e1f41d3787616383cae9e323bd56656efb85ba860b088a513670554f73f2db7f

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.8MB
Sample260808-cwkdgsbb79
SHA256 e1f41d3787616383cae9e323bd56656efb85ba860b088a513670554f73f2db7f
MD5 f0373e52511c90c760e380d6ec2d59e9
SHA1 bc5b23efb5d03a3638437c5c67714dde20d7a398
SHA512 a4da0ed566e9ef2bf8cccd464bd06bdd4980cd40af0f9b4e3b3aecc379a8a531e5c30abae4cf807c658e2303b0dcff5fa63260a1463e902fb11ab67f4b01e43c
SSDEEP 24576:66afiQqeH4KNO3VGQ9uBn5qXso5oAG1B8KInTH+F6BvEo:6ZwA6sC6n5GsQO8xQ6
TLSH
T1E9958D1BB2B900EDD067C179CA165607EBB274550330ABDB17D08AA62F23EE55F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000441-2.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000441-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000441-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000441-2.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000441-2.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000441-2.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000000441-2.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Enumerates VirtualBox registry keys 2 TTPs 18 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	5ols69h4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	3kf1x2q2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	diix1414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	8fwdqwum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	l42wshen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	csoupg5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	d4d8iwpv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	kmwnn7jg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	gbcxk70e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	ug1js1na.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	yoxmpqxf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	byt2fqw4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	8zk4d640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	sys3B98.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	0xjarrwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	njyhbon6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	a8wc7ux0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	amvpb8ui.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 18 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	8fwdqwum.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	l42wshen.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	8zk4d640.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	amvpb8ui.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	byt2fqw4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	sys3B98.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	gbcxk70e.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	csoupg5a.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	diix1414.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ug1js1na.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	njyhbon6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	a8wc7ux0.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	5ols69h4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	yoxmpqxf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	d4d8iwpv.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	0xjarrwr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	3kf1x2q2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	kmwnn7jg.exe

Looks for VMWare Tools registry key 2 TTPs 18 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	0xjarrwr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	8fwdqwum.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	gbcxk70e.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	a8wc7ux0.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	8zk4d640.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	sys3B98.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	csoupg5a.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	3kf1x2q2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	d4d8iwpv.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	kmwnn7jg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ug1js1na.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	amvpb8ui.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	yoxmpqxf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	diix1414.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	njyhbon6.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	5ols69h4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	byt2fqw4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	l42wshen.exe

Looks for VMWare services registry key. 1 TTPs 18 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	ug1js1na.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	8fwdqwum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	l42wshen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	a8wc7ux0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	yoxmpqxf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	kmwnn7jg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	gbcxk70e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	njyhbon6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	0xjarrwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	byt2fqw4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	3kf1x2q2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	d4d8iwpv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	diix1414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	8zk4d640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	amvpb8ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	5ols69h4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	sys3B98.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	csoupg5a.exe

Executes dropped EXE 18 IoCs

pid	Process
2244	sys3B98.tmp
720	csoupg5a.exe
3428	3kf1x2q2.exe
5628	d4d8iwpv.exe
2032	kmwnn7jg.exe
4372	gbcxk70e.exe
3436	diix1414.exe
2100	ug1js1na.exe
3160	0xjarrwr.exe
5900	8fwdqwum.exe
5788	l42wshen.exe
5180	njyhbon6.exe
4704	a8wc7ux0.exe
3692	8zk4d640.exe
5932	amvpb8ui.exe
2556	5ols69h4.exe
2928	yoxmpqxf.exe
5316	byt2fqw4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\9joehc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\csoupg5a.exe"	sys3B98.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\k1zrai = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\3kf1x2q2.exe"	csoupg5a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\hr5buc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\d4d8iwpv.exe"	3kf1x2q2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\fu4tn2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\amvpb8ui.exe"	8zk4d640.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\zbz3kp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\gbcxk70e.exe"	kmwnn7jg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\c4b1p0 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\ug1js1na.exe"	diix1414.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\9tuquq = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\0xjarrwr.exe"	ug1js1na.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\1v2kty = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\8fwdqwum.exe"	0xjarrwr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\5s4ot9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\5ols69h4.exe"	amvpb8ui.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\wcs6xa = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\byt2fqw4.exe"	yoxmpqxf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\d2yn4z = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\kmwnn7jg.exe"	d4d8iwpv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\a0tmiy = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\l42wshen.exe"	8fwdqwum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\vbxrwc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\diix1414.exe"	gbcxk70e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\vv1pyu = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\njyhbon6.exe"	l42wshen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\sqzr2f = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\a8wc7ux0.exe"	njyhbon6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\hqlddn = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\8zk4d640.exe"	a8wc7ux0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\1n4w3z = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\yoxmpqxf.exe"	5ols69h4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_1hicpeqj\desktop.ini	8zk4d640.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\desktop.ini	sys3B98.tmp
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_q2zr2tt4\desktop.ini	3kf1x2q2.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_j4de9kq2\desktop.ini	d4d8iwpv.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_3w75sfa7\desktop.ini	kmwnn7jg.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_bq4tozkx\desktop.ini	5ols69h4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_bq4tozkx\desktop.ini	5ols69h4.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_aa2o6mx5\desktop.ini	csoupg5a.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_viiencx4\desktop.ini	8fwdqwum.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_03hspzy8\desktop.ini	l42wshen.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_b2nbrlio\desktop.ini	njyhbon6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_r08y66lm\desktop.ini	diix1414.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_hdaia06l\desktop.ini	gbcxk70e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_rmmnexf9\desktop.ini	ug1js1na.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_s2o8oxnq\desktop.ini	0xjarrwr.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_b2nbrlio\desktop.ini	njyhbon6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_6e8869ps\desktop.ini	a8wc7ux0.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_q2zr2tt4\desktop.ini	3kf1x2q2.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_j4de9kq2\desktop.ini	d4d8iwpv.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_3w75sfa7\desktop.ini	kmwnn7jg.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_gjhxyrd8\desktop.ini	yoxmpqxf.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_hdaia06l\desktop.ini	gbcxk70e.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_r08y66lm\desktop.ini	diix1414.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_03hspzy8\desktop.ini	l42wshen.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_6e8869ps\desktop.ini	a8wc7ux0.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_elwxq70n\desktop.ini	amvpb8ui.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_elwxq70n\desktop.ini	amvpb8ui.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_aa2o6mx5\desktop.ini	csoupg5a.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_viiencx4\desktop.ini	8fwdqwum.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_1hicpeqj\desktop.ini	8zk4d640.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_gjhxyrd8\desktop.ini	yoxmpqxf.exe
File created	C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\desktop.ini	sys3B98.tmp
File created	C:\Users\Admin\AppData\Local\Temp\sfud_rmmnexf9\desktop.ini	ug1js1na.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\sfud_s2o8oxnq\desktop.ini	0xjarrwr.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3304	cmd.exe
2068	cmd.exe
1028	cmd.exe
1444	cmd.exe
4520	cmd.exe
2700	cmd.exe
1248	cmd.exe
940	cmd.exe
2224	cmd.exe
5928	cmd.exe
4772	cmd.exe
5280	cmd.exe
1920	cmd.exe
5296	cmd.exe
1844	cmd.exe
4760	cmd.exe
3092	cmd.exe

