ba74a1578ffa32896a40a63956cd04e1c49
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Firefox.lnk
                      • Path C:\Users\Public\Desktop\Firefox.lnk
                      • Size 1KB
                      • SHA256 a688909527f66e9ba1d910c40f9f88de806c8db7c0a3fddf6ab38cef13fbb1e3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Google Chrome.lnk
                      • Path C:\Users\Public\Desktop\Google Chrome.lnk
                      • Size 2KB
                      • SHA256 8c88495948f271a83d83552b3cefffa20040ad1f2723cfd3325b654a14eda1e3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      VLC media player.lnk
                      • Path C:\Users\Public\Desktop\VLC media player.lnk
                      • Size 923B
                      • SHA256 a478f0435ff520c41c7b771059953c617738828cd67fa7fd5b67f775d2ef7af0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/2736-13-0x000001EE4A790000-0x000001EE4A7AE000-memory.dmp
                      Download

                      memory/2736-7-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-262-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-237-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-294-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-33-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-297-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-26-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-23-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-21-0x000001EE4A790000-0x000001EE4A7A2000-memory.dmp
                      Download

                      memory/2736-22-0x000001EE4A4D0000-0x000001EE4A4DA000-memory.dmp
                      Download

                      memory/2736-20-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-667-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-19-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-18-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-17-0x000001EE4A4D0000-0x000001EE4A4DA000-memory.dmp
                      Download

                      memory/2736-0-0x00007FFD167EF000-0x00007FFD167F0000-memory.dmp
                      Download

                      memory/2736-16-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-15-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-14-0x000001EE4A7B0000-0x000001EE4A862000-memory.dmp
                      Download

                      memory/2736-10-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-9-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-8-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-269-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-4-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-3-0x000001EE4A500000-0x000001EE4A522000-memory.dmp
                      Download

                      memory/2736-5-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/2736-6-0x00007FFD16660000-0x00007FFD17004000-memory.dmp
                      Download

                      memory/4832-756-0x0000019301EC0000-0x0000019301FC0000-memory.dmp
                      Download

                      memory/4832-754-0x0000019301A80000-0x0000019301AA0000-memory.dmp
                      Download

                      memory/4832-742-0x00000193001E0000-0x00000193002E0000-memory.dmp
                      Download

                      memory/4832-774-0x0000019301CC0000-0x0000019301CE0000-memory.dmp
                      Download

                      memory/4832-744-0x00000193001E0000-0x00000193002E0000-memory.dmp
                      Download

                      memory/4832-788-0x0000019314260000-0x0000019314280000-memory.dmp
                      Download

                      memory/4832-743-0x00000193001E0000-0x00000193002E0000-memory.dmp
                      Download

                      memory/5764-1095-0x00007FFD17BB0000-0x00007FFD17CA5000-memory.dmp
                      Download

                      memory/5880-1217-0x00000239C7AE0000-0x00000239C7BAD000-memory.dmp
                      Download

                      memory/5880-1204-0x00000239E0840000-0x00000239E08EA000-memory.dmp
                      Download

                      memory/6132-931-0x000001DBBD030000-0x000001DBBD031000-memory.dmp
                      Download

                      memory/6132-936-0x000001DBBD030000-0x000001DBBD031000-memory.dmp
                      Download

                      memory/6132-939-0x000001DBBD030000-0x000001DBBD031000-memory.dmp
                      Download

                      memory/6132-935-0x000001DBBD030000-0x000001DBBD031000-memory.dmp
                      Download

                      memory/6132-937-0x000001DBBD030000-0x000001DBBD031000-memory.dmp
                      Download

                      memory/6132-938-0x000001DBBD030000-0x000001DBBD031000-memory.dmp
                      Download

                      memory/6132-940-0x000001DBBD030000-0x000001DBBD031000-memory.dmp
                      Download

                      memory/6132-929-0x000001DBBD030000-0x000001DBBD031000-memory.dmp
                      Download