e1f41d3787616383cae9e323bd56656efb85ba860b088a513670554f73f2db7f

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.8MB
Sample260808-cwkdgsbb79
SHA256 e1f41d3787616383cae9e323bd56656efb85ba860b088a513670554f73f2db7f
MD5 f0373e52511c90c760e380d6ec2d59e9
SHA1 bc5b23efb5d03a3638437c5c67714dde20d7a398
SHA512 a4da0ed566e9ef2bf8cccd464bd06bdd4980cd40af0f9b4e3b3aecc379a8a531e5c30abae4cf807c658e2303b0dcff5fa63260a1463e902fb11ab67f4b01e43c
SSDEEP 24576:66afiQqeH4KNO3VGQ9uBn5qXso5oAG1B8KInTH+F6BvEo:6ZwA6sC6n5GsQO8xQ6
TLSH
T1E9958D1BB2B900EDD067C179CA165607EBB274550330ABDB17D08AA62F23EE55F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000002428e-2.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000002428e-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000002428e-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000002428e-2.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000002428e-2.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000002428e-2.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000002428e-2.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Enumerates VirtualBox registry keys 2 TTPs 19 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	z5o6e4an.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	4np31bmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	duca2fdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	qydrn5rm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	1nr7xh6s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	4s367o77.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	uepyokms.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	7x5b8bqv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	sys8364.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	gqfiiz3w.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	s8wzrb9h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	r56nj150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	43swo59k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	pzskmka7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	6vmvgm60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	ws2drzt4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	x02heao4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	mldzlxue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	t3wr02cu.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 19 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	qydrn5rm.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	z5o6e4an.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	duca2fdj.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	6vmvgm60.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	7x5b8bqv.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	sys8364.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	gqfiiz3w.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	mldzlxue.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	43swo59k.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	t3wr02cu.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	4s367o77.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	x02heao4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	r56nj150.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	1nr7xh6s.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	uepyokms.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	s8wzrb9h.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	4np31bmk.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	pzskmka7.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ws2drzt4.exe

Looks for VMWare Tools registry key 2 TTPs 19 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	7x5b8bqv.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	x02heao4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	z5o6e4an.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	duca2fdj.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	uepyokms.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ws2drzt4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	sys8364.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	qydrn5rm.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	43swo59k.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	4np31bmk.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	gqfiiz3w.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	r56nj150.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	pzskmka7.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	6vmvgm60.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	4s367o77.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	s8wzrb9h.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	mldzlxue.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	t3wr02cu.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	1nr7xh6s.exe

Looks for VMWare services registry key. 1 TTPs 19 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	6vmvgm60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	sys8364.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	qydrn5rm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	x02heao4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	r56nj150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	4s367o77.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	pzskmka7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	uepyokms.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	7x5b8bqv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	1nr7xh6s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	ws2drzt4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	gqfiiz3w.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	z5o6e4an.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	s8wzrb9h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	mldzlxue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	43swo59k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	t3wr02cu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	4np31bmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	duca2fdj.exe

Executes dropped EXE 19 IoCs

pid	Process
412	sys8364.tmp
4912	qydrn5rm.exe
5040	gqfiiz3w.exe
1084	x02heao4.exe
3588	z5o6e4an.exe
2780	s8wzrb9h.exe
2704	mldzlxue.exe
1424	r56nj150.exe
3416	43swo59k.exe
3964	t3wr02cu.exe
5700	1nr7xh6s.exe
1076	4np31bmk.exe
1584	4s367o77.exe
2908	duca2fdj.exe
5604	pzskmka7.exe
2764	uepyokms.exe
4176	6vmvgm60.exe
4620	ws2drzt4.exe
1944	7x5b8bqv.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nrq8sb = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\uepyokms.exe"	pzskmka7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\z6w8t8 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\ws2drzt4.exe"	6vmvgm60.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\usv1rg = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\z5o6e4an.exe"	x02heao4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhdik9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\r56nj150.exe"	mldzlxue.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tlhdce = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\1nr7xh6s.exe"	t3wr02cu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c7o47n = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\4np31bmk.exe"	1nr7xh6s.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spxygd = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\4s367o77.exe"	4np31bmk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bhbk8m = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\pzskmka7.exe"	duca2fdj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rc9pze = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\s8wzrb9h.exe"	z5o6e4an.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qb6u0s = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\t3wr02cu.exe"	43swo59k.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a2hl27 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\7x5b8bqv.exe"	ws2drzt4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uchxkp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\mldzlxue.exe"	s8wzrb9h.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4nbel4 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\43swo59k.exe"	r56nj150.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d8jikq = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\6vmvgm60.exe"	uepyokms.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jttnfs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\qydrn5rm.exe"	sys8364.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4ksr4c = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\gqfiiz3w.exe"	qydrn5rm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\27txls = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\x02heao4.exe"	gqfiiz3w.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nu3y96 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\duca2fdj.exe"	4s367o77.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 36 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_ucwlrduj\desktop.ini	pzskmka7.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_gshans87\desktop.ini	uepyokms.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_83j95u5x\desktop.ini	ws2drzt4.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_3n4lcr36\desktop.ini	r56nj150.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_vnfnx8tg\desktop.ini	43swo59k.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_80dima6o\desktop.ini	1nr7xh6s.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_ujkxm0k1\desktop.ini	4np31bmk.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_mkokc7im\desktop.ini	x02heao4.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_x5hq78mu\desktop.ini	s8wzrb9h.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_xrhnj57p\desktop.ini	t3wr02cu.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_eq6laney\desktop.ini	4s367o77.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_gshans87\desktop.ini	uepyokms.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_83j95u5x\desktop.ini	ws2drzt4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\desktop.ini	sys8364.tmp
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\desktop.ini	gqfiiz3w.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_mkokc7im\desktop.ini	x02heao4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_y9vv3vvl\desktop.ini	mldzlxue.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\desktop.ini	gqfiiz3w.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_ujkxm0k1\desktop.ini	4np31bmk.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_9l44wzn3\desktop.ini	duca2fdj.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\desktop.ini	qydrn5rm.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_otdi3awz\desktop.ini	z5o6e4an.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_9l44wzn3\desktop.ini	duca2fdj.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\desktop.ini	sys8364.tmp
File created	C:\Users\Admin\AppData\Local\Temp\sfud_otdi3awz\desktop.ini	z5o6e4an.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_x5hq78mu\desktop.ini	s8wzrb9h.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_3n4lcr36\desktop.ini	r56nj150.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_xrhnj57p\desktop.ini	t3wr02cu.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_80dima6o\desktop.ini	1nr7xh6s.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_hzkjxyfq\desktop.ini	6vmvgm60.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_y9vv3vvl\desktop.ini	mldzlxue.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_eq6laney\desktop.ini	4s367o77.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_ucwlrduj\desktop.ini	pzskmka7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_hzkjxyfq\desktop.ini	6vmvgm60.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\desktop.ini	qydrn5rm.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_vnfnx8tg\desktop.ini	43swo59k.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 18 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3080	cmd.exe
3068	cmd.exe
3804	cmd.exe
4868	cmd.exe
5916	cmd.exe
6104	cmd.exe
5864	cmd.exe
4980	cmd.exe
4732	cmd.exe
1804	cmd.exe
4592	cmd.exe
5524	cmd.exe
5016	cmd.exe
5132	cmd.exe
3396	cmd.exe
764	cmd.exe
844	cmd.exe
3548	cmd.exe

Enumerates system info in registry 2 TTPs 38 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	4s367o77.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	duca2fdj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	pzskmka7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	6vmvgm60.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	ws2drzt4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	x02heao4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	t3wr02cu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	gqfiiz3w.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	6vmvgm60.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	z5o6e4an.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	4np31bmk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	pzskmka7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	7x5b8bqv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	sys8364.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	gqfiiz3w.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mldzlxue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	mldzlxue.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	4s367o77.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	uepyokms.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ws2drzt4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	sys8364.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	qydrn5rm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	z5o6e4an.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	43swo59k.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	4np31bmk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	qydrn5rm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	r56nj150.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	r56nj150.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	1nr7xh6s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	7x5b8bqv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	x02heao4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	s8wzrb9h.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	43swo59k.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	t3wr02cu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	1nr7xh6s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	duca2fdj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	uepyokms.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	s8wzrb9h.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5636	schtasks.exe
2108	schtasks.exe
224	schtasks.exe
4712	schtasks.exe
2056	schtasks.exe
2664	schtasks.exe
3408	schtasks.exe
816	schtasks.exe
2008	schtasks.exe
1944	schtasks.exe
2588	schtasks.exe
1248	schtasks.exe
2996	schtasks.exe
3008	schtasks.exe
5960	schtasks.exe
2764	schtasks.exe
5756	schtasks.exe
5268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
412	sys8364.tmp
412	sys8364.tmp
4912	qydrn5rm.exe
4912	qydrn5rm.exe
5040	gqfiiz3w.exe
5040	gqfiiz3w.exe
1084	x02heao4.exe
1084	x02heao4.exe
3588	z5o6e4an.exe
3588	z5o6e4an.exe
2780	s8wzrb9h.exe
2780	s8wzrb9h.exe
2704	mldzlxue.exe
2704	mldzlxue.exe
1424	r56nj150.exe
1424	r56nj150.exe
3416	43swo59k.exe
3416	43swo59k.exe
3964	t3wr02cu.exe
3964	t3wr02cu.exe
5700	1nr7xh6s.exe
5700	1nr7xh6s.exe
1076	4np31bmk.exe
1076	4np31bmk.exe
1584	4s367o77.exe
1584	4s367o77.exe
2908	duca2fdj.exe
2908	duca2fdj.exe
5604	pzskmka7.exe
5604	pzskmka7.exe
2764	uepyokms.exe
2764	uepyokms.exe
4176	6vmvgm60.exe
4176	6vmvgm60.exe
4620	ws2drzt4.exe
4620	ws2drzt4.exe
1944	7x5b8bqv.exe
1944	7x5b8bqv.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 412	4372	2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc.exe	87
PID 412 wrote to memory of 4732	412	sys8364.tmp	89
PID 4732 wrote to memory of 1944	4732	cmd.exe	91
PID 4912 wrote to memory of 3804	4912	qydrn5rm.exe	94
PID 3804 wrote to memory of 2588	3804	cmd.exe	96
PID 5040 wrote to memory of 1804	5040	gqfiiz3w.exe	99
PID 1804 wrote to memory of 1248	1804	cmd.exe	101
PID 1084 wrote to memory of 4868	1084	x02heao4.exe	106
PID 4868 wrote to memory of 2664	4868	cmd.exe	110
PID 3588 wrote to memory of 3080	3588	z5o6e4an.exe	116
PID 3080 wrote to memory of 2996	3080	cmd.exe	119
PID 2780 wrote to memory of 764	2780	s8wzrb9h.exe	122
PID 764 wrote to memory of 2108	764	cmd.exe	125
PID 2704 wrote to memory of 3068	2704	mldzlxue.exe	127
PID 3068 wrote to memory of 3008	3068	cmd.exe	129
PID 1424 wrote to memory of 5916	1424	r56nj150.exe	132
PID 5916 wrote to memory of 5960	5916	cmd.exe	134
PID 3416 wrote to memory of 4592	3416	43swo59k.exe	137
PID 4592 wrote to memory of 2764	4592	cmd.exe	139
PID 3964 wrote to memory of 5524	3964	t3wr02cu.exe	142
PID 5524 wrote to memory of 5756	5524	cmd.exe	144
PID 5700 wrote to memory of 5016	5700	1nr7xh6s.exe	147
PID 5016 wrote to memory of 2008	5016	cmd.exe	149
PID 1076 wrote to memory of 6104	1076	4np31bmk.exe	152
PID 6104 wrote to memory of 3408	6104	cmd.exe	155
PID 1584 wrote to memory of 5132	1584	4s367o77.exe	157
PID 5132 wrote to memory of 5268	5132	cmd.exe	159
PID 2908 wrote to memory of 5864	2908	duca2fdj.exe	162
PID 5864 wrote to memory of 5636	5864	cmd.exe	165
PID 5604 wrote to memory of 3396	5604	pzskmka7.exe	167
PID 3396 wrote to memory of 224	3396	cmd.exe	170
PID 2764 wrote to memory of 844	2764	uepyokms.exe	172
PID 844 wrote to memory of 4712	844	cmd.exe	175
PID 4176 wrote to memory of 4980	4176	6vmvgm60.exe	177
PID 4980 wrote to memory of 816	4980	cmd.exe	179
PID 4620 wrote to memory of 3548	4620	ws2drzt4.exe	182
PID 3548 wrote to memory of 2056	3548	cmd.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\sys8364.tmp
  "C:\Users\Admin\AppData\Local\Temp\sys8364.tmp"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "91l928m0" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qydrn5rm.exe" /f /ru LIMITED
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc onlogon /tn "91l928m0" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qydrn5rm.exe" /f /ru LIMITED
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1944