Enumerates system info in registry 2 TTPs 36 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	a8wc7ux0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	amvpb8ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	csoupg5a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	8fwdqwum.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	8zk4d640.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	amvpb8ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	5ols69h4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	kmwnn7jg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ug1js1na.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	byt2fqw4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	diix1414.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	sys3B98.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	3kf1x2q2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	gbcxk70e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	d4d8iwpv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	8fwdqwum.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	yoxmpqxf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	yoxmpqxf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	sys3B98.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	kmwnn7jg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	a8wc7ux0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	8zk4d640.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	l42wshen.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	njyhbon6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	d4d8iwpv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	gbcxk70e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	ug1js1na.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	0xjarrwr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	5ols69h4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	byt2fqw4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	csoupg5a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	3kf1x2q2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	diix1414.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	0xjarrwr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	l42wshen.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	njyhbon6.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5672	schtasks.exe
1828	schtasks.exe
4800	schtasks.exe
1820	schtasks.exe
5132	schtasks.exe
2940	schtasks.exe
1288	schtasks.exe
2348	schtasks.exe
3244	schtasks.exe
5992	schtasks.exe
5488	schtasks.exe
2812	schtasks.exe
4492	schtasks.exe
4244	schtasks.exe
1408	schtasks.exe
4912	schtasks.exe
920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2244	sys3B98.tmp
2244	sys3B98.tmp
720	csoupg5a.exe
720	csoupg5a.exe
3428	3kf1x2q2.exe
3428	3kf1x2q2.exe
5628	d4d8iwpv.exe
5628	d4d8iwpv.exe
2032	kmwnn7jg.exe
2032	kmwnn7jg.exe
4372	gbcxk70e.exe
4372	gbcxk70e.exe
3436	diix1414.exe
3436	diix1414.exe
2100	ug1js1na.exe
2100	ug1js1na.exe
3160	0xjarrwr.exe
3160	0xjarrwr.exe
5900	8fwdqwum.exe
5900	8fwdqwum.exe
5788	l42wshen.exe
5788	l42wshen.exe
5180	njyhbon6.exe
5180	njyhbon6.exe
4704	a8wc7ux0.exe
4704	a8wc7ux0.exe
3692	8zk4d640.exe
3692	8zk4d640.exe
5932	amvpb8ui.exe
5932	amvpb8ui.exe
2556	5ols69h4.exe
2556	5ols69h4.exe
2928	yoxmpqxf.exe
2928	yoxmpqxf.exe
5316	byt2fqw4.exe
5316	byt2fqw4.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5160 wrote to memory of 2244	5160	2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 2244 wrote to memory of 1248	2244	sys3B98.tmp	90
PID 1248 wrote to memory of 4244	1248	cmd.exe	92
PID 720 wrote to memory of 940	720	csoupg5a.exe	95
PID 940 wrote to memory of 4800	940	cmd.exe	98
PID 3428 wrote to memory of 2224	3428	3kf1x2q2.exe	100
PID 2224 wrote to memory of 1408	2224	cmd.exe	102
PID 5628 wrote to memory of 2700	5628	d4d8iwpv.exe	106
PID 2700 wrote to memory of 1820	2700	cmd.exe	108
PID 2032 wrote to memory of 5928	2032	kmwnn7jg.exe	111
PID 5928 wrote to memory of 5672	5928	cmd.exe	113
PID 4372 wrote to memory of 5296	4372	gbcxk70e.exe	116
PID 5296 wrote to memory of 5132	5296	cmd.exe	118
PID 3436 wrote to memory of 1844	3436	diix1414.exe	121
PID 1844 wrote to memory of 3244	1844	cmd.exe	123
PID 2100 wrote to memory of 4760	2100	ug1js1na.exe	126
PID 4760 wrote to memory of 5992	4760	cmd.exe	128
PID 3160 wrote to memory of 3304	3160	0xjarrwr.exe	131
PID 3304 wrote to memory of 5488	3304	cmd.exe	133
PID 5900 wrote to memory of 2068	5900	8fwdqwum.exe	136
PID 2068 wrote to memory of 2812	2068	cmd.exe	139
PID 5788 wrote to memory of 4772	5788	l42wshen.exe	141
PID 4772 wrote to memory of 1828	4772	cmd.exe	143
PID 5180 wrote to memory of 3092	5180	njyhbon6.exe	146
PID 3092 wrote to memory of 2940	3092	cmd.exe	148
PID 4704 wrote to memory of 1028	4704	a8wc7ux0.exe	151
PID 1028 wrote to memory of 1288	1028	cmd.exe	153
PID 3692 wrote to memory of 1444	3692	8zk4d640.exe	156
PID 1444 wrote to memory of 2348	1444	cmd.exe	158
PID 5932 wrote to memory of 5280	5932	amvpb8ui.exe	161
PID 5280 wrote to memory of 4912	5280	cmd.exe	163
PID 2556 wrote to memory of 4520	2556	5ols69h4.exe	166
PID 4520 wrote to memory of 920	4520	cmd.exe	169
PID 2928 wrote to memory of 1920	2928	yoxmpqxf.exe	171
PID 1920 wrote to memory of 4492	1920	cmd.exe	173

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5160
- C:\Users\Admin\AppData\Local\Temp\sys3B98.tmp
  "C:\Users\Admin\AppData\Local\Temp\sys3B98.tmp"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "rq6v13hm" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csoupg5a.exe" /f /ru LIMITED
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc onlogon /tn "rq6v13hm" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csoupg5a.exe" /f /ru LIMITED
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4244

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csoupg5a.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csoupg5a.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "vwb85lxd" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3kf1x2q2.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "vwb85lxd" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3kf1x2q2.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3kf1x2q2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3kf1x2q2.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "5h1bxt3f" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d4d8iwpv.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "5h1bxt3f" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d4d8iwpv.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1408

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d4d8iwpv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d4d8iwpv.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "csptdm0q" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\kmwnn7jg.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "csptdm0q" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\kmwnn7jg.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1820

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\kmwnn7jg.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\kmwnn7jg.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "pexa0svd" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gbcxk70e.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "pexa0svd" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gbcxk70e.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5672

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gbcxk70e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\gbcxk70e.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "x7ot5dir" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\diix1414.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "x7ot5dir" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\diix1414.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5132

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\diix1414.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\diix1414.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "rviiogj3" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ug1js1na.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "rviiogj3" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ug1js1na.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3244

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ug1js1na.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ug1js1na.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "njh45ovu" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0xjarrwr.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "njh45ovu" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0xjarrwr.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0xjarrwr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0xjarrwr.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "s6n367ig" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8fwdqwum.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "s6n367ig" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8fwdqwum.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5488

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8fwdqwum.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8fwdqwum.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "mr0e4fb0" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\l42wshen.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "mr0e4fb0" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\l42wshen.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\l42wshen.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\l42wshen.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "02tomir6" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\njyhbon6.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "02tomir6" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\njyhbon6.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1828

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\njyhbon6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\njyhbon6.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "hav2v0sa" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a8wc7ux0.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "hav2v0sa" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a8wc7ux0.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2940

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a8wc7ux0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a8wc7ux0.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "onbgfe2p" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8zk4d640.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "onbgfe2p" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8zk4d640.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1288

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8zk4d640.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8zk4d640.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "x12ear4i" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\amvpb8ui.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "x12ear4i" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\amvpb8ui.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2348

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\amvpb8ui.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\amvpb8ui.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "mohomirz" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\5ols69h4.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5280
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "mohomirz" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\5ols69h4.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4912

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\5ols69h4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\5ols69h4.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "aatbo3vw" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\yoxmpqxf.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "aatbo3vw" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\yoxmpqxf.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:920

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\yoxmpqxf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\yoxmpqxf.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "qq5gjje4" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\byt2fqw4.exe" /f /ru LIMITED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "qq5gjje4" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\byt2fqw4.exe" /f /ru LIMITED
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4492

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\byt2fqw4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\byt2fqw4.exe
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_3w75sfa7\desktop.ini
Size 282B
SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
MD5 9e36cc3537ee9ee1e3b10fa4e761045b
SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
TLSH
T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\sfud_3w75sfa7\screenshot.png
Size 433KB
SHA256 74ac3ef984a205f5d1c697e7ef43b28450d4fc0913c8c6d334485f0dd2e59afd
MD5 2125d3386fc9fa8ebe7f6bd372919ea9
SHA1 3f33d1a7229da91cd0bda6087307dc67da774caf
SHA512 da20d4816914d727f8bac694a4c8744750cbe9b7b06cb202258a3031c2f60cb6964c4be78c597b0afeff98a7263d334b51c1948921c0a958536424b1fa354029
SSDEEP 12288:FEntFSBzvbm9sdj7kHcRuEigT6gA6BM+MiLD50Za3BXn:On+BzvbpQHcsc2gAN+bPeZI
TLSH
T10A94121AB6F3D98C8C8F0167A2C405EC53549A2BDC93183B10B52A0DD927EBC7B55B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_aa2o6mx5\RDP_desktop.ini
Size 402B
SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
MD5 ecf88f261853fe08d58e2e903220da14
SHA1 f72807a9e081906654ae196605e681d5938a2e6c
SHA512 82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
TLSH
T18DE0ED19A2FD661052719F26BC78D011CBB1B8216C1B8E9E86C4918A18D5E14FA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

browser_history.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_aa2o6mx5\browser_history.txt
Size 92B
SHA256 7565a63bb14b58f501f4a7f68d7d3841b2bb8611f3061e3f125ec24351eaaeae
MD5 1d7ea04cf94468b753de19b3970bd715
SHA1 d0b199ac89870773a9a9f54043a01282e561333a
SHA512 b17e778ffff1a3fadd4c464cbc2037222ce12b8e8f0cdcbbfa1b5a0cefbd777de40be967fd3bb5e4baeaa3e9189d1284f27250e9881fedb671543be82442e5d9
TLSH
T1BCB01298C11544E2571C30217A47462C781DF20F0A4042113C850445A70276642829B3
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_aa2o6mx5\desktop.ini
Size 504B
SHA256 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
MD5 29eae335b77f438e05594d86a6ca22ff
SHA1 d62ccc830c249de6b6532381b4c16a5f17f95d89
SHA512 5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
TLSH
T1AAF0FE19A2F9561052719F27FC78D0119BB1B8226C1BCF9E87C4A18E18D5A19F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

ftp_vpn_rdp.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_aa2o6mx5\ftp_vpn_rdp.txt
Size 43B
SHA256 31fd6687fa56c5bc6daa22a7fd879d3d4d390f2c15bf352cae63194abd9339eb
MD5 37650121bf2afca6096d843157d005b5
SHA1 9aa0b2644be54fe62e9b13707b5fb9055f9470df
SHA512 ce287b6fd1a647b149ddf3f00717dae099304b8ca7f67b138ff0eecd431fbc0805536dd47d6f167c1ea1677e0967d5f48b3ba93fc325cf422a610a50338a3c3b
MD5 SHA1 SHA512

Submit Download

mail_clients.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_aa2o6mx5\mail_clients.txt
Size 69B
SHA256 ccc3bf1bb2e5aca2d3bc8eb7338727b10fed9d2aec624fd26b36f9d5c11e5b3b
MD5 e7a80003174cc9c3efa4a142e206d3e5
SHA1 4e5937f4e02e02e792ab60b53d20b655a80e63a4
SHA512 070d8f0b24ca3706fa20b7b6b0ed824907cccd8459b78dd6ba496d1bf7481858207ac2df4ce7fbb0da8f0fb627213cff82e6f9983c12441618689b746ac1cb39
TLSH
T1E3A022C080C8E80E3C20200B00F0CACCB223000B3F023BC28300CE282082808FACE0C2
MD5 SHA1 SHA512 TLSH

Submit Download

RDP_UndoEnable.doc

Path C:\Users\Admin\AppData\Local\Temp\sfud_q2zr2tt4\RDP_UndoEnable.doc
Size 1.4MB
SHA256 5a60e2deb88b5bcd6d5b357af671652cd1a10416b28c5a7cff6d46d1555b448a
MD5 3d86523dac6ef4f0091d8158a10288b8
SHA1 274fbb736912935ff233f963016afab2d5e987b2
SHA512 36d3b85996443578461cd9d69b6eb00b6b845b43f845294abf93b04325f4151287e5e824f3628a0b3229069f567e56e02a3ce7e2893553ef298680c4405e8315
SSDEEP 24576:It2CrvOPFF3EYdrY78TpnQHIX7jYyKgRFzsVl5gtIWmJRHwOG9T:It2vPjEYdbnQ4j3KgvzsjJdJV21
TLSH
T1636533E7A0D7E87719A8842FF0E0DFE736EE1869971E7A12F0028DF803A505751785AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_q2zr2tt4\desktop.ini
Size 282B
SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
MD5 3a37312509712d4e12d27240137ff377
SHA1 30ced927e23b584725cf16351394175a6d2a9577
SHA512 dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
TLSH
T1AFD0121496E8221052714E26BD789005DBB1B8212C1BCA9E5680918B18E6A45E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeSFX.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\AdobeSFX.log
Size 1KB
SHA256 c277c2cd2723fed83073fa9dcb339fcaf02c1b10a5e9be175fedc56728ead682
MD5 495a346acbc2a9148866c04d87fbd290
SHA1 c36c571c026cccab51cec5e00f57094d0134872b
SHA512 2a8dd55f3ba4e73ea95c6156986e0d8e40c6c170785753697d3946b2d1afefdc9cd09c57ddd4087f8778cf1d6a0f2991828734c70be5ab9c18983bbebba4e9a4
TLSH
T14B4176490AAF41F52601C187A27E6EFDC7D0F42F2F45DA61A34942883328927FEDB592
MD5 SHA1 SHA512 TLSH

Submit Download

BackupSearch.edrwx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\BackupSearch.edrwx
Size 266KB
SHA256 d9f6af8a0aa6b86529546f1cd59a369dd67cffbd618570edaecc73242c41bf4e
MD5 df9227b8380e7a5cf012131e77d2a772
SHA1 2667bfc0a291922b3537f9a858c838e654d7d5fb
SHA512 325ff086a74dc53ec1b7f3d4e42d39739d3fe94b8ec26404fa0c31febae106c0e8059d618b6b3639e95006f23454f7d0f94eefb822ddbd6f12c5c0a054822e1d
SSDEEP 6144:iopADNMVwdsIHyCn8HDMwrp/J5K7i7mOOhUdRZxcE9FFpFF/X4P:ihDN9ds/Cn8jMgK7i7mOOgRZxcETFnFw
TLSH
T1BD4423C0CF8A365092DE374617C63E7F6B60BA62C0DD71AC56332F59601F1A6C4EE698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectSave.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\ConnectSave.ini
Size 419KB
SHA256 6568e7e5ffbdf50f2bfebfaa6202b0be627240bdc319a74c71d9c72614ed118e
MD5 e2e6732358f5b876963f19f189116db6
SHA1 52a5c80df65881f9ceff7b4f45c456b88b2eeba5
SHA512 daf5730a39cf94891b7e5b831b77147e55049f390c3af72811225e2c689ac832e44b3b2b160e49d8868e60beb859dfb20cf5472254f651cdf62c9b8a1b56ae12
SSDEEP 12288:W37FkGNHevJihVUhcAGXBtsT+t8dyGk0rQbCi/2Bs3w9jd:87SGNHevJgVgGXc+t0yGBi/isgjd
TLSH
T11E9423CC3E91160211ADCFCB66BA1F3D5E92CD4628B6C6F381CEEDD74217987A055A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultApps.xml

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\DefaultApps.xml
Size 6KB
SHA256 ca0fcc99f517e2d4d0a2f1bbcd254dc3d369d1d0d06431629cbb8c0827b34371
MD5 5fa0b53d52b55d3a933f2af24df7580a
SHA1 9d94c99aaf105c179d6d61762662aa2b6883322b
SHA512 b00d7acd515ed4db0c5e4715cf0edcbce35ac2ba9273948d697d3acf8ad9c620a634bdb54dd750b4963000c5c4ec59f16469a143a3e3f1796a933e67ef723c36
SSDEEP 48:cD9zmasFd7t4aDiLq0xQ+gQ+STyl/6d3b3eE7+HE7+HmRdtIPovVcjkLwv+ariQ6:WCUoPzenamcnquWfPfw3bdbGaE
TLSH
T179D1A6E15BC51CD6A35F99A3B78BD19D21AA406FCBBC2A00F0C3612EE51BB6C0777452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultAppsNew.xml

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\DefaultAppsNew.xml
Size 14KB
SHA256 69bb70836496d453033413285f37978fae0ace73596a59685d4988f2a964bda4
MD5 ac935163818db1b96b9d3fdc81187f07
SHA1 4f786d90b47f9efc981063d85625b6a0c5276b1a
SHA512 8836963a8d80f5ab1b66288612acda2e24297c76b214acba53bbb7cc04d7b45e596f5223cdba158dbcee8f3af90554f219244cdad652671192838b210eaf91a3
SSDEEP 192:/obm5Bg5Lm5xg50q5Sq5Hq5rW5tcdlZu5aWlClxFqHks51s5cd5ts5Iv52l3lNcR:u
TLSH
T1D9621A02B7FD1689F0F31F289A7B61690E7ABC694A3DC22D11616E0D5C61E50CC62FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectInvoke.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\DisconnectInvoke.docx
Size 348KB
SHA256 6c91296b0ec5766e9ebab4d0ed94d766554caf5fe64f57f7d3e79698b994f0bd
MD5 b40a972ee2cf4a0be53d8f70e24e77a4
SHA1 4948321f3f5853a1f9bdcdd4464cdc602b43431d
SHA512 3fa96397d158460c0ab529d2a6e4ef329325748621b396d29348a4aea39c8f2a2dd471f9a67a0cf01a90b572a25619f0e6e7424f228646fb4ff35a8b349a7f52
SSDEEP 6144:ETolUfFb3SgJCn9ZKXfAu8eryZufLAf7lZDNCArOvrN60rw:5OV3Sgo9ZifAu8JCcf7lZDNCArOBrw
TLSH
T11274231DECAA77783456D42AEE5CA77D2FD4E113888DEF1E0368B6214A0E8A30F53615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindOptimize.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\FindOptimize.ini
Size 351KB
SHA256 83601ec42393f1b87da84b581cd6a95c1ce50c455ae94ff948e18419f6d48ccc
MD5 2925e8e29c0243fdec305af5c63661df
SHA1 ba26e59375b19d4b63532a18d427b485d9aa96fd
SHA512 34f6eea2e8eeb14f2b7247b6ccd57b35d881a39c58c0df2b31432283411231cacaa59070cafa90443dc1fa822959dd1397c63852d1a02d7a59d2aa481b1bbb81
SSDEEP 6144:cIA/ue3oUWQKD2OcDlrqwflcSsijc757MqbLoXX1Msvpw219rNog:Re4UW0BlhlcS3jc75ElMsvpw21NKg
TLSH
T17A742392ECD1BAF405BB5CE23F962C2A4B732CFCA8371C51D9A145E27454636D9A8CF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetMove.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\GetMove.docx
Size 442KB
SHA256 f9ed595481cb72c34a8829270c0cd80e35699b8c2ed2dfac0009189e5ca02442
MD5 0f4ec1ee78af59b2e9b1cd1753798589
SHA1 c93ae22f6a45b08d995e52d4438d41e9960b80d9
SHA512 11f19d8620126fad243a237a74559152b5202d140613c19efb81cda87114b37034c0986a73db27d4a1322e9ebf5a04cb74b04b2a884e9aa8bb937dd097d39b5f
SSDEEP 6144:dHKhhJ7TKtyu6FudW5a/eWyd0hPW0hZ9eC9vmw7YV4YlJtgNhRLdBpQCZ+cEWAde:dHKhBeW82WthHz9F7u4cUhRL+CZMNde
TLSH
T192A42353803F66785DC8B851D89582F2FB1B6EB5783EEDDC5AC81C34508ED4F80992EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideRedo.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\HideRedo.docx
Size 14KB
SHA256 cac703677e465c1256184a47cb3a89aeb33284b858c07d77dd42f5eafe76ac02
MD5 c7b40cc38b1fc34a1561f9c67fe4b383
SHA1 a2ccc7c49cc151aa7d518a57d8ab7e6aa429e4d9
SHA512 8e6ade27265beaa1436645d82ad5f02f28933ae182c9e2135f4d1a49dc2ade2ba13c9a4707b6a952f6a2de19928a1269d3217330e659cb1e6dce2dba5f691636
SSDEEP 384:afIwpiDaFlQtT3cdNxt/ZtNNLPpXBIFHDJ9MQ0:e5wMlQuxllNBBItDsd
TLSH
T12862BF38DB40E860E9838F3DE06941F6F14D9013FB699887309A9DCBC2669574B9FCC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JavaDeployReg.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\JavaDeployReg.log
Size 13KB
SHA256 0ca8f97c2545ff1c6999651cfd2966204c015cf44e233e2d3c04e1b7bd014036
MD5 92b100fa120b333c865e5c084058b957
SHA1 2529d7dcd08ef6a866c75d92f5f9370ca2073571
SHA512 882210aa443cfedbe08075e6c07bc30f53b8eec4a58a6b43934a9224524c809e4b3111a1731c4206b800c4e4d4e3cde0f259ef66f9da50630a91994961011160
SSDEEP 384:DrfneXU1KGHcLIopGHSP2yxFteuThhhhhyD+3d+x:DruGHcLIopGHSP2yxFteuThhhhhk
TLSH
T11052BBC28ACF09F650628556C6A33CF25ADEF1E7A72ACC153244FA7A7B448465F234E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20260709_142637721.html

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft .NET Framework 4.7.2 Setup_20260709_142637721.html
Size 93KB
SHA256 a34a11e2079d00d28bf419dd650f04cfaaf4b6a6d91ab611e89259197d37d837
MD5 c829a8a86be5bdd2a4e54d5a82bc2082
SHA1 c408c6bf013b6a5c434a19fbba9867aa2af8c773
SHA512 aae326339f63526ada0b9b0cafc110105a97cb34e27ad6e7677d66c74be8171a97645f5a734d037baa0675d1397c9fbc7e1f68a3e0f0ad82f0a4af27374c0644
SSDEEP 768:fdsOTLyUFJFEWUxFzvNNdAQVR25wJ+LoK:fdsWyUr+WUxpvNNdAQNK
TLSH
T1C893A2537BE84155A4F3BF4DE97610261AB8BD865C34DD2C13A0895D0A92E24ECF2FF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142714.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142714.log
Size 15KB
SHA256 d42d0214f385e6e6438d27600a71e942d3fcc7b6a088e286173c3c8bf461028a
MD5 42dd7cef804911ab6578acda0be073fa
SHA1 4b1aef943ff6b21ed9e16ff27c0c0cfceceb17ca
SHA512 e2c86912c49c0ded9ff29a09a19dcfd7f343f264f76ead67e05dc33afbd5ad0b7e7f0aabf19a56bcb0095eae169d6d04f07a16815c5aa35c38e79a782ee13b34
SSDEEP 384:l4cvVx+z/g+LOgPOgGVZ6a4VaV9PV9Q++QfkSjTxgZQHj0wxg1:l/A7P7oMa6s9NLLeEe1
TLSH
T17262BFCBF9D963813C707AA6C12EAAF9C786FD45565419B02E83030D6383917EBD5BC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142714_001_dotnet_hostfxr_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142714_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
Size 95KB
SHA256 fbfc9bd383c1222ae88d960b05de4dfe93fd7ff44f582094e1da28a99f1d2a20
MD5 d9ea6edfb7dfacd8806a824762db5c98
SHA1 ced27bb94d64b7da8ce58f7e49397f41b8ece077
SHA512 f72702b77c38ca962bd5b33dea36b4b327eafd0603b63746658761c16a7ec499d893057e8d980dc51fef43cee5f47be49a19d2cb33745bdcf556cbbac7e6c5f2
SSDEEP 1536:Hy89XW5ENBvU2ri7eRVbvjzLhpvvcuGmIwOo9G7cEv5ZuVNjHQETKMg:HaYjHQETK7
TLSH
T1A7A3193A2FF8400BB2B3DA878BBB04215533BD2A6935D95D61D1854D00B2D09A9BD7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142714_002_dotnet_host_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142714_002_dotnet_host_6.0.27_win_x64.msi.log
Size 105KB
SHA256 e9cb0fa49981bf15bc6057f64d3be108a3c22bd3054c89802e05774d3445be7c
MD5 4d63f7307830b96c6d9b6aa120327bd8
SHA1 b0f059050665357a206811ff3f9a5b4dda0e7ccd
SHA512 88ec62fc24d840037c459d498ed974997fc71b51c54b3ffca674473293204ac2a0889a463a808c718f4cd0a64a709ca9a585ce392c15f10f56231637cd830e6a
SSDEEP 1536:t5pGPe/+7HpkbsTDGiWqvp3JBZABO8k9vkLu8FkEGmHCvjgBB5jxZzV1k2H1Loqm:ty1jgBB5jxZzV1kJZ
TLSH
T165B3383B2FF4000AF2F3DA479AB7081256737D1A6A35D94D61D1864E00B2A09B97D7EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142752.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142752.log
Size 15KB
SHA256 0014c3f591801eb8ee42d2da506aa48c4bc50069348af171976eafa1e1fb3c9c
MD5 ba59c83bc350c0e89e4a13a9977d31e7
SHA1 0048f8fe819d70a2fd3ee818377690f3191b4227
SHA512 03235a045377adc8c222da8fae474284028569aa23b9d5ddc5d5eb0a04a45b25fca574c5f0e22f1e292bab010640bb333127a6aa39a5788c1711fbc93b0c3371
SSDEEP 384:DUTnVuWvz++oPhFPhAVNjfV4VDCVCQshQIRqRY2hZQ1/WT2hW:D+EZFZyNj96DkQFafaW
TLSH
T1C562BE907EED96813C72A1A6817F9EEDC6ABF047261419B0AE824B0D9352D03DFCD7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142752_000_dotnet_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142752_000_dotnet_runtime_7.0.16_win_x64.msi.log
Size 470KB
SHA256 2ca53c796d2695a327303f3f138c5c71bb8d465a2de4ccb443261f048af6d99b
MD5 5502e89df47638e53fee3fce99716881
SHA1 c5c86b01c7ddfb5e9c4b3a07b823e647382db05a
SHA512 b3773983ee7541be30251e8baa665258e1eb15a493c6ed33076012710124bd0bf7b038c964e734639d8889699bdeded16b0eb15b6d73d247914dff5d048ccefa
SSDEEP 3072:ZEyTj2V6xXQGuHwor3Fywl0BbXe1EHsglgD3xw9GhmbbPkh36orvFVJUzmr9WnE5:5j32
TLSH
T166A43F25AFF80216B2F39E47DEF34416A476BD36BC39C91C5092425E0471E04E9AAB7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142752_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142752_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
Size 95KB
SHA256 384ab973d434ba3b8e87a458f73f864ffa601da7e103650bce82cfbe3639a35f
MD5 92d0484e6e80930aa5d08ca33913cd40
SHA1 a0425909b66b410017c0ef8df0de26e7c8d5cda4
SHA512 19b94dd66eeb7cb6c70ccfa138991e4b3aaf806bdec42be2a28cd7ed2ff87bd44b702026c1dec91b4eb6afd2f6adc11e491fbcd846eb54ae51ebd17c22a79968
SSDEEP 1536:udGsvDhsVJXQbr5jmCuUiBAfDIJrFiog57jhbieefULc8vCvjWQxZjj8:ujpojWQxZjY
TLSH
T18CA3193E2FE90109B2B7DA47DBF714629573BD2A5939CD0D2192810D01B2905E6ACFEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142752_002_dotnet_host_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142752_002_dotnet_host_7.0.16_win_x64.msi.log
Size 109KB
SHA256 06db80a84d3db583b56b06d39efed84132f9f0faa2726cb219769c6d10293014
MD5 23880f7146ad2beb6fcc8df9e343765b
SHA1 db2d0a85c034da1a60c1cf1627a73ec9e590caa0
SHA512 393c563568ac7ba346e58271358c1e03173161d5b990ec16efea812b0eba24bd7638dd997632ad0f80e454c65091b69e4d133ce98cb205667fe665a330e2ecef
SSDEEP 1536:VhH//c7S/zdQ9x5TmObUeVfYTJBnUm+eALEGj6v/xRCEUUbeLKzBwXOKdKpRUGjK:V9TjjJcyyqTHhkeod
TLSH
T15FB32A2A6FF80209F6F7DA47DAF744129973BD199D35CC0C21D2860D04B2905AA6DBEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142829.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142829.log
Size 15KB
SHA256 d87d18b88cc04c25977c99dab43a6b22d2b0891d1feb50e612f1dec16311b5fb
MD5 ee849df620b432c39110a72258309ef9
SHA1 461ac5c269c88d76e05209e0e0519e16770c5c13
SHA512 b152417809bc741eab83326f7d7ddcabfd49514f40ed1ece2fc71cf39e53c1b21f3171c517bc7d0ebd454cc7c78b5c2b5a508974d2e8fa27b1575325c0a3f7df
SSDEEP 384:LzeS7VM69Xo46NIwNISVvjQJN9aICsV7Vz9IVjOLQgXQUuj+jQIVQwEYfiQI7:LzT2+w+Uw9n5RqMPJiJ7
TLSH
T12D7211886EDA93943C757266C13EDBECC7A6B44A0B0069F13F920709D79680FD7C9AC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142829_000_dotnet_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142829_000_dotnet_runtime_8.0.15_win_x64.msi.log
Size 470KB
SHA256 f431ee0ccde3f501597979472b736c3196a9bc01ae402f930c2a394d256e0f1b
MD5 e14cdd2231f766e03f57cab98e79ca5b
SHA1 9bdab64de7a9c3dc11d5da58f5e1c27f6faa6199
SHA512 abc1bf6d121eddde09177352e3caa29379e294ad752052534f503777a99b80b26ce350375049071fa48a418942dff089f0a29adec1993ed16605f0d02673f02f
SSDEEP 3072:Pvp2NcLF/iDJLxMp0SMHFzpvuCjOpyK2tBDFwAeff9j+xsAfeLmSHGWrHO2sKEMi:Wj1ScB
TLSH
T19DA43C25ABF80216B2F39F47EEF344569476BD32AC39C91C2092425D0472E05E96EB7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142829_001_dotnet_hostfxr_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142829_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
Size 95KB
SHA256 90d81ef39384ffd75fcab07b828eca27f57abaed7bb2da7720ef9c4932801b8f
MD5 065b182d32f6c0d9381196af15561bf0
SHA1 e2dee77073efadd1193ea5b6b0fc86b8bbc865a6
SHA512 477aca6ba7e681290a11b3d1c891ed57d2c7ed0f795c88fa08618ee3af9465ad75cbae722127aa0a00a67a9796fa2f10c34f8bd51f37fd2333fbc535becd6ec0
SSDEEP 1536:ikE5ATFzrZfv8Cb+KguPzZTGbmcOuKb5W5ecPRZBrjxLCez42/0jUjwhiMC4pnCN:ikE5ATFzv4cAUhiMC4p6jYgdgl/AhYsd
TLSH
T1BDA3E51B2FF40016B2F39A87EEF354269977B9A65935C90D30D2824D00F2909A96D7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142829_002_dotnet_host_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142829_002_dotnet_host_8.0.15_win_x64.msi.log
Size 109KB
SHA256 5c577a67983b0769ba16abb534665c5bca731f58d5017d986476a6923c107152
MD5 29dfe3d8269e204d86ece31d1eaf2361
SHA1 15accaef1b69ba95f13100fb2bdec38560875fd1
SHA512 c23c159bc2dece29bec7b7c8878ab6d7f50c62b0296dcc262360184e96ed6490a8ad463e0a12236012257f53f2c4209098adcf3325912d041fb3f265ce296334
SSDEEP 3072:GyW97+0WsYbjMgsVuEjFWdZEJSIRkyiSPyxw2L:Aj2
TLSH
T18BB3F31A6FE80105B2F7DB4BDEF314168977BDA29935CD0C71D2860D00A290AA96D7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ApproveMerge.mpp

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_ApproveMerge.mpp
Size 1.7MB
SHA256 f8495257ad4146abec315221d16b423a278f98338188995be5cb3b59d72d8d48
MD5 96aeec31f176a561883b98ffd7d7a434
SHA1 40010a225a5b46c490e67a279541b473827e4d67
SHA512 287d90589e84716a735000e768a554ddb16cb5c0ce6b5221b369f11c2297289c161eb2391a80f337cb37a1ea1f81f955391e877fda9bd632c18d9d8a64a46d92
SSDEEP 24576:xosB2wq2IL26BJMmVghqX5rdjh60axddLf+3OqnReBQ4G8mb6aGgFSpT33Vio:xs2+JTVNdhmxdRfXAYQ4IGOFqjgo
TLSH
T1598533D05B3147870C5C92B767FE03E94EE14A082CDD662B8FA6F86A1235B591D780FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_BlockStep.vsdx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_BlockStep.vsdx
Size 1.3MB
SHA256 daaff409c1608313e1bbb8b7786623b291636df69a1feb5dd7c733bc8253ddd8
MD5 5f347161663751b31441d84ac7aaa23c
SHA1 f6615ddd4c920959adbe63c16e2a7637555e203e
SHA512 eaa7867be6f5ba9678cc33a6cd64580815776b502ffb5fc0c7f1f4c84f67175c26709e2b191905e3b893896bd0bb85905ca6a41808287f735a65462595319325
SSDEEP 24576:/IuN/hSh6wGvxeDRUT3lE9HrPHIIeiERfTYd0K7uw9PLJ+YXrlqLtf:/Imh1/vYa7lULPoIedrYz7/9PccxqL1
TLSH
T1EA5533B30CDBE1696D02A7D408B86DDFCD92C73F952975270C0282BE345A9A653D0DBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_HideFormat.xlsx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_HideFormat.xlsx
Size 11KB
SHA256 d775222c28ef6a9996e8a1ea382e0a282158c18558d4933fda0fdc92ba5dbe53
MD5 0eadf583620cebbad5f07d704c7e0ede
SHA1 3fb6d45af1147b50b9e784f3e9e71355fcc7de1f
SHA512 52267fc1ef2050572a618d0b93504703032338c570675edaa9b8c2cbfa8b39d187747393bdb13700888b57c139c5e73394b3fc3a99afc6916061e8386a061c33
SSDEEP 192:wc8mVH3lXb3UoGhRhCdIjdaFUlbVvevUqzQXpS0koXcVsozTLfVkKaok:wc3113YhXjuUlM9z6pxsVkKaok
TLSH
T195428D66C1A4A46ED26BCC7F900B10D5B29CB1425B8336C97420F58E77806BB537F3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_InstallExit.dotm

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_InstallExit.dotm
Size 1.6MB
SHA256 fac3168126975fa250c750a92309dbbd94eb9f8a6dba31afc6e8289462bf85b8
MD5 94dcd62b6e4be1a292af133fe9f53171
SHA1 3e44f06147d7b4d75f931a0894dcd5144a3a2ad1
SHA512 5270c94f95eb62dc5950a274244ac7a6f06a83f26c442da4d37354fb49ec4a593a43b37f69692d6a3518baa2118a0861f1438332db7f3185e44a7ed7c6aebf3e
SSDEEP 24576:MmBQz8qqRmEqGuxPPyDRvk4/SjAN7MTyo8LtCZiQo94CIU4NOXFGin1q5JzRn90u:daxq+G8yDRsgSjuC4LhFHuROF7g
TLSH
T1B07533C6DF3C68C14612E6A98DE648B9FE6A4B7995804F31CB3828263D1C7F8E517F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_MountOptimize.xlsx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_MountOptimize.xlsx
Size 12KB
SHA256 f8dece45cddbcd5ae38674785f7b1cd43f08c5e2b3fc8c0bd65b6c65e3bd664f
MD5 a91c1500df125bbaa1dc2acac48a01a6
SHA1 244f9b4c774cf821a0861624ca71000a135daf4b
SHA512 6f08033ff61fdb005d0ea8b88c9f684fb079f738e9c9a91546967143fcb0652466831167528581cd06971ff51bc3fd13f8f47330c1bc271c6a5154414b01da28
SSDEEP 384:wc3VghI3mLmsFUlM9z6pZAAxHm/UJwaoS:wLRHFxWpNmhfS
TLSH
T12C426D0BD1B2446AE337C47EC54E00E2F31E70825A912966A624E15F25817DBA2EF3DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_MoveCompress.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_MoveCompress.txt
Size 1.1MB
SHA256 f0dce667e325a4e3c1e495dfc3208d15203de6626c635cc24dac23ec7d4883df
MD5 85a7a6e3e63a172e5c8e552a095a7a1c
SHA1 9286cc3da01227457385d9724469bbe4a4c8c5ec
SHA512 596277d6eba76b71479fd1e62c09edfe3d1abc685ffdf1fde6896b5ff8167bd737a18f4e9b4448ba010b03df192cb0f94e5a49a75ccce7243c30b8bec54565d5
SSDEEP 24576:fnN1pK9eNqwR9vTIJig1vzqKgmLqkOW2okYgcQro1rpO:fnJ/LRdy7ZpLfOW2o7gXoe
TLSH
T13135338B4AD8CA29E4C0282F0DBCFE743D5778D97CDD65B8887587C885785A8DF00396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_MoveMeasure.xps

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_MoveMeasure.xps
Size 888KB
SHA256 5833bfb845fccda215a0718e10f456e63bb919625d171617ca510165ae70cedf
MD5 54f29f79142d922b7e4d1604017f56de
SHA1 72fdc73061722e889f7450fd7696683f92c3a174
SHA512 1afa29ac189e78975ef67b449fb7e571c2949e6065d5cabd486a13df07aac87baed79f5fa4e0595ce96c5a10468db5d789a91c002eda422d9c708597a6e41209
SSDEEP 12288:X7FommjU1yOkjav5Kx4fW2gLrA4II7QpMZ0ElhlagSRzki/kfJviikUVFj/pu:YUAYBKif/gJQpO0P2i8vVC
TLSH
T1D415332C3F14929932465A37BDD99994ADFC23DA3E4FB2B2FF2D4047BFA35501482660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_MoveOpen.vstx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_MoveOpen.vstx
Size 1007KB
SHA256 2534c20190172a5bcab154576e39bab3b4f06220bb3a0ca1e8c4330877285137
MD5 a1f91751c0fec6a8c6c23eea242b6678
SHA1 b4acb03b0788a91e12fd6d635b7f655f9498b88d
SHA512 b31c8049e031283d083a9b129605ea7bca2426a8bbec9f8e28b794d20c7b4fb5b1caf98420bbd286e6b25697323cc78ebf1b786defa9f3ad40fafcde0a29153f
SSDEEP 24576:opNaN2vYS3NybXUigS1GtsxdXttAECeW7yYYsSWmFcWBT:omxS35igS1Gtktt6Ebjhp
TLSH
T1F42533B9C2B560F244C8F8C312391AC80CD1F16DA93DC7A55DBA9DC4B7559F0AA0D2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ProtectSync.xlsx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_ProtectSync.xlsx
Size 10KB
SHA256 6d959fd2efa8e9caf908004f36416751e2e49db9a9670d0a9522fa1d96e0bf56
MD5 99b7085f59f12d272ff74c5db75c30b0
SHA1 89140f8b9dabbe00a93f61d35b96490f942e17f6
SHA512 db3bda1263cd4e8f2d9c9db85e4954912ab0852bb0cf408374eacde18e1085e5a34600f1d370a438c3325615792d0e8b3a3d8ebd7785064191756a487f606e32
SSDEEP 192:wc8mVWhTHrA8Kb3U9XT6IBHN9aFUlbVvevUqzQXpS0Wo1iBHboQc/maomf:wc38RHr43sT1tOUlM9z6peo8B7Bc/maD
TLSH
T1AC327D23B568453AC327C87D81DA04EA775D10906746298A7C35F0AE3B822E716BF2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_ReadTrace.xml

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_ReadTrace.xml
Size 770KB
SHA256 ace1b834b8a6e387e156aaee78fbe51dd065ebd26b33221ef3da2b4463ad70d4
MD5 8af70a112d4bf2facf86a72ccba9bb14
SHA1 07db8a8dc0c3207a28a736e2f04f1d8320f8acf1
SHA512 de74c0bde14d7e0054629684a5604f6f945df68dd9a43b24227bfae9c5952f2e77125ea9b50d00e5d09d2237c9ba32ad2079668b2bb2fc5f8caf84260776dc9e
SSDEEP 12288:NfO/qJQFS3E4Q8aPYAKqQ017jKYEtqRP+uqHHOMOhrMkvRwxWvbSBXx0bfoH5:NfO/qJCS3b/aAAbKzAUOMzkvRwQIuDA
TLSH
T15EF4339391C6A2DF2040DE508C722D1DE3E1F2A6D750F955FBC05098A2B66A80FD329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_SearchStart.dotx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_SearchStart.dotx
Size 1.2MB
SHA256 6b4e7a2fe8507fe5edf596ad0a29d0d0e4dabf4df3aca288985c6a610f4df3d1
MD5 8300269742b356341ce40449e5670541
SHA1 24b4971690759ae04281899f38ee603be57709bc
SHA512 504dca23a584caa2f01d1f40c9945178ba2994cc96f2dbfaade61fcaebfd32cf5beba9752a994b793db85945991a17d8c0db0327aed822ecf08ff189b9558257
SSDEEP 24576:8OuHAtTY/wZyK7ZkxBjKdwuWRYyIPD+g3zvd6azjny/HviFRUZPwtOT:8OuMk/w56PjokRYy6+8zvdbHnkHKvxK
TLSH
T10245330C7A0973BDD1EBD95C1FA0C81C6F76EB841D654B602D2B8DEBB099084428BB7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_SetDisconnect.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_SetDisconnect.docx
Size 19KB
SHA256 d3721ae83e42a9f596609263d43c25b881d98e71290afe83e224b84f489083c5
MD5 b866d18c3517661c79b3155278d7a35c
SHA1 c8195604cc98b4596a73ee8109ee7f26dafd9283
SHA512 8182260a4d4eacecde6edafa45f10e9859ef8c25998ad8e11e3c29e9f58b6f132fdeeff364922694d2bc26519f2d4e17a3c754a9696f0255d20d65e731940bd4
SSDEEP 384:aEi4uAu9So7kfVZhWwU5wyOlhQB3he5dNxt/ZtNNMIFHDJuBQx:hJo9l7kfS6hlh2RUxllNMItD0I
TLSH
T16492D074D604D922F5AF457EEA5F80F3D458AA313721DA432A0A7C5F83B7962331318E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_TestConvertTo.ppt

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RDP_TestConvertTo.ppt
Size 651KB
SHA256 153389531eb429a8eea85ebe414c8e49569e6d6c2f94152272c28b0402b2a525
MD5 ae743386c1f8ea0a2ad96b5f0d04c415
SHA1 ec4f7e237959a3826a0c459378e2e7ea58da6271
SHA512 a9722175b5bf27ecd4271ea72d97beacd21c0d22961c1ea1f328f6b7d955b0bda78d75f17ceacb81f537ee2e6402229d9f7b00c2336b7edc0dec4ae2a711a597
SSDEEP 12288:sJhRzSj3PpxrGB7O1hikmfg3UWs6md7TXqQlYrv0RDtzdt2vE:s/RSTpp8ylg/Xqam0t5F
TLSH
T1A1E42383DC3018A57C786DDC95AB7F6B6ED3E204F8940B37DD788402A6619F413E662B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveGroup.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\RemoveGroup.ini
Size 295KB
SHA256 28770226e6abd9ab39f90f88a30948781232121c369b538a70bc682876e6c383
MD5 ae767581cfb3cf2e1008d0a674d61afe
SHA1 e21c56cc244fff53703850165caa3169c1145bff
SHA512 c6ce62a7c69df08078c25ebf214e04bbe6a40f53bf3787cf799db94709f6271fa6290fb5b4ab19a227b10dd2af134308edf51031727ba49924a459fe27e3367a
SSDEEP 6144:oEWB0g5Haa/7IltaIpuoJFzdvU0Ll5AlpdcZZXcvME/ZWXz9w:oEyB5zIlMIpuoJ3vU0L7Ap4E/Qhw
TLSH
T1CC5423D8637FC1DB44DE69A00C337400A6C6ED1B8B45CADD6FB9DB2896C105D288DAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeSearch.ini

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\ResumeSearch.ini
Size 430KB
SHA256 afdcbaf098d77933fd0ec12f48ec16313fa67958d428ee00ae7a59cb0d86815e
MD5 5bd4da6a79707ba343ae7318ff01a94d
SHA1 666ccebe320fc884e2ce55cafc251b5bf15042c3
SHA512 a52ff45595a571729fb6587b42325702f7a96a1de3723976969765e6eeb6a758342755782bd9766ebcf3926f5c71fee16a9496ca2884e848d145462ec42315e2
SSDEEP 6144:eaYVkcvLjaVe5Z9hOVs9dnNYfrobBgwA8L/iPo05ECmPX05JkzwrVx3dJ:eXGcTjw+Z9hOVo2TnGS1mPE5+mVx3T
TLSH
T16B9423C97BF82861FB2432F73A60D77106D255EAB70618217AE7463E52194DE2EF00E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitOut.docx

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\SplitOut.docx
Size 17KB
SHA256 fec1cf5f814e1f610f125f3107f6ea78e47a25c1703dd7414cf5896586abdfbb
MD5 b1b3309f5b16977f9286f4181e710f10
SHA1 48d7738c3b7d87fadb4df98e3a82a20d7cc25bc8
SHA512 beb000a009f5b9bf723c9f2de740f10d568c169e787273f7bcc5772cb1ace22df4eb687f9dc23b0d4700cc29f4a2cd03f751cd04a5bf052a053fe1d281755f23
SSDEEP 384:acTF1OP6NTcP73CA5dNxt/ZtNNH8gcIFHDJk1Py1:LFPTcrCAhxllNFcItDMy
TLSH
T18382C028CB10B161E9CE4E3EE019A1F5F14D11823FD2900B306EDF8FA57EA275327486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WLQWINKU-20260709-1433.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\WLQWINKU-20260709-1433.log
Size 59KB
SHA256 6605647dcaa30083588063273bb76d62306ad63e3f3d097c6dd5392e3c4ab4a4
MD5 08ed1563447d259d1e830c65a3e494ff
SHA1 853aee75488185505d33334c08749b125c74bf26
SHA512 f6168d65292602cc99e4d4c17f6bb79669dd74b1ce3ffe6d5202b8ee65b53ee1b9fb783e770dfa23bb90d2b0b2794c2e349e89168e54455b36465b5301b1ca1c
SSDEEP 1536:LDJUbVbrk/D+9AbZbWRbzbcb+b7b4lb5bbWbmb/abTbepUt0TbCybaZbkb7bLbSR:hZS9FURpUt0yJ
TLSH
T1B75389281FEA0256F2F38B5A99F2406BAB767E577835DD8D10910F0E1926E417C60F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WLQWINKU-20260709-1433a.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\WLQWINKU-20260709-1433a.log
Size 169KB
SHA256 0609152145078e41637e34d9302665740d8f2d6eb17a4db34e85a14665010920
MD5 0077e8e27502fb1796ae995d6d4e3ca0
SHA1 efb97bf92198d82b3dea01538a47ae9ad0962ddc
SHA512 1e47864dc360fcd7ab41923ed21baa970d0575d517e898489ce23932c14b282d370db3a6fc4b820aaf0e4d64ecd07ba6b5a1c297cea0b44db804863171f8dbee
SSDEEP 1536:GUbbb3bbbjcubbbZVbPbd6bLbvbL6bbbObGbYI4SZm/iJCE6brbK6bdefbN2a6bS:G8t0/S/4/29
TLSH
T1E8049A281EF90226F2B2DE859AF640239775BE676835CE5D50910F4E0623D45BCA2F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\cv_debug.log
Size 805B
SHA256 69b30c96515cbfdff12b48d7f0e6c6b1ea82dfbc27fc299dac80cda03f94e9a6
MD5 d7eae050ecfdfb358226ab666dd28acc
SHA1 b1bbafed14a199f3032720c5833dc95b79525359
SHA512 07f0fa166e18099948a1bb6714632b17e4f5d9b6f2b12194342011f2f46c528f5b0fe162905d9567ff1011f12536df8e1c015041c79b5d8da61c0cb776781c94
TLSH
T1150108E43836736F03C247D590254CD65C20E485032F666CDA5AA031FE2CAD1639E3CA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 5f9b7dae086b1924b628af1f67d0b70788bca487d8195cbc5366d716a10c9b92
MD5 e6738d046cfd195a8c8337438c3d21c6
SHA1 0ba42fd882e8f97b143d79090d30be20f8cbd349
SHA512 96ab18899ca32ed208e8de7b0e5e011cfe7b6c98a4a55c0e7b929f96c837d2f8ad636b5b1d9a126900ec051d3397b979b6e2cd75e72c8a85cf924555aeda9f63
TLSH
T120215BC084CF587A446582A48C96BEE380861B465ECF7DF97B00E9CC15830EF5AF98E3
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredistMSI7987.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\dd_vcredistMSI7987.txt
Size 428KB
SHA256 de2c0b3fcc6f25582de1fd1f0bdb1c6815198b107d1ae09075314b2379f5333c
MD5 d329f7aa63572b7dfdfa52621ccfd79d
SHA1 971a7522809df61e3692f72c4bb1b06c906932f9
SHA512 f467b91be74a96d31143e211812262e821e4c1d4cadda9716fdad48b7239316a40ce53b250e5876d9f2db6d99bb28348de72cc5d90474657c7fe335e8152479e
SSDEEP 1536:0Q/SVev3dJ2uK7asZ6RTm4OoNFp8tbP39124b3nM3cIX/k2aR5yopZ1SoQQO3GA+:0QjOjnkk7gOGwvB
TLSH
T1D7946D2A5FF90216B2B2DB479AF345136933BDA2B939C94C2191830D0171E05E979FBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistMSI79AF.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\dd_vcredistMSI79AF.txt
Size 413KB
SHA256 e712b9d381251532ccf187aafe83874674966e8a36cae22ce47c1171698d076d
MD5 5a485570eae0543e2f4ef03cad5eb91f
SHA1 bbc364df67b01c020ff7bcd1fbb729d7972dde38
SHA512 1e8ba298447745b6c864adcc8f11cd506e77af1e063df3bf3262f9ad9d896644046cd80db0e67a37096d26704785147835b1fbba6ee2a8fa65bc54b9ba11db2a
SSDEEP 1536:osbMtSOSfLCiLrimrv8HYfrY9HrHQ/srQbTuSF98kReIoSIWzfJUhR8+fbL6hrhT:osajjPQ4B35cKgNzH
TLSH
T129948E295FF90216B2F3DB83DAB704525833BD63A839D94C6191830D05A2E05E97DFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI7987.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\dd_vcredistUI7987.txt
Size 11KB
SHA256 017d9452b843f9bef8c301647cbf7a40b1838073a9b41ffc4facd7fd1be7596b
MD5 9e504992a3f138e3e2a3cc9ed31f2b59
SHA1 5b1764b82adc30d09ebef7ea4bb9a1ff95fd6813
SHA512 99081ed86ae4d1c0d92cc81b3ae231e964a18e71520b38e501b032994ce66b8bc095be7f874d3d5cd6da2172e910741f19e31be1be4173735c00a36a49a45b30
SSDEEP 192:il08FEj+Ylzn7nTRn7nhM8dn7nADkT81Bsk8Yf:il08FEj+Ylz7t7hM8d7VwoYf
TLSH
T184327D2B8AA50055F4F2DA4FE8FA5113EF76B861597E850E10F6138E15B0608F8E17BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI79AF.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\dd_vcredistUI79AF.txt
Size 11KB
SHA256 7d0870d0c8514972459d3153c2987d15546c2062b6439ac4920b2e53d0a46205
MD5 c5ad1279430107af20a250a25a58c6bc
SHA1 4cc5784e80c1f85df6d64892c61d42023ba818e1
SHA512 4d2ea37c54042121259318a7a8c507017f743ed69ac5a6d7b39ea2cc3a07a649173256567838811060f95b67780cfa7a7ce0fceb8529d0644391791325bff18d
SSDEEP 192:z6wgtVeDwuAnwnzqnwngMP+nCnR+3O80R0M8wP:z6wgtVeDwuAwmwgMP+CurJwP
TLSH
T1B432CF3BABB50059F4B2DA4EE8FA4112AF76B861697D950D10F5138E11B060CF8E17BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_grabber.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\file_grabber.txt
Size 5KB
SHA256 a2cf246924de2e42bb07b6a8f1df1bf1c4059d4ce446e0f2e2080ac1324d50e7
MD5 4a77ce1579e1528a17ba593e0105ce04
SHA1 c7d06effec295348de8c923ba3a7a8cec2ac727a
SHA512 363f399302325e69cfcf00b07630abc9eec82c8973f58fa702c97f0bbac0fe0b9463be281e065707b47921d7ad45dd11d4c32da2ba9d5d1d5c92f4794cfb5003
SSDEEP 96:7n2fpp3JlbRbkbWJbWhZ7UmM3MTEALyEtgEtnEtwEtL5EtgUEtM8Et0EtjEtYEtl:7n23D98uqrxQBLig1oVMJhdzzslU3HVH
TLSH
T142B126454ECFC79D01A8B0B762B7E69CB3758C0F7E49A7585B50848EE09361EF5E2E02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firstrun.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\firstrun.log
Size 371B
SHA256 4711ad6af9bd9e6b5cb97728b7cc68e5b27296066d3bd36cfd7c45a297cf99d7
MD5 3d3d23ac6fbc8a5d65af8e1024d47536
SHA1 66421c310df0a6dcce35f5221fcd9e51c10bb6d9
SHA512 48d5bc6e7643869cd48440f09d071fc4786469259d6fe99cb8746d248f7213f10a528651b3f77988e61a2be26eaa6e8a7074e224089d4676c06175076ecc6f2f
TLSH
T16FE068AF481582FB8FB010E02429A73B6F15290E078DE4F7C20E3BAC12070980C38813
MD5 SHA1 SHA512 TLSH

