0c9d3755f7157ee428cccc43c2497daae05b9fc3d9667ede6806356596319740

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Size 601KB
Sample260808-dcymfabc93
SHA256 0c9d3755f7157ee428cccc43c2497daae05b9fc3d9667ede6806356596319740
MD5 b63f29e7768bef83e2a6b33da764b385
SHA1 4e024d2de572331cfa493f53813ca34ebe956860
SHA512 16276af1884708e5fca22a72df6e4ee87ca048d158df39bcf8f3a2ca7552d4dfd8fd2965505bc21c3e2148f9187da430577673b82cfeb4380d5ae7687f99f1b1
SSDEEP 12288:bwdak8b5WyNFwOBXldqjdZRRelu0vizx3f/Jw9mCcMpT+:bwdaktRmu8i93fmXFpT
TLSH
T1F8D45C57F6A2D1BCD12AC075935A9173FB32B88A06327EBB13E487343E65E506B1DB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects ransomware indicator 2 IoCs

resource	yara_rule
behavioral1/memory/384-1467-0x00007FF6EEF50000-0x00007FF6EEFEC000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20
behavioral1/memory/3412-1470-0x00007FF6EEF50000-0x00007FF6EEFEC000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4572	bcdedit.exe
4476	bcdedit.exe
6116	bcdedit.exe
6104	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6800	powershell.exe
6840	powershell.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4300	wbadmin.exe
6132	wbadmin.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\nsi0d54.sys	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
File opened for modification	C:\Windows\System32\drivers\nsi0180.sys	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe

Sets desktop wallpaper using registry 2 TTPs 4 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wupd_bg.bmp"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wupd_bg.bmp"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wupd_bg.bmp"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wupd_bg.bmp"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6864	cmd.exe
6932	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2832	timeout.exe
6180	timeout.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3548	vssadmin.exe
6080	vssadmin.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\TileWallpaper = "0"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\TileWallpaper = "0"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6840	powershell.exe
6840	powershell.exe
6800	powershell.exe
6800	powershell.exe
6840	powershell.exe
6800	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
384	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2020	wmic.exe
Token: SeSecurityPrivilege	2020	wmic.exe
Token: SeTakeOwnershipPrivilege	2020	wmic.exe
Token: SeLoadDriverPrivilege	2020	wmic.exe
Token: SeSystemProfilePrivilege	2020	wmic.exe
Token: SeSystemtimePrivilege	2020	wmic.exe
Token: SeProfSingleProcessPrivilege	2020	wmic.exe
Token: SeIncBasePriorityPrivilege	2020	wmic.exe
Token: SeCreatePagefilePrivilege	2020	wmic.exe
Token: SeBackupPrivilege	2020	wmic.exe
Token: SeRestorePrivilege	2020	wmic.exe
Token: SeShutdownPrivilege	2020	wmic.exe
Token: SeDebugPrivilege	2020	wmic.exe
Token: SeSystemEnvironmentPrivilege	2020	wmic.exe
Token: SeRemoteShutdownPrivilege	2020	wmic.exe
Token: SeUndockPrivilege	2020	wmic.exe
Token: SeManageVolumePrivilege	2020	wmic.exe
Token: 33	2020	wmic.exe
Token: 34	2020	wmic.exe
Token: 35	2020	wmic.exe
Token: 36	2020	wmic.exe
Token: SeBackupPrivilege	1368	vssvc.exe
Token: SeRestorePrivilege	1368	vssvc.exe
Token: SeAuditPrivilege	1368	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2020	wmic.exe
Token: SeSecurityPrivilege	2020	wmic.exe
Token: SeTakeOwnershipPrivilege	2020	wmic.exe
Token: SeLoadDriverPrivilege	2020	wmic.exe
Token: SeSystemProfilePrivilege	2020	wmic.exe
Token: SeSystemtimePrivilege	2020	wmic.exe
Token: SeProfSingleProcessPrivilege	2020	wmic.exe
Token: SeIncBasePriorityPrivilege	2020	wmic.exe
Token: SeCreatePagefilePrivilege	2020	wmic.exe
Token: SeBackupPrivilege	2020	wmic.exe
Token: SeRestorePrivilege	2020	wmic.exe
Token: SeShutdownPrivilege	2020	wmic.exe
Token: SeDebugPrivilege	2020	wmic.exe
Token: SeSystemEnvironmentPrivilege	2020	wmic.exe
Token: SeRemoteShutdownPrivilege	2020	wmic.exe
Token: SeUndockPrivilege	2020	wmic.exe
Token: SeManageVolumePrivilege	2020	wmic.exe
Token: 33	2020	wmic.exe
Token: 34	2020	wmic.exe
Token: 35	2020	wmic.exe
Token: 36	2020	wmic.exe
Token: SeBackupPrivilege	4792	wbengine.exe
Token: SeRestorePrivilege	4792	wbengine.exe
Token: SeSecurityPrivilege	4792	wbengine.exe
Token: SeIncreaseQuotaPrivilege	6088	wmic.exe
Token: SeSecurityPrivilege	6088	wmic.exe
Token: SeTakeOwnershipPrivilege	6088	wmic.exe
Token: SeLoadDriverPrivilege	6088	wmic.exe
Token: SeSystemProfilePrivilege	6088	wmic.exe
Token: SeSystemtimePrivilege	6088	wmic.exe
Token: SeProfSingleProcessPrivilege	6088	wmic.exe
Token: SeIncBasePriorityPrivilege	6088	wmic.exe
Token: SeCreatePagefilePrivilege	6088	wmic.exe
Token: SeBackupPrivilege	6088	wmic.exe
Token: SeRestorePrivilege	6088	wmic.exe
Token: SeShutdownPrivilege	6088	wmic.exe
Token: SeDebugPrivilege	6088	wmic.exe
Token: SeSystemEnvironmentPrivilege	6088	wmic.exe
Token: SeRemoteShutdownPrivilege	6088	wmic.exe
Token: SeUndockPrivilege	6088	wmic.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3548	3412	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	86
PID 3412 wrote to memory of 2020	3412	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	87
PID 3412 wrote to memory of 4476	3412	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	88
PID 3412 wrote to memory of 4572	3412	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	90
PID 3412 wrote to memory of 4300	3412	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	93
PID 384 wrote to memory of 6080	384	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	106
PID 384 wrote to memory of 6088	384	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	107
PID 384 wrote to memory of 6104	384	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	108
PID 384 wrote to memory of 6116	384	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	109
PID 384 wrote to memory of 6132	384	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	110
PID 384 wrote to memory of 6800	384	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	118
PID 3412 wrote to memory of 6840	3412	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	119
PID 384 wrote to memory of 6864	384	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	121
PID 3412 wrote to memory of 6932	3412	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	123
PID 6864 wrote to memory of 6180	6864	cmd.exe	127
PID 6932 wrote to memory of 2832	6932	cmd.exe	128
PID 6840 wrote to memory of 552	6840	powershell.exe	129
PID 6800 wrote to memory of 5016	6800	powershell.exe	130
PID 5016 wrote to memory of 5700	5016	csc.exe	131
PID 552 wrote to memory of 5712	552	csc.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3548
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4476
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4572
- C:\Windows\system32\wbadmin.exe
  "wbadmin" delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wupd_init.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jiqijsgr\jiqijsgr.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB800.tmp" "c:\Users\Admin\AppData\Local\Temp\jiqijsgr\CSCAB32250C9B884452A16BF1B16398D9C2.TMP"
      4⤵
      PID:5712
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\wupd_gc.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6932
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2832

