0c9d3755f7157ee428cccc43c2497daae05b9fc3d9667ede6806356596319740

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Size 601KB
Sample260808-dcymfabc93
SHA256 0c9d3755f7157ee428cccc43c2497daae05b9fc3d9667ede6806356596319740
MD5 b63f29e7768bef83e2a6b33da764b385
SHA1 4e024d2de572331cfa493f53813ca34ebe956860
SHA512 16276af1884708e5fca22a72df6e4ee87ca048d158df39bcf8f3a2ca7552d4dfd8fd2965505bc21c3e2148f9187da430577673b82cfeb4380d5ae7687f99f1b1
SSDEEP 12288:bwdak8b5WyNFwOBXldqjdZRRelu0vizx3f/Jw9mCcMpT+:bwdaktRmu8i93fmXFpT
TLSH
T1F8D45C57F6A2D1BCD12AC075935A9173FB32B88A06327EBB13E487343E65E506B1DB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects ransomware indicator 2 IoCs

resource	yara_rule
behavioral2/memory/4864-892-0x00007FF667620000-0x00007FF6676BC000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20
behavioral2/memory/1204-908-0x00007FF667620000-0x00007FF6676BC000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2180	bcdedit.exe
2504	bcdedit.exe
2316	bcdedit.exe
6000	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1588	powershell.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5028	wbadmin.exe
3756	wbadmin.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\nsi1300.sys	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
File opened for modification	C:\Windows\System32\drivers\nsi04b4.sys	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wupd_bg.bmp"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wupd_bg.bmp"	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1768	cmd.exe
4208	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3212	timeout.exe
5980	timeout.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3704	vssadmin.exe
2356	vssadmin.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\TileWallpaper = "0"	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4116	wmic.exe
4116	wmic.exe
4116	wmic.exe
4116	wmic.exe
820	wmic.exe
820	wmic.exe
820	wmic.exe
820	wmic.exe
1588	powershell.exe
1588	powershell.exe
1588	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4864	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4116	wmic.exe
Token: SeSecurityPrivilege	4116	wmic.exe
Token: SeTakeOwnershipPrivilege	4116	wmic.exe
Token: SeLoadDriverPrivilege	4116	wmic.exe
Token: SeSystemProfilePrivilege	4116	wmic.exe
Token: SeSystemtimePrivilege	4116	wmic.exe
Token: SeProfSingleProcessPrivilege	4116	wmic.exe
Token: SeIncBasePriorityPrivilege	4116	wmic.exe
Token: SeCreatePagefilePrivilege	4116	wmic.exe
Token: SeBackupPrivilege	4116	wmic.exe
Token: SeRestorePrivilege	4116	wmic.exe
Token: SeShutdownPrivilege	4116	wmic.exe
Token: SeDebugPrivilege	4116	wmic.exe
Token: SeSystemEnvironmentPrivilege	4116	wmic.exe
Token: SeRemoteShutdownPrivilege	4116	wmic.exe
Token: SeUndockPrivilege	4116	wmic.exe
Token: SeManageVolumePrivilege	4116	wmic.exe
Token: 33	4116	wmic.exe
Token: 34	4116	wmic.exe
Token: 35	4116	wmic.exe
Token: 36	4116	wmic.exe
Token: SeBackupPrivilege	968	vssvc.exe
Token: SeRestorePrivilege	968	vssvc.exe
Token: SeAuditPrivilege	968	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4116	wmic.exe
Token: SeSecurityPrivilege	4116	wmic.exe
Token: SeTakeOwnershipPrivilege	4116	wmic.exe
Token: SeLoadDriverPrivilege	4116	wmic.exe
Token: SeSystemProfilePrivilege	4116	wmic.exe
Token: SeSystemtimePrivilege	4116	wmic.exe
Token: SeProfSingleProcessPrivilege	4116	wmic.exe
Token: SeIncBasePriorityPrivilege	4116	wmic.exe
Token: SeCreatePagefilePrivilege	4116	wmic.exe
Token: SeBackupPrivilege	4116	wmic.exe
Token: SeRestorePrivilege	4116	wmic.exe
Token: SeShutdownPrivilege	4116	wmic.exe
Token: SeDebugPrivilege	4116	wmic.exe
Token: SeSystemEnvironmentPrivilege	4116	wmic.exe
Token: SeRemoteShutdownPrivilege	4116	wmic.exe
Token: SeUndockPrivilege	4116	wmic.exe
Token: SeManageVolumePrivilege	4116	wmic.exe
Token: 33	4116	wmic.exe
Token: 34	4116	wmic.exe
Token: 35	4116	wmic.exe
Token: 36	4116	wmic.exe
Token: SeBackupPrivilege	3200	wbengine.exe
Token: SeRestorePrivilege	3200	wbengine.exe
Token: SeSecurityPrivilege	3200	wbengine.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeIncreaseQuotaPrivilege	820	wmic.exe
Token: SeSecurityPrivilege	820	wmic.exe
Token: SeTakeOwnershipPrivilege	820	wmic.exe
Token: SeLoadDriverPrivilege	820	wmic.exe
Token: SeSystemProfilePrivilege	820	wmic.exe
Token: SeSystemtimePrivilege	820	wmic.exe
Token: SeProfSingleProcessPrivilege	820	wmic.exe
Token: SeIncBasePriorityPrivilege	820	wmic.exe
Token: SeCreatePagefilePrivilege	820	wmic.exe
Token: SeBackupPrivilege	820	wmic.exe
Token: SeRestorePrivilege	820	wmic.exe
Token: SeShutdownPrivilege	820	wmic.exe
Token: SeDebugPrivilege	820	wmic.exe
Token: SeSystemEnvironmentPrivilege	820	wmic.exe
Token: SeRemoteShutdownPrivilege	820	wmic.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3704	4864	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	89
PID 4864 wrote to memory of 4116	4864	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	90
PID 4864 wrote to memory of 2504	4864	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	91
PID 4864 wrote to memory of 2180	4864	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	92
PID 4864 wrote to memory of 5028	4864	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	93
PID 4864 wrote to memory of 1588	4864	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	108
PID 4864 wrote to memory of 1768	4864	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	110
PID 1204 wrote to memory of 2356	1204	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	113
PID 1204 wrote to memory of 820	1204	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	114
PID 1204 wrote to memory of 6000	1204	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	115
PID 1204 wrote to memory of 2316	1204	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	116
PID 1204 wrote to memory of 3756	1204	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	117
PID 1768 wrote to memory of 3212	1768	cmd.exe	123
PID 1204 wrote to memory of 4208	1204	2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe	124
PID 4208 wrote to memory of 5980	4208	cmd.exe	127
PID 1588 wrote to memory of 1168	1588	powershell.exe	129
PID 1168 wrote to memory of 1828	1168	csc.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3704
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" shadowcopy delete
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2504
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2180
- C:\Windows\system32\wbadmin.exe
  "wbadmin" delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\wupd_init.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4vlihsaf\4vlihsaf.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60D3.tmp" "c:\Users\Admin\AppData\Local\Temp\4vlihsaf\CSCEE7A76E7BCB48CCA894F333B884F991.TMP"
      4⤵
      PID:1828
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\wupd_gc.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5968