Submit Download

jawshtml.html

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\jawshtml.html
Size 13B
SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\jusched.log
Size 163KB
SHA256 32ca4a30956b3e9d7d680ac3599847c659bfa94bdb242219a04739ddddef126d
MD5 62c69563617f13ae5346aa41a0e2aebd
SHA1 99d2264ddb8bab15fbeb92f0a820fbc40aad142a
SHA512 31872be930f196997c45cc6973b2ddf2e03920931d87cc8f0992d09c0aa89b58aabc0224184a83dd86593401cbcf20c930e8b785dcc85491656fdcbdc63186f6
SSDEEP 3072:LY753G3uw9oVM+4/aJdS6fd1el4sPtQuj3UXsy3Jz0024SrVumcWQmEUW:gM+4/aJdS6fd1eqnu4
TLSH
T1B8F311C7C91F45FA24138A97C3BA6D6445A6314A435E891C22CFC2EFA645903DF2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mapping.csv

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\mapping.csv
Size 120KB
SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
MD5 d3186aada63877a1fe1c2ed4b2e2b77d
SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
TLSH
T11DC35121D2F6619CF5F3AF941AB41AA91E73FC16AD2DED9C0250620D0466E61DE31F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\msedge_installer.log
Size 10KB
SHA256 f76a42616fed4486a76722eaa89bfe2c08c200ca593a99e3280db8fc64fcfd50
MD5 6ae28b4c75fbfe28c143795d999a90b9
SHA1 55a084df0bd31802b33a64bc96fcf24f3a8509e9
SHA512 8d1a2e94b0884ff819bacea35cb57af14971950f868cd1bd623eb4e094c4fdf1c600403fe2a1b540235d0e89f14b2ea5b6543be0f7ee956fbf99652fb63d7f3c
SSDEEP 192:LQXwoo2XggvOVti2Qik8gosjKFz9vOEJEL:LUWXiRCWWEL
TLSH
T1E13225549A47C1B11BD773BB11577D17C59A0A8EC6D0A87336F9B086F482AB9013F8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\sysinfo.txt
Size 1KB
SHA256 6963c9191fd47f22d13892d35b8762043757ce5519dbd1484d7bd9a9eb671934
MD5 63b2853c2e96d08d17330cbf33714af7
SHA1 c28e298115c1ebdd9e68b0b21bfe0ddbed977d9c
SHA512 8ebe572d86f70693d671ae00069adeb2fff89d85a8a80d056eb1cd7778a435798a574f02498cdd2f1454d25b5e6401988141356e279ddc631c22dcb78163bc1b
TLSH
T15431120E8D59B0868539BA8A61B2DF48B65F9743BBE0CF1144CE020EC517BC7E9FC599
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\sfud_xbelbw0f\wmsetup.log
Size 697B
SHA256 bec0a9d4e7471d102326c588de46d713cb9c1a8e40f1a463e1ec1492d4d772f7
MD5 02feecd38ef9a8fc98f656d6670c1f2f
SHA1 e6aa4bfac0ae740d42a3e1b389626070c2d26a50
SHA512 a35129c6b06cb613f2d83a71cd0130c6e36a341486e29c793c0589d0a665f215142d46ce5fa083ea2c739167ead6d9bf3a75b875f3ee01e737d50d06907e8555
TLSH
T117014C974A0AE4F48D9297A369CC8E2673BAE7CF4394D026A389E055450913E233E07E
MD5 SHA1 SHA512 TLSH

Submit Download

sys3B98.tmp

Path C:\Users\Admin\AppData\Local\Temp\sys3B98.tmp
Size 1.7MB
SHA256 5e652793d476d1ba3de4cea76586055469669b9c560efaabf7a43b7b88d5668a
MD5 23b5d4ebf05a58612fb278fea4349eaa
SHA1 2fc3b922d3762cde88c6f3b1dc1cfd354d23861d
SHA512 1c9af26cd01df5c7f0a8e58bfeddbf1e01a5d3fb46b52300ee5f0bdb2ab40bb8dcf9b48a8a7fa53bb726a52f6bd4322d52c5d0751eb3c972c5864ec449f5d1b8
SSDEEP 24576:efiQqeH4KNO3VGQ9uBn5qXso5oAG1B8KInTH+F6BvEo:ewA6sC6n5GsQO8xQ6
TLSH
T1D2858D1BB2B900EDD067C1B98E165607EBB274450334AADB17D089E62F23EE55F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download