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3436

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:1980

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:6080
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6104
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6116
- C:\Windows\system32\wbadmin.exe
  "wbadmin" delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:6132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wupd_init.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6800
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1naig1vb\1naig1vb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7F1.tmp" "c:\Users\Admin\AppData\Local\Temp\1naig1vb\CSC70FE690E973C4EE1B0C6FF169B4BD65.TMP"
      4⤵
      PID:5700
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\wupd_gc.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6864
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:6180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 f3fa20f5a00731d1a6fddcd1918489c882369a7ff85c5de936c70ab34fac2688
MD5 b5a206295945d6a5c3ccf8be0fbc3888
SHA1 d10766475b084612944b77bf1982de322af5970c
SHA512 ff398504bce3dd114b3e3d0f4569a8292ecc8b4bd7204293c56b07a8996e8439e1bae00564d4ac0a428584a9e9561f1d9e8f7fdd5bb6678930871524fa4427d6
TLSH
T14E71FE323275B0D8C9567F072E2819C053BF4356EA94AF5CB29C625EDA2640B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7cbe843dda39466c617dd4a3ac6b0d616ded2f7d69593da7be4c007c9cdae6a2
MD5 40257e5102377c8449a2ff377e1c0345
SHA1 00f44d48d0ca984a5ca2a16928972a0675ecc489
SHA512 cab14aea75f4ada900d3f1f58dbaa7c7103307a0e01e87827403d77aacd2322f09f1086601c1093cc709572d8df635d71e5327aabf17807fb5696ed665e56d14
TLSH
T1F5215427B3DC8921CC8A113A409D9C1076B693C7809EDF9FAEC4D614A1BF9C8CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

1naig1vb.dll

Path C:\Users\Admin\AppData\Local\Temp\1naig1vb\1naig1vb.dll
Size 3KB
SHA256 aacfe312b109507b4042507e3aa3a5eb088e625897e5e77b5e7b04090cd5145e
MD5 74f920fc86d43864f1d57e0f469c3693
SHA1 1a14f501f44fffc8ceb545590d3d3aa051d378ed
SHA512 eef1878450da409f30be0d6cae621b89512c23563418ef3b8d462870df40760b905a34f2ebb41d5ab07104f3d136d251e7f8a08e9fede2c2e202d46376159242
TLSH
T12951AC1B67E8166BF0B74730AEF3435737B4FC50AFB2932949C052299C257245A32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESB7F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB7F1.tmp
Size 1KB
SHA256 0b3e509fb669b561dbd7f5a0ee84b17980eb3d9634b65e348e24fa51ddd095fb
MD5 840afe3e6eaf23fc90c5ebda4b9e8c70
SHA1 dc924df122db8a9ff3c30d10fdff26d21b9e4e25
SHA512 79090cb0695bdc10a4f1ae6d720448206ea93bf01e2f69c5da50850175d6439e86c713e2ee61c2e71ccd43a1a976cbd512e0b8ae60727b8bc8a2715340b1850d
TLSH
T1F2217B0643E84B1EF0B75B31A9FA175BA274FE59EFB2536B844042282C51104EEA1F73
MD5 SHA1 SHA512 TLSH

Submit Download

RESB800.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB800.tmp
Size 1KB
SHA256 c8e975b1ad4372781c0fa861b9fbd26aa5f29a620be91d30ac84166a520640c1
MD5 38be501e63aab0584389e6079106ea59
SHA1 a8bf1d7ef64f21afef975b91ad46f4bbfb7c07d4
SHA512 2653e4f5d1a07a61f7e56c0cfb25366b218d5b2105540b1112e191d5d41a02d6bf1cb4c9a9e17b1e58c623af6850d037e946d234b961631c0187596f7cd44974
TLSH
T1C121AF0583E84B1EF0B35B317DF5171FA278FD65EFA6635B854042281C51104EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dzqx5x00.fzk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dzqx5x00.fzk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jiqijsgr.dll

Path C:\Users\Admin\AppData\Local\Temp\jiqijsgr\jiqijsgr.dll
Size 3KB
SHA256 8dd51249b92134975b6701123059455a71bdaa245a1df485672ac5c529e20d25
MD5 623f1a6c0f3a7ff8f09595219317e51a
SHA1 8102e08074685349c6df114d3df4cba412d32f17
SHA512 0940675e916f08e30b18c5d86599a9ca476c8f516e74e7d3eeaaddc7817a6a4dd3c01133bc0359e1b568c2f1b1388373799ee20b8bc1a70c472dd869aed8f026
TLSH
T1BD51DE1667E8466BF4B70B306EF3431737B8F860AF76932D09C052299C617285E32B70
MD5 SHA1 SHA512 TLSH

Submit Download

wupd_bg.bmp

Path C:\Users\Admin\AppData\Local\Temp\wupd_bg.bmp
Size 7.9MB
SHA256 71b78d85eb5dd4ce9e33ed7d9d8da78f911d730f38443c69c48b2079751c9455
MD5 de84713137057be9e9c8a54402bf587f
SHA1 65029ed1de91404eac9ff93bc5c0046811a816d6
SHA512 92d7b05821451c3112293d3c83fd2c575d6fb2ad30ce9cee5ecf55af7b9a7942627403686d83f4dc56e0dc61de1b41e441a5bfee9c9e68b48e0affb01f76fc36
SSDEEP 384:thuFioSB+EfXQBqDyqXkSWofIkXqRnz7fJ6XbKHXrH4P+HXr4LnGeAHXrURrw3rq:tT3gdEZNx
TLSH
T13B86A5E9A934E8C7D40A61318C1BE3BE8561DFA967B1A5E04DE1FF2B37D20A63C1445C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupd_gc.bat

Path C:\Users\Admin\AppData\Local\Temp\wupd_gc.bat
Size 186B
SHA256 07ec1a5789a5372d9d192918024279443d972fb2f6b0bf9797103f4094f15028
MD5 66c3c79c992bceb0e00e06311a75ae6c
SHA1 d286a8a5a5ad9ac92d2a4d6cff92cb836d9c428c
SHA512 bd05b146dc235ba724ccb73eb6560f04daaf1e0cd86ced2854be1fcbfa77da7eb4e035c09520111ffbf8773731e0aecbe34419715469f78319b984a7017a905d
TLSH
T194C0C00F304A0F42080228D84EFF660A069C20930E00FFC10381CB24474326D57F69DC
MD5 SHA1 SHA512 TLSH

Submit Download

wupd_init.ps1

Path C:\Users\Admin\AppData\Local\Temp\wupd_init.ps1
Size 1KB
SHA256 753bf1a6df9283e72a56a516f4082b0ccbae260ca1a68406642c7f9c5601bcdb
MD5 7ad021d62cd20b0ebfb6de35fd161a28
SHA1 72d2a062c1e9c917d9331e5c126fb9ceee4a2629
SHA512 bef423afd3271627e1b1545cc5d632277c92328f8f56fdb39aa791d93f1c25024cf5347845746018b2b8aaef2880aea6eec9ec8c4ebe86f3470379e1d8f21870
TLSH
T14B21DA30638BD99E0A88909FA96ED4C49B71031822B5ED4D73DEC314934B924933A376
MD5 SHA1 SHA512 TLSH

Submit Download

README_DECRYPT.txt

Path C:\Users\Admin\Desktop\README_DECRYPT.txt
Size 64B
SHA256 7bd23106ac7ead2c3e2783c5976ed41da0a02d86bb2e6dedcdd6c69cf5fd7372
MD5 560ead593038b020cb9d72d33717e13d
SHA1 5c60a14818494899360d39fb856e5a8e6fd01816
SHA512 af5a5aa8366328ecbf54816f1bf4825c4d7c9ee567be98df09d4c64d205d024018a9221d66883cc6e4cad10bf3a799c6b823519a187b590f7b417246c25a8713
TLSH
T1E5A0222330838CA28022E3C8A800B830830202C2B0CA8882B0080C8C32CE8008C8080C
MD5 SHA1 SHA512 TLSH

Submit Download

1naig1vb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1naig1vb\1naig1vb.0.cs
Size 196B
SHA256 70dfabfd1615832390e496ccb312d1f826cbf4eb57a36a6c2e337130e6449192
MD5 cd4c8f77ddfac54ecdb1419ed733915c
SHA1 dfcf7c139d7c355b5e81d9e33f66768de50097d6
SHA512 4dba7eece25cf15567a188d5953a2f7d5d42c4e6952bd9eb146b5b7c0f2ede46cc341d34e202a436edde2f7fba267e6e7191d39a2c2641d2c0f6623124a0f0cc
TLSH
T119D02234C747DAB52042801A0CC2E89A773A5110ABB8B803AAEC4312884B90C2230B25
MD5 SHA1 SHA512 TLSH

Submit Download

1naig1vb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1naig1vb\1naig1vb.cmdline
Size 369B
SHA256 145c30222eecfbe4138469f3ad1282e22c15e7e0db85e79ec3aabf874406b0cf
MD5 5cf7aaa3cb6048b01dd4444134867018
SHA1 5905b444298c4df4cebe1813b257988e82db13f5
SHA512 d418d3a7eaebb8a6c169b3e642e598704c2aaf11855f78768a9417a7b0db8eae1932b8051c0d90e8583619fa31c013e1ef0d697f557e944ba31d23a8b60a042b
TLSH
T19EE0D83B5396C67D56D9201721A9E9ACC27217873D457F849150C45EF01B008B7D2757
MD5 SHA1 SHA512 TLSH

Submit Download

CSC70FE690E973C4EE1B0C6FF169B4BD65.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1naig1vb\CSC70FE690E973C4EE1B0C6FF169B4BD65.TMP
Size 652B
SHA256 8b215be77d15aa09de16d412439032e838878e5b9ca72fa29fc4141835343032
MD5 60ef7b7cc9d9cce1034119f0c2d6c77c
SHA1 89d628199cd08ae8cc9161c94c893704f222a6aa
SHA512 cfd8097bd26bed67460f26e85f8e2baf7e6c1aa0b966936a91bff626e79f3763dccb1776a923af9b6f1adf75b44dca61065b976fdbac2ce3a318d275b47a1974
TLSH
T18BF05E4A63F8020EF0F74B31BDF643A7A1A8FC65DE7293ED145003196C645208A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSCAB32250C9B884452A16BF1B16398D9C2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jiqijsgr\CSCAB32250C9B884452A16BF1B16398D9C2.TMP
Size 652B
SHA256 0e776d860ca82defa0784041e85e2c0036e026f4e95d2e2de980f19933697624
MD5 8f7abec7315d8378d63dbde0692ceccf
SHA1 b4b719643a8407d042ad4a0b894e35d12a6e96ff
SHA512 60c302abc05ae79b0eb80f6bcf6d3e6b7d7f26174d2c1496039c11671afbbcdb64b51ea3edaed81e10a96b89d9f80a51ff8b00e32242f58d42af4d32d07b7e76
TLSH
T152F03A0963F8420EF0F34B30BDF6436791A8BC74DE7693ED158017196864524C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jiqijsgr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jiqijsgr\jiqijsgr.cmdline
Size 369B
SHA256 e04c2cfda2e15da683bca8a36434ad7aa7b39af3c1ccc38ff59ad9eb6953e00d
MD5 fa6787a32c015a3a3fe56fdff496aa69
SHA1 cf63c7d80aeb472460792b92d32455e37650defb
SHA512 4b1d7fc1dd878e2cf52cb01c5158001b740e3c673560bfc715999d60b0a21c324f4caad260d842899da93dc816852afe17c557dee1187405cc9b8757c2cd7a2a
TLSH
T164E0C02E5257CA7D15DE27073279C4ADCAB60B4B39403F84D044D49DE0170006BD2763
MD5 SHA1 SHA512 TLSH

Submit Download

memory/384-1467-0x00007FF6EEF50000-0x00007FF6EEFEC000-memory.dmp

Download

memory/3412-1470-0x00007FF6EEF50000-0x00007FF6EEFEC000-memory.dmp

Download

memory/6800-1515-0x000001DA649A0000-0x000001DA649A8000-memory.dmp

Download

memory/6800-1520-0x000001DA66A50000-0x000001DA66C6C000-memory.dmp

Download

memory/6840-1517-0x0000023037DE0000-0x0000023037DE8000-memory.dmp

Download

memory/6840-1478-0x0000023037990000-0x00000230379B2000-memory.dmp

Download

memory/6840-1524-0x00000230379C0000-0x0000023037BDC000-memory.dmp

Download