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4276

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-08_b63f29e7768bef83e2a6b33da764b385_akira.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2356
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" shadowcopy delete
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:820
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6000
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2316
- C:\Windows\system32\wbadmin.exe
  "wbadmin" delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:3756
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\wupd_gc.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

4vlihsaf.dll

Path C:\Users\Admin\AppData\Local\Temp\4vlihsaf\4vlihsaf.dll
Size 3KB
SHA256 dd1e124bab426297ffba291822fa566a774c651ccb99871826597e6b1e469bf4
MD5 90d2411b2aeb30bac44eef81c30d37aa
SHA1 aec9f4aa148dca574946239b81eca783862d8550
SHA512 933b29b78c51a73afeaec4d2dfb7c728374d8965e32881b8fd04e22b8c9bb0a5429e12cdb4b068d36e820fb98d1f0e72b91b71904cf0111594bd32ed2be447f5
TLSH
T10D51DE1667F84667F0B747306EF3435737B4F8509FB2932959C00229AC607645E32B70
MD5 SHA1 SHA512 TLSH

Submit Download

RES60D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES60D3.tmp
Size 1KB
SHA256 3a2b13f33b5999366c8ec34ebb91629b8a5b3a93ba22fb83239205028c82b57e
MD5 11d1900bd671651ac18c20df02252928
SHA1 cfcc14183ca024226eb8eca749a47f32551a9507
SHA512 6dddec09fd9930487b879ac3568278f243a044e098ff027f4dda265286483438216ec48d7b6e8ef8b39400676529864448daf7203a039ce6655a4064987ba6f3
TLSH
T1E0218C0543E8470FF0774731A9FA072BA174FD55EFA1A76A954042292C51514EFE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

wupd_gc.bat

Path C:\Users\Admin\AppData\Local\Temp\wupd_gc.bat
Size 145B
SHA256 e146f835032b184e7227f0cd168285a4452da8fed0929bd311d99047d61c3488
MD5 bede8e36c5cf4bb7efdbc32994df8abe
SHA1 53299b5c0178dff609c65afc99c1f06e8310b47e
SHA512 e1d60d5828e6331882bd129494a704724cf20917d1f4fad44ccc02aa7caffa9fb78a08abba4ebd660bc25e779d4e1e7376dd77c173a1fd57ade6836b0f3ddda2
TLSH
T1E8C08C0B35864F81000010E109FF224602E800870E00FBC003C180298A4B1269793AE9
MD5 SHA1 SHA512 TLSH

