cf7bb67b6a59778548c759d6251dec6d553c784662420a2bb23412019935d6b5

Analysis

max time kernel
1s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Size 597KB
Sample260819-abkgmsshqg
SHA256 cf7bb67b6a59778548c759d6251dec6d553c784662420a2bb23412019935d6b5
MD5 25e63a488356abc27588601aa91a99b5
SHA1 4addceef33297c712281dc83fe4249483e32cd8c
SHA512 fd8b7eb4adb99f3030aa08b0c52a30e1280d23de7e9434c01511225853e21cf49aaa11993386dffeec571ab8fb404dde442b6a4ab8a4fccf5b1b5de29e650f42
SSDEEP 6144:wA/LD4UcBdHwQob0917MvkW7SJRuj+tnHRHLTjkmpL/2DD51sZk6mDkA0rCjblEK:w3UCrLjxLTLh/WikU1EeXq
TLSH
T18FD42956F21AA0FCE517C0B4835AA532B676708A4B357DEF12949B353E1AFD06B3CB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6812	ScreenClippingHost.exe
7632	ScreenClippingHost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1324	2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
1324	2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
1324	2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 4112	1324	2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	87
PID 1324 wrote to memory of 4200	1324	2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	89
PID 1324 wrote to memory of 5864	1324	2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	90
PID 1324 wrote to memory of 5736	1324	2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe" -/sibling
  2⤵
  PID:4112
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:6992
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:3720
- - C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe" -/mbr
    3⤵
    PID:7044
- - C:\Windows\System32\charmap.exe
    "C:\Windows\System32\charmap.exe"
    3⤵
    PID:5484
- - C:\Windows\System32\charmap.exe
    "C:\Windows\System32\charmap.exe"
    3⤵
    PID:1552
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:4688
- - C:\Windows\System32\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    PID:3000
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:5672
- - C:\Windows\System32\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    PID:7108
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:2320
- - C:\Windows\System32\charmap.exe
    "C:\Windows\System32\charmap.exe"
    3⤵
    PID:7116
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:7376
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:7452
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:7756
- - C:\Windows\System32\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    PID:7960
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:8144
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:8324
- - C:\Windows\System32\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    PID:6868
- - C:\Windows\System32\charmap.exe
    "C:\Windows\System32\charmap.exe"
    3⤵
    PID:8024
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:4440
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:8740
- C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe" -/watchdog:1324
  2⤵
  PID:4200
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:5864
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6968
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5736
- C:\Windows\System32\charmap.exe
  "C:\Windows\System32\charmap.exe"
  2⤵
  PID:2108
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4512
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1400
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:1472
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\services.msc"
  2⤵
  PID:6676
- C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-18_25e63a488356abc27588601aa91a99b5_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe" -/mbr
  2⤵
  PID:6712
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:6728
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:7148
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5452
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3104
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6768
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4444
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3116
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6260
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3388
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7352
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:6976
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7432
- C:\Windows\System32\charmap.exe
  "C:\Windows\System32\charmap.exe"
  2⤵
  PID:5144
- C:\Windows\System32\charmap.exe
  "C:\Windows\System32\charmap.exe"
  2⤵
  PID:7276
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:7408
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4164
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:7680
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:7880
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1372
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:8072
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:7384
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8460
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5348
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4168
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8500
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4864
- C:\Windows\System32\charmap.exe
  "C:\Windows\System32\charmap.exe"
  2⤵
  PID:8416
- C:\Windows\System32\charmap.exe
  "C:\Windows\System32\charmap.exe"
  2⤵
  PID:8756
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:8892

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x0000000000000500
1⤵
PID:6104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6616

C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppXvj4keqywbrw1mydqk4hd4832qv899sb2.mca
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:6812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7308

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
1⤵
PID:8748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8776

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\683aa8fe74c1465caf1810337e88a577 /t 6188 /p 5684
1⤵
PID:8860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1144

C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppXvj4keqywbrw1mydqk4hd4832qv899sb2.mca
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:7632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AddTrace.winsys

Path C:\Users\Admin\Desktop\AddTrace.winsys
Size 13KB
SHA256 2f69ce4c31cf290c80c43027ac8275f9c8eeb9b827c64155332556d328423480
MD5 039d5dc6ebb9384832055e28076beee0
SHA1 91aa2c5f4005b0f3b8b2deff2fda7d7b278f204c
SHA512 0c723fc8bf5787edcf6c56430189915fd48fdc07b58930e61c61a8aab0a9386378f2c57651963d00d92ca39f4b3783252e03b9d9dec642418577ad1e0abef3eb
SSDEEP 384:gwZiH5jzAfBSl4/J5mnT6eLWXw3ng1OEj:viH5GecJ43Lpk
TLSH
T1A552D0A569D5B1EFB2F5875E8135883011FAD2C498BD3AA11478341843DA83D1AC3A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDismount.winsys

Path C:\Users\Admin\Desktop\ClearDismount.winsys
Size 111KB
SHA256 349e8d44c4cd1afbc2cf6b7b625c5644c3523168f03acfabd9a203b72982a721
MD5 290426cb10f3a738aa34722590733c19
SHA1 acb9def76343dc4ef0779740f341da2acf5ab4c6
SHA512 ac38da3622d43565e47665ea9deff2f0d0b9fe17227cf5e0bce52d4469b46240f48d4f075dbe377cb56909678d6a837b0e029b4f03833b95e385b331c6d1bfd4
SSDEEP 3072:sYqZPOYcqBcrl/fawlKK5AGkBZoCgGZyomQku6KB:mZPSq6cmAfToWmvL4
TLSH
T1F9B312B719853375219B377E66E0A6BDC7D24C22AC2F8985E86E1714FF3C76E004352A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearUpdate.winsys

Path C:\Users\Admin\Desktop\ClearUpdate.winsys
Size 140KB
SHA256 51a47bf02f9b6bb372e37dbfafa44088f44b9543ec1a23f0ba59365ab5792b56
MD5 52cc425e06951f14601fea7331495fdd
SHA1 06c2b7dcd53cc7ba8564df88d567e7e6ab79f092
SHA512 773a381a3613a664afa293f907707c929ea6c5999b743a29d4b471f10d3fd65a26980a01dafc77e443fbaab03fe137b1eccf395a0a71b6cb4f0395066a783922
SSDEEP 3072:Ztg8fiHLa1+IJw2qdI4LFLxQe0gCx8W0T/pFhtS1zBk:v50a1JJBqdjZu6Cx8L/htS0
TLSH
T1D2E31258B1388FFAC9F5A539A26D798C44FA52CFC2A445BD7273C54C4E7A20C7288B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseLimit.winsys

Path C:\Users\Admin\Desktop\CloseLimit.winsys
Size 121KB
SHA256 169227ea63713696b5031d75938725bab781c19a3ffd6ab3e75a0633c309e847
MD5 f1e8dc149c0dc0d928f931c341e9fe28
SHA1 e2fd5606d59f2968c9f8810e1adfb5ac8f91c994
SHA512 5403f78fb49c5c859da8c7cc19d3611bc12dade83a0f996f446d2274046c4353a39bc2ecb1de20a1dc92a01e4c5b39ab35bc62b670c583091f24d3071836d143
SSDEEP 3072:6P+QJPHOAOdYkAdSInAuFSGnXoebPCo+Y4SnDsyjMI0q:6P+QJPHOASYtwzU9nXFL+YWgT
TLSH
T116C312EBFA866BE1A109997E1D8CDBD6D59C43B511300811BCF8BD2A329D81F71E6C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmResolve.winsys

Path C:\Users\Admin\Desktop\ConfirmResolve.winsys
Size 246KB
SHA256 356b92e30002bb8fb164b386e50e7c2997b85f582903a22f2cbac221d97415bc
MD5 c8699867678d2ebd6a8873196562580f
SHA1 fc53d86a80af861364b53a1e9048ffe3e0c166e0
SHA512 6a412663b20520fb590578c173b579495c5845617cfb33ffe75c762d37ac0817b58b0c680a71211e8d9675ac6c1bf18bcc41ee6948bcaeb4f0d5795e263b8674
SSDEEP 6144:5SzIvca2BqgJakcNycVF9G26U3t/7B1Cdgap:9ca2T0TNymF9TtvCdg6
TLSH
T1E73422BE3AC19172EFF97B77A851A075CA7F53C824456F51B309D124A28A0930A4E3BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmWrite.winsys

Path C:\Users\Admin\Desktop\ConfirmWrite.winsys
Size 188KB
SHA256 84816a4332bbd992241ed3b7ba43aa26890e8d9745343ff27a9427e4890e9177
MD5 b6a36c4df0625615ac216047878220e6
SHA1 9ec189ebbb24e8716e6599883e1244a120149e7f
SHA512 111d85dace9bf010ba2962136ddfce480ada8779ac49034ce1f7417d31fe06cea113ad2be5b199678dd2aa27ff11002f715dba4ae04d6c6b896c10f0c847951f
SSDEEP 3072:/ukVecSSMfn1KP7PXwFBDP019JMAuO/K2u665ryyBiG68rXda1yh8F:GyeR1cXwDDPQ+ATC2uTpyyU8Hh8F
TLSH
T1681423936489A72B080D9F53EB62F34C344A93E979215AC0F68B8F265AC015DBBDC47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromRemove.winsys

Path C:\Users\Admin\Desktop\ConvertFromRemove.winsys
Size 435KB
SHA256 664652b68b4fd7cc396df40f184ded4dbf1796c03aa35692727f8a74c3fe0836
MD5 04d51b6c3169dfbfcd858af251e2dea6
SHA1 7b15dd7673ba6033955f54ff3ee1e59391995b2e
SHA512 ea542810a083988d156cfc5f7ed04f5ebe09281707bc6fa422720e81f14887d73142d545afda8acdf5f0a9a6ed719fef05f40eee11b38135e8365b1227a55461
SSDEEP 6144:/lYbKKCMlwG2nxhSE4uh4BLKFzkvAJDsCP9DmJDyj3VtE8RtRH4AEs:/abKKCMyGqrh4leFzCAJYClmDyrR/rEs
TLSH
T1EC942326CB63B98713AD9A9472F390A640DC18CED17E1EF7AFAB8225303B705575D0B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableBlock.winsys

Path C:\Users\Admin\Desktop\EnableBlock.winsys
Size 227KB
SHA256 9ea6229ddfbac6cad43608e0159cf908b8c8840a120fc7de426c7334121c536b
MD5 5c9bf21fd96c8613f27afadd28a9496f
SHA1 9ff4300bf24f388a5f6361cbc9347760146a0bfc
SHA512 893463859aac0662d1bf44917ce9c04496f34e0b639e53ffb75fd1895dfb55309be9777f9044e756d7f388b43043571870356ebe7bb642453e4fb4d2cec6f391
SSDEEP 6144:7CDMxB9DqqiQEruka1nOz6u+yPODboviUxhc0R/woqMZG6pe:7fDa5ufBq6u+rsV/R/D+
TLSH
T19E3423B38574FC0D0B400E19EBFB94C9DD4B6987943A7886E47B768390277E66F48D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandEnter.winsys

Path C:\Users\Admin\Desktop\ExpandEnter.winsys
Size 237KB
SHA256 0a10eab56131f3bcc99817247b1960b21f2e534bfaf138a0c310c6a178bd678a
MD5 3189470994eed7fda900787a163f8640
SHA1 e9bb07ca39de9254b51bf01d9f58409fa4462314
SHA512 657a67ab42581b8911db007d1a37aea4702b3a10a80a5941ae4823379eb5aa528b5b953f1ab8575d1f87b050e4549640c03f30fe4e927d075a88d07c5835dcfd
SSDEEP 3072:mmUHY0OFO63kHKX8zq5HZ3nXWoLL3EjnSeAfQ3gob2Ua1sE9aX9zL7w0g5eh9e9f:uYRnGy53nX3L01Af6gwAsE9s5e89e9f
TLSH
T126342350D4F1F8414F9626CE0F57BA5E3E5F5664030CCF4A21B8478FA68C5CA85BD923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindReset.winsys

Path C:\Users\Admin\Desktop\FindReset.winsys
Size 150KB
SHA256 8cf41237b46081e6bc850ba20df2a1d3a9520b908d6e0d932c0ab49f6fb2f8c7
MD5 36521f9a53331f40502e310514e8b8a0
SHA1 b94f03ee1d0b3ccf0453c27a9d13329403bc7f4d
SHA512 d7c03aaa45af7c8040f3118c09e27f23028af7780bc90a98a95e1d8d493c7250b844c8da4d75dc96fa3c9f381f2ffac1b178c586e64193f4f6466e42da0fd3e8
SSDEEP 3072:6S+uSv0SgaKlLUfJFs1ixfqYneDq9vFOdKRO+nTTWxC+0otuZzlXUa:6Sapg5+a0C1DeOdKROuUC+01FUa
TLSH
T179E32257F1EEEACEA3D10FA747F5B429A17671634A825FEF0BEC1C28914784759004D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportPing.winsys

Path C:\Users\Admin\Desktop\ImportPing.winsys
Size 304KB
SHA256 9570cfb652403dd09d2f3031db754d7595202323945663f5a6032445851be3d4
MD5 bd04be678eea15d79e47654b475852eb
SHA1 884f430ed2ee876ba24b3d764cf3eaf2433eaa64
SHA512 65c4e1982b635487be7f06aefcefb39a194508f7499720daac12434a3474bc93dce3c16996aabdcc0b4d729ba611d3afd719e279f5ef0e6fb4c2d205807531ce
SSDEEP 6144:dPcrnbjOAgzDH9HodI+C9MNXfJRtbfZv1+MF74YdPSN6NXbXFZln:Rcaz9H0I+BNXFTzBPScxXN
TLSH
T1DF6423BC014477EE66CCB7FAD8C67817C1FD2EC5F889D4AEB204A1724954A9A90C347D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeMove.winsys

Path C:\Users\Admin\Desktop\InvokeMove.winsys
Size 198KB
SHA256 9f5192f65e3861a8237a6505199a80290726a366dd9fcf5d4cd8eb54773aa8f5
MD5 402a8accbfe465bdeaed604d14355c11
SHA1 abb42f9181b0ebbe12b624c94b04c07f9272fae2
SHA512 edb8b5ae1d8f7c7292c86985a78859959c9a5861800354996e746af1c72d640902af083b4325f5c67c99709bc8e9ff3d9b4d6d48a7f654fe2c9eaac3d90db6d9
SSDEEP 6144:IOP6+19UCvreBGhRumyr0/avwfWso/JafwxEM:Iy6ewuA0ZWR/x9
TLSH
T1781423915F8FB298A9E4916800654DE69436C33C429951AEEACD73C2B7A70AC7FCD7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MergeExit.winsys

Path C:\Users\Admin\Desktop\MergeExit.winsys
Size 266KB
SHA256 5c85e07acc2fdb4285eb77899d7a4cd87d43456b33669c41596e33bb72e0ab68
MD5 be072ff59b42a0e9e5a73bff5ba59c24
SHA1 5e60a499427d37119c420680d0bd759db0e7e563
SHA512 bd912ef7e2b3a035a85d8a852e22954b6e6cdde0dc8211d20fa8c30976b6af8fa415fb39a7373684ba6fcf7328fdca7f9ec4131f797a7584da586fa811872610
SSDEEP 6144:b8By96zt8e77CDgYTwOjUhrSBwiHXm5nTA0hW+uOTFGIj4WwIU5Cy:ayAz6UxYs2iSTHMAVFyc/5R
TLSH
T1F6442259955CFC979733EAECE20CF1E9578685240AE8F0F058E7B00735B20C9DD6CA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountJoin.winsys

Path C:\Users\Admin\Desktop\MountJoin.winsys
Size 256KB
SHA256 8798e882089f026a5a2da6087ab470fb7eeeb2edc39fb9b11c5c3dcfac0bd105
MD5 641db01548dd2832efe4b577bdd8636b
SHA1 173d48681edc11b1193197ba997eb7675ae893b9
SHA512 1d105ab102d353492dd03aaf9137d3ce31b62f24292bc5a3367e17d299a08615797028547a96813338debf349e06796f52d01b32883fa557e8dfb3258433978d
SSDEEP 6144:k0cw+PYzIfzgZWq7T0+sfU2vYTffuXs9GMx:k0c4zIbgoq7T0+s8oKWc9Gq
TLSH
T113442321D65CDDAA286DEB2ECFCEC0747B8942A67961C00C5562D267F7B3D4CC722983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeExit.winsys

Path C:\Users\Admin\Desktop\OptimizeExit.winsys
Size 13KB
SHA256 3c11c4b72aafeea9a076f9522b08d2a9e8c4d25f8a55672fe4575199997f6fcb
MD5 ae801c0f5e9e594de3321bfa5d60cdb2
SHA1 fcc5fa1fab4bb96273f53eb7572a0bc7f3c49fac
SHA512 0dd861b04be7265fbd324f313e1f17e98caebaf8ee2ff64dff68148eea5d4e8c3e5884b46cef6315ff27da5ada120e0e599efc81cc78af818525f872e56c72f9
SSDEEP 384:nuwmm6QfrO1yK3fKHU5EsuALxjeqgDfvwssx:n5mOrO8qfjC06fvwsi
TLSH
T10C52D13802B571A7BCEE6D95C33286207710F66AE987AD443F8E8FB7990302349C60B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeInvoke.winsys

Path C:\Users\Admin\Desktop\OptimizeInvoke.winsys
Size 217KB
SHA256 8b8b15fbe75429a5a6b2fd9e9633342817737f402b204e263f2505f954594bfa
MD5 b0467141da1ac8ef5c7c13be5757321c
SHA1 0dc03eb1bd078cfadd7353cbad9578b38819da90
SHA512 3006b358752c2a48c3bfe8caeb8005fda153d06c733b2dde78d85ef2d0e2a66ff34a984817c417013b910393784e4d683384386a2e566b466174a815b282e827
SSDEEP 6144:xOkXzR+Vi6wKK4ePgH/ievFJgjzw/5Al1IQ+8fNOwwIaTr6sIy1XN7:Q2CiyFe4H/iMFJgjzS5Al1H+aPaf6PyH
TLSH
T1A32423AB2766DBA02FC07D211A53E50C2CF4E6461711CC3A2235BBED5942F8AF1E25DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopRead.winsys

Path C:\Users\Admin\Desktop\PopRead.winsys
Size 169KB
SHA256 d57466f9b8cc019ee790e039d8bd3f796c48d383454add2689b04522fd061730
MD5 98dd1c60c6786b6ac496b80e2e8e6588
SHA1 6e949a286ed499326f45ad45d0e7cd1d7745a793
SHA512 7f039606c50b58ceedb8d475ef6020bd109a9a3fd596ade4da9a133297820abf75099b593bb932535420c62e5516d5b6177bbce91f588e71d8f5d95e2dcf335f
SSDEEP 3072:PGKb+8t5o9SDGmY8+o9yQA0F0mCmzVpodd/LENyHntR5uPzRZNqkOL/2AjN+Wva5:Pdz5oEKmpB9O0F09IpY/LXHnP5unNqLa
TLSH
T1CC0423FDE57B6C8F198EA2A7FC2900E380ADF5385F05B4AC569CB5BC45DF0488AD1461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushResume.winsys

Path C:\Users\Admin\Desktop\PushResume.winsys
Size 275KB
SHA256 74aa63ad2d2c19da3759b085e8faaafbb278540be994094c0ae4b768d07bfc6f
MD5 05defebcd59a650c03a096a9f26caa45
SHA1 ca226e54eeaacfeb672c95e25469e11461690d31
SHA512 4d297a5820ce020d4f624fcde326903935d11d6011e039505ef3754d74b7ee7f62250355c7b20c0b4cdb020f2a85cfe7c7e335cc7981a803aba3ee5ac6a9d574
SSDEEP 6144:tVRv11ghnackcz5edsVga5y3enX9sRV5cIH0YG3JcuFQ/:3Rv11ghaC/seX9g5d7G3G8s
TLSH
T1275422C04D524ADB724E17E424CAEF68C7976DE9FC73A848162CE73B835118DB97A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoStart.winsys

Path C:\Users\Admin\Desktop\RedoStart.winsys
Size 159KB
SHA256 42f2efdfc55c721dceec6fb7b2e628c174fcebf8a8c4901ec4f79ae319a17199
MD5 53c45f61483ecfd54e22ae91fdd4cdb4
SHA1 bdd78d7f1aca615d18fd27abf3a5b141cffdff6d
SHA512 8bd565cda77dc50256471406e7c2fd562d62a1902787fe6ec1aad236772e3797439a381341cd8689e962d55e04e2358c7bb3dcbbbe03c55d1c01b6bd48e9137f
SSDEEP 3072:CwocH0lBXUt4AmyVdIGqKTLtU3Y3BTcJraWcPO7xwMIvw88Fye23JKK5l7WvD43:1ocq0mM8KTS3Y3VUrKP+w38n23JKK7II
TLSH
T1DAF312A705C513435D3C1937B78024B5ED2650C9BA1BE9B39ED6F752276CE0D8B60CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipDisconnect.winsys

Path C:\Users\Admin\Desktop\SkipDisconnect.winsys
Size 295KB
SHA256 cc60e1591b0d830855b634c69c9efdd23fe97f14775235c6554a794cb3299835
MD5 c074fa0af48d6cfabe2a5e3a58c77e74
SHA1 95bb9b13a1e8645c29051bc651a2cc69168424b2
SHA512 994d031781353fa20924e044a9c002c3a73a2cf01f8a8fda13c2c391c04f5f38166c03ce64f98135fee7695f967e2a84a4ed524518625cea0338969dddaaff61
SSDEEP 6144:o9s2IzwhPy+Jop4zROdQIMFzLOIoZpSTbCjBRBNFH94sWNcqhR:ow0Py9oyaSNZoWPBNRRWNB
TLSH
T156542390BF48BDD6C2071A7ED19B0D8C5209D6F185740F8C5C0E76F69E2792B3EB8692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchSet.winsys

Path C:\Users\Admin\Desktop\SwitchSet.winsys
Size 10KB
SHA256 50ea8589b7766e2348b4fa7d54a7db3c091b25ac5f1ef3e5832ef596c91692ae
MD5 3eda5f06b09452165ff73930b22068be
SHA1 fe03d25a24d26fda9442a63c654ddc07d7df8d35
SHA512 cd1d03300464c024d5a2bee2f68b978f0a936040647615e558294e1f02980164a2d26280e5fc365c3c73fce9024d5336ad801486159e12e0b67f3a4355e8cb8f
SSDEEP 192:elA3/QYEoUP44qSfaKXyc/Kh7OW30G5GbqXLrtG1RoccUHwByAS/d/DaxaBt2DxF:elA3/QPExSfaS5Kh7OG8ALpG1X0sd/DC
TLSH
T13132C0C0F7982EF09096D9A8FA75E22B23A7E0B17017425EDA3314361FD6241378D8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockRename.winsys

Path C:\Users\Admin\Desktop\UnblockRename.winsys
Size 179KB
SHA256 b887c016d8d6656d70d40f857a9f2f2f9950dd0e3d3e085e1cc74896f40c9e5f
MD5 80e3e0b69cd1893e8f16ba3ca5e9bc94
SHA1 ecc7fb77181e1690790d71b59824a3415d60a648
SHA512 b4a8d68f1f97410e8c1b4d4b25b7fb234de3d31c6a6b04de9f5d5b5d923c7014465f0c01ef6ac6f0f74799999aa6e1c8b8cc4211d22a1579324b62a20a68d3f9
SSDEEP 3072:en4F4otzROQBE/zOPhoDO9ydCWYUZ6LXNmVyF0kwEF7UeYZldlvlb:O4rMpzwOdCVDayF0kPMlvlb
TLSH
T160042308B91CAA58F050B7C7DFFF2E40943D040F8A7BD2F6A259032F66D40EA6C78681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoInvoke.winsys

Path C:\Users\Admin\Desktop\UndoInvoke.winsys
Size 208KB
SHA256 0787fbef89149563b7ec64870ce707814d1b7889a54b6531b8255ae4f3245064
MD5 7315210cb6122bd625d79b439989f13f
SHA1 c117eceb7248102e9863445e7d58d8261a4e97d4
SHA512 2d35f888d473da31cb4fcab99efaeac4527d796b682fc0f5a22b9f64dabc37d6d9e2f569bb5d9ee2dc824430694ecadc284e7569005d33fcb81d12dcf0e75438
SSDEEP 3072:5KX5uH85mUvZqcSWYaFn/rJTFWVR/sffKIJS8OWOWUVm2zjtHuBlIY7kHiuLsjAs:50hI4qYpdrJT4VR/fIiE2zhKItL136
TLSH
T16E24231410431F92A11F63599C469BF9FDEF4BA851EFD688B9EC460A803F780CEC95C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishConvertFrom.winsys

Path C:\Users\Admin\Desktop\UnpublishConvertFrom.winsys
Size 314KB
SHA256 2b8a9cd98683a9de528d4649f00db766651347a81d3ad3303a705146fbe02aeb
MD5 c8fef8d0bf69e3c39c7f57bd29954605
SHA1 af3f2bcd9a77786146827a566eba4acd20ae8bde
SHA512 897c9b6053a7ff5d85314ed162b716377ad56ec9b392c548e42e9fef118a03fdf42f6c5b311ae56202f1003a562421a482fd53554897ef0b4796f36446903e13
SSDEEP 6144:eIITv+17nEMUXYFNoL9V3MKHfn4rcuIQW1fKeilFtWOSH3dZ:vITHXUmLvZfn4IubeoFknHP
TLSH
T17B6423D69A923F5E605ECD041FB99F0B3A869F60F2608CCC96D214D812D8CF646F4E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterConvertTo.winsys

Path C:\Users\Admin\Desktop\UnregisterConvertTo.winsys
Size 130KB
SHA256 f2a087a27e5dbd1841730df56b3b582459d0eb82017095450e74fa5524892037
MD5 188aa1b37086923ce00260d80834ae32
SHA1 c560c9370cc9ab9036a165b2d6fcae866810120d
SHA512 3a87ec6294bd161e612fe79fc5564554d7a826d45b8c7302a6fc56eb033be939b891eb316593ff9f671d11376def57dd3c70259bda55746419b0ad3f7386861d
SSDEEP 3072:0w1iNE+skjpsf3KoDb4jrQw/sJCp9WlTU5lUpDmxr1Lg:D1iDpsCoD/OqqgDge
TLSH
T132D3126431A4BB7493A207811033E9C647B7EDF0EE292545FF8870909421DABB9EB35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteUnregister.winsys

Path C:\Users\Admin\Desktop\WriteUnregister.winsys
Size 285KB
SHA256 aa89742d3d48b52d8e893430e850f34b71c0879649b323de7fe8c5c2fad28ae5
MD5 2a857c57bcec9058da44d3f37045e762
SHA1 c80ff7f4ee1b3de73270aa678dc6f3aa82287142
SHA512 a898967603c49ef05385c2743d5a8384f961b4c99c1993a08bbd95f3638f53d2302a7dd75a18c3d93a357feb6edf5f3996661d9add434ce54281689a80275cb2
SSDEEP 6144:/rW5t97+liE2IbhR1LTc3UVucfeW60VOTkJmGRd8nSA1v8c8rR:jit97+UE2Ilvc3EveNLTSr3MPd8rR
TLSH
T14B542376DFD1EA684A3C3EB4C21C62794452A94903F6CC07F2A35675F3250CABB5A4E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.winsys

Path C:\Users\Admin\Desktop\desktop.winsys
Size 1KB
SHA256 d0fadbe64a67056d7b59b8c7e4f3f0feea1eb9c0406c5f60758d1c4fbe610e32
MD5 0377702814dbead24de06bcbb703b241
SHA1 9a9fffe99666a68e6f12182f7aec33b794147095
SHA512 5b03170da51fc3b36041de89f2f21094346d591dde447da526f9d68306334d1c550f8ed45a4a5e3e1ca8225308499611ae4ba22ef20ae71f7f50d10f7e2e5af3
TLSH
T19111B6A8C40F13E1AF8612E878618B3FCF35DA463C063B21A1C8A757B124B040B5C5E4
MD5 SHA1 SHA512 TLSH

Submit Download

BackupSet.winsys

Path C:\Users\Admin\Documents\BackupSet.winsys
Size 330KB
SHA256 d055f56ce4057f666d2888c7d33a5af4e5724ff2c20bbf4f1757b4f69ee781d0
MD5 29887d571e11b3f847b2422b8c7963b5
SHA1 9909dd5dcaaf732ea667be9f793c7c988608a9bb
SHA512 4628354fa4e6103eac9f5cfb43c77cecd6e2ce4399dca935ad6efcb77125fa7f09c8e283c3c1dcbe4c154a8a1a6c129511a23c661bed0c35e210648dca56b0d0
SSDEEP 6144:Zjdzs9NAph0aod8bAqsSau0dvhC0ELMrukOwiWSA7FeiEdz9l:A9Nuhjoysu0rC0ELmxO0B74iSl
TLSH
T1FE7423C455324DF9D3B900D1DE20DA5969785DF33D3239128A1AA4E622AE273F3F871B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointTrace.winsys

Path C:\Users\Admin\Documents\CheckpointTrace.winsys
Size 344KB
SHA256 e06e8988b007ae2e2568217317a0bcfe4e22b2d9dca61359710004f8f6c3ef00
MD5 83b642853334828558d6f7312f993201
SHA1 e42ee351abbbf5347a87e5c60396e9f3f9a0f17b
SHA512 70d93c2ee0563b7d051d293bf81b929c2da84d661bd6c7526a9327a78af759a5151f83f52e727cf1578a6d3224a2f11ac92765bd5895794bb3b14d662956c211
SSDEEP 6144:L5IHdONErqQBnK4vQeQU0n5ushoSgE8kVMjI1Y1PpoHF40IiMcMZJv80VR3lKXUs:L1NEzBnK/eQniEMSY1Ppol4wMZiqJJkL
TLSH
T1977423884F292601B6C7B7F080A30CBA174BD0FEA949BCAD7C429561A7B7EF7501C752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearOpen.winsys

Path C:\Users\Admin\Documents\ClearOpen.winsys
Size 402KB
SHA256 d0c73e58f934d2ea027e18c9cc30e334eee67c4d4b2b3e93828cf56fa9e9c30d
MD5 860d024fa5fd791d7004233c614172fc
SHA1 6b13f2ddd9e6d3d477a06e01d8440c8a739eef1d
SHA512 6ba47f1846cf07042624799a1a203676ffa32fcc254ea0f3bccd2bc43933e489c70c3125a680572f539994b94b111e2051f63894ad72d0d8dffaa8c6f1626751
SSDEEP 12288:jEwZRA2YndK+wgmSvp3fpUkrZE7VdyYfsq:jbA2Ywhepx31E7V4q
TLSH
T159942389D9F88A9CC3ED821E9CF4062616EC762D6E04214CCAB059BB21BE753155AFF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseCheckpoint.winsys

Path C:\Users\Admin\Documents\CloseCheckpoint.winsys
Size 12KB
SHA256 66f67e3c74804ea67badd2465d5fdb85cd25c60dbc518fc5c54732577ebb8c30
MD5 0e912640c37ee46026e63dcb45539414
SHA1 407a74792980bdb7da6523acce64d7f04d8f8793
SHA512 18f238c39f43c90be593f41831fea06c7801455ac6c08922819bf57b8741376c5a4b756ad0e5a2125820357316c4af7d55536afb6665ea2c804c2929295667de
SSDEEP 384:8wiONhhDHQVjl4SZCqDVvKkQnNQJX3OR6gY+a3rkrsx:8cN/zQxKSZCqZvKkQyh3OV6wg
TLSH
T1BB52D04FBA164B17C3F19197575CEA283F05A483F87AA0EE7B5B55330A990193A42CF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmAdd.winsys

Path C:\Users\Admin\Documents\ConfirmAdd.winsys
Size 287KB
SHA256 ac71487650147cefdb19a89313acc38e12735f5dbab2749f2df644dadab05843
MD5 86806681ea6e0759b66729b005dee70f
SHA1 4ebad0b9c370145847716a0f4a1bac8f383c5627
SHA512 0e7d7ac45f8ac784cc9b217364b42d1ffea09b20a4be5bb664b2bf3062c06e4c19d2c532f5bfefcf30bd8a375111a1ba6479e26c5ee24a3ae7b2de180ab2c736
SSDEEP 6144:moO7TXST1KR2nMoz867NTPdtMlzuAtrZm6OCmVQ4dCwjtJB5ABe71z:moO3C5KR2n7HN002e9jtJrAAV
TLSH
T19D542398C30AC6B906F9D69BE0DC41724C4F585FBA19CFACC5015956B0ABBCC96F18CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertUse.winsys

Path C:\Users\Admin\Documents\ConvertUse.winsys
Size 502KB
SHA256 c672afdbea1e6733456fc2e91eac6381091400a28626b55e19161ff85522baf3
MD5 e58e75e591b5e655bd0361aebe1dd527
SHA1 403e78ae2d570d936dfe300175c157be955c89b4
SHA512 f821814845ab9fa23f073c2ea383ff86ab804b71bea4498615c95dd783a5336af828eb9f01b81cf5a24642532f12d3c9045fd74abe1821d0d49182a39814951b
SSDEEP 12288:4LPT9KRFTYLAFlJyWbPuToazJvyOxFTYROhiOgP:4tKRFksVyWbPgtvygFuOgP
TLSH
T1A3B423746D749899142298BF942C8421EE322577D4BFB5CEAB7603EBD3BB6E0183C453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyEnter.winsys

Path C:\Users\Admin\Documents\CopyEnter.winsys
Size 258KB
SHA256 866787b75ea2717dfb8a21ba6545abaf18c00bca1ae5680f95b6d1a64b4dbb76
MD5 04cec3d240ef728d046f9025e36687a4
SHA1 7ad4d856251c8e0ddd72208b14e89cd79f6c0d5a
SHA512 719eca2529055b53b8dfaa8f1794dae7cfe1b7d12ac1be103075050803c75ed4c12ae4f9b35638fb8c4b10df8ce04f39dd0ca9f041514db5c09e47566fecd510
SSDEEP 6144:dYt7JCQJM8u5Bh3tc8YXMbQf86BrPUPD3b2Op5gfFy/Ku:dYtAqM8gbOhXMQf86BLUPzbFYMKu
TLSH
T1E3442362DF76D3642FF1D5BBC159CB80E889959E6F2C366023E4C0B5A801BA6FF046D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectConfirm.winsys

Path C:\Users\Admin\Documents\DisconnectConfirm.winsys
Size 459KB
SHA256 fd2bb761d333a6266179673fee36bf769ae7ca29a324519f89bffc37163065f7
MD5 bb1400c71bf855ad5d9efa2e7d28f21d
SHA1 bea053169041bbde9c718bd3c4bc9c471124121f
SHA512 8c8a79e8b2d0f03da1e6b92ddb0a8d8eb748f387ec72df5b7b5984eada75d5e1d8023d242dd480b8d2a7528166c1c439dde6e8c6f75fc4ef01e17aaa1aad4472
SSDEEP 12288:DRSOs+jiVXl2NPwIe6EXou/z4aF/ZoIpUGIlRgaxfHsCF:DRSZ+GVXl2NPwDYur4a7TUGO6axfH3
TLSH
T17BA42396356005E79364843640BCAC8EA7FB0EB834CF4BB0ABD7F42ECD95A5683C7564
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectConvertFrom.winsys

Path C:\Users\Admin\Documents\DisconnectConvertFrom.winsys
Size 12KB
SHA256 fa98953939f53fd0f3ff6098dbf9c93783d1c6f3348c239d7dcf174df17ed6af
MD5 d2db635cb7a2aa70fd6c3b1c0ce57a74
SHA1 9919197fe376e480c4ea887141d10fde6691a2f6
SHA512 d405060813fe1a5e6ddeecf109f73a0ecde892e0df448f6334fcda1e1e555c4cadb24efc2cf71981d8793d90f1126c73f05ac1d8fa9cffa5afec5196f067faf3
SSDEEP 192:0STQk5qkyAZAhfmdaiPT3Q8pN2GPQllFXprKXWorLow8DrXzLSAUFCqhR+q5nQ1:0svUkzV4i88mGYDKXWyLnyr3aCkRZtU
TLSH
T1DB42CFB854C2743181C5BF74FE2A14124B7079612D740E6AB36A8CB1DB3F98FC096EE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountAdd.winsys

Path C:\Users\Admin\Documents\DismountAdd.winsys
Size 359KB
SHA256 ab03f52f2bb9cbc8f58f693c05076c757a90eca2ae51c82de26fa3b5feaf10f4
MD5 683c0633d3c04cb20a1bb45097879bf3
SHA1 b1bfbe771366a0db58964abe0ca794832e908afe
SHA512 66028d341045650c67623717134d76194c9e243ead31930f60c49970bd8a5c28b0a9c6a2f39d26bf5d663ee9640909075d38cae8031d891e65c5a9f3c40068b5
SSDEEP 6144:jspt13rRxuctXZ2/tQ9CRPQY+BZMGSmto3HTRdPEsnwu3EQfWPuA4hxwxIABcJsJ:j0t1bqc9cmCvSnSHHTXP7CