019494c7258388629c4a8f7973ee2615f5ebfb3140b301ee1b6a9cdd26f9868e

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_c947402bc05855b386a26c4947a94de4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.8MB
Sample260808-c8f7la1xfx
SHA256 019494c7258388629c4a8f7973ee2615f5ebfb3140b301ee1b6a9cdd26f9868e
MD5 c947402bc05855b386a26c4947a94de4
SHA1 1be7d8023cc6829513fb52c214d3681363f6ae91
SHA512 96cca9c3f992e9dcb26688f14466aacfc9e73f58f2e4861599cd28200872ea8346e830119706112ad4905b7ddbabcca7520322008bae8b18a7cd335147a07676
SSDEEP 24576:PCIx2Or9BZEUmZ4bJzsvsgctKeNA7Spl2iKMPbnhSXbM/pQxYV7c:PMO9O0htKQA+eoz/Xm
TLSH
T196957D1BA2B900ECD067C178CA565607EBB2745513346BDF13D08AAA2F23EE55F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5f5-1.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5f5-1.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5f5-1.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5f5-1.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5f5-1.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5f5-1.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5f5-1.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Enumerates VirtualBox registry keys 2 TTPs 17 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	l7xep9cq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	d5tnm7pd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	gnmz5e51.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	qnahh7ib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	pvoutby6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	4o61rsg4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	sys7A85.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	kmncksx6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	mfvx79j4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	oikug9mf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	zknpv4lr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	ur7nt15r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	7fb75xgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	feadi0j7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	qcnpsuzn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	rz4ewvfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	fn1xsq45.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 17 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	sys7A85.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	pvoutby6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	fn1xsq45.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	4o61rsg4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	mfvx79j4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	zknpv4lr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	l7xep9cq.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	kmncksx6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ur7nt15r.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	oikug9mf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	7fb75xgp.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	rz4ewvfh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	feadi0j7.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	d5tnm7pd.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	gnmz5e51.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	qcnpsuzn.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	qnahh7ib.exe

Looks for VMWare Tools registry key 2 TTPs 17 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	4o61rsg4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	mfvx79j4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	feadi0j7.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	d5tnm7pd.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	oikug9mf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	zknpv4lr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	l7xep9cq.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	gnmz5e51.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	qcnpsuzn.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	7fb75xgp.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	qnahh7ib.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	pvoutby6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ur7nt15r.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	sys7A85.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	rz4ewvfh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	kmncksx6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	fn1xsq45.exe

Looks for VMWare services registry key. 1 TTPs 17 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	fn1xsq45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	7fb75xgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	4o61rsg4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	sys7A85.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	qcnpsuzn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	ur7nt15r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	oikug9mf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	feadi0j7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	zknpv4lr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	d5tnm7pd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	mfvx79j4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	l7xep9cq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	gnmz5e51.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	pvoutby6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	rz4ewvfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	kmncksx6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	qnahh7ib.exe

Executes dropped EXE 17 IoCs

pid	Process
3868	sys7A85.tmp
2688	zknpv4lr.exe
296	l7xep9cq.exe
3120	d5tnm7pd.exe
5740	gnmz5e51.exe
2680	qcnpsuzn.exe
5044	qnahh7ib.exe
5204	pvoutby6.exe
4736	rz4ewvfh.exe
972	kmncksx6.exe
3532	ur7nt15r.exe
3124	fn1xsq45.exe
1632	4o61rsg4.exe
2384	mfvx79j4.exe
4276	oikug9mf.exe
2608	7fb75xgp.exe
1384	feadi0j7.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\gyahlm = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\d5tnm7pd.exe"	l7xep9cq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\lq9nd4 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\gnmz5e51.exe"	d5tnm7pd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\ijgno9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\ur7nt15r.exe"	kmncksx6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\45weme = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\4o61rsg4.exe"	fn1xsq45.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\80p8ve = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\7fb75xgp.exe"	oikug9mf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\9h5yua = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\qnahh7ib.exe"	qcnpsuzn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\zox7ir = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\feadi0j7.exe"	7fb75xgp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\heh6l0 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\mfvx79j4.exe"	4o61rsg4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\dpvqaz = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\oikug9mf.exe"	mfvx79j4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\29imxh = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\qcnpsuzn.exe"	gnmz5e51.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\6sri10 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\pvoutby6.exe"	qnahh7ib.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\qota0e = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\rz4ewvfh.exe"	pvoutby6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\blf776 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\kmncksx6.exe"	rz4ewvfh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ecqhc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\zknpv4lr.exe"	sys7A85.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\fago2b = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\l7xep9cq.exe"	zknpv4lr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\phm1cf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\fn1xsq45.exe"	ur7nt15r.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 32 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\sfud_ukb4tpqg\desktop.ini	gnmz5e51.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_ukb4tpqg\desktop.ini	gnmz5e51.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_71bd6tp1\desktop.ini	fn1xsq45.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\desktop.ini	zknpv4lr.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\desktop.ini	zknpv4lr.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_ioxz9w0j\desktop.ini	mfvx79j4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_ioxz9w0j\desktop.ini	mfvx79j4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_vtdw1ngh\desktop.ini	oikug9mf.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_25wwznra\desktop.ini	d5tnm7pd.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_045qtrau\desktop.ini	rz4ewvfh.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_1qfsj4f6\desktop.ini	4o61rsg4.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_drgn2cmq\desktop.ini	7fb75xgp.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_6pzcx8ku\desktop.ini	qnahh7ib.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_vp5bc3jg\desktop.ini	qcnpsuzn.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_6pzcx8ku\desktop.ini	qnahh7ib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_w3uknga3\desktop.ini	pvoutby6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_045qtrau\desktop.ini	rz4ewvfh.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_i1khtl9i\desktop.ini	ur7nt15r.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_drgn2cmq\desktop.ini	7fb75xgp.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\desktop.ini	sys7A85.tmp
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_25wwznra\desktop.ini	d5tnm7pd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_71bd6tp1\desktop.ini	fn1xsq45.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_1qfsj4f6\desktop.ini	4o61rsg4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\desktop.ini	l7xep9cq.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_vp5bc3jg\desktop.ini	qcnpsuzn.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_bcq9o5r5\desktop.ini	kmncksx6.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\desktop.ini	sys7A85.tmp
File created	C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\desktop.ini	l7xep9cq.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_w3uknga3\desktop.ini	pvoutby6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_bcq9o5r5\desktop.ini	kmncksx6.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_i1khtl9i\desktop.ini	ur7nt15r.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_vtdw1ngh\desktop.ini	oikug9mf.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3468	cmd.exe
5776	cmd.exe
1700	cmd.exe
2996	cmd.exe
1356	cmd.exe
4824	cmd.exe
1556	cmd.exe
2992	cmd.exe
1152	cmd.exe
2848	cmd.exe
6100	cmd.exe
4308	cmd.exe
5580	cmd.exe
5968	cmd.exe
3732	cmd.exe
5212	cmd.exe

Enumerates system info in registry 2 TTPs 34 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	gnmz5e51.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	qnahh7ib.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	pvoutby6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	kmncksx6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	fn1xsq45.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	fn1xsq45.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	oikug9mf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	7fb75xgp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	sys7A85.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	l7xep9cq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	kmncksx6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	mfvx79j4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	sys7A85.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	zknpv4lr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	ur7nt15r.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mfvx79j4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	oikug9mf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	gnmz5e51.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	qcnpsuzn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	qnahh7ib.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ur7nt15r.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	7fb75xgp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	zknpv4lr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	d5tnm7pd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	d5tnm7pd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	pvoutby6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	4o61rsg4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	feadi0j7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	feadi0j7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	l7xep9cq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rz4ewvfh.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	qcnpsuzn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rz4ewvfh.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	4o61rsg4.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1132	schtasks.exe
4340	schtasks.exe
2360	schtasks.exe
5728	schtasks.exe
4608	schtasks.exe
5304	schtasks.exe
1788	schtasks.exe
1928	schtasks.exe
2172	schtasks.exe
3732	schtasks.exe
3212	schtasks.exe
3080	schtasks.exe
5908	schtasks.exe
4508	schtasks.exe
2860	schtasks.exe
3376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3868	sys7A85.tmp
3868	sys7A85.tmp
2688	zknpv4lr.exe
2688	zknpv4lr.exe
296	l7xep9cq.exe
296	l7xep9cq.exe
3120	d5tnm7pd.exe
3120	d5tnm7pd.exe
5740	gnmz5e51.exe
5740	gnmz5e51.exe
2680	qcnpsuzn.exe
2680	qcnpsuzn.exe
5044	qnahh7ib.exe
5044	qnahh7ib.exe
5204	pvoutby6.exe
5204	pvoutby6.exe
4736	rz4ewvfh.exe
4736	rz4ewvfh.exe
972	kmncksx6.exe
972	kmncksx6.exe
3532	ur7nt15r.exe
3532	ur7nt15r.exe
3124	fn1xsq45.exe
3124	fn1xsq45.exe
1632	4o61rsg4.exe
1632	4o61rsg4.exe
2384	mfvx79j4.exe
2384	mfvx79j4.exe
4276	oikug9mf.exe
4276	oikug9mf.exe
2608	7fb75xgp.exe
2608	7fb75xgp.exe
1384	feadi0j7.exe
1384	feadi0j7.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 3868	4724	2026-08-08_c947402bc05855b386a26c4947a94de4_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 3868 wrote to memory of 5776	3868	sys7A85.tmp	90
PID 5776 wrote to memory of 3376	5776	cmd.exe	92
PID 2688 wrote to memory of 1356	2688	zknpv4lr.exe	95
PID 1356 wrote to memory of 2172	1356	cmd.exe	97
PID 296 wrote to memory of 4824	296	l7xep9cq.exe	100
PID 4824 wrote to memory of 4508	4824	cmd.exe	102
PID 3120 wrote to memory of 1556	3120	d5tnm7pd.exe	106
PID 1556 wrote to memory of 3732	1556	cmd.exe	108
PID 5740 wrote to memory of 1700	5740	gnmz5e51.exe	111
PID 1700 wrote to memory of 1132	1700	cmd.exe	113
PID 2680 wrote to memory of 2992	2680	qcnpsuzn.exe	116
PID 2992 wrote to memory of 4340	2992	cmd.exe	118
PID 5044 wrote to memory of 2996	5044	qnahh7ib.exe	121
PID 2996 wrote to memory of 3212	2996	cmd.exe	124
PID 5204 wrote to memory of 1152	5204	pvoutby6.exe	126
PID 1152 wrote to memory of 2360	1152	cmd.exe	129
PID 4736 wrote to memory of 5580	4736	rz4ewvfh.exe	131
PID 5580 wrote to memory of 4608	5580	cmd.exe	133
PID 972 wrote to memory of 2848	972	kmncksx6.exe	136
PID 2848 wrote to memory of 5728	2848	cmd.exe	138
PID 3532 wrote to memory of 6100	3532	ur7nt15r.exe	141
PID 6100 wrote to memory of 3080	6100	cmd.exe	143
PID 3124 wrote to memory of 5968	3124	fn1xsq45.exe	146
PID 5968 wrote to memory of 2860	5968	cmd.exe	148
PID 1632 wrote to memory of 3732	1632	4o61rsg4.exe	151
PID 3732 wrote to memory of 5304	3732	cmd.exe	153
PID 2384 wrote to memory of 5212	2384	mfvx79j4.exe	156
PID 5212 wrote to memory of 5908	5212	cmd.exe	158
PID 4276 wrote to memory of 3468	4276	oikug9mf.exe	161
PID 3468 wrote to memory of 1788	3468	cmd.exe	163
PID 2608 wrote to memory of 4308	2608	7fb75xgp.exe	166
PID 4308 wrote to memory of 1928	4308	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_c947402bc05855b386a26c4947a94de4_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c947402bc05855b386a26c4947a94de4_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\sys7A85.tmp
  "C:\Users\Admin\AppData\Local\Temp\sys7A85.tmp"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "3lktzq7r" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zknpv4lr.exe" /f /ru LIMITED
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc onlogon /tn "3lktzq7r" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zknpv4lr.exe" /f /ru LIMITED
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3376