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qydrn5rm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qydrn5rm.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "3qc48m64" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gqfiiz3w.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "3qc48m64" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gqfiiz3w.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2588

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gqfiiz3w.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gqfiiz3w.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "96d1s0rl" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\x02heao4.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "96d1s0rl" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\x02heao4.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1248

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\x02heao4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\x02heao4.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "dlho3028" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\z5o6e4an.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "dlho3028" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\z5o6e4an.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2664

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\z5o6e4an.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\z5o6e4an.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "npkyx37o" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\s8wzrb9h.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "npkyx37o" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\s8wzrb9h.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2996

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\s8wzrb9h.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\s8wzrb9h.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "23qguler" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mldzlxue.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "23qguler" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mldzlxue.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2108

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mldzlxue.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mldzlxue.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "cho7v5nv" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\r56nj150.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "cho7v5nv" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\r56nj150.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3008

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\r56nj150.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\r56nj150.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "5h9gu08c" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\43swo59k.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "5h9gu08c" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\43swo59k.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5960

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\43swo59k.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\43swo59k.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "o2guevsf" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\t3wr02cu.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "o2guevsf" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\t3wr02cu.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2764

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\t3wr02cu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\t3wr02cu.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "al5cee7p" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1nr7xh6s.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "al5cee7p" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1nr7xh6s.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5756

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1nr7xh6s.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1nr7xh6s.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "g0np9m57" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4np31bmk.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "g0np9m57" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4np31bmk.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2008

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4np31bmk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4np31bmk.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "xoj1w35z" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4s367o77.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "xoj1w35z" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4s367o77.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4s367o77.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4s367o77.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "49zcpb6k" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\duca2fdj.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "49zcpb6k" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\duca2fdj.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5268

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\duca2fdj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\duca2fdj.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "ei1dmxy6" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pzskmka7.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "ei1dmxy6" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pzskmka7.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5636

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pzskmka7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\pzskmka7.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "2cibn9wz" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uepyokms.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "2cibn9wz" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uepyokms.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:224

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uepyokms.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\uepyokms.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "den1b4ii" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6vmvgm60.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "den1b4ii" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6vmvgm60.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4712

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6vmvgm60.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6vmvgm60.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "ezcarmvv" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ws2drzt4.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "ezcarmvv" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ws2drzt4.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:816

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ws2drzt4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ws2drzt4.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "zl9arnny" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7x5b8bqv.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "zl9arnny" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7x5b8bqv.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2056

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7x5b8bqv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7x5b8bqv.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3q496f2c.db

Path C:\Users\Admin\AppData\Local\Temp\3q496f2c.db
Size 20KB
SHA256 ffa3322f7837d87b02dfde5e0c728ed4f878de28bc2bb8966dc5b1f2edf3520e
MD5 a48a2eb8289f33d5be1fa5b1ba81c5cb
SHA1 16ea98a601477e3664881b02ccadff733009c150
SHA512 de57b267741108d0b998dc2fc5500419ab76daee08f957571823d872e85ec92e9bc4e25a2a49881753d27834b7c2431ca6904953864d9560f2e74e0a9cb2568f
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd5zpEfopidYQa+UEkla3j:TeW9aw/aHLopFMavU1iBNH6weYQSE86
TLSH
T14E92058F1F307514C0F48B32EDC285571E7C211CA327AA99AE5420B39DD659BF5054A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4sbxwor6.db

Path C:\Users\Admin\AppData\Local\Temp\4sbxwor6.db
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fvlcgjo.db

Path C:\Users\Admin\AppData\Local\Temp\8fvlcgjo.db
Size 138KB
SHA256 efbbb14f16a03c4198dab865482b4ca4cec861113158fbbed7d08245994b0bf9
MD5 812ffb2baed49a420da3c2bf41662565
SHA1 6c4b8df9aa0169d56f8a777b0e4327873c913b91
SHA512 036542d5ce386985a4502b38117e1c73a3bfb6d9146035abdfdb89938c85a8a01e4cb3f2a9c1a64603f3d8a3530a97248d51bf3d40821cad30a536ea238ea0f4
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OeSpX6cq/+dVumkwkb:zeuvBnhJsueMEGvIW1DcP2O50WVumknb
TLSH
T1A9D3874B3A743102EDE69A721CE050BF5E3C716D4F55A5D428B620688EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dabp1r8a.db

Path C:\Users\Admin\AppData\Local\Temp\dabp1r8a.db
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffsokais.db

Path C:\Users\Admin\AppData\Local\Temp\ffsokais.db
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gl93ckqw.db

Path C:\Users\Admin\AppData\Local\Temp\gl93ckqw.db
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hxn9nzq8.db

Path C:\Users\Admin\AppData\Local\Temp\hxn9nzq8.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o5z6cc3h.db

Path C:\Users\Admin\AppData\Local\Temp\o5z6cc3h.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_83j95u5x\sysinfo.txt
Size 1KB
SHA256 a7ac030606803d25d65a70649748bbbbbd5c61db504e91fe397c5051ee3afc03
MD5 d2890e591f8c2ead10e1fac22fdad6ad
SHA1 a234b216bcafdac343ef2ff1f321d9293aa98c6c
SHA512 670949db64d74013ac597f4ae784e3c58b38bc781d6ab2dbf0a84f7a354fdb007367ea10b04240e87e7fd0ed69f0e74fa36ffc23a3422212a9d4b7b4f70eb83b
TLSH
T19C31120E8D99B0868539B68A61B2DF48B55F9743BBE0CF1144CE021EC5077C7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeSFX.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\AdobeSFX.log
Size 1KB
SHA256 606db60e354f052de3c5da8f87b0e4513515a6aeeb24cddc810415df50fb3c28
MD5 4356e1c6c9652f7f7ed264a32a938804
SHA1 b2e5d4499113d349afa5f5bc0c94f252e50afaf6
SHA512 0d44c05a34634b5a7f8a641406a2fec5f657733a1496c2a47219c6afc5e0d66dd80139a6d20c2406dea7bced58696d4edaf672d8407edaeece7098220155721b
TLSH
T104419E4719FF81773E014385B36ABFFECE50F62B2F45696063858129350AD346EC361A
MD5 SHA1 SHA512 TLSH

Submit Download

JavaDeployReg.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\JavaDeployReg.log
Size 13KB
SHA256 b3e2a631bf361bd9e33136c47ac1343e88cd2ce3ca3b49591c5a6f2ab0e5e581
MD5 133c3ba8bb1f27cf0187e4767a0abd1b
SHA1 03436738f664fe3e1fb8ebd7fcb7bbf0f8eb3b9c
SHA512 1dc1de9fa43cb8bfc6489177acba7b260387963635d4921e02026340f03fe984373e7138637551abed78d6eea64a047130f10c6aa6f727ce16d3b17240a4754c
SSDEEP 384:0r+KXEHM4JKXEHM49SqdA7ZZZZZwf+Tv+o:0r+KXEHM4JKXEHM49SqdA7ZZZZZh
TLSH
T1145279811CAD09FB68E202D7A7433EE4D9D5A08F878A180434D6D97DFA16D405BE3AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20260514_004758169.html