Submit Download

wupd_gc.bat

Path C:\Users\Admin\AppData\Local\Temp\wupd_gc.bat
Size 186B
SHA256 07ec1a5789a5372d9d192918024279443d972fb2f6b0bf9797103f4094f15028
MD5 66c3c79c992bceb0e00e06311a75ae6c
SHA1 d286a8a5a5ad9ac92d2a4d6cff92cb836d9c428c
SHA512 bd05b146dc235ba724ccb73eb6560f04daaf1e0cd86ced2854be1fcbfa77da7eb4e035c09520111ffbf8773731e0aecbe34419715469f78319b984a7017a905d
TLSH
T194C0C00F304A0F42080228D84EFF660A069C20930E00FFC10381CB24474326D57F69DC
MD5 SHA1 SHA512 TLSH

Submit Download

wupd_init.ps1

Path C:\Users\Admin\AppData\Local\Temp\wupd_init.ps1
Size 1KB
SHA256 753bf1a6df9283e72a56a516f4082b0ccbae260ca1a68406642c7f9c5601bcdb
MD5 7ad021d62cd20b0ebfb6de35fd161a28
SHA1 72d2a062c1e9c917d9331e5c126fb9ceee4a2629
SHA512 bef423afd3271627e1b1545cc5d632277c92328f8f56fdb39aa791d93f1c25024cf5347845746018b2b8aaef2880aea6eec9ec8c4ebe86f3470379e1d8f21870
TLSH
T14B21DA30638BD99E0A88909FA96ED4C49B71031822B5ED4D73DEC314934B924933A376
MD5 SHA1 SHA512 TLSH

Submit Download

wupd_note.tmp

Path C:\Users\Admin\AppData\Local\Temp\wupd_note.tmp
Size 64B
SHA256 7bd23106ac7ead2c3e2783c5976ed41da0a02d86bb2e6dedcdd6c69cf5fd7372
MD5 560ead593038b020cb9d72d33717e13d
SHA1 5c60a14818494899360d39fb856e5a8e6fd01816
SHA512 af5a5aa8366328ecbf54816f1bf4825c4d7c9ee567be98df09d4c64d205d024018a9221d66883cc6e4cad10bf3a799c6b823519a187b590f7b417246c25a8713
TLSH
T1E5A0222330838CA28022E3C8A800B830830202C2B0CA8882B0080C8C32CE8008C8080C
MD5 SHA1 SHA512 TLSH

Submit Download

4vlihsaf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4vlihsaf\4vlihsaf.0.cs
Size 196B
SHA256 70dfabfd1615832390e496ccb312d1f826cbf4eb57a36a6c2e337130e6449192
MD5 cd4c8f77ddfac54ecdb1419ed733915c
SHA1 dfcf7c139d7c355b5e81d9e33f66768de50097d6
SHA512 4dba7eece25cf15567a188d5953a2f7d5d42c4e6952bd9eb146b5b7c0f2ede46cc341d34e202a436edde2f7fba267e6e7191d39a2c2641d2c0f6623124a0f0cc
TLSH
T119D02234C747DAB52042801A0CC2E89A773A5110ABB8B803AAEC4312884B90C2230B25
MD5 SHA1 SHA512 TLSH

Submit Download

4vlihsaf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4vlihsaf\4vlihsaf.cmdline
Size 369B
SHA256 10ec70db44c15f005fabdab9c0f5df7f9c664143877f157aafe865b0468e1f12
MD5 a2783c08d709abb2df2ad0ac1a124f57
SHA1 aecd3b8e3e4c18fcff54bb27f60f1236c65dc379
SHA512 59e31a9a6a400d4623a12a426584f77885dfa0fafdf0e27b654b760cfc6dcd12c36663bb71d0b6ef923b65ad8437ac3ccf7ce59e87f1db3df30392529197a4bf
TLSH
T19BE0687A4256C67D93DA241B22AAC4AC827206933D803F84D440CC0ED0974442FD1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEE7A76E7BCB48CCA894F333B884F991.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4vlihsaf\CSCEE7A76E7BCB48CCA894F333B884F991.TMP
Size 652B
SHA256 aacb02d4d00135ee10bbd7415b9047b73d19836239190302d38f6e60eb8f9e2a
MD5 0c1785c8ab8284c5db1f769c93a94eec
SHA1 d0e79ea79afa1065a1afd98214086ca001d094e8
SHA512 befadb9900a73f3998df8b489c3e719672b709863d5ec28d84b0046c0a7c556f89b904aacda9343aead9b73f92e52898e7ae738a59801aa18e0ef7a79525f8db
TLSH
T1E6F05E0963F8520EF0F35B30BDF64363A5A8BC65DE3293ED2840071928646108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1204-908-0x00007FF667620000-0x00007FF6676BC000-memory.dmp

Download

memory/1588-906-0x0000024EE5400000-0x0000024EE5422000-memory.dmp

Download

memory/1588-925-0x0000024E80000000-0x0000024E80008000-memory.dmp

Download

memory/1588-927-0x0000024EFD830000-0x0000024EFD9FA000-memory.dmp

Download

memory/4864-892-0x00007FF667620000-0x00007FF6676BC000-memory.dmp

Download