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zknpv4lr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\zknpv4lr.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "zopbbgm0" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\l7xep9cq.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "zopbbgm0" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\l7xep9cq.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2172

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\l7xep9cq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\l7xep9cq.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "1gzfuspk" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d5tnm7pd.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "1gzfuspk" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d5tnm7pd.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4508

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d5tnm7pd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d5tnm7pd.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "5w71he1s" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gnmz5e51.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "5w71he1s" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gnmz5e51.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3732

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gnmz5e51.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gnmz5e51.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "76cegh9j" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qcnpsuzn.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "76cegh9j" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qcnpsuzn.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1132

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qcnpsuzn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qcnpsuzn.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "rvrcq0lw" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qnahh7ib.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "rvrcq0lw" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qnahh7ib.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4340

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qnahh7ib.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qnahh7ib.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "05ynyvoz" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pvoutby6.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "05ynyvoz" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pvoutby6.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3212

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pvoutby6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pvoutby6.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "2awahkcr" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rz4ewvfh.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "2awahkcr" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rz4ewvfh.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rz4ewvfh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rz4ewvfh.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "2sp0jrm6" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\kmncksx6.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "2sp0jrm6" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\kmncksx6.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4608

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\kmncksx6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\kmncksx6.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "8oj3pori" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ur7nt15r.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "8oj3pori" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ur7nt15r.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5728

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ur7nt15r.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ur7nt15r.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "jz663qbp" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fn1xsq45.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "jz663qbp" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fn1xsq45.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3080

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fn1xsq45.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fn1xsq45.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "rdih4iyl" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4o61rsg4.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "rdih4iyl" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4o61rsg4.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2860

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4o61rsg4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4o61rsg4.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "eiopig6k" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mfvx79j4.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "eiopig6k" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mfvx79j4.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mfvx79j4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mfvx79j4.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "4k0d267i" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\oikug9mf.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "4k0d267i" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\oikug9mf.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5908

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\oikug9mf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\oikug9mf.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "rcieu53r" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7fb75xgp.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "rcieu53r" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7fb75xgp.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1788

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7fb75xgp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7fb75xgp.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "ikyghalr" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\feadi0j7.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "ikyghalr" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\feadi0j7.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1928

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\feadi0j7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\feadi0j7.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_045qtrau\desktop.ini
Size 282B
SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
MD5 9e36cc3537ee9ee1e3b10fa4e761045b
SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
TLSH
T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

EnterAssert.pdf

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\EnterAssert.pdf
Size 296KB
SHA256 5a5c19451bdbca2f011dc68d5e9bedc2d30573c8ff1072c208fff3d2b6bce1ef
MD5 cae24fffdfae70adb09a9245c62a8494
SHA1 a72551459f7f9d77c9ad92914e731e594415af1e
SHA512 6ee1176efb8b7de39b424277430fd280e7cac176272138adeaaf307cefb55f7e47ca2411d36f94e17d9c3c09f655076cb3c1986dcbf8388277f4a7b5055c9b3d
SSDEEP 6144:JJ/kdbK4AEZfjT1oPfwVO45YCLiXhDJFEm/8OCh6+kDVRLxspaQY5+eQxFLu:sD9n23e55Y6ChDN/8h6+4xU5YoTxU
TLSH
T196542326DA00B423D6DE719E8B0455143F8ED46DADFCCD2BAE4F0A9E911F5F808B12D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitConvert.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\LimitConvert.docx
Size 19KB
SHA256 76b4f5fe8857cbd609055fd1b1b811ee9bae855294ea73082bdc6e482fbdfd78
MD5 9de218714c8c196b048965d43364176c
SHA1 2ff86c482ebafe2df1d3fecb40d59ef44771db5b
SHA512 52f0246b84730a303a070ee35a5e02e0281dc3f3808c457a2817ba104107e87fd9db372743fd55542d21af8c9714716da90b564ea58b117c627d633441603035
SSDEEP 384:a+6JPH7uvGp4JwWOUFmONRkU5b1xdNxt/ZtNNWG1yDIFHDJR9KRgdv:k6vm4JwqUOMOb1ZxllN/kItDbIOd
TLSH
T18092BFB8D25B3A30D5D347BAD05C63F6F2282692B46B8487308B9D4E8723A170B9DD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142755_002_dotnet_host_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142755_002_dotnet_host_7.0.16_win_x64.msi.log
Size 109KB
SHA256 2819933f3fc89b093192ebfd1bff2c968d16479e5f7d0e9a004c7a84681f68fc
MD5 af2816b925128e0f33ff7fe5c3c54875
SHA1 2793edf6d1187cf8d6499f9c253e264a7eca74fd
SHA512 48bde8e6bd229f53af1f3939dde1657f3ee760b2da0d77151098a4a681490c0b0b1126a14153e8e14c11a94de626ad8bb67a979ade2c1c5a0c5f2616a5f7102e
SSDEEP 1536:TEvxf2NAp1L9JE0L+YizVbhxoJoqdz7jZOteFrmHTzm95jDW0jy1vXLs8Y+xc:TLcjDW0jy1vXLs87m
TLSH
T15DB3032A6FF8015BB2F7EA07DEF704119573B91A5939C81D20D3860D04B2905AABD7EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_AssertInitialize.xlsm

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_AssertInitialize.xlsm
Size 764KB
SHA256 4d0ef49fe825128a54d7429c37c87b32c78ad6ce8222c11866fb537160f3e084
MD5 e1b16803c6146391e68bea614323f4f3
SHA1 3d4402155d86497dd619d5f29961e372ebc039a1
SHA512 bf058588d4e627e4875d2fb78d7da320479d826b7b2743d33f2b19eb6fbab5a0c9b7570bb2bf3cee81388c16939d3c38dec4c40cd57ac38391d1a7db0e772d08
SSDEEP 12288:f65VGLcugb+WmHkJ5ZDACww4JAvM7wFsHAlULan+y90kv2LfAfTL2MWpAan42G1A:f65uU+K0Ak7OsAGLqT9N2srLrWqae1Ad
TLSH
T168F4337FD553F51085C6C714F74D420E09ABA9185307E672B0FA4B7AFF9128DAEA80E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_CheckpointBlock.pps

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_CheckpointBlock.pps
Size 1.1MB
SHA256 f424eff0cc279c16de3b9f66400731383ce273464255a92e7a53edd0d0c63344
MD5 9cf19f5fe93a5a68f33b4697ef051696
SHA1 05e8f0002feda0bcfa3cd8c74aa53c74e17bf5cc
SHA512 086febc82dc534370ee16c19d267f273e39de9ae1475043345252397ba145356a3b560c1109a452c81754fffce33aea664b6e6d0b1396ae1e16fe45fd644be14
SSDEEP 24576:ctnf45+D734D1qS+6JTgv3hp830V2eeWjechtfif1/55aT:/+D734hURp842eeEechMf1/mT
TLSH
T1B04533B41CE8FB2D8710F359D7C589576791ED39A083A3EA76ABC0BE8DCEC9E0110654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_CloseGet.pub

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_CloseGet.pub
Size 499KB
SHA256 c5c0eff805c722f2a0804ff81d1809a0b291ffb1f536b59dc76378e66d792cc2
MD5 8afd48bf21df48e3af16b1d91acf5f44
SHA1 6391b7e49bab2f1336ab1553aa8fde8c00e4d80b
SHA512 71cbf06cbebcaaa2a93db2c2aaac0dd05c3c16288b046018cbff45ac15ed459012093136489503588b7443e836b88e5afaea5c42c810a16719db2c39ddc83834
SSDEEP 12288:1BSFIiUeBE2MoKCnoWhRUtW9BJ0/itCBE3Xym6nh:1xCBEBoKsHihVm6nh
TLSH
T185B423B5C882B1C7FE5C9D73626C645ABE48480E8E1431AC2F9E3570D4A86D7D7B4C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_DebugReceive.pdf

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_DebugReceive.pdf
Size 546KB
SHA256 d531b2a819db0c1da642b59e004557275b3c6e07f01957c264fb58545690c34e
MD5 4570734712e30f7687f3af76ec77d4da
SHA1 8f27195319a9916d74ddfe0d7a0a4ccd5445b0a2
SHA512 ac98220c589d398422cd47f6acd6517f48485d15c1803b85ea18cc97fa61fece4331da22fd08af93ac958f458e60573b5b6d3a2fc33ced8eaaa1c677dcb55646
SSDEEP 12288:uUvkyhQNoXyYr6s7u0Ep7W0oy38vleSc83k+wJ8f81c6G:3kyhQRYr6szUFovfcuwufqc6G
TLSH
T131C4234016369F44B97FA581DE4AE71610F29DEACFE3384DE9A813B7438C7AA0E5411F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_DenyPing.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_DenyPing.docx
Size 592KB
SHA256 eedd3c0eb1ef0b7b485fc1b2c6d3ceb9fdf500ce92549b3259776a1985074ae5
MD5 d7c0c52673866f001e8621ac7d94f8a7
SHA1 8f88c79cb3e3417398b573a9c6baab8c6329d536
SHA512 7f1444b2c491454fda4852a0d31e60c2644860d3bf726aa84cd5977314dfdad2c038b5f3f1942c09c92348992db13a75a8a7669e2c62950d577ad5050ae9485c
SSDEEP 12288:3XTN5XUPC8Zsv9VdYI0ek6jILIRF0zooRBFqbaTDK/0M1qPLPh:HxNX8mvHj0ek/LvkWFqee9qjPh
TLSH
T118D423EFA545AC0FD5848316797BAF29940EF039637EC10660E927C59036FC48E2BAC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_RedoSave.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_RedoSave.docx
Size 358KB
SHA256 781bad9225e3d8cf2abe420e7fcc60fe761d13e138273f436cfaef8e491d6801
MD5 e49a48f577797eb6cb83e9bdaf5b284e
SHA1 0f7ef9598f81262beee671ebf9046631acc6b651
SHA512 47abe39740ca66926a349b1b8011124785a9ec8860b6f02e67e67c7dd791fdb9fe18f47d8a26794342a2a75a5441ccf329957a0e1a20a5f173881f07f0863077
SSDEEP 6144:J38F/sQsBhkcf3wbhwUa9u54jvUlsZ7eLhwnOIgkG7UPc0vsndUWIZI0:J3K/sQsRgbxa9u5bwPnOI7fP9re0
TLSH
T1887423BB7FC92D8BA7047857E22E5E03645E379D95FE143222287C956B2C8F0B157832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ResumeProtect.doc

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_ResumeProtect.doc
Size 421KB
SHA256 23342465a0f7134fe3544975f0c8db1a06e0ad71dded149dc24fcac552fc6d34
MD5 27f8916233a5826b0697e1e5faa61bbc
SHA1 0d77fd97beebefef09e830c5183e752fdccc7227
SHA512 40f1577da3a5780a9dd0cb4ba8d17820ad824a2a79a3b0e77b722b4b343abb9f0590aa9edea0bf64a5fb19211ced9a251673788e02613d605cf497e63f07818b
SSDEEP 12288:hiaYmj5Pvarp5cI8ACC2+grTXhPl7WnDZ:IaYmFPv3Ph7fryDZ
TLSH
T1AE9423D940BABB03CB26E0B1230D6A55BF93CE6826E27A0C56931DA2357F630D7717C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_TraceRepair.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_TraceRepair.docx
Size 20KB
SHA256 903453a2408a7ddf5bca299854d16cfbf84200ebdd53ec363209efc2bb327bb7
MD5 5bf6410069bb67b205617bcbd8bd25b7
SHA1 21e11a99ee01b6ae993fbc3b291b23b0e1f7264e
SHA512 6e71f8efd3cc810488ac707395660eaa747bed84906769e79caa3e072e571287b4758b4ddbd0f111d157c3e172425a93dac4749947c768f4e6c2d2599a2403a5
SSDEEP 384:awz6eawCrJzXbl+8yqQDZcLPe+dNxt/ZtNNlHrIFHDJRo0qz:b5CRbYqnPxllNlHrItDb5M
TLSH
T15092D07DC5219A31E2F30B38D03B22F5C288151B7F13E68A22D63AED0A53E6317519DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_UpdateTrace.xml

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_UpdateTrace.xml
Size 343KB
SHA256 4cfb99bd8281ef28a9b5868d23d5a7a4eb8f2059c6e0d3cc3bfe2f154a2db3df
MD5 7609068d7fb7e00cfd3c9d0e4f0ee4d0
SHA1 123889325d69ebd1b78d3465e4d508343dfb3e35
SHA512 1db363ca1ed78e3850407fe1f54821f60619d9c1fa9a0acd26fa0ca37a2e163816f682202caaf11436fd6a3639513498a666786f118e3d82aa52927787822ec1
SSDEEP 6144:xmdrR5GnNwGdIdfH27rpSgjozdm8lPTGGmQV6WzHhd8scgnNZTRLbxhRI1ixrf4F:xmpR5cLwP27EocDhT3ms6YB6BgNZF3CX
TLSH
T17F7423FBA1AEABEC4E9C9F7215E0D7564AC0E1F0DE90B75C51ADB41C7808087B36814B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\RDP_desktop.ini
Size 402B
SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
MD5 ecf88f261853fe08d58e2e903220da14
SHA1 f72807a9e081906654ae196605e681d5938a2e6c
SHA512 82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
TLSH
T18DE0ED19A2FD661052719F26BC78D011CBB1B8216C1B8E9E86C4918A18D5E14FA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_1kdkkome\sysinfo.txt
Size 1KB
SHA256 dcfd165763c1a67d66e8a9b0c656e17ab42d8242403e598aada3d21e2fe5025a
MD5 217f96e3588cc607301d57d5492658ee
SHA1 b651b4260eeb4d939754aa4f00a40efa0477d15c
SHA512 93f972f75db22573eac5c424f291f47f605deeccf925bd2ef43f18444c6967d77fd8f28557c7302484466761f5aafb4af355983880a8874cb74a76f928f507a7
TLSH
T15131010E8D59B08685397A8B61B2EF48B65F9343BBE0CB2144CE020EC5177C7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\sfud_25wwznra\screenshot.png
Size 437KB
SHA256 607620f3c12700ab7acb46b495bf8c3fd9fda53b61b86a9b16638fdb8a1128ce
MD5 1111e580398621b9b66df540fabf3e96
SHA1 580f819275d59851f2318d66833f004c0b9642c2
SHA512 8fda29bc208f82cdba1a33f1bbf18dd45d2df735b4127befe6d50128665725971a3358aaa218e836e772cac457f27f8759ea8f1cce8f19794442ce70dc0580ec
SSDEEP 6144:KBwJIN/eSdPOO2lNPF15Mr9Aw6dLdWdJsrOM8GyTfJz4sAaCfpsFsatKWaMUEkdd:heNPp01iSxdIsrOMKTRWsFbR743tuEp
TLSH
T16494124ED2F39D0A5EAE08FB6E9949CC9F32D04B521A247D1625318CCC8783D7B25A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeSFX.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\AdobeSFX.log
Size 1KB
SHA256 3a2518de3fc97f66c1ed9b9dc9a838689469cf94cfe59d98d93802018cb0788a
MD5 c1253f3f23c86423cb0c554bec89b133
SHA1 500a0c8ce082af7bad47991958e9b29dd2750133
SHA512 b65828c44ef2aa644a436f2e8784cbc89d57804bb12f4f8f0c125a53aee1d5cb8beb8cc7e9a061568a601672ad55c51fee5b6ef2f424f45e5a893ae1d87988bc
TLSH
T16241778E1BAF15F12641C286A3BD7EFEC5D0F81B2F45DA607B055208330491BDE5F642
MD5 SHA1 SHA512 TLSH

Submit Download

DefaultApps.xml

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\DefaultApps.xml
Size 6KB
SHA256 ca0fcc99f517e2d4d0a2f1bbcd254dc3d369d1d0d06431629cbb8c0827b34371
MD5 5fa0b53d52b55d3a933f2af24df7580a
SHA1 9d94c99aaf105c179d6d61762662aa2b6883322b
SHA512 b00d7acd515ed4db0c5e4715cf0edcbce35ac2ba9273948d697d3acf8ad9c620a634bdb54dd750b4963000c5c4ec59f16469a143a3e3f1796a933e67ef723c36
SSDEEP 48:cD9zmasFd7t4aDiLq0xQ+gQ+STyl/6d3b3eE7+HE7+HmRdtIPovVcjkLwv+ariQ6:WCUoPzenamcnquWfPfw3bdbGaE
TLSH
T179D1A6E15BC51CD6A35F99A3B78BD19D21AA406FCBBC2A00F0C3612EE51BB6C0777452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultAppsNew.xml

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\DefaultAppsNew.xml
Size 14KB
SHA256 69bb70836496d453033413285f37978fae0ace73596a59685d4988f2a964bda4
MD5 ac935163818db1b96b9d3fdc81187f07
SHA1 4f786d90b47f9efc981063d85625b6a0c5276b1a
SHA512 8836963a8d80f5ab1b66288612acda2e24297c76b214acba53bbb7cc04d7b45e596f5223cdba158dbcee8f3af90554f219244cdad652671192838b210eaf91a3
SSDEEP 192:/obm5Bg5Lm5xg50q5Sq5Hq5rW5tcdlZu5aWlClxFqHks51s5cd5ts5Iv52l3lNcR:u
TLSH
T1D9621A02B7FD1689F0F31F289A7B61690E7ABC694A3DC22D11616E0D5C61E50CC62FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetRedo.cfg

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\GetRedo.cfg
Size 299KB
SHA256 0551ed288c8c4444c6af70ded355038da7f8453da88225b471ad8241b5804bfa
MD5 30b45cb08fdd02a66fc2e03449bd2c11
SHA1 d76a93f2a2cdefc222bd8315e7e5699da1525e3d
SHA512 1000362a727582a7b11e753d406700dec09174725eebbe64c7f3df9402a9cd249e756e4699e33d839dc46e6ad1ff934aaeffd6fc15e612b54acf47a9051b578d
SSDEEP 6144:xkBj0T/xh5OkJizaYfOcIH783+TYWLlHo4lRERO/JriW8PxD8flOIb+ZcRq3:uxOxmkJizaYm4ePlHo4f+qJ2W8JIw7T3
TLSH
T1C86422CDF02FE6C4012D2537511B631172FB4906F2A6BDEE97928A19BC0E8FD9B58136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JIRWHFKN-20260709-1433.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\JIRWHFKN-20260709-1433.log
Size 57KB
SHA256 36ff4496ac9b435c725b8e0fcb1f250494f6fac730b83b9f163608309d73809e
MD5 c0efada5540f96522cc77ef8e01923de
SHA1 04e69b0537f1c512b869b1b4513e3c2830cccd3b
SHA512 b39122c406243378bd784a5c468cb9cbab63c9af3dab35c1e1f8123f6dd2a9280b089b80e2909751acf2665b487ecc3b0800f8f52d5b0598c48d5e122df14fe5
SSDEEP 1536:rt/C/W7o+CayWCokHj0IS4TZumR6hSNeAiF3YJuuUTWSroN76X2PAzKqU5d/f9BS:rWoC2BLhSNetF
TLSH
T1434366285FE90256F2B79B4659F640A7AB76BE537935CD9DA0910F0E1822E407C20F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JIRWHFKN-20260709-1434.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\JIRWHFKN-20260709-1434.log
Size 170KB
SHA256 9d327839676a049758a8e32c4c69d86cb773911c70e628b62ba0db18416620fa
MD5 83de8f66f62adde9f938a98d60fb6a9e
SHA1 dc07c12625765176022ac01472802a21b3526215
SHA512 46d3864de38f8fd5a373a4093ecb494be7ea3d8a42791f56d7ed08b94342244ec987780742779b93a7ee3a0a2527d65a45f90394d4120f40e95e1c965948e31d
SSDEEP 1536:KZst4Cm/azZJRVbPa8sPB0eKP8PEHEld/5saPbkPczG5JP8KP2PYu/4vJPd2/7X0:HB+n/n/a/l9
TLSH
T14D0468281EF90266F1B2DE859AF680629B35BD576831CE5D60910F4E0523E46BCB1F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JavaDeployReg.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\JavaDeployReg.log
Size 13KB
SHA256 f7f1c7f546c1bf11bcb99d22d2e346397673392d3db9a12c5dde446c57bee83e
MD5 1f7dbb355a3a9bcee0c05fff03f84980
SHA1 761869f2245f6a22ca68fc1842abeae52b84e3e2
SHA512 14d0b4729c78fc4bf769b29d38030aa56d42f829e52da66934e685ce3017c5ae245cdfbe9f17821801127ee1acaa95c6150718cf4776251079c481fde1c59a43
SSDEEP 384:s3UR47P7v/PKNfdhf/wnMu3ttttfgK+BON+U:s3UR47P7v/PKNfdhf/wnMu3ttttfJ
TLSH
T1785299C288CF4AFA45668155CBB33CF1599AF0E7A30AC9143B64CC7A7B159825FB34E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20260709_142640218.html

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft .NET Framework 4.7.2 Setup_20260709_142640218.html
Size 93KB
SHA256 deadae4909864e14d9251eb94ae5abd4f0d99ace768bbc48d7c1fba397385fcf
MD5 d37bb1427729b38fb5b898e7791a274b
SHA1 50b9abc1debb1eefd2cb3a1d84cda3574f6bebcc
SHA512 d80eb2e98b37ecc88b8e19a0edf460125ba80949da36c5b722f76c6666150098b1f49240cd8491fdc4f05a82e8b5173b0d8d164fbb1f293e482feabac123ea77
SSDEEP 768:fdsOTLyUFJFEWUxFzvQ31YQ9BGp4ZWboC:fdsWyUr+WUxpvQ31YQVC
TLSH
T11D93A3536BE84155A4F3BF4DED7710261AB8BD865C34D92C13A08A5D0E91E24ECB2FF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142716.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142716.log
Size 15KB
SHA256 46fa3c36afc05f05a72d2e3c4f28c17c597398ff4565f3778ca5a708cd904964
MD5 726add39f784379538ec515fc4e3e6f8
SHA1 067950ca8e6bca8afa2e5761ce9038ae67637354
SHA512 3090630c398228ca57d28e0221c47941f758b8cc0dc0c3255e2bb5d26fcdcd039931430a4958ef2ab3d861cffbce7cbf4899944cbd5d7529bfedd45557d609ba
SSDEEP 384:y8YVk/m+PlqOuAOuQVauYwCLNgKp/Aa9B4guE+V5VvFPVnlgv+BJRoCxu3CU3xxZ:yfxBABiauYwCLNgKp/Aa9B4guEQPvFN2
TLSH
T12E62BD9739E953C02C717BA6C26E9EA9C386B4C5575829F12E93030D9382E07FFD5AC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142716_001_dotnet_hostfxr_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142716_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
Size 95KB
SHA256 f15c82a6d56bc079dd95ea028b9afc65204137951195dbe2332ac991e5c8dbc7
MD5 e17519da6fe92da754a88efa1873a391
SHA1 89ebb0e0646d1525c83be72f3fc8e8ae77c61b24
SHA512 dc30d5058b4b24a14aa82aa4e7418712d650a3064f39a722061639cf2ab9fa8c8705358ea13cb0b1c921dbe12410947bfe238b45e5a61456d8643b3191e3e300
SSDEEP 1536:d6u2wrVmFFqG/upEdR/cKAubOGBfXpGRn5J/8emWYQ+4tGCDvYd9WxkjKk591usp:x9gjKk5fRB
TLSH
T1ACA3F23A2FF4011AB2B3DA479EF748224673BD199935C90D21D1870D01B2E09A9B97FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142716_002_dotnet_host_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142716_002_dotnet_host_6.0.27_win_x64.msi.log
Size 105KB
SHA256 f77cd2cef42e97bccdf8c0865bf4b98d2ba3f85e65dffd00aff59eee7c53282d
MD5 ede88ec508d45bff93ff5fdb5ee14305
SHA1 194f366a4489234f252dbd34e6890a4c29bb6f47
SHA512 9f3c1ba0e74892cf6ac5917a4b0138fbac4bb2e09a2d9474753946b1e27c00d3c60937748e0f465ad4ded05288de3549a5f24dc8cef666441b822e26953d8a19
SSDEEP 1536:3B13XrgV2xbm3KDK3rlMcbhDGwosHAbBnZZroCKq8n42OHENGmoV0juZdRZi0j+0:rGRjuZdRZi0j+cLWg
TLSH
T166B3343F2FF40059F2F3EA479EF704124A737D969935D84D21D1820E01A2A09B9B97EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142755.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142755.log
Size 15KB
SHA256 95f93ef09777378d60b8247ccdc3b483661cc8aac989f4fe3192329c714a51ae
MD5 29500365e8a7775073dcb2e72362ca74
SHA1 0ee10e9fb9801a0b94ec66717d4c532cd2fa9235
SHA512 224197fd564d151686a70dbcbdfde64dd0b7e7e6e36fcb0c8e65b32099112f55804764e6722b10ef5ace326635de17cd943f856ab3845b0de0d6373a9faef640
SSDEEP 384:SZxVRo79iGOPMoPMiVTjFV0VbCV+Hh/YLeF2MBm4rE2Mi:SRnEoEETj72bkcvrgri
TLSH
T1DC62AC406DDEA6C53C7171AA813E9EE9C6ABF4C6164029F26EC24F0D9392C13DBCD6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142755_000_dotnet_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142755_000_dotnet_runtime_7.0.16_win_x64.msi.log
Size 470KB
SHA256 b17974171365702f20d4e02b018b550874daaf8b1871a32bad2a4981634b83b4
MD5 21ff9fcfd268a02f68e1bfe536f201c7
SHA1 6092a2aa4bc009a6cd54015b0266c205a895a60b
SHA512 9c5e4beb1402bd3a16972e5d87aec4da8ba47ed92f694a0217de9a788628fdb34a6dc461f1cb6a333f4c766712526cfe1ca3f8d64cf3a9e404dbfd7b0dd85538
SSDEEP 3072:AbIvjQfYS88WQBECR/mf8szP9hpcahkH18qTCz1GWl0PvcCOCVLgT7nq6W4xRHav:zjD8
TLSH
T1A7A42D25AFF80226B2F39E47EFF38416A476BD35AD39C91C1092425D0471E04E9BB76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142755_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142755_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
Size 95KB
SHA256 630186636f5259b2830777bc457cafcf97d98ab9ba0abae068ea7a8e4b0958bc
MD5 3cc9b0a109e0fb5af39f26f658c765ea
SHA1 ed7e9ab444255a1888e92b4abce1d8ceb69ee2e8
SHA512 eb734579fe7e73c97acc0fb7352b989500f3d368da76fd43f59a03f4e05854b880c1eace5951619a7b04b197cc8ca1022ebefdcc20d5a5f3ef9165910b460d4e
SSDEEP 1536:X+GKvhloRdj9iaETWx+kV30bVJzi1LTLxJrRMO+7K7Z5oh7jqsE9ffR:XtMjqsE9f5
TLSH
T111A328262FF4014BB2F79A47CBF71522A6737D165939D94D3092C20E00B2909A6BD7EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142836.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142836.log
Size 15KB
SHA256 84c85c5102628c85a20d2ce20f317cc61151750d4855bc5a83a42d3248d9360b
MD5 9606f826f5f6724e81f6f88726f881d6
SHA1 d49e4362eb5cf999546807246bce3fb9016800dc
SHA512 af008989c90dd67d32b19c4f8a10b8b5f4fe512daeb1eb7701d8b7353de1c49c558df6fbf28e5ca1feecda84ce06888d4a9105934d437f27277466a8dbd43ed2
SSDEEP 384:nwtdV0ID5mC0NMyNMWVMx3ic9Q9OnVVOV+9IVkPyQaXQ3bcNeQM/QdBnU/QMU:n62uyuY09/AAqj2NFNU
TLSH
T17672F3C42EDAA3C83C75716BC139DBECC2AA7489571079F06F928719D392C1BDBC6581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142836_000_dotnet_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142836_000_dotnet_runtime_8.0.15_win_x64.msi.log
Size 470KB
SHA256 7cb31cb2a76d06f4cfd31ae98c9d7087f0e2f427971a511b987e5aebd91026be
MD5 f5e199a03693fe5240ebd5facb0d1449
SHA1 b09d9f85f2ec851f8fdc8aa635cec98e34125060
SHA512 7295a44a63b6895407cb6c0d9f61b49b6b96dbb0e9277f7dacaa57168917f57701aafa8fc77b9206f0bda75c6bab6778ed388f6f39035fa6262172c809ce1031
SSDEEP 3072:6v79bhJnaDx598088a0/d7BHWhjh6u+82E/14Q4oaPaIIKPBerTT2G1HTzx7lbyN:YjnI2q
TLSH
T150A44B25AFF80216B3F39E47DEF38415A476BC36AC39C91C6192425D0472E06EC7A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142836_001_dotnet_hostfxr_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142836_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
Size 95KB
SHA256 3f4832d7b6bd789fdf7064adbaa2984a41b4ba2af2f723931818feb1105d583a
MD5 271764a5856c59c80e70f9170599fe47
SHA1 5f3eea72c1d183302707f9e3d584b124b7945cca
SHA512 1fcfd2db16ba44a0c9fa9af2d03a6e1e63c76daf4ff5f5c541b8b68da0d0ffa459699d7ea8b560d3a0fde84891ffe0aaed2989bcd5137e73e1350e55252ce783
SSDEEP 1536:axCtjBnhf+jv2AtkYi/5o1DmlmgFML3xrZG8/xJ/FdfloO+qmD0BUBOQxrZnCRoI:axCtjBnhCCAukQxrZnCQj7PX0zsJyour
TLSH
T157A3282A2FF80016B3F3AA479EB344255673BEA66935C94C71D1824D00B2D06E97D7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142836_002_dotnet_host_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142836_002_dotnet_host_8.0.15_win_x64.msi.log
Size 109KB
SHA256 a52ff3fe08ce96c54912b6e555d5b3fb8cc6efb485bf4adb1bc5961cd2b96d4a
MD5 a154e225040bca7451b43f838f996084
SHA1 4db3c3f0f9cd2a189d119e5e9b20d066b89b8905
SHA512 5093406c2ef2ce797d05609c494c580936f89b3aee5202196f12fce22ecf1a93313c3d9c038db41db32c76abfd988fe4ea0dfd8566bd1fe0f15359bbb37f681c
SSDEEP 3072:qLhTDxpfDc/q02Bg/Dj/8jPUBVI4c+aBnx7F2D:rjd
TLSH
T10BB3161A6FF4000BB2B3DA879EF305565A73BEA26935D84C7191C25D00B2909E93D7EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_MoveRequest.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\RDP_MoveRequest.txt
Size 795KB
SHA256 ad007779ece1d867b19d42f7157f1908a3b77f9a9108497a7dd145ffe8dd2e9a
MD5 7916b1d567dd64c34b11277de2b7fbbc
SHA1 01e1f144e9328e86546bc17953034977e3b233d1
SHA512 910ac7d8a073fcf5885e6c59ae8807a02b7274e84bc7132f38aa00ec26d5fc9f6183c4bd8f42a2fcf385b0b05d341fae0221ce668e7a4c6fda6de21f183f4438
SSDEEP 12288:ousVDPKl6V5PfjX4VeAwfYmn73kcYQ7ZJv60blih/RhMGTAxdL0qcfrH90:aVDiILu70vb1Yw7gRGGTmWNH90
TLSH
T18C05336507563BEF2542A3251CF7E81F6A3DF4BF822E037EE2046415A47D4C0739AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_SendEnter.pdf

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\RDP_SendEnter.pdf
Size 530KB
SHA256 78a3beb5b654953c50d1dfd22c77bd38b464356423005da5fe05e74c2b3eed86
MD5 2e742512258dcff2282ad8f4516ae16a
SHA1 d7bf008fea29b18c760146be0022dbaf0a04c5c2
SHA512 fc0bf3bba08c29a8f818c6287e167cabc590da86243c91547da6b8fb2107c6670a9dbf0b83e2e486758ac3dae5a9d52e9af55d622b54cddfcfcd95a12ebf2886
SSDEEP 12288:1UPOHMVK1PHSvE437sqejdkYEm7O/qL/9Vw78:1UmEK1PyvvLZKkqK78
TLSH
T15CC42372160523C398EB3E7535AC208EBD7B8C0A775A2543429A7E64230DE75B7BD353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveSet.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\ReceiveSet.docx
Size 231KB
SHA256 79e6d0169753fe6034ad7f19205fe937ab35599aa0b61f27400753ba93346f40
MD5 df2da6e6f23a0ab0ce5fa0fbff549966
SHA1 cc4a1d03bbba74179a73c65c8bce8954a4687207
SHA512 474385864f6f53937cda0a318cf2b2c5ab24608d7b0ede3f3bf721097f5115231c2c7d657a28337aef4ced3bce52195eacf7c736b0293168b4099d3b33edaefc
SSDEEP 6144:yAUoIOVL3MYeQ0tDAapDmuH9Y2Mw81jjn:koIOiYkVAa8u2w81jD
TLSH
T144342355661352F387171813E607D54C398863CC57BEEBF5398E409AECD88AF24EBC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameResume.cfg

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\RenameResume.cfg
Size 327KB
SHA256 dac3e19a6d2d47a7296313dd8854ae2424788f3a8919388924f230f2ab726638
MD5 21d3abcc75fcafdd6be7de1930de1ef9
SHA1 b69c0948873f4ad59079c0240e60bbd67015719e
SHA512 f403bbc583b77e1c6d93239f3056b3a49823cfbd2ee09f06ae48983cda0985c56d862fbbafa020ff9f89f46bd10f811ca89b05e7d88a2e9d189801aa5b7c0100
SSDEEP 6144:sKghI7VmfRgX2fd9URiq/6hKvRcnpfMujz535uAcKVMWIBm4Mjt4RZU:sKdEZgX2fvLOrvenpfMujdkAAW2m4OV
TLSH
T19F64238AAE1046B9CD11A35C6970AFC01AB05AE92F1E331D73929DF64037743F7A82DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchAssert.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\WatchAssert.docx
Size 14KB
SHA256 bc5785740122eaa193ac4e8ec64375d9ca499b4cb9f999bc1abaf24286815e8c
MD5 9121408b9e0893f31c22d6e5c4bb8452
SHA1 1040d1e1e62c804d58ed9de394830873fa445285
SHA512 41e6b1ab1a3ca1ca31b7eec7bb1c1bae4ab536da318d75d29c2b90a533219cedcacdb62138db932839015e1462518782b1e18c25d35ecc6439cfddd6098cc785
SSDEEP 384:a8lIv3R985xVdNxt/ZtNN2nzIFHDJyxHT:PlIv3K1xllNYItDYz
TLSH
T15062C178E546B870F7AB4D35983903F5D508814277E6E88B21BABE8F810BE630347D4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aria-debug-2572.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\aria-debug-2572.log
Size 470B
SHA256 8002322c42eccbe033cd91e8d9a9f1e5a15a941d4475b7fd216cb9e19a7b4ae0
MD5 c91129a7e0114dd65a14cab6f1582033
SHA1 df58de6788bfb05fd89656d5d05599690d444943
SHA512 dc8786396f74c0af022aa71ff98e652604e4709b09c1f93cbc837a542d155609b6a0626f9ace837931ee39a9ef7223017241856ca9690a152d06a0294ff22436
TLSH
T1B7F09E8A0AAB4CA3C20B73B3B4638DD329D4E67FB2D04700851E4328204B3C8A247C80
MD5 SHA1 SHA512 TLSH

Submit Download

browser_history.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\browser_history.txt
Size 92B
SHA256 7565a63bb14b58f501f4a7f68d7d3841b2bb8611f3061e3f125ec24351eaaeae
MD5 1d7ea04cf94468b753de19b3970bd715
SHA1 d0b199ac89870773a9a9f54043a01282e561333a
SHA512 b17e778ffff1a3fadd4c464cbc2037222ce12b8e8f0cdcbbfa1b5a0cefbd777de40be967fd3bb5e4baeaa3e9189d1284f27250e9881fedb671543be82442e5d9
TLSH
T1BCB01298C11544E2571C30217A47462C781DF20F0A4042113C850445A70276642829B3
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\cv_debug.log
Size 805B
SHA256 66cd9730a426bbc36436c0a038bc37c31474c219c75db5770ac542c4b5135f54
MD5 0c3a49a0a9a3e741805da98f819ba6ef
SHA1 42e9e0d283176bd2114e68b8909f5d0996b3b93e
SHA512 7ff3d88ae311aae12a72062146b8c8e3ee6330b303c76c73429b81e752a1f57ffa2271e3e22838e8c5a75746bcf6024748d956b57bbcca24268fdae940747011
TLSH
T1220104A43932337F06C24BE8A0364C95A950E546036F66ACDE47A024FE6CED1631E3C9
MD5 SHA1 SHA512 TLSH

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 f82712ee6d8ba683f721ceaf567ab71aa73aa50d2c1316484f7413e6344dc592
MD5 fa19e9f20416683602cdbd1edc0da661
SHA1 0a16a167ffc0407cf132941a49c9eb56aa34eaa8
SHA512 a598094a15a105b94d8ba0d00e57a4395a4f7045c49004ffe51ebf2555643e468b0380f5b81f149ac7dce137c7f8ebd2f15694ebf9a806c8730d03c3a55a8932
TLSH
T13B218BC2C0CF58BA447086820E179DE290860A455A0F3DF17B24E58C19874EF5EF6CE3
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredistMSI79AF.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\dd_vcredistMSI79AF.txt
Size 425KB
SHA256 3f262baff93b623ca9c558ac20878d4caa6c086113780da9c930c901c4cda09b
MD5 0cd44e3c96150dce264ceb47dee9ded9
SHA1 585a1efb4065f88d84abfd89c96e131178874880
SHA512 901dc12660b9e283a29bd1a15ca59a780842faafe2383023c2f914f85e9dcebc28c7cd5aa1517cf32f7884cf4c00782110620e95c79eb7a4d1646c520a02450c
SSDEEP 1536:+NiOZqP4OS1t6kBUDAbebettGgNRcfz/X1TewzWJsqsY/vU26RZNqpxr4y6ESzq2:+NDTjpKcLXrIe9G
TLSH
T157947C2A5FF50225B2B2DB47D9F3051358337D62A939D94C2191834E01A2F09E97EFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistMSI79D6.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\dd_vcredistMSI79D6.txt
Size 415KB
SHA256 a81ab75ff230a11ae3c5114b9611a90b2c21e110aaf39897eaa1e200ac6f6829
MD5 da5599acd2e500feced16672244f3087
SHA1 6492193cd67509ce579bbb559f18c3590c318ccd
SHA512 c3cac432ec6e684a98cb2ffb3c102d93896bc5a07b46c0a730e59b6ddae2693d129b4f21c0f6c410fc9278074c9f27cdbbf342b54bd9078806d96556937fbbff
SSDEEP 1536:q5rTKv3XtJW+Qrqe2D5D2K8DyRLcI/zj8bLx/Or4T4M77QKWF9z2526tDrTJchns:q5YXjkN9RO34h7uBi
TLSH
T1FE947F1A6FF50226B2F3DB879AF344225833FDBAA835C94C2195834D0561E05ED35BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI79AF.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\dd_vcredistUI79AF.txt
Size 11KB
SHA256 178dcde7d6d8007cde5c83a66f82b1d9ee5ff1b53c4709302728befbed1391fb
MD5 53b6da9331597b72abb2b10e3452a18b
SHA1 4412481d73c771ede82353a896aa6836845385b8
SHA512 04099f7520d7a46b1657a66cdb161798bca012ae1ba36d6a32004b2dd043425fb3d791612618fabe81ce8dcab94994bedf3a69124c73693a53fd4e5cff1ee997
SSDEEP 192:xQqqtVeDwuAnwnzqnwngMP+nwnMfQv85xKy8C/:xQqqtVeDwuAwmwgMP+whkkC/
TLSH
T11B32DF3BABB50059F4B2DA4EE8FA4113AF76B861697D950D10F5138E11B0608F8E17BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI79D6.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\dd_vcredistUI79D6.txt
Size 11KB
SHA256 5885fef70239d52ea28814d4579bcfe559e19bddb52adf110ccd81c1d417857c
MD5 0c5efcaede9fa47b580bd80163195e95
SHA1 b0f81a20878dfa9a308ebe4d65635208727437a3
SHA512 2b4431b1d74781f587772158b23646ea14a96ba0d6cad52ba44368013d65e73e01f3d9f0c43ff6043733fb3be32ed1f5dd10386ef65514c1ca1b24174261fa8d
SSDEEP 192:YL5sF298IrtnVnz/nVn/MSjnHnKNKd8bhFN8zP:YL5sF298IrtVDV/MSjHLOqzP
TLSH
T1AE32C12F4EB50065F5B7DA4EE8FA4123AF72B891997D890D10F5138E15B0608F8E17BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\desktop.ini
Size 504B
SHA256 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
MD5 29eae335b77f438e05594d86a6ca22ff
SHA1 d62ccc830c249de6b6532381b4c16a5f17f95d89
SHA512 5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
TLSH
T1AAF0FE19A2F9561052719F27FC78D0119BB1B8226C1BCF9E87C4A18E18D5A19F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

file_grabber.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\file_grabber.txt
Size 6KB
SHA256 18bac23a79437e53af67787353dd2031841d50c0db0c96bbcc9c10edd4c70076
MD5 8d6c29a8405a9c00835e7b306c255193
SHA1 5383bb5ae1a64a981c9909866ef558eb2133ca08
SHA512 c569e7a441f35bef5da4c41f6e31eae0fb2aaac745f07142e81f93986441135ccc6f5cd15bbe15eec2f6c5681b4a2741f7878a9b086c669574a90e18b847b356
SSDEEP 192:D72W+HQbP7qTdiu1ZyJoMd3XslY3LVMg2mrf:D72bHQbP7qTAu1ZyJoMd3clKZMvmrf
TLSH
T164D114054ECFC79D05A8B0776177D68CB3748C4F7E89B758AB50848DA19362EE9E2F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firstrun.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\firstrun.log
Size 371B
SHA256 5a35d139cdb0f4fc9bb223047724f98f98c7b53329c9c2b32a4f39e46b4407ba
MD5 a9ad363920ebd4a2520599f68436b7b4
SHA1 7313b9986cf82921691384a8d0ba8f62ab1e502d
SHA512 796e00776c2451c23b9545ad209b574d6cdd2dde2ce0e43b21175a7b8ebfe877af1e33bab59e7ce9acc950324c0cb946f172cdcd1caef41fa9a11c7983f76824
TLSH
T17AE0D8AF495552BB8FB110E0242DA77B6F55290F03CDB0F7C21E37AC16571984D79813
MD5 SHA1 SHA512 TLSH