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft .NET Framework 4.7.2 Setup_20260514_004758169.html
Size 93KB
SHA256 8c89b3444b8a643f9cd128812e8cf5e387926ed141851a90842b64eca82a8f57
MD5 041f477ea8bda731b3c8d5d3c74f378d
SHA1 846bc5ee93fd653112663863c9962aa356121952
SHA512 f5544a4b8590819d376a9e2b2dc67f45105a643a4aecda989779ebee8d507abff54fa6d41ecd5fc13c416c26523d2fb6739cf0aa23cabfe716477d15d172e6b2
SSDEEP 768:fdsOTLyUFJFEWUxFzv8vdQlQNBep/Z9bwR:fdsWyUr+WUxpv8FQlQNR
TLSH
T15993B41377D80195A8F3BF4DEDB210261AB8FD855C34DD2C13A54A5D0A96E20ECB2FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514004822.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514004822.log
Size 15KB
SHA256 bb591c253ad082f45fe3b1f68f652f9c46713ad09870b8ce81640ee04256c4e5
MD5 2c75d26e85a390d99e3ef23d1b13905d
SHA1 1892af25532df6bafe00961b40dea4284995e94a
SHA512 796656dba0d9dd765ba91955248593bfe96696ecc42a1da0a2239faa3dc5288115d1f967a4387d09bba1ac9261def00ea2fef3f7db8b392f5c3cf3dfc2c85170
SSDEEP 384:zj3XVw38333l3g323xO3fMO3fsVpaEV6VrPV1MU+A333N3K3Ex3fBE363D3hx3fh:zB1oMoepamMrNrNBJBh
TLSH
T1D6621287AEF453862CF07596E3152BE49F07B9431E0426F0BEC3472EC685D24E36BA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514004822_001_dotnet_hostfxr_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514004822_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
Size 95KB
SHA256 43d1c4fd8a86d8835571901d35a0448a8dd39496c166d84a53128c6b4035ddd3
MD5 5d3f835d9451fc7e8fa2c58bbc5078da
SHA1 140a28726bbeb52361543ea4b82404825fe9c1fa
SHA512 41d98c2043879200ae6f6a418037244138c42a3a261d16f2e6bc188b2bdbc7d3ad30561ba33b2fa65f0064345c722388e26309d1a428ac6679616cc41c2d463a
SSDEEP 1536:ZzwSf4zaH71dJXVDmRy47Z45OpJboiq68UCc5W7xES2Wp63jJXdVUP08:Z6hjJXdVUc8
TLSH
T121A3C8192FF44146B2B3DA479EF388179673BD265939C90D2182830D05B2D09E96EBFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514004822_002_dotnet_host_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514004822_002_dotnet_host_6.0.27_win_x64.msi.log
Size 105KB
SHA256 965f8eb105c0f0abc828a0d735068dd744cc529687a3af98143a39ff27156a0a
MD5 ed8e5b7188f21d5ed82421e83a11774f
SHA1 443cd4e4216036cca93bf00c2af1a3ca0d7d36eb
SHA512 9ce04741d8fa03c3077ab34d3b00a926ddee80b0c5f9dd22802e5d06f8c396c38c21c3f3d2ac8e260756e4e7af81c25be7cb60a96cc695beda9311edcecf5e94
SSDEEP 1536:zq9SP2nmTfxN5HObemCeBTPRlp6aNzrDZ+t+yhUvtNTefjhg23aEjzhjrCBke:zQEjhg23aEjzhjrCye
TLSH
T15AB308196FF40046B2B3DA47DEF3481756737D275A39C90D61C2831E00B2A49E96EBEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514004848.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514004848.log
Size 15KB
SHA256 a261b135623d737270aede127d544a86644d310e02d884a289a50cdd452e298b
MD5 c71b87da8117d23f79f9e1032e4c2827
SHA1 c6c36f6ac5701b2154af143bb8a1f362a9ad0733
SHA512 fb5e34644a3c941c2eb4a69c5a23d7a48dbf3202da4846172c29c6c1c31b4a046760afb8997922bdfc0c82860c7d621f68853ecf42379cb5bda036732bc5a956
SSDEEP 384:57acVja3ayaqaha9a9PanSPanqVKjUV9VRCVP2ahsaaafaEaX2anP0aKaHaU2anN:5RV8S8cKjWDRkVqbvbN
TLSH
T18362044AAEBC62860CF174AAE37A6FE5CB17704B0E106EF43AC30E5ED545810939EF55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514004848_000_dotnet_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514004848_000_dotnet_runtime_7.0.16_win_x64.msi.log
Size 470KB
SHA256 51b6ce0809c61a1e1075b5091f6bda9f86c4f92e73f17f4ca7adcde1840f9ee7
MD5 e4c7ef700323403b270ed9ef26ff827c
SHA1 9739275f736a2b1ecb4411b383c40a07ff591e79
SHA512 72e2cb29dad84c9e8bdc8d6983a068a0078ef17dc88d45ac0130d894202d2a3f4813037feaa5287f656a92a25aaf02065218836225a9a67dc58409d8baba9476
SSDEEP 3072:dQmkj8YXWsRK0In2+qQnv8fsTx6+b2ekj0chfMmGYRe8eoHBLONPeQF60nmkFibc:ajxW
TLSH
T10EA45A24AFF80256B2B35E47EEF384179576BC32AC38C51C6182834E0576E05DD6AB7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514004848_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514004848_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
Size 95KB
SHA256 09e23d8734f33fe6d545293875d55a9e3c03af084837c74d42dbd14a9d4d273c
MD5 5230da69c364d6687e305b856ded9494
SHA1 87744180361234ce935c8a0121bc2167adbb2c9b
SHA512 ed2a9b6dabc899003569d04d28b2891b108890ea9b4a29109d31b24b296a54f9b20e99086e26003da396102201b8be6c6cfd8c14a77ef36f467fb569da2bfa99
SSDEEP 1536:KvkD360Zw8+9b1TzG7oKcCvJgpDbIyKKs0SMZmTBUaY40MbjZlkWkY2gI:Kn4jZlkWklgI
TLSH
T1E8A324192FF80145B2B79B47CEF344279B7379225A35C90D62C2834D05B290ADA6DBBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514004848_002_dotnet_host_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514004848_002_dotnet_host_7.0.16_win_x64.msi.log
Size 109KB
SHA256 34e5f4a7e9d0cdc8abd9dd702e8cbacb40c7958b0f340e4f55455102a983be64
MD5 6ade9c56a5cc925f70cf95f13f29a9c8
SHA1 967975efdd3438ddbb9f8d03e411318f7256f813
SHA512 979f1dd013990db2e67c5960b450d9280a6bad7ffa15d9a83642b153bf3dddc1c8e862360d03c6f9731e9ad6fdd0b976e425e51859a159b002497e82c25277a8
SSDEEP 1536:x2Rt/m9wJV7VyTcLOYaRbhDJt56il7D7hG1eiG0qtNA47jeXFSq+K3WLOEbVF:xqAjeXFSq+K3WLOERF
TLSH
T1AAB315196BF80146B2B7AA07DEF3442697737E225D39C40D62C2831E05B2D06DA6D7BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514004916.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514004916.log
Size 15KB
SHA256 64a8ccea92245060a7cc4eaa3d845a00e8e20916c88327f16f79c704846b2679
MD5 33e9f6afe3fe28126625c7850bf7185f
SHA1 81f65bd4309cbb057c0219277bab6da50dcd6b34
SHA512 249d3427aeb46073a0d3758e590dca8f7fe2b19b27624d5c8b0fd77532c433f65298ec38d53fd19560c68404927f07b69f2be5be7a31ef2ff929da57011033ac
SSDEEP 384:r0gUV4gzg2gmgFgRgzNgjMNgjuVRsy/a9kRlLVeVq9IV43miGXigAgrg4gdQgjro:rW24M4g89AwUqL6nNln2V
TLSH
T15672F189AFF452C72DF4B5B693267BF85B22784B1F1017F06993022ACF9A818D38F545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514004916_000_dotnet_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514004916_000_dotnet_runtime_8.0.15_win_x64.msi.log
Size 470KB
SHA256 06b119814c088b70b70cce0b65b06875f65794b23deaf09fadb018352142bd5c
MD5 991c0dfcd045c1b9567b226b117280da
SHA1 26323dc010deb4af529b07cd64821afbacdce04f
SHA512 95a5829ad41547cfd89a6f084e12602830adc1b37ed5adbe641cd1249e57446577e8ad500427f9b481d374c646a84830e7c1657d9d173f1905c56db9ce2a1337
SSDEEP 3072:iuiV3W/BMC0LkW0wtX1q0e4ibdjsZ5yJDqh+KY0DauP7We0eeD/BwGhrEbF9F5eE:1j6Bb9
TLSH
T161A45B24AFF80265B2B38E47EFF34417A576BC32AC38D91C1152835D0572E0AD966B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514004916_001_dotnet_hostfxr_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514004916_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
Size 95KB
SHA256 5da8a97a9bd7e083b5fd0d15ff62b5d28b03e15e09670b8d63fe91debd3e3a2d
MD5 88bce5c481bc935be2a489a2be5d18a0
SHA1 d4f7cec099ce89068a91e2951cfe4e41ee26b2fc
SHA512 e8601d854d8284be4e0dc3240925aacae4e44199d74d18e71f706f1673c0b507f0add80decf1da10670b86b4e61482bc12848e101468edadc05d27458e0a073a
SSDEEP 1536:vbt9nOUmd9AHiUJAM+KpXxTmemUseeexV5C6NDrTJhjpEeYV0Z05U5mrjZrlE57u:vbt9nOUmt022ErjZrlEkjUvuvEnCXBJf
TLSH
T153A349256FF40095B2B79A87DEF70423A673FD269D34D90D2282835D01B390AD66C7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514004916_002_dotnet_host_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514004916_002_dotnet_host_8.0.15_win_x64.msi.log
Size 109KB
SHA256 0c875b4b85bdace325daeaf06a13c00ae1facfff6abd937e574f95342013cd76
MD5 ba7013058051d6384582158e18afb19f
SHA1 fbe8964d43b4bfef3e932022b151238a3288a568
SHA512 65d02ab6a3a66086ff49302edca83a14616b01b36a6f9234829282764c84d2b3086126c9e74819bfaddffc6fece336e92bd243ea69aa6edc17b2ab0a6d5b88c9
SSDEEP 3072:ZuUSWnRHd8R3MJKHA9j20JI84Wo1D5cV36MHE2s:nju
TLSH
T187B327156FF80066B3B39A879EF308274B73FD259D35D91C61C1835D02B2A08DA297AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aria-debug-1516.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\aria-debug-1516.log
Size 72B
SHA256 3593497d58285fca2848b64eb88ce5ced0e284b427cec12632f62b54a9728273
MD5 cda380fb0a05e101eb37a5179b4054b0
SHA1 6a973482bf6f1e0dc49e23843f6c48292c192197
SHA512 a50537d699fe71abb2af5320a324588a417db22453e7ea829fe3063ad3d8ef17a971687f858769f42b01a6dee5f5c1488b95bc802dd5082b7cb9e57853f15e7d
TLSH
T19FA0240044CF473D4100C1135031C00DD1F50C4D3FC073140705441C434143575C3100
MD5 SHA1 SHA512 TLSH

Submit Download

aria-debug-4328.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\aria-debug-4328.log
Size 72B
SHA256 81c407923515392e92a5864c206526fbc058c2c1a633e39a38f35f2025094335
MD5 b340e95cccffbe2109693fd20c31bd46
SHA1 0d4cc29b736bb1dc39e0a4481b3c65bfddd82dde
SHA512 3737a2bcfd76d73d02e39b366117c755ad7943820b20ca6be7be5d492ffcaed488dc9f8e7a23db3c3aa9cf63b5f02467eae4ce6853ab874c7c984a0dc8557d4b
TLSH
T12FA02200C0CF8B0E8208C20300B2C00EC8FA0C0E3FC8E3380F02882C8302338BA83300
MD5 SHA1 SHA512 TLSH

Submit Download

aria-debug-4736.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\aria-debug-4736.log
Size 470B
SHA256 862736942ed2f98e45e7f087ff13149a628c3a36b37ae9587c4dadc141c7da03
MD5 7c827763ed9d11d5b220ee02e792d823
SHA1 826e535023c7443ba318c4af74c8f22a9dd274b5
SHA512 ca459d4ce3005da51110680b53653cdc4b288cc4ed93095e7ff15f827ef9d3313dbc7b645057684a5f41ce1c3a5dae84f1e4574fa9311ece4c816c107b055958
TLSH
T1ACF09E8A0A674C67C61B37B3B4939AD328D5E67FB2D40700852D532C10873C8A243C84
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\cv_debug.log
Size 353B
SHA256 69dae5a001919f13e44494c495e765fe4e0879b4a0cba819ae97fe1ecfb173a3
MD5 2eaee2b88e4ef6f377680d3dbbff8d00
SHA1 eac4132120683b0cf9c94c34d3858348349c0ea8
SHA512 5d83f4fe9abd20f0532d8bcac3dcc754b8e0ebbda3548ee42a8c2780e52b22da44a861394b21d7752710bb564d7e60570a278e1e867128bd56aa78fb06867a72
TLSH
T18EE026907470E22F2B878BC480614CC45612F157836F4B1CDE8A8034BD1CAF1B79EBC5
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 15de6360d97c6fa2c3abb7271f05addb4e9aec6bc69df37ce518fad349d0b94e
MD5 6a763f5113f3506df79b73744260f485
SHA1 a5a0753944871871731d68baffca01fec2d0c033
SHA512 d8684adf22e2bb576933bc2cff6f1d419c8ac81d88318836fa4461ed6b2a437d825171a2586c74f334f893c93e41835850f45a5d19469c3afb627e2fbae848c7
TLSH
T1F72123BB40DDD0A138F5B4C0C75F9ED280FA014AB2C995B6BDE0A58C292307DAB598C6
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredistMSI6F9D.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\dd_vcredistMSI6F9D.txt
Size 426KB
SHA256 0c57d244dcd2ad8949f0c35db5bb81adf115b5018c5e158dc47b33d55b550338
MD5 196635789f92b12067e93c064fb6cd85
SHA1 3c99402b694b52d6b61a43422d25aa2ecf749b4a
SHA512 bd1483ac9a63c8801406d09662520273809888f57713f1397f2e5c850acf57cc29403c6c9f794bfa827260179dabc58222b8f53c2d6d6a7cecb569695629be4f
SSDEEP 1536:7bIdWJm18S4UVHAf+48vHCcabICn4re/2pEyVPcXT//dKWArcXEVEY3/cOqxpdj4:4qivjLrprj8h4iWX
TLSH
T1BD9476245FF90226F2B29B47DDF34523A9377DA2B939CD0D2291830D05A2B05C969B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistMSI6FC1.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\dd_vcredistMSI6FC1.txt
Size 413KB
SHA256 46e16b79769882d55deb3c3590e36de83f7c379c8f671b0cc68055da45df2414
MD5 91e1e82715c094dc34c4e1ac3b220fd3
SHA1 77ba25823d6b36be1dc040e41d6fe3d9f7605970
SHA512 f96330555d197f7fcd670eaca8eb4fe8f94c898e35dea0ff92618e69db43bb5292c1a8170c653d43e33ac9239c2ffcebcfcd7d8671be99b660ad4959b30a65fa
SSDEEP 1536:HP0iC3HFf7oQBp8mNXPjWEfrsB3cDXjzMPjpXDb4lwszb4SGFV5cZ7n02+OQ1oae:HPAFjzrURWDzAUAeG8
TLSH
T100947D245FF90216B2B39B47DEF384136A33BD6ABD39DA0C2251830D06A1F05D975B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI6F9D.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\dd_vcredistUI6F9D.txt
Size 11KB
SHA256 fe570f347103cfe254e508ad52708e9f86193e2ec7c9de137e3824c8cbeddaab
MD5 f3e1662f1d84afcf171b2b2071f6e5a7
SHA1 57c39d9593f00aef11f71d4bd59ec78913c3ac26
SHA512 01676e978fa7352096e12f54dc7a81cccb308d97ac8955bcb69a606005561dff13250e5ebfe882a78531f130800bd2707bdca9a0b089a20499810b89d56b3050
SSDEEP 192:Ij6oBKcL1QXi4JfnXnzdnXnlMARnXnEHYX8BhF98Df:Ij6oBKcL1QXi4JfXBXlMARXJMEDf
TLSH
T13132EE65A7E40447F8F29B8FECF29013BFB6B9517978C90E46F5234E04A6604E4E136B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI6FC1.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\dd_vcredistUI6FC1.txt
Size 11KB
SHA256 488ae9849f81dc1238845265c9b4f79974db2961818b9efabc98210e10310553
MD5 d0c0c3d23e6dd7af868fc3a6fdda09ab
SHA1 9b1958b81d52804d3a5775a43d2fcc25256405a2
SHA512 ce571e6a00e4877593e21276d74da232f71d13b206f176721cc6e2261c6a0d35f708419295775403124ded79cde2334e14eb1ef14e70ae5b6022b83614f75365
SSDEEP 192:bSy5laZoInBnZnjDnZnbMOfnrnG5GJ8vhrj8dP:bSy5laZoInBZ/ZbMOfrHCWdP
TLSH
T181320E65A7E4044BB8F29B4FECF29013FFB6B950697CD50E46F6238B04A6504E4A136F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\desktop.ini
Size 190B
SHA256 d01a7ef6233ef4ab3ea7210c0f2837931d334a20ae4d2a05ed03291e59e576c9
MD5 87a524a2f34307c674dba10708585a5e
SHA1 e0508c3f1496073b9f6f9ecb2fb01cb91f9e8201
SHA512 7cfa6d47190075e1209fb081e36ed7e50e735c9682bfb482dbf5a36746abdad0dccfdb8803ef5042e155e8c1f326770f3c8f7aa32ce66cf3b47cd13781884c38
TLSH
T11BC0121492F93264A1724E12BD707011DBB1F4227C16DE9D1341518B08A1600D631B53
MD5 SHA1 SHA512 TLSH

Submit Download

file_grabber.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\file_grabber.txt
Size 15KB
SHA256 be9042737ea9e2688715cf2b496ad56246ea83ecfc53a949be4f22c721886c88
MD5 341dffaaaddce998164f76627755fcd4
SHA1 f12f46437f42b3d230a52f1ba0d01378bf846eb1
SHA512 2cd8b3663af0bf1688eb8c7da15ad03dd40ecf978b269577fe5e0a2388a73a4a5ebcc8aebb27cdb26735852eaeead5f17ad2d1b154694c29d78a23fdc039714a
SSDEEP 384:DJvPR7Cug363al3o3s3fiaSaXacaFanmgEgogWg+gjQclYWdPpBE:hR7CH7NjpW
TLSH
T11362E64448CFCA9D024EE0FB24B6A54CE7704E4F3E8A7B6E9B11C54893C271EEAD1E55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firstrun.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\firstrun.log
Size 371B
SHA256 dd63d4ff679f8e70622a2ca954fcfe0a5c91ba57425bd1218ebc3a0ea13cf440
MD5 4ed79c1575033d0ae5add2e10f689605
SHA1 15296382f26c05ce34f6e4d32bac1a69b381e286
SHA512 e9fe5bca2ddb6fa7295c4cc0b7dfff160c5b3472badbe4180305220eff9fb2e549eceb11c1e57c2bc442ef77daaaee90fb584148af1ca49740f95955e13ace5f
TLSH
T1B4E068AF440582BB8FB011E02425A7375F213A0F03CCA0F3D21E37A8028709C0C39817
MD5 SHA1 SHA512 TLSH

Submit Download

ftp_vpn_rdp.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\ftp_vpn_rdp.txt
Size 43B
SHA256 31fd6687fa56c5bc6daa22a7fd879d3d4d390f2c15bf352cae63194abd9339eb
MD5 37650121bf2afca6096d843157d005b5
SHA1 9aa0b2644be54fe62e9b13707b5fb9055f9470df
SHA512 ce287b6fd1a647b149ddf3f00717dae099304b8ca7f67b138ff0eecd431fbc0805536dd47d6f167c1ea1677e0967d5f48b3ba93fc325cf422a610a50338a3c3b
MD5 SHA1 SHA512

Submit Download

jawshtml.html

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\jawshtml.html
Size 13B
SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\jusched.log
Size 163KB
SHA256 66928e98b4379461855b7e60108df0aab1714eff19870341c57d04b36965117a
MD5 be67918f5c8d09bc69f20a683f9341c8
SHA1 e82d8487612d8ad7b1d9dee1f78d9c408a5cca28
SHA512 72208a0a40b5959b70c7638e01e2add7772466d1b853e324c0f3a16f247caadba4285b744d376422c9c6c513d67c99134d0614987cc4637b77cd99f42711f157
SSDEEP 3072:wMzRUJRRjsJ1oqflfj5kFpN3MCcrrNF0VIOgW8+fjFA:Hsf6
TLSH
T1A6F33186983E44BB38634BD3D36A6D64D596050F839E0A1C31CFC2EEB456D03D95E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mail_clients.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\mail_clients.txt
Size 69B
SHA256 ccc3bf1bb2e5aca2d3bc8eb7338727b10fed9d2aec624fd26b36f9d5c11e5b3b
MD5 e7a80003174cc9c3efa4a142e206d3e5
SHA1 4e5937f4e02e02e792ab60b53d20b655a80e63a4
SHA512 070d8f0b24ca3706fa20b7b6b0ed824907cccd8459b78dd6ba496d1bf7481858207ac2df4ce7fbb0da8f0fb627213cff82e6f9983c12441618689b746ac1cb39
TLSH
T1E3A022C080C8E80E3C20200B00F0CACCB223000B3F023BC28300CE282082808FACE0C2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\manifest.json
Size 1KB
SHA256 609995e8dbdba5ba968a6c604750e725059902b4e8c1f693851c738d3938317e
MD5 8afea622647be84467127ef5cb12745d
SHA1 dbbecddc500f406b199dabaa7cd38b1bd3d34557
SHA512 51e562c06c99d5a7bdc56df7b61d8b420a42e18e46d9d7ba182c07ac6fd671f68b9c65c0a2356d4ab17e7c6b4f22920d94f57514ac831a46d0fd60450a98034a
TLSH
T1744169F7BC00AD634BA49898AA1E710EFB29B24D55CFD4DB8298107342CCDAE1D601E5
MD5 SHA1 SHA512 TLSH

Submit Download

mapping.csv

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\mapping.csv
Size 120KB
SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
MD5 d3186aada63877a1fe1c2ed4b2e2b77d
SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
TLSH
T11DC35121D2F6619CF5F3AF941AB41AA91E73FC16AD2DED9C0250620D0466E61DE31F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\msedge_installer.log
Size 3KB
SHA256 2c0c4b16b046029ee9c87b7a401fd01f04d6faf6a67ef7b4a6bcfdeab8776469
MD5 5562393a29272f07e72a6af57451b49d
SHA1 4fe3d072e0a84021ebc9a6ece0cece769b00c4d9
SHA512 5bce8fcbc6526f3ff5c9a3d734dbce1890462e68c7a0a2552a1cc551bc3f840ac7c6763852f4c248b9c94cd356b22fe9da73b3517c495135b08b13f6cd003a2b
TLSH
T1E8614B62621BC3FD278B3172215B17FC919E0589CAC466B52DF84264BC83ED3427EA92
MD5 SHA1 SHA512 TLSH

Submit Download

offscreendocument.html

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\offscreendocument.html
Size 97B
SHA256 b9fa2d52a4ffabb438b56184131b893b04655b01f336066415d4fe839efe64e7
MD5 b747b5922a0bc74bbf0a9bc59df7685f
SHA1 7bf124b0be8ee2cfcd2506c1c6ffc74d1650108c
SHA512 7567761be4054fcb31885e16d119cd4e419a423ffb83c3b3ed80bfbf64e78a73c2e97aae4e24ab25486cd1e43877842db0836db58fbfbcef495bc53f9b2a20ec
TLSH
T132B012EE6C03C10004551E8A38E092146412638870D1A1445CDEE0334D4075C9C0B44C
MD5 SHA1 SHA512 TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_96mcvupi\sysinfo.txt
Size 1KB
SHA256 3245c3d74aeb4d18146c6e6726301f55d6cfdaeeee46e962a82cfa944b2a3a18
MD5 9e4c18e793ea255ce55e6187f88bdcb0
SHA1 05301b61b2510097e47ec2811f16435afee575ed
SHA512 52f7adcad00c8a5cc31f095d098f9ccaeb7d909c0b08a2b002cb6f2dee4db845df5b83aadbabc6567dc46144ae95c0cbcf36843c0afb8cd230b03aef9d385a18
TLSH
T1E531010E8D99B0868539B68A61B29F48B55F9743BBE0CF1144CA021EC5077C7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_9l44wzn3\desktop.ini
Size 282B
SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
MD5 3a37312509712d4e12d27240137ff377
SHA1 30ced927e23b584725cf16351394175a6d2a9577
SHA512 dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
TLSH
T1AFD0121496E8221052714E26BD789005DBB1B8212C1BCA9E5680918B18E6A45E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_9l44wzn3\sysinfo.txt
Size 1KB
SHA256 bdf0127d1dbfdd4cbebb16703aef74ba096493b54f5e107ddbeabc4b1577c36a
MD5 f6d4703834335dc0644566263476c630
SHA1 f5c89b1f8c971bb95554571499a27d984effefc2
SHA512 69676d1fe12366158c44fe451471bdbdcf6e95fa90b7505b8abfc4033162c2cf6d2054c0845748f0da7fb1426ad115e6da18f335bd67d7da96582dbb0d3476a4
TLSH
T18B31120E8D99B0868539B68A61B2DF48B55F9743BBE0CF1144CE021EC5077C7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_otdi3awz\messages.json
Size 2KB
SHA256 bbb81c32f482ba3216c9b1189c70cef39ca8c2181af3538ffa07b4c6ad52f06a
MD5 26b1533c0852ee4661ec1a27bd87d6bf
SHA1 18234e3abaf702df9330552780c2f33b83a1188a
SHA512 450bfaf0e8159a4fae309737ea69ca8dd91caafd27ef662087c4e7716b2dcad3172555898e75814d6f11487f4f254de8625ef0cfea8df0133fc49e18ec7fd5d2
TLSH
T17E41669EC276678D0F386C779C34ABD914BB47D0349073268C1CD186B3A66B890ADDF9
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_otdi3awz\messages.json
Size 855B
SHA256 156fc7ba9b5728908e1a74950b97474f73d8f58933d345c8eeea8284565c8357
MD5 aa431ec252b4339a49d172c6b9292ba3
SHA1 26fd7003368d5342620464a53af547ddea7c7328
SHA512 c47c2e530ee2dd0bcc1ed1c2f8c54aeea3dcfac277bd85026dcc6c07e2da693b35577bac4924c45bb8423ad9aaecba324eec74291ef5cf2586a8b0b9f0084cba
TLSH
T136114C1657731D648B5F9012FD367547517C4BC61185E0EB248D994F219582DE2B32B0
MD5 SHA1 SHA512 TLSH

Submit Download

AddInitialize.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\AddInitialize.docx
Size 19KB
SHA256 cb0e0ca901bef78e220f3456eae3bca8660ca32460a8aacd425dadea76899c1d
MD5 bba17e8e7f11598f5936b5e957ad9eb3
SHA1 16a45c114efd66b41d4003c71d01c8a99a7763f0
SHA512 b87618f1aa4f8f45e705669be76d276370bc8797780b01348d86ae3e3f0022b056a06309b8053f5ff21275c5739f5abaf80b66c72e207983e36cf777a2db1bf1
SSDEEP 384:a2hsNjyB/JLtiFvo5tZw1rdNxt/ZtNNSUeIFHLsPOH:5s+BLtYkZmxllNxeItLGc
TLSH
T16992C07097226C24F8D3867D904D42FAD15E949739263D9B310EBF8F0202D671B4F96A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSet.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\GetSet.docx
Size 18KB
SHA256 b006a87c7a93547ff1dec40e4b418ad1c04589b19f25e6eeffcd3b260733da6c
MD5 f6babb3a8b64fc988698667bba588db9
SHA1 05c18acb440c6c02917fa33ff33c30fc4e3e9557
SHA512 2fe7464e8fa9759a1a83fc273534011ecf8977bd3cb73b0ab3251499dca655ff564d82f34c426741c718b86f47b88404b5b151be7d29e5acc3114a4e2bfd8829
SSDEEP 384:agvFh2ftIgQqi1cIlYngdNxt/ZtNNdA8f4HIFH4sO9y:buq/FGI6MxllNu8QHIt4Hg
TLSH
T13582C06ED78A4D70DFA74B3C711C21F1D62AC343BF5AA8DA103A9ADE471671397064C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewRevoke.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\NewRevoke.docx
Size 18KB
SHA256 dc98513fdd0239bd3e22038c9d2df24f872e0bac7a8374bb754cab48f2efd28f
MD5 ee6f65ca7f7d93a6cad6245543d268c8
SHA1 1ce774b6b1a93e8f9779e0879bf99f0c8ad59b3d
SHA512 a427a338da1791132863d4cbac32ce34a7ff18f3b9c0436a189b69e0683e32df14c68e1af781a2c7964b26c4cf232d89501343ba1097f14de96ff11338370ead
SSDEEP 384:aNoIo5RI3G4NbDVW0hLyW7cwOrDdNxt/ZtNN2b+IFHSTiQ:tLiW4l1H7toTxllNzIt8r
TLSH
T1E682C074D9226C91DBA3C63C915F31F4E51C42463121A18B729C2BCFA3A6B9BCB172D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopExit.html

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\PopExit.html
Size 380KB
SHA256 df5e42bc592fc515894ab18bfc5f1f21712f8ca3decd4885317a396995d2f775
MD5 61593fa3053b34892ac5b768b4f39183
SHA1 d2a2236b44d708e3d14807dc8c5dea76e2dae18c
SHA512 5fe348c4b78b6811c7a3d863071c01f7956c29e7aa58a7650c4390de5a7db80abf7e088670ee952e2866a73d6a69fbd022de0846575beced52a765a71c1f9c1b
SSDEEP 6144:xBc6gSlj1YsVgfMI0XrTAZMw9VaPa4+yzIDfyNGtRce8ZQQ/BecqfV/3VaDtBVbk:xq69lj1Ys0M7rT0Mw/aP49ysG/g11Ep4
TLSH
T1D48423DA73461B0EB4263CE96390D00664E8F7397E84D9E815EEC0F5B4174F692AB332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ApproveSplit.vssm

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\RDP_ApproveSplit.vssm
Size 665KB
SHA256 14e7fc89c03febab0a15972171d726d68e64a3025532063d78e6a178817e37cb
MD5 a9df36a5490a16e1a50b4a8c2036e849
SHA1 980235ac862a986db4366cbfef8432d3213183c3
SHA512 6e5c15c28b26168d68676a899efdd0ea68aa427f2ae5de70af6feb3269c06a06a9b0e72cfbf805d638aabd08fa41f3eb330a256e00ae55680e9eb33588482cdc
SSDEEP 12288:7TTdsg6X9My2n2cwGygETKP/2HPWRtTQl5loBRJkfMTGPU/75xspH3Zhk:7vb6XIEKX2HP2GloBrkUTGPU/75Chk
TLSH
T184E423F18022DCFB0B509A54F948D76E8AAAB72F4A1479D4B317D5B122206D45BFCF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_AssertDeny.vstx

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\RDP_AssertDeny.vstx
Size 551KB
SHA256 28e26ccd0f66cad9bd40cedad01d74b4d1fce73abc70fb3f87707710879e1335
MD5 2123a45bf6e43194243da00433a33513
SHA1 39468bda71bbaa3ffdc862536f8c682121d04572
SHA512 030f0480ae0faacdaefdef0be18d6b1768f6f71b5c3d4e762517bcba827e33d5c86c81ccaa9a768780d7eaa89ec2d023c75064f68e56a54c47c8ffba437a3e30
SSDEEP 12288:JLZGN35ZTEg4ULXBgVT9j0duCYUxlxSQZwL+JBpilHZ:8ZYgB69j0dLxlxSQZY+ryZ
TLSH
T16FC42389AF2162FF79118F5CFF0A94363419F5BE45E0802E54D85AEF53A6EE45323E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_BlockStop.xps

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\RDP_BlockStop.xps
Size 323KB
SHA256 839ea2718177efe9b0223649add5c0570fee2817519de2f95638adf4d8fd90db
MD5 bd7cc95359c5a2030aea4bf3b4eaf0a1
SHA1 b008b63a8bfacff9bb8d434cb60ef38df3ab5193
SHA512 f6c334289b41bd37042ccf9eae1d7671a431c3923c18e8d7a55ae2e9418f3dac8f534df53de0620cd40caad2a42cff279f338249d2ea16dfd948b0bb47ddad62
SSDEEP 6144:4ozZ1SSiIKpjqJLmWABlj1WwzZ/gbrcdEptGK0DqED5UX57o60z:4oF1STDjhNZ1WwV/MrU0I/dUpoXz
TLSH
T1BB6423D73B689F1A12EFE8C811C959DD49283F84497063F1A3C4626EB05AFD6783197C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_CompareProtect.xltm

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\RDP_CompareProtect.xltm
Size 399KB
SHA256 c49f2541f67a94526253756b26f0449209e02414390021d1ac102f51e37de2de
MD5 07b77d733a1ad6da385a53cc1257b16b
SHA1 a95d979724519a66d54318ffe455d71c122a8708
SHA512 037390f5922668fdee48170bc3aa78d2016398159173330e8250ed398150433ee2b134ede49b0637f64c51ad2a2eb6a18d73d9db0a4d81c537d5545331467b39
SSDEEP 6144:06iLwEX2qvFUv2PcwdDLmlaAOrisMLFys3PX+jqWD6JphWUB/BXtYyVqN:0IoFUvLiALcs3Gm060GB91y
TLSH
T1AC9423C973DE0D5A660B04BD44D5BEA2EF9C431DFFD01A1A60378620ACCAD9A2D5CBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_GetStep.doc

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\RDP_GetStep.doc
Size 722KB
SHA256 98f88bdb27b2cfe6f49f0bfa15518834275d949dd3c6ac40bfe86000fca00c4a
MD5 9d342e6262671bd6145ab2bdef1e0b58
SHA1 3db0fa57c8925e35f5273f021461efd70928752c
SHA512 c084639cd43c3c91e72304f4432d5b40c956e95409a477e6f1a881656c2fe368386df7a81b303def36a31571a232b6dd2788193182d9ded2fc50328ca71e659e
SSDEEP 12288:5Z4F8Byx0VGfIoYgUaPBrfo9PP1KePQApaHwlCztN/TvhIJIWq2Rx0B0Xb2:/42S5PFoPHQCmpTZaIWqkx0B0L2
TLSH
T1C3F4231F72949F59A6E429F23307E8E2FE206599E12F17395CC1BB273569BC62D4800F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_RedoInstall.xml

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\RDP_RedoInstall.xml
Size 646KB
SHA256 4765b0d83116bee11d74e1a46f9d63cb2d54e936e3c67fa9ab2b45934504c6e2
MD5 4a00fb9ca607d3f394ff31a4dfa05246
SHA1 45e1abd585fb44c084e745e8a4d31ee76f203f81
SHA512 c33d16b0cec1e44bde3cf73018fec5aba857f1468d97bd99d4e9b6ab8529c056c06e432c6080dd2e38dfb203fc624f7c63af21a284dec312f28820abe14c54a6
SSDEEP 12288:SvLxt1ilGzoVZ7rj5ke/rpeqSHhA8HTbN8xry39BxQwY72mwm/XQL:obqAQZDdrpJKhA8zbND9B67aMQL
TLSH
T12BE423777C744521F25A889B0C0E05D5496DAD0ED7E9DD1A90FAE22CA081CCBDEC7B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_RestartExit.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\RDP_RestartExit.docx
Size 836KB
SHA256 625e9b9a9de0bd1b9bf61a63b1be48d5e4a33812d9ccf0071300058fe635be88
MD5 cd33c7732613dd8da2205236b6c12c98
SHA1 d3b241416efde408f6665bb1bd94bf1e8758d03c
SHA512 3aca5508aae4d12e8a1d945e103d72a557ce70ec7a99c12591454760a3d71ac716113e3a8c427c6c2598d85e55e017ae84fd07ccce57e3a1380a32e8c3b95efe
SSDEEP 24576:9eZM4FnIn185tuiLkPpvaUWdERwR2V7Mg4EUn:sZM4ZkGTLkdK87MgbG
TLSH
T14605339039BE6E33E2044AD5AEB91ADD49BB9176B50FB593C00043D53CDAEE38F252C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_UndoFind.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\RDP_UndoFind.docx
Size 15KB
SHA256 233e49203f264c3ad312a1373049a2938af76d1e733b30529bf08dd4dcdc03bf
MD5 7fe022ebc7294792b112e1ca42c4f6f2
SHA1 fb76aba73c54ebe34de30a9a538243baac3331cf
SHA512 5ff3bea47a80ff5eb79dc9feba253f425ee1ed5fb549eb9a11d8f620b9cb6c986eb3437e3b656008e48fd96704c197ebf04bf5a74383c175015a753d7f98c919
SSDEEP 192:Cto8lerDWWbYcGvk+m+xOAACCNxtpgoZ22NNqY0ZEpRueTWNGFHBEcbjsllr:ao8levNYMcEdNxt/ZtNNGTIFH/jsllr
TLSH
T190629E30D9576E20EA635E78D44D12F7F60D8602B753E0CF644EBB9E562A742234728B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\RDP_desktop.ini
Size 402B
SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
MD5 ecf88f261853fe08d58e2e903220da14
SHA1 f72807a9e081906654ae196605e681d5938a2e6c
SHA512 82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
TLSH
T18DE0ED19A2FD661052719F26BC78D011CBB1B8216C1B8E9E86C4918A18D5E14FA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

StructuredQuery.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\StructuredQuery.log
Size 4KB
SHA256 c2ac78109ae266fb586b8b348aa8e5ece0d77f4b39af79f1c837a3dcf78a3985
MD5 8e750883304a2eeed7e737e6f42bb3c9
SHA1 4d24d9212da1df5a20ef059f46cf5524ff4ee578
SHA512 22fced65a2a3490040aa92e24de388c12c94306b2b09e04173faf926199f0c9ddaf84f40f09d20fd468c8e4efaac50b61ac8d150ccf9dc298217eafc77fe4581
SSDEEP 48:Klx9Vz69T0oXIGXTWGXsP9JEX98TNw9PT78lx9Vz69T0oXIGXTWGXsP9JEX98T4+:NvTlxvTlC
TLSH
T196A1C2B7A5C48D26407BC0119AA41AC4FD3082734F6A5A41F69FE2339F334BD764BE0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VGXMSUXF-20260514-0053.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\VGXMSUXF-20260514-0053.log
Size 56KB
SHA256 08c5be6254f3e1d08a1520c2613ecae549846b728ec92e0d4e4ff19c35128f67
MD5 b3a011ab029c7ad0404aa2887d8140ab
SHA1 f44c55198810dd8874adac9e6bfdbed18300399f
SHA512 944f940ac6ca4dfdab22b108bfb2ef4e6a2df76b42b183e63749999b37e89801cc4d21b2c8b6af8790c93e19418dc6cdcca1ae6c102c5a160c964a19109b231d
SSDEEP 1536:PTmaUGESzduoOWWMh6CAIpw7WH4d4Bkt8XydGiUjBvYeSi6uQm22x1m3XHnTb/fj:aJCuAMeBkt8it
TLSH
T145436D18AAE90686F2F78B4699F74067DAB27E577C34DD8D20510F0E1926E45BC20F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VGXMSUXF-20260514-0053a.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\VGXMSUXF-20260514-0053a.log
Size 181KB
SHA256 15f599fb02f6c1ea85ed1a8a63cc2eadf1cf503031cca1a1aeb66a2daed4b267
MD5 659ad532057699b775e4688d6e91ab92
SHA1 425d0cb597910059c50fbf3a89a2d82f8ed5987c
SHA512 7add556e41ebde588c7b32ce145b8b54286b3216619f2cbccd2ba91da6e03249271b19d21b7c87a69a1befa8b056b67df5eb41ed003d5ecb4e6246bb66a3dc6e
SSDEEP 3072:oCJGsxgNLkpKiylIAQagBLL/6fuU/6Wbj9/6sa:n9pKiAIAQau/g/p/ja
TLSH
T18704751C6DF90656B2B2DA8AAAF24463DB72BE676834CD5E10920F0F0416D41BC65F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\messages.json
Size 912B
SHA256 ec78ddd4ccf32b5d76ec701a20167c3fbd146d79a505e4fb0421fc1e5cf4aa63
MD5 71f916a64f98b6d1b5d1f62d297fdec1
SHA1 9386e8f723c3f42da5b3f7e0b9970d2664ea0baa
SHA512 30fa4e02120af1be6e7cc7dbb15fae5d50825bd6b3cf28ef21d2f2e217b14af5b76cfcc165685c3edc1d09536bfcb10ca07e1e2cc0da891cec05e19394ad7144
TLSH
T1F611C0C543D25FC9472E83577B15B0112BE60BB562C23A73E9E9321D18578B57907F38
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_pdzd1d30\wmsetup.log
Size 697B
SHA256 6252f71b2656ff3c71f43f6d47f20ec96b044e4e9ab2be3edef157ed408a939c
MD5 4f36ee7e573d1d0cb49dc69c7e230003
SHA1 37d5d471afd5d258c4a44db42dc1dcffa12cb843
SHA512 48d365c4886654cd14b9b48015d694280f0cfff59b13c5c7b20b84f2765fc2d4379148a77bb36e9ffd05b790092c6b121009b919a7200dead0b98dd6927b19f6
TLSH
T15F01FC971B4DD87099D01BA76EDCCE2573BBC3CF93D1E066A348D025450A52D673E05D
MD5 SHA1 SHA512 TLSH

Submit Download

RDP_DisableRead.ppt

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_DisableRead.ppt
Size 570KB
SHA256 2407d1acad08e08947fe3a6ac017752012e28ce0dbf248339d2b4d3e0d210b45
MD5 b2cf8e5556cf7a3621614b0cad32c742
SHA1 ec1e5b6082fc99ca9bb9f16d850aa119104b0494
SHA512 2910e262c3a3c93291a8b406a89d129630477d01d020f43d6865d97e82fc9ee756b0f1087706c5890cb0f3f035f7e8b2ba15e758a8d5e1cfedbcc21189f6240b
SSDEEP 12288:dKMz89kqk5NBdhFRXfDvh2B08gGCUCeZXjY4Pf3z:d0qqqTHrv9BGpbdjTPf3z
TLSH
T1A7C433F748051BB0FAF4D08B33AA250FE862BF630375B8C6E6F971E60085B9574A651D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_DismountClose.vst

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_DismountClose.vst
Size 532KB
SHA256 36b6ea50e0836c974e195345f76f73f64c071dd236fb3dadbdd37b1d20ee962c
MD5 2d5536f1142ef23477fd1f6cf24ac495
SHA1 629add74e2d66710a6a0e7ad273b188df0370494
SHA512 a063ec575c3d6c0c77db359d512e4d11c363d8d43632ffe4121425de882814763d0626b2be03d7646f360f618ff614bea62ac7bfec80bbf9d0d5747024d509a3
SSDEEP 12288:B+ExaFEjiivLsElNky5L3S/1MOmvYqYCFAtiN:B+EAFTizsAd5eEYRCgk
TLSH
T1A4C423E5BEDA8857A7C17FD62CEBF0FBB14AE1CD9EB14D1E4934430181463A2A7294D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_EditPublish.ppt

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_EditPublish.ppt
Size 475KB
SHA256 ae820449c763f990c54b471b23a6a90cb5d0f4adbc3424036815b5c631627e9d
MD5 ff3d1de795186566330c16cde5aa25bf
SHA1 7f8293a86e9024125e68f6ff7f1f3165970c33b7
SHA512 de08842e6634cdae5d11bb3dde2af315e18401febf3be0270a75619d25ca857a99c105ae51863e51907bd525902011dbc13d8f4ec2b77d3a9403d5984c6316c6
SSDEEP 12288:ybDmztcDmcAvgRd7GhzCvB9eHngN/CJSSAYw6Y97V:yfmBAlD7dZ9eHgNFuw6Yz
TLSH
T10BA423E6C9D5D8B8D0917C6F9C84D1D00B96E52388B6631700AEF0D706FD64EB6EA438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_EnableConvertTo.vst

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_EnableConvertTo.vst
Size 418KB
SHA256 3b38bd23b5ef6b0bbdfe1a7e952150459a259743e225dca510cf48b805527e2d
MD5 d06c7bf73c1a1f8c42ebc59224123fd5
SHA1 da70eb4fb1327baf52f19ca611cf459596fde59f
SHA512 eeed7e58ab220130d08183ca15cb9f0464e0e0e2faa6070efebe9bf506c514d9a2ea62dbf308a77a5a375f9982596329c68ee7efbbdfbcf80bccc1b9fa744440
SSDEEP 12288:d/vP53je7Q08qDDsIbl5bD1KjI8bZKjsZxkY3:z3je7Q08gsUl59K089XDD3
TLSH
T1B5942352C6EECF8957538EAD2BE9759E9B552298ECF94DD80CF2BBE4948E1531C0030C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_EnableResume.vsdx

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_EnableResume.vsdx
Size 589KB
SHA256 653808a8e8b659f5d618e7daf4cd91ddf33c9dffeb522981232ee4c3a6b01b59
MD5 4ca837aaad8e95a07c58f84cb547ad88
SHA1 3ebb5f2f924ac77de5324ef32abc98e94cd89337
SHA512 744b00d1326953fc7da37c822de4458069b0b7fde47a925bd6979406478193fbe2eeb9caee6eb021305208e69bc0f8c96e7c521d7fc8faddfd3b56d0e588d662
SSDEEP 12288:F8QRV/YF/VLd74NtK08B0jqHLUpQqFOuT3x1l:TTKVKtj86jqrcQwR3xj
TLSH
T12ED4233F73BAC230D5A84B50C90B3B1292CECECB6A9509B70614ED66F8E7D80BCE5555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ExportConvertTo.xlsb

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_ExportConvertTo.xlsb
Size 494KB
SHA256 23f7ff08f6c77cad3ed6181c6007a2355ebf998b45c960d9eebc2c67feb5d8e1
MD5 4ebd8c6d837a66e95ec22ef473248d08
SHA1 2850bd90ad680d65652cc46e59ce350c938e53d3
SHA512 e0f762b24e36d9e4bfdc64262eccb171a002832ed9cbaa95791341d89dfcca694aa20c5cd63526826baf3ea59a7bc956c8a9a97ed78e8f77e805be8478fa450c
SSDEEP 12288:xTuVSQ1uH2hHfLUKi65u9T3k0z7tl3/pSnr7lVrhyKaEZhGK:h7moKiIu9TU0z7tJ/Q7lR1hGK
TLSH
T1CAB42378D8B9CE699D303EE4A9274842708B0BC760E4738A7CBFFA71DC65916761604B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ExportUnlock.xlsm

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_ExportUnlock.xlsm
Size 874KB
SHA256 cf170c3c5dc941dd51e7bed8d12abd644f5dce3e6643752f8665079433e6674a
MD5 51c5a75ab4a42c6f4c3c1395a3df801d
SHA1 ca3a824b54201ae30a3202e20cd0dea9ff976491
SHA512 1eb7f61877d88ac28d16d1c1a82677cf2c2b8a529ea1e9bdd7c6f68a76d2c40aee0919d42b940dc59ab16af1a839f4d07363286b350dc5fe71752a0e0355b7e7
SSDEEP 24576:VWekxjUybRcteuhXyAbbxzG3Bw09z+pwwrLBjbpv:Id9bisuh1vxP0o9hj9v
TLSH
T1551533DDE269477DB30A1559E3FB5FB98C036D4AF4042BE458DC2FD9D20520B82B3A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_FindProtect.potm

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_FindProtect.potm
Size 1.2MB
SHA256 7b484b08096de6caebe7099e438066973aaee23ea99494cffc9fc61a18297f66
MD5 39c61f06a11feba29e7172be2def83de
SHA1 e88e7959c5404c2e8b9475c80f7bd3282f33fd14
SHA512 7f728b13e049e42b5e658e1b0bdab0c94b25d1d95dee934e6b57ba32edc89fb07bfe24795b047cde7f2c3bedfb6110bdb269ad061214c0ee5702451124ac39a4
SSDEEP 24576:BGwyaT91dnPGVqh6/yPG4/dHrnDKj29bLmyylWsf4RC26mlmK//GGs:BGwN1dPGUh6/yPjpDG29bLmyqWsf34M7
TLSH
T1164533FE140D5A3E1FDBCEB790B22BA6146CE63E584A971FD5874196E8036718209C73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_MergeTest.xlsx

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_MergeTest.xlsx
Size 760KB
SHA256 792a0f110d5c03d4ce0c32c0f64784c65bb00a749b0b5d3566cd194a5861ea3b
MD5 45741c18f0835d81031d81791b1513c1
SHA1 c13b4afdf313d1c883f5483a3edf266af18a9d78
SHA512 c2e0a36e45114898af3eac56a5c16b5e8256c4867ed0b36c065af95fda0cbe9a62db634cfe0608f6af953145e13bc8b4fc1fac1d8390e1429743f338a0d14b23
SSDEEP 12288:0Gc5EVL+eesvEZB93wf4RpUUf9nkqz/4JCGK2dJQXpDmXqntGJw/SVBCFRmm07ma:EAaYvEZBRXjUU3/4XK2E5DmXqCw/qc9c
TLSH
T170F4330D16AC04570530F58AA1578CD8FF6F44885DAB8BFB879B7B3D918A76CC0F2A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_NewLock.pot

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_NewLock.pot
Size 798KB
SHA256 87ca82244aab6e50bb0bd6032407eb4f740293a9e2d8352f65a1bc33e3acc992
MD5 7483f5afbfb6a1a26f00fb8bc8837de5
SHA1 e2c7473c8e2471848604fc4dc5f662a6feacb2c5
SHA512 0741f08193f9717b8f9deae6c4c6b474d5786c832f4fd2e345c8a7089af835c83d68171cf26e93c4f256af64f3195a0fc140e56bfde0e11c1cf44cc7c7726108
SSDEEP 24576:QvsbEuxYAAXbcM57For67TS6sru0ZOSGUH:aKLpALlE6iq0ZAw
TLSH
T13B0533CD681DFF70F9BB0299C50A7998A90E0531EC23AB4E69F7B45BFD9878F0085914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_OpenInstall.potm

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_OpenInstall.potm
Size 779KB
SHA256 7b092b265a247a2de85b6aadfcf329d4fc86c015ea34762db89bb9c018d5ea45
MD5 63b39b6f6481a96f90becd14f4de4416
SHA1 4104d6d420a670ed5ab52d2e439954d6ecc8c768
SHA512 ed96cb3a999f81a4d0888c1d036e9c114d23bdd82aeb94e43011af0b7e7e9d73e560ee5abdc86440ba37bc01a9e156290cbbffeca377997faeed0956ffdbc10a
SSDEEP 24576:KZs7cN2V1PiLVii7kT422FBmfoLIqr7+/091d:wN2XKVX2qmgLIqvK0F
TLSH
T16605236950FA69DE9F0FEE921505A41D39D89D14DF60E0AD30B272C43C6508F3B8AEEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_RegisterReset.dotm

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_RegisterReset.dotm
Size 437KB
SHA256 158e78cc58ca73adce386d7a50d37573919d9452317c51a3e847ebe909c27299
MD5 6649ba79f6e5d673f31383a327d53139
SHA1 5a1e98295b4ab79d81702138a41b94dc569aa3af
SHA512 f33dee82e31fdda552d259cec2ec5fe30faa44824d7368dd0b3fe313a995fa3a1c23507f4187b06a3cf54e39ee3f714354ec50c9c6cdfeb2eab7556223d27dae
SSDEEP 6144:LzZbf1wXct5KPNYfzWPFS/KUQCyedraRIBisNzX4vP7OR5xHp:/Zbf1wXctEPNY7HKUQCyeVaRIBfZi7E
TLSH
T16E9423C19D8C93CC60A5C88D376F52AE3D3723A9C22876C5985FD6F51884EE60036FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_RepairGroup.mpp

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_RepairGroup.mpp
Size 608KB
SHA256 b313c947019fb060a3d30c6f759a338367b65cfedae1700f7fba1905c7390636
MD5 1d8c58ac44cf37b239e3c77e17b41e0e
SHA1 90517a73e824495f391fff465597994a773be779
SHA512 fbe7b095b9e195cb7f1e2269712c0f7a4a8d14f4df2ee6bb78f60a7d88cbd3efcb4bccf267d20fdbf1687a57123fd9495f9b1b133009684dbb2620af0848d4ed
SSDEEP 12288:gIL0PPftfBXbH0RkdjUijznevlEmnQjcqmGs+xcev4Iiyo:5oft5T0RkvjivlejcqmKFvk7
TLSH
T18CD4230DC17BFB0A8C99552809E8956824F1419ED5FEC3BFD60F22AAAFBF204485F645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_RequestComplete.pptx

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_RequestComplete.pptx
Size 304KB
SHA256 af8f8afe3de1a6389575f7cfb73a35eaf6325c58e5034f55f4770b62f57f53cc
MD5 bc15e52e791cbf103cd7c47e1d740280
SHA1 1bb6be39f8a3e2124cc51ee47c94d4d10b3ffbcc
SHA512 aba96af07bccdd5b2ac9ba5956fdeee989276cb9e656b260593b351dbb8f612299f981ffde453ed21937eb3a41e27017fcfc52364349786db57c7b6019ff0b39
SSDEEP 6144:/VC7cSv8mw0BRO13rnLRc1mVZ4yVnCoorLhNdasUJ0LlAPss64U73hvGP9:96dvFw0BRi7dcs1CooZNdaXPs9IV
TLSH
T137642379D2A8CFE11FDB8213639C8BD6062C6D4507601FC85C95E9CDE2DD9CA889E84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ResizeAssert.ppt

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_ResizeAssert.ppt
Size 456KB
SHA256 b3b38550b6bdb3bcd44838f5c11d127b09d85dbd8f3743b9df1db1c3b08c4bf6
MD5 b35e4b396ad8edec6b1cc64e21e9e643
SHA1 06d26575eb2af640002e02430a7fd810bbb9d864
SHA512 6a43ff6a9221e29465b5f2fac197bdb222bd0e86257cb83f88dd3fd962fbd0296d70471f02b1af93987bc81b08274f0ea697b53393e899acb79c2d4707b6493e
SSDEEP 6144:Bosl3ncyIvslqkPXV1Olc6zFEA9/mOQJUVlxM0leuWPwgS0oM++1UA4hsWXHxRVh:lVbIvslBulcoFXAUVlx+dRd++75WhRMk
TLSH
T1F5A423ABF5D8B027EE204634F2E46F0FB226F774DEC9EE221E1064A53C564654D68EC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ResolveRestore.vsdx

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_ResolveRestore.vsdx
Size 513KB
SHA256 dd1ec8ccf37a044759b6e155f2f9010e5cede32f29ae159437800ee27abf61e4
MD5 00afeef1fe2cea484bb4a7fb91f46b88
SHA1 21e14602b43663d08a08710e1fbd74b548322b49
SHA512 3c59d9fe2f4960c280b5f3e43a5f8dccab3eddd94871c20319f5bbd3a26ac228dc8073cf71ce69b12a511ea5540dc007fd91b7060ef8b3445c7af2f6687d0186
SSDEEP 12288:HTo7BbMd4U5leFTGoOh9Cu6ciz8dG/RUSiI:zo7BId45Cpr6ciwdsl
TLSH
T10BB423E36E76293508FCFE77A1B026DC816AB46EC1F8935100D5B7A3BE189D586F09D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_RestoreSelect.ppt

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_RestoreSelect.ppt
Size 817KB
SHA256 0cb99db4b7a1fb7dfaf5bd2e0eb5bf9454565fb2027594986534b8a3a3ed270a
MD5 1a30ba30875f6634461d30587b54dea2
SHA1 a0bd82e72ca562b8ccfa3856154a01795b8094e3
SHA512 3bb0e68914ad8953c8561b2949cf8ec975ccf6496a3fecc00741e4385b35c3389d6377d6689657120c04d056a810c38e770fe0b0e8e2238fcec57ee2d882176b
SSDEEP 24576:Nfw6jr7Rl+0fi18evo3cGaOhz23L8q7jaU:NYOl+0K182xOt2IYGU
TLSH
T1BD053339BBB338DD53A41B6F35C8D33197747F22F9CBEF4029C62128B6389456445AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ResumeMount.vsdm

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_ResumeMount.vsdm
Size 361KB
SHA256 f9e9efbdc49ab64587a74f0d880e355922234224a0fd97619101f13d9c38dd6a
MD5 8cde7efd0d2c1e6c1b0739759787c7d6
SHA1 85f9b2596014d084b8f4fbc909c2bee947ee01d2
SHA512 8386ddd11145296148c817d6214f3ed0f6521badc5b0eb5aaa6bebef08b36c4592acf7732e00901354dea5885012e0077cfcb64e5e7c0d1d73f5c49e422b9a3c
SSDEEP 6144:G7qe+HZHlVQqxx8YC3ffysrtCXUVQ4mWOWr3aYCFB8esUb0xXoADn/TETjcApA:GVyx6/UXUVQ4r3ZCgBUWYXjcAG
TLSH
T138742369212D63EB8EB932CC327E5743279DA9BA2F23174282C41355DB3878FCB17590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_SelectProtect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_SelectProtect.xlsx
Size 11KB
SHA256 2728f58864721bb78fb40f2f2cde6ddba772f6efd4eab8ed48cfa20151be18c3
MD5 7bc5e35b9eb22e98b412a0cf58efe234
SHA1 7f07b94ecd8a667e7c98110334bdf9bbcd809347
SHA512 aeb61fbdafbdf34f8ff2d7366bee743163cc2d613086329915365fdf531d3be0140370aa861d260a18a80ad8eb363ac0ac7a9ba3400b568839e20aa7a8244f8c
SSDEEP 192:wc8mVSJXhB6TPAb3UdMWIodyaFUlbVvevUqzQXpS0KTZvjw10UGLsEOaoSN3t:wc3Ux6M3eDUlM9z6piTu10psjaoSz
TLSH
T1E8328DA5F462E85EC273807D80AB00EA275C7141570979E83920F57F22C26EB12DF2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_SkipResume.dot

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_SkipResume.dot
Size 342KB
SHA256 104ab570fa1d347fd3e1c11e2145c8290ab49d610cdb2d0c891c0c6899c6dfce
MD5 108c0e2c21449a30778b459be4d1cb34
SHA1 859e9739270a466bfc7dc887870a13605cb88baf
SHA512 df318834c14a87457467b39eb2d4ad3dc6846ed392e97811ef78347454caa61ccfb13cce258e2262710d195502826fb72b0746db06b22f38ea17bf8cbed8f035
SSDEEP 6144:MLECW09dvzCz4UEjzTtUghfu1rJlacKsZv6QR0/1iv4ySPVRyYN5N5P37g1MTYI:MLh/24TUefu1Lhgo4vrlvPYI
TLSH
T1347423032447EE9BCE1687D0E68D9C3C4CCA1989B9A77D589822DDD5F88748E4BF20F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_StepSwitch.ods

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_StepSwitch.ods
Size 855KB
SHA256 b3aec8d078877a06967cae30d912eea4297563610fe14fe8ede83bc1198d9566
MD5 4efad6b09471bdce73897bc78ec61b1b
SHA1 ea286ae58606b6b2de3eea4d4cc05274e53f6391
SHA512 02dc6cc5eaa7d7292360d277a9c118adb9da4498432f7542cebf93f740c41e9efcad0adbc4640f37113737db9dd7f7a4e01fe2d19f6e5780d046c36dfb338064
SSDEEP 24576:MxPkyEq8IEQBnmxfrQfFTxV608mPMoW03+Xm:MxdEqx9mlrQfFT/58oM/0OXm
TLSH
T19C15339CD883313CE241424C75E6F7B5700499922C293C3AD57AAAADA9326FD4C772DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_SubmitSet.xlsm

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_SubmitSet.xlsm
Size 684KB
SHA256 bfd9ebeafc6d75034ed2d6b175176ca5b026c5d06e4698ddab7df731e9a138a5
MD5 32cabc19a707e138f704a1e756f39a11
SHA1 b402bb76c3b2cbbdc40d91b1e9f4d9e978916271
SHA512 74bc665f1f533b2e500703b2d282076e803c5e0442e6851c08f14cf74f53bdbb88354cf72ad1f34057cfe4cb0c34d17c9636b5c8bd6d33d71d792e545cb93d3c
SSDEEP 12288:wNX+E4EIq9g89kDeZ5la1GyFdZA30+XUA/vlWSJ+x40CdhnHj+8MDmf:W+WIq9g89kDeZPwGkdG30c7/vl506BHF
TLSH
T12EE433220F37226A132E6C635679AFECF8C61A128C371F11CD094D5BE9DC8E1A7472D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_UnlockWatch.mht

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_UnlockWatch.mht
Size 741KB
SHA256 1f9aed51138c22f065c17f5c611d9f5f4ecf4dcfd6f5eb3a4a2b9b2c108302ad
MD5 2c718807ebfb47aeb19eed6f7204ad0d
SHA1 b327e3dafd2f472358099e02dde09b862b456d3c
SHA512 c2b87599d40ff9a09fc406dc558b2ec37a12c9c58d5d0bc63040279299275b482bde28204792e01e615ff69f36ddbdc0e22f48db58fbc6c3fa95d5ca5dcb0dd2
SSDEEP 12288:Roqkhez8+9sf/0udaX4mh4B3OYI/wMEYtt29iHGyjVqwDdl/n/W4vG2cEr7ffuF5:+xA8tf7dlxsYIFEYtt/HdjVqMdl2Ey4S
TLSH
T1CAF423A1927AD40AD1CE70D7DC7CACE657A6C0D24DB91303149760E917CB26ACAF7E8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_UpdateTest.vsdm

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_UpdateTest.vsdm
Size 703KB
SHA256 652a1517e54b1716f5416300492b92141794a1fedca39d515624d3ff504494dc
MD5 953ef5c448d5e8b6bda15e84eb1fba3b
SHA1 6da60c60d757719185e4267fe11e6622fafe7f3f
SHA512 d379e5d27ccd0e1a97cadd3b4d93c5fc10625fe29e061ea18a71a63c7a0467a18da2b331bbfe9592d51ff19ba42e548e69f205d51eab66b277a148c04ced6e42
SSDEEP 12288:ph5u2rMAkMSQOkC7URCrvybV2Neg8jFilP8jSd57Hz7o3S+Wh5rgXd7GYG1UcnbP:pzu+9k0OICz82Ag8BilEw7IC+WbrgITP
TLSH
T110E4238F519AF18A52061E00ED6BFD23EFAD6C7D15CA2EB894EA7647AB40F0D150C4E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_WaitNew.htm

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\RDP_WaitNew.htm
Size 627KB
SHA256 73909ba70b4146a08d0fc80a10a9ce1ffc260946eae41419edb2c8e7dac84353
MD5 75720ac554b0688ae1783248c2275894
SHA1 181caf68b9752fd6789a14e93938b7b0e1e61f2d
SHA512 97135ae4254a7176fa1cf6a8d0a8f2ce57ab679fae65bf66f642be7318e292e61739577a517352eeb85abec3ba988a0d0e2d93179ff50a07f3694632970fdfb6
SSDEEP 12288:wWJ8IWc6i3QNGFSNliVYOc92MU97ZAMdVmFiErTrPAKIS5ac:2qaUA4c974DdlaTIdc
TLSH
T1A6D433539779E270916776978CBC4D7B72D41EF4606ADEECBAD89CC9850A1F380288F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\screenshot.png
Size 491KB
SHA256 bba7b6d2e8282194e3a98f25875dbd4996109dee4674c402242a84a657bf7219
MD5 8eb15cb3690420a74fe58a5e82c26bd8
SHA1 c0344172c1ada4a9c4612abaa0697e032f9aa82f
SHA512 40249c7d5b0f46076de268a4cd5c2843a31de93a849e5084b95015925979b07ee7965786c841867b2151d32257c089d248263e73d5fcfbcf6b783dcca8e22437
SSDEEP 12288:upHu/hacdQ386u2sgP2brxFtUJ6ZE5StnsklNyUr1XINKL:uihac0rW3KaEOnsIye1oKL
TLSH
T1FBB4238DA2F3D01ECC8F427ADEEAA65B17B005179665A13E6CB134549D09B3C3F6019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_tvb1aqs6\sysinfo.txt
Size 1KB
SHA256 e7873ddbdf3fd119e784091d27c32be7e9d3207b5dcf0381c2cd99b54a96db88
MD5 afb7c975478c3f08d89607d9e7764fec
SHA1 4794b094260a2a49d36ee171e7df9a4b691c000e
SHA512 bee6993c7980b09f05c1992b6ece435eaf89a0a6cf0d9b469fc7bc051e8b4fce43cefa96a192083e52dffd490941696edeeaeb43d4cd6093af972dbb67b3b2df
TLSH
T1D531010E8D99B0868539B68A61B29F48B55F9743BBE0CF1144CA021EC507BC7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_ucwlrduj\desktop.ini
Size 96B
SHA256 e5bfc54e8f2409eba7d560ebe1c9bb5c3d73b18c02913657ed9b20ae14925adc
MD5 c193d420fc5bbd3739b40dbe111cd882
SHA1 a60f6985aa750931d9988c3229242f868dd1ca35
SHA512 d983334b7dbe1e284dbc79cf971465663ca29cec45573b49f9ecdb851cdb6e5f9a6b49d710a1553bdae58c764887c65ba13fd75dfdd380c5c9ef9c0024aa3ef0
TLSH
T133B01221804AC929D05AD00F1452490490A5080F9E09BE04D340C40405C5F8CFCC92C7
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_ucwlrduj\messages.json
Size 2KB
SHA256 47652115cbb912907f405992fcfc64f987642158f0cb35c9d6e0d4742d833802
MD5 c825621044e4d5c504404dae9752285c
SHA1 68c1e29daf042487cb76629abcdc03f16fccc92a
SHA512 4aef3e7a747e290be8ba10e22e670c1c2dc653d4311020a4fd3060205fd88bb5d13d9edf388fc18919abe353c62d6841a4ef87e38064430299e52ca16c81941e
TLSH
T1CE511EE4BBB6695C051CEB0399BFEDDC18553DC188EB90321B7C13C882296097E5D3A3
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_ujkxm0k1\messages.json
Size 1KB
SHA256 64e01bc292ba2ea1699576fcc445367047520ee895e290ccee20c24c9336d8ef
MD5 83e0e58d0752ff7c3f888e6406413b84
SHA1 14a8981e4355301bb3073db6d7ffb337ef8482e3
SHA512 fc772bd3d6ac64110562aaca7d320f49ffba4e1f9ac2e10456fcb75e172d086d3ce8996cfc64b33b2ecdf4f6b96e38905e671c1e6ba5205fede9af4a183812c4
TLSH
T13F41184CC989A599E7F7908FACB9A0F54CF70E90D580B8391DBDA20E526543DA04BCDF
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_x5hq78mu\messages.json
Size 796B
SHA256 9b32c491d0bfebdca1455f73c3c6f71796d433a39818c06c353da588de650f81
MD5 db4d49231c88c11e8d8c3d71a9b7d3d4
SHA1 4829115ace32c4e769255cf10807f3bdb1766f44
SHA512 c8b4a982abf61eabb1b7280f3e10fdf1350b20f38ca9878f33ddaf979fd617ca8e5ff4df6099c395fbae86c8affbae77653ba9cb736af22466e3cb85d4d92e56
TLSH
T1DA016B4F5399393E470AA19B74C5790228C90BD94F81B55718CC9F78016EAADB702B24
MD5 SHA1 SHA512 TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_x5hq78mu\sysinfo.txt
Size 1KB
SHA256 5f926450b54f216d34587039b5bf7b7334e53cafba507314bc09992d78f5757d
MD5 c8614f41fa50a96f5955d64123aef3ac
SHA1 cd02021cccbc9645c98e5f28725ce1348b786159
SHA512 012875df09b8175711be361b80638ad3c2588b37fd7ce5e9fd0b7ac11e5446f8a41cab4791ef64465f97b7e31c934ae9ce32d7bbcb4e6f3831442cecd0b43750
TLSH
T15F31010E8D99B0868539B68A61B29F48B55F9743BBE0CF2144CA021EC507BC7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\sfud_xrhnj57p\messages.json
Size 2KB
SHA256 3e3ceaa214d8079b02c9c941635f5d45e621236d9c3f82e06ac604f0772670e8
MD5 b1101fac65ce2faa3702e70fd88957d2
SHA1 06ebd889fad9ee2d5d5083b10abf7b2a4d0e1724
SHA512 398d03bd3b51e2789d0573f5e4792c13193c36539e8fa35261bc3b9a991a155635e6d44a9999b42d3dfa264e3fc329e11dd65d6e1408c4076a49576e7e5ef4ff
TLSH
T12D513D0AB0E5FA89060D3066DC3064FE5BAC599741301B3A8D8FDACA7E1E17DC16F9B1
MD5 SHA1 SHA512 TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_y9vv3vvl\sysinfo.txt
Size 1KB
SHA256 f3d963b1a6e47bce48519907d6643523a091e72286f7b93544051279b3eed204
MD5 a5cdf2ae246995968118907c35afc649
SHA1 a345656b6051541c0800248e3d239e7bd4451ee8
SHA512 189fc15e803ce115e20c49c9ffe75ae8c5016768b141520015bc12cac5362079e54c01dbf064b15e3431defbd7a979b5658cb082284f1ec3fa0d7ebd2a0f1062
TLSH
T17531030E8D59B0868539B58A61729F4CB55F97437BE0CF1144CA021EC507BC7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

sys8364.tmp

Path C:\Users\Admin\AppData\Local\Temp\sys8364.tmp
Size 1.7MB
SHA256 5e652793d476d1ba3de4cea76586055469669b9c560efaabf7a43b7b88d5668a
MD5 23b5d4ebf05a58612fb278fea4349eaa
SHA1 2fc3b922d3762cde88c6f3b1dc1cfd354d23861d
SHA512 1c9af26cd01df5c7f0a8e58bfeddbf1e01a5d3fb46b52300ee5f0bdb2ab40bb8dcf9b48a8a7fa53bb726a52f6bd4322d52c5d0751eb3c972c5864ec449f5d1b8
SSDEEP 24576:efiQqeH4KNO3VGQ9uBn5qXso5oAG1B8KInTH+F6BvEo:ewA6sC6n5GsQO8xQ6
TLSH
T1D2858D1BB2B900EDD067C1B98E165607EBB274450334AADB17D089E62F23EE55F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download