Submit Download

ftp_vpn_rdp.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\ftp_vpn_rdp.txt
Size 43B
SHA256 31fd6687fa56c5bc6daa22a7fd879d3d4d390f2c15bf352cae63194abd9339eb
MD5 37650121bf2afca6096d843157d005b5
SHA1 9aa0b2644be54fe62e9b13707b5fb9055f9470df
SHA512 ce287b6fd1a647b149ddf3f00717dae099304b8ca7f67b138ff0eecd431fbc0805536dd47d6f167c1ea1677e0967d5f48b3ba93fc325cf422a610a50338a3c3b
MD5 SHA1 SHA512

Submit Download

jawshtml.html

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\jawshtml.html
Size 13B
SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\jusched.log
Size 163KB
SHA256 74cff460a3f9e7d4cced93438fdb57f457cf81e55147777f2895eeee6ff9b92b
MD5 b141a0da86f232c994b493477b3595e0
SHA1 db464c9878dee68b70374199889a4dcd6632f1a1
SHA512 4655f88a456a515ffb8fcc9ff0682016499bd1508bd6a5268a1d1111d46697b7993d9ff5e9f00209fde1f4d456cc45484ba93b6ba687cd4d999b9f2d65f3031d
SSDEEP 3072:Yo5NG/RQakaM0HyV0mZtkrMKrCczzdWO1J5F8q7EiyG:zlLe
TLSH
T169F33187852E44FB24134AD7C3BA7C6455A2314E536E8A1862CFC6DFA641903CF6F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mail_clients.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\mail_clients.txt
Size 69B
SHA256 ccc3bf1bb2e5aca2d3bc8eb7338727b10fed9d2aec624fd26b36f9d5c11e5b3b
MD5 e7a80003174cc9c3efa4a142e206d3e5
SHA1 4e5937f4e02e02e792ab60b53d20b655a80e63a4
SHA512 070d8f0b24ca3706fa20b7b6b0ed824907cccd8459b78dd6ba496d1bf7481858207ac2df4ce7fbb0da8f0fb627213cff82e6f9983c12441618689b746ac1cb39
TLSH
T1E3A022C080C8E80E3C20200B00F0CACCB223000B3F023BC28300CE282082808FACE0C2
MD5 SHA1 SHA512 TLSH

Submit Download

mapping.csv

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\mapping.csv
Size 120KB
SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
MD5 d3186aada63877a1fe1c2ed4b2e2b77d
SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
TLSH
T11DC35121D2F6619CF5F3AF941AB41AA91E73FC16AD2DED9C0250620D0466E61DE31F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\msedge_installer.log
Size 10KB
SHA256 404ac7069627067f07c036fb6e0c3101a0e53c7db1bca3e418bb282ab0572b7b
MD5 835d1ba1b568e9d5b1549afd62703a99
SHA1 99d305038fe3b4c54ad0dd6f68360f55d297e522
SHA512 7265d85f4576efe1b8fc9a42e98a087df4cb6e2b535da820ef5c45db5d96b7870e3021bb3cac941e5dcbee5c9870e7ce7a4e7cc03396bcd14a0970c30771c7a1
SSDEEP 192:A/2qorpDcovOEVwHZgLQOmHojoGnXCzvOpw/q:C0W6wbH1zWC/q
TLSH
T160320E50A783C6E15BDB76BB12667E5AD59D08CF86C4A47221F9F406F082BB6013F4F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\sysinfo.txt
Size 1KB
SHA256 1343a5d2eee628a6a0a8b5488ad593e76294a0bf9f7bca320de92530ecf7c23e
MD5 5bd2af921aeeec5e38053737a08f9df6
SHA1 a7bfdad9b303a7d6e98e17588264f784304006b7
SHA512 eba120289670b8f3c1d7cb730a9df52762f63efb775914960ce6453d1b6d8a7358f963530501e00b3a423e8fef692d2edece2a65c39366fdfe6979e4ee17ade9
TLSH
T11031010E8D59B08685397A8A6172DF48B65F9343BBE0CB2144CE020EC5177C7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_6im1jegq\wmsetup.log
Size 697B
SHA256 d903f85ccfce389b03b9f5e57a26410a8adf26f0ceacd9b157055b2b67e16f21
MD5 b4cba142cc71c12f0bb1e388a60becf1
SHA1 19e81bfa03f016860d4a9d7c09564ce3e690aeb1
SHA512 9758443846a08f7d3e04e1413187a29ce55c7e323ad0df2e7c4654c1916691dba03947a4f2bb694e6371a6750f341704f9669c3e76fc239347f7dd7212e5a4d0
TLSH
T10B0140974A09D4F48D5257A369CC8E2773BAE7CF4354D0166385E065450913E233D07D
MD5 SHA1 SHA512 TLSH

Submit Download

RDP_CloseImport.pot

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_CloseImport.pot
Size 483KB
SHA256 1343fc3b8dfe36c150cfc6abc487c628e39c348812890b9dedf995549a7e2b5a
MD5 7a4b6c6868e28b3c8bccc4c30fd804d0
SHA1 83c5bd341e13473f5869dad6088aa29bc45e5e4b
SHA512 5d3c53fa7819598b48f4af423e1862f7be1d3cec4a599ea18ea82acae4524d27f077d60bd1534c70247223336fcd2af57ff202d7a91935238033929a5d7f71c6
SSDEEP 12288:Vs7exds/MbdOUAeRyPfKtDMFHURc+P+644e1Ep3LnBCJ5j7bnw:Vs7UdwqOleCWDMqRqxc3DErw
TLSH
T17EB423B8D3EC5A188026D73DEF5035C92E843825639E1A27DFC4D2BC5F5AC093A2D679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_CompareRestart.ppsx

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_CompareRestart.ppsx
Size 748KB
SHA256 5492ef6b85f2895ba04b416021979e1b3b76aa3bbcfac2acb90dccdd74095264
MD5 c628527acc5bd2405c10f89e4c55f669
SHA1 6bb080314f33494c366c2acf71bb7aa08c81dca3
SHA512 dc2463cc80f6f71e52bae1f50775d93bf4bb01854564bc535c90b0e1b6393c1954e61f316f9741d842c6b46fe35e6f12533a552cdfb9d5c637c4a71260434880
SSDEEP 12288:y8v+m/6vr1dqFV9w03NhoUedN6AqT3jPMUD5zzjAoU+layw3PLcSXiOazY39ynUf:Pv+c6zXoG0dh4SfvLtfAHA83PLcSXiyr
TLSH
T1D6F4333B048E27F59924EF90166C5EA6F7CCAD236E86A668744373BA4C7D01F8D11B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_CompleteExit.htm

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_CompleteExit.htm
Size 686KB
SHA256 3b02e50f512b8fd0a09ec4f94de20acdfd77cb069bb76c75dc1741632d240402
MD5 c9d7cbd5bd21ff71555b606a86c88eb2
SHA1 71f2bb175c823930345bb6feae56de1f191f7484
SHA512 b4c4a828fd69793333a3c8e05e915d3aec37e1b4546803da123c9cc1389a70b2320841b63c6b9f85701baaf87080f2f5a205168153c87d8a0ebb3834c1ff8fa8
SSDEEP 12288:p+04n1UOajg3knSx6CPVzPfDHRB7GihlgtdFzXXSAjFjYfPm:pv4KcUSkCPx3DHRB7gFriOFMW
TLSH
T1C1E433042C2E4169EE1737DE10AC24FACA4069D9C925E0309B6D801EF3FE5BAD77566F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ConvertFromUnpublish.pptm

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_ConvertFromUnpublish.pptm
Size 624KB
SHA256 23c809e5dfade8325d2b7440444b64cb0a2575b00353e6a3926d1ba2d2a43f26
MD5 886bd79814b2c44b6237d8fca1c2e1b3
SHA1 9672345ce129f8b18d3062c56f027e4b3a4001b4
SHA512 92816098b87d9a7dc5d271c012fa20366d9d7a0965c9655ab34babbf6cfd54508268db10eaf1883c56a6f8a7d9c12ee672b0cc56623ee7a24048f652ad9cd9d9
SSDEEP 12288:A/OGsVKthQ0q51lTxLEgBkH3vGS4F17TqB+/L9Z1ZXYGjicOln9q+q+W3Dh:AUSS0o1lTPkOb7Tf/L9Z1vjiLtLToDh
TLSH
T18AD423AB54EDA35914620824E73DC42B6FA3F55CDB838D8EFC55E7C48C2E0E2DA854B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ConvertTest.xla

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_ConvertTest.xla
Size 702KB
SHA256 61f23364588e386b47f88ecc9c4ea56807e1a8683b0d7b5c9efcde561f4918e6
MD5 9f74ef21f3c6878fdf700521dd9f4d2d
SHA1 09502401d490dc86db566bdbc9827ce6056dc4db
SHA512 c205c445225a4c4d15581dbdfe2ea37fbfcb5b1dc5cb9cf8eb6094217169f60fdc5881275739fe0e60e3b828cd9be0d0a567167ed5127c82f459b7989c415a9f
SSDEEP 12288:JBOie28u2Fio1nBj1PpNXZnBzAB42gqApq/49m3Y/CcEYwnHfjLnCL:Je2x2FiovBzzo4EAc/4Xq3M
TLSH
T146E423EBC729166C61EFC9408FDD580F1284AEFAC95E650207772A51C79A6E07F91CF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_DisconnectDebug.vst

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_DisconnectDebug.vst
Size 842KB
SHA256 34188ff040fa8acb44927afa829931694972d248f742287874deb8ccabf3eee2
MD5 3868aebf7830e7ad57c9a65745402ed0
SHA1 f3e0e3dec60e47e9a5017e96ddb3e69ab1f3672d
SHA512 3479cba9ccc24447b93a0414f42dac15765fc33de30c29c8ab74c7e83bfa310fec325203de91eb3d5f2f5c4018536de815551bd7edcf83712ac61219c9d45b13
SSDEEP 12288:emwb4r0waBc94gIH9wHU52yHlmg/VY3lYBJz1C46Zhtle25125oWNjCC6AW06EjV:Y4mJhH8gO1g4Jd8c2df6EhdTZP
TLSH
T199053378CEA0FB24E623FB5587854C289F0523E4169C96BB70C25DB84A317B6E713CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ExpandDebug.xlt

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_ExpandDebug.xlt
Size 639KB
SHA256 4dbdc80316121b464ba629b6bc8cc9d8b977e9d83bcd39ac7e07f91d6cbf52ce
MD5 04a2af122efc45e8e504a5e709fc1397
SHA1 1e176492939a8a09972c436503a01269b7dfed82
SHA512 696613765b3f92d7a37c2b10d362a6820642abbbd7887885c09789f3436191e4a8a4cf1822b6d138cce50033092856cdd3a670d8f6be420b17dd018d6d91c21c
SSDEEP 12288:AOPMjxzgirk6hyOV0L2pbLNbr/yZdgvPPGtdSZXLokt5fZzHepNR0F+pCIxgddl:HPocirk6hBVLpHNbr/ygPPG+ok7ZzHeY
TLSH
T1C3D433A8F8AF6AF27D010CDEDD064E7F760F7221168D6609D8C3A0591DE39B6D02E54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_FindCheckpoint.pot

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_FindCheckpoint.pot
Size 717KB
SHA256 a366d5d4e9f4b7325602d7b80582b8c66c466a01b08df15eef3c07b4adcfe315
MD5 265141f52957ac9acb873935302ee93d
SHA1 46d58f8bd94afcd0ae9c1605a91af628cf33ba8a
SHA512 c9d7c9f0436c14f0dbca38de2fd2b8bfad9ee6336ac5597a4e5a70b4354313db4eec17d202d0fa374904d03d3fbe580a0db3fc442b04b63dd0e6509f882ca433
SSDEEP 12288:27zZRfQw6T8wxbkPY4kcoMA5TA85F/GLQeITPzpOzGwf+NUu50VRkSzBGapVqm8T:2JRz6Llc9A1tEQ9PUJiUu503zBGchAF
TLSH
T1EBF433EE348D494D0660C2C61813A5A8FADBB1FF1152758760ABFDBB7C3215F86D1A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_GrantResize.xlsm

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_GrantResize.xlsm
Size 655KB
SHA256 48182644ccf3ca3af89822fec9aede07835a3860fae6c204e19f04776f4ffa03
MD5 d42319c0b605fcc3d3032d4b6e42a70b
SHA1 989ca706c9ed4857699cc4f14104dfeed602da98
SHA512 3ad84ab5ec0ad21a0c4f9ad288d04e9fc92e2a4c54258c5c6c59239d739b04183c72d6c7c56e5094308d4a5c107063e33842aa6ff79ae4b5b9dbd1bae5399759
SSDEEP 12288:wrYJ/Oq1Cyi0YBv8B0eTbOlSFiwqO7Z24lvgf7FubaQMFuT6z5MAGJx5X+HhJ:wrUWqnVAvxeTbOAFvquZpKFubaQKfzwm
TLSH
T161E423287976521BA808BE8F1321CFDB57FE61B439740054EFA3B86BB58D40E5112DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_InitializeWatch.xlsx

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_InitializeWatch.xlsx
Size 858KB
SHA256 82da0e78b865f2b0941fbc75bf68faf0370fb445c158e26ec48e09a21fe28f3d
MD5 9f09ad5817f59dd8b32e9b08938df162
SHA1 5200a03e908734960e57b577d4c18d22d82c2b92
SHA512 174e5fe057f9cce0232ce964048c5c2b53752f0dd9b306d2072cf801fb5f4e2ccaac577f97dc0023aecf915d62e5b750030841c08b9c4c7d2087d11451ee536c
SSDEEP 12288:J7Did1SmcIs3pE2FRnrtNdS24nVi02sOM08Zc+K6BwiztwbJzxXhxE5fS5gJ+1k4:J6XC3ZE2FdiJ9t1Zcvjq0RxE5fJ+e9lo
TLSH
T15415331E15BBEBA5648F2C33B7BF3EEE85608492F303575FFE802D9F59A85889141181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_JoinStart.xls

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_JoinStart.xls
Size 561KB
SHA256 8c6e90809b6b6eff4b59a1aa04519ff360751f65df8b466035d70738e3e9bb6c
MD5 458e0fc0a7f0b42ef62218aa6939893e
SHA1 825d3d698db09d48fd2dc286109a21706c070e39
SHA512 61432980e2499cd42354ceb551a8490d17b3adad4ff77dcdd3e55788490cffa24db7654d1887a1fc508c1f35d716f595eb4dca491022ed6768f0df11fe5650b3
SSDEEP 12288:EvOfjtA/TNOCnEYvQOcQGxGQWfceudB3ZrxrWw3le/g2P:sjbTvQjdZYVCB3ZtXF2P
TLSH
T173C4235B993324E899ADA6AE5CD0742F4317931F13688155E4AEBC0747C1BFAE231B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_MovePush.xlsb

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_MovePush.xlsb
Size 811KB
SHA256 a9de6ba2d904539611e1d080acf27c38771a9b19bc7cbf95a34fb03195aa8331
MD5 d34613093ac814d3873d75368ea00c41
SHA1 2413c715c13743f5e7741bd9607d75eb490e8a7b
SHA512 31f7743d95fc4ae02b215b789f69feb3d0c2dbfbfc1bce935dba1a792d8ced15a848cc47d13e3a8d411df6f6fc4965474fb8fcaf4ac5c3960ad71fba0b3f3b38
SSDEEP 24576:+CfkJ4Iq9Bbg0p5Br5TmAvTXnOqpmvRQeH:5M+Ime0p5p5TmAvjn+
TLSH
T15D0533EE8B9C574F1F902F37A61880EF4620F98EF8D1BED8125856D99CDA23DC84B541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_PopDisable.pptm

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_PopDisable.pptm
Size 327KB
SHA256 a7475ff957c8b5c943669c56b8f8deb840807de6ac36878a589584cd8372ec9f
MD5 e28689059c04dbe6299d1b94426948ef
SHA1 7561ef393c8523392134e593869d438a94f2639f
SHA512 7923cefcc60f60e9ee8a77a145ee00aac00f4e88b9d0f4b4cc58551487c470ab81029852a00c52cf0c54cb9431d9c4bf339b8fe934a2d077367db12aeb64ebb3
SSDEEP 6144:nm9e3Z9wt+FQaQgROrv1fWIWJGgpv/Q49xt7x3p8MoTHJH:ce3wraQWA1WVboDJH
TLSH
T1D56423413C63294A0BA261E81148315C6D2E2DAF2C6CEF416196D25F9EF43F79CC3E8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_PopExpand.xps

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_PopExpand.xps
Size 390KB
SHA256 690d410946ba55c502e18ba6d66ec7a019d11399968baadf7d5b27a769ea027b
MD5 1e15bdeaa1d154a5a11c94e4ea1665c4
SHA1 bbee2772c18d6c7f4b751a4687cd8381a8f8d96f
SHA512 dccb6c9f3fb730bfb2ad8f9351e0fd01768660e8506a04012697c44b33f2436bc456f91cd923f090cf6659a4fbc84f35b5a4c1c3e6d3ae3806ff25d10c926dc0
SSDEEP 12288:mbZaoHk3peWP+nd2W630T8iOv5dMx7pj6pyz:0E3j6d2W8JvsxV+G
TLSH
T1AD84235CB71EE382C734C14B5A6F66E549CEF79465832098EFAA1D0897D22B3A2770C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ReadConfirm.xps

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_ReadConfirm.xps
Size 436KB
SHA256 5791496a300c359337ac84c6b37445dcba6718d68f722afc5722b1c07bd563f9
MD5 ef8685085f00eaea309f66feaa4b5a31
SHA1 cdb0ab923119b7f8d35b81510633de39367f1d45
SHA512 00b12cf0741325ebcfe8ffa02363dca2d0623906549ea995cfc34b04e6cab2a161aaa6c071e5c42dc9e50303383518478f72464eeb4dde3603cb097acb9d24e1
SSDEEP 12288:uLRIJXs5xMj1/Gf/t6V5isl3SieI3BjHsU:CRIJc5+j1/GsVMslXNWU
TLSH
T1B89423895E13AF840106DD8697ABCFFC5670FC9D81980D449C0EB73CD51BEA92AE3927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ReadDeny.dot

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_ReadDeny.dot
Size 780KB
SHA256 0d566576009b1c90a54d4edd64f2fb083e86f7a136b94c49ac42a5ae73865330
MD5 ce78994b521580d522edf47e93a21959
SHA1 82f02ccb10eda7ea8d16e00bba4ac43b5ce9716b
SHA512 a5dc1f582c0db63647ef168806dd82ffc6d5baaa1698ccc2d70019adc165e38c76318d6bc7c2418a0751cff97993cf86c0273a13f1684abccec0bff7c8ca43cb
SSDEEP 24576:qVaXEowGJC6nOdRnBq6FMVa/UDFnzHYf1WP8FY5R:qAXEoH8AyLq85/UxTqY8Kr
TLSH
T15D05336D55B278BF320A365644E000F1CEAE9ED5C09B8EE6FDF7578058B02E0505DAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ResolveWatch.docm

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_ResolveWatch.docm
Size 514KB
SHA256 ceaabf3c4a94c85cc79bc716949e017706a1d2dfb4c72aade83a870dd302d81d
MD5 e6957b484e2104cad1bcfb47df6d91c5
SHA1 12e36e2314b11667090f8e5d665fe4f66be41e82
SHA512 ca921d36d1705fe4837a08867cf7efa9c40dad06efb8e62bdb9925f10162935211353b22b316bbf4e0cd6d389018cffb911962125b224f88382b2f77be25b125
SSDEEP 12288:UphKtcfR1BLYJdL+95CdTxeDJtUPFIWZKDbjHrd5DC659:whKsVgleFKd+bzrds659
TLSH
T126B4235EC40852D6A33490E3AF05F8A7908D983615A2819B9E55C07CB73FED2C36DDAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ResumeDebug.vstx

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_ResumeDebug.vstx
Size 452KB
SHA256 370869af0bd21e8f44cddcd6bb9f002155d71e5da502f20309bfe1046601afaa
MD5 58cf0336bd3d868444666d842b247aae
SHA1 87a41e2a8a2aa99022731e63b2c28a257698c793
SHA512 4fa1edcedfcf8c0ee397d0f48efff4860fcb6f13eb145b67d606ffe4ed79fa94eb0d2a15da4d56f20033b114b181ec547efb4d701e3d2c1fd3c1793fd5e1d64c
SSDEEP 12288:GHaLnJWiRLWhiKefGZUEdiDu4Cb2BIyav:GHakiK47/Ub2+Jv
TLSH
T1C9A4239FA65ED34C83C8CB4F88460776666B7BF9A90A2108038ADC8AD533F750C77746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_SendAdd.xps

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_SendAdd.xps
Size 608KB
SHA256 af66a53da04929e5e1d5ba3ab6b80e3b17daed937f703bbd1ed4e73143a42e0d
MD5 8e7f38efa10bcac12bfffa21e4a787b6
SHA1 8ab1fbab115521c2a5ce1fb33fbbfe3922e88df3
SHA512 4b170f4752a49cb23a4f6fa83cd6b9a6bd74c71ff17fcbb74df5c6bfb72952920af7279b4852cbfb8cff405e7881e15101efe9c1b307275db19f061570a4ea9b
SSDEEP 12288:TQvMY6vqYSrJK3ymoOdgwhGHr6A5kc/Kle/FTkHxDdc+uN:T2JPLfw4+Uoe5kfON
TLSH
T1C5D42366665E4C034B833A2AFB0C2C3DD46DB90FAA2991A15A9137195F03CF2D7711FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_SendUninstall.pptm

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_SendUninstall.pptm
Size 468KB
SHA256 0924f14927c8e87793fd3c5e265d60a6b89414f7d37a6ef7eee4a63ac2d5bdfc
MD5 b0fe80735d056a1c1adcd9957ac3d717
SHA1 5f8b144fbcaddef5e14752af6608a45e0d992bac
SHA512 ef6fa9ebbf68fd032bdba5b42e9daf923312322cf1dc4d8fae644373e73afe502047fea1dfab786e8f9a059e6be4b24c8abc029e94d04be82cea8b37f7449a54
SSDEEP 12288:LUiViCjZd+89K/EK5VErvzf6te/j+4siGC:L7iYoYK8pbjye/j5siGC
TLSH
T1BFA423496DD5D66E425280689CEEDCE54C815AC4C29CEA30CA7F1AB753E0C67C2DEF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_SplitExpand.vst

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_SplitExpand.vst
Size 670KB
SHA256 ef24166d2432bd8d273ca5392f8dbfc5b1363ad0e80f68f4869ffa57eced3b1f
MD5 66388a311f16f0eef52f41c481a12d5a
SHA1 012ee10db82391ada5c7a840b01522730165e576
SHA512 592daece8023fb76af8bf2ec17d35250be9696ed23681176e6c501ffc7aa277e298d9f8662116e16c24005e525d13daf2d84f7dd754f3fea069e4b66cef6c506
SSDEEP 12288:oSajpof4ofpHBumQW2/nX/YmQytNnoimtFqWPHd6KA/Z/e+C:iiQof9Buuungst+imtREr/e3
TLSH
T146E4230F6B61D371D0A900942BAFCC55B947580985EE567358E8A2BFBD8F01ABEF7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_StepConvertFrom.vsw

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_StepConvertFrom.vsw
Size 374KB
SHA256 69344d8361050c8b8fd0263bb1759f5204a8d938c5eca75ac147dd16ed53ffec
MD5 ef52c42cc1d95c8fce49f81e66736bce
SHA1 d5ef5efd01225596946a63870c6ee8dd8581baa6
SHA512 8dfbe9c50e8f1b90d75ac3363ad5e9913c313cb537196bf57f828eb607a9e9252f3de1981e81c55e26b636fa62ea5c56c070551cf1e17b9513ff00820ab2b85e
SSDEEP 6144:bdayAl8/+dlJEE5No6kyHwgpAs6l6ivBmsgs+hvv0+o4Sa//Npd/IxGvDPiO:RslBfEE5i1yfCsCubs+hvMTmixG+O
TLSH
T11D84234173CFB3A9E0AD9A32DA3D50A5B3CC3EF889D6992DBF014D5013ECA609559473
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_TraceUpdate.vssm

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_TraceUpdate.vssm
Size 826KB
SHA256 9aa14cee972350304183ef3608fd05e4b57e012b7cf0f8afd4fefd6bfe1e4e53
MD5 18bf2e516c0c0b5bd1d02d53803d4fbc
SHA1 eb5d48137b1cc750dec10eb81b4fa6b10c86e5ea
SHA512 c6782345caeb078a70d0f9eaef49f9182deb989189d0f5860b83ba037fede9a320dbfee6e78c186d17198285768f9ca04f95a1c71e76da50284775943e6cf5de
SSDEEP 12288:bnmk38WNtMBrsSLpWa14kR7ztM21eGzdR2Ese4o6aTmLRTv+t4cG4BU53:bnlNtIsGlmkNz6WeNEH4orqdGuiUF
TLSH
T1B40533E2D2D81165C02E71980CBE654CFFEABC68E153D38F02E54C68D65B5BB72A0CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_UnblockUnlock.vst

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_UnblockUnlock.vst
Size 733KB
SHA256 fefd55112a2d4cfbf599f1e9d38614274da6cea6f1a4ffe5dbf4ffa95cf67c07
MD5 f8e36c37acfd731957c41530f0e9c13d
SHA1 26c9f29f97671c1a90d16a1dbdfadd97f1b1376b
SHA512 22573f478053bcaa3c35aca29fc6e68f0ef15688bca1e600040a1d9b7e1228719f17369bb21195c47eba2e1eef17cf4313c9b65a9a2c25f4930e00cb2aff19f7
SSDEEP 12288:hn8D25oHZwjC7mamECMbLGIoUUWGsR9nA7tgErpSyaJtyY/4iq4xfZGNurhCYw1N:Z8D2a5Z7maDLGu0ku7tFL4tn4GxfZ4uo
TLSH
T161F433C8239114181896033FE4FADEAB2E1436D75938555E0E7CAABD3CD62B7E36D078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_UndoEdit.xls

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_UndoEdit.xls
Size 312KB
SHA256 7c133c2e2b5271ae46a07b1397403ff5a154414bb29934ab685d9f10b0d09e47
MD5 b7105ced68f119cca5f1f37880848685
SHA1 3f97b6ea791658d0be443a2281549a326180e2ee
SHA512 9dd056fb97f1ff3d070084cece224358139e53528d74070c1211997f359dc67438cba82d0312eb6f981afb03ccb29274dee9c64a6184644c45a5c6936eea0fa2
SSDEEP 6144:VUmdZvNAFW4pVKq/JyYAGZAyJ1mn2Y4IHSA5+6vh6QxvYE/X8qCXWwyM6IEC6:VUi1QxpIqxwHRJXZM6vh6Q6E/X8TRyMo
TLSH
T1B26423205C1C931BC47ABBD0D44B4F2B6C3531C9DE6858DE91A1D994CE5A8FFF898923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_UninstallUnregister.xlsx

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_UninstallUnregister.xlsx
Size 13KB
SHA256 3327e64748342cc483e47eb4dc65c0cc72636d7bfb372b951c91053d60e4d54e
MD5 d73bdfbf110720febaa1bea9327b1f9a
SHA1 70bcf7fb0d68a5010c3dc90e618aca586f4e8724
SHA512 c2ca9c4fa6a4c34e4207c15da51f3629c6a3adc19a344cc2191b899e3707f9dc57e7e4b88779b299012c31d3a886774faec4c7d4758abb44356ee1bc714609fe
SSDEEP 384:wc3ZEi3se8EpGas3UlM9z6pE5MSydAdaoKH:wo8GGF3xWpEUdCfKH
TLSH
T15A52BF06D81214D9EB1B88B980D905C2B20CD3C25742BD9B7666F35997891FFA3FF09B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_UnpublishReceive.pptm

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_UnpublishReceive.pptm
Size 405KB
SHA256 2f9e423aa293448fc806ed4009c45f4be6f707ee4d72c7a132827888ddd9bcd5
MD5 ce2b800954c11b379a9bfea20bda3221
SHA1 3c19ef245b3abc6dc6399878b60870d8383e8e40
SHA512 3f5ab1c8e2956b265739a0bc3b357876c57b95e8a1d1ff25c6bc3f85a256b2061b7f7e2dc7f0a69ea15526c27620600c32d8618b2e9b5a979e7a80c5e2ea7f61
SSDEEP 6144:/zWzU9p4ctiFYxmGdWdXqP7F3u4m+D4vJaLAmRtnC3YZ+YpdKe5CQtV9HOJy8kCH:/CZWbAdlpNsAMB1AYpdK5QtKE8RXxpP
TLSH
T1B3942387B58CCEA47D6D4F187C17648AB2F98B931B90A22082664FFD57E0C96BCC85D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_UnregisterReset.vsx

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\RDP_UnregisterReset.vsx
Size 577KB
SHA256 41d4903c8f056b56561f1724489f85adb3a8b6dc87931084778f1fec06af04bd
MD5 020ed572b0b51d95cd503dcda8825641
SHA1 c3d4bcbee8ef027d98ebf2dd204559da95e8d37e
SHA512 96ff0138d119ba075cb10ba59615474b57f8322a339c3ace7d440d4b9f28a1e75806046795b67d9e0db367ec51dea63517170a808a2a76c18e7c2dbfb9ab898e
SSDEEP 12288:XFiFq6nKrwUZp2wPQ3e9RnEa2p15ilmCoQuvT53x59Hdj5F+Rn+jd5yQ4tEcf:XFKjKMmp2w43U1EZ5ilho19Y+viL
TLSH
T1E7C423A5FDCD94362C25F10CC58FA14663A5A1AE46E3C3798FD35CBE7938D251480E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_vvvgklfc\sysinfo.txt
Size 1KB
SHA256 5cbf577f030cd75355ceb9a26629984c75f7ce3bb9f43ba34f30f390beea2924
MD5 676ad63f5a17b4bcffaf8e34af4c5770
SHA1 1895bbda3a2f036bedbb391beccb3e3ee1f8aea9
SHA512 b0c447ef510ac4e5718562e84d07d6e5eb35139690adaf7605059f32d624179b93d5a9839d406c937597e55edcf813d4c340cc5c5376ea29466d70238b1e65a8
TLSH
T19931010E8D59B09685397A8A6172DF48B65F9343BBE0CB2144CE020EC5177C7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_w3uknga3\sysinfo.txt
Size 1KB
SHA256 0b4915b54f7138a7bf6e190505e875c9d08d75158daa1c539e66d811be0202d9
MD5 df5e9455cc26a404a627beb078eeafd5
SHA1 1dc138b98f81b06dd84d72ee5d88c1f07dadb8d2
SHA512 83e9c9d32b8781483baf73121853395bef24aaec7f4a2f88329d51c23dd6cc2137f2156f2bf9eae6ddf0cb8bc74c6dbcb27714f6688b973292516645b2fa3a30
TLSH
T1E531010E8D59B08685397A8A6172DF48B65F9343BBE0CB2144CE020EC5177C7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

sys7A85.tmp

Path C:\Users\Admin\AppData\Local\Temp\sys7A85.tmp
Size 1.7MB
SHA256 d060836c3002132224222f97b126ab3144f2ffa7e8e5c2240955c2cb4335f311
MD5 41a819051ca70a8e76bc0e4195624955
SHA1 25f89ca6413fbbff4070ea2ae115b2c74275017f
SHA512 e773bb53b595eaaff37b3aec0981ad99b18152f94b92ecabe0abf3ddd7fb28d32f811e5544a4a46596bccc40dac8922065656ca998c628bcca600e026f6a9fb6
SSDEEP 24576:kx2Or9BZEUmZ4bJzsvsgctKeNA7Spl2iKMPbnhSXbM/pQxYV7c:jO9O0htKQA+eoz/Xm
TLSH
T149858E17A2B900ECD067C1B8CE565607EBB2744513346ADB13D08AEA2F27EE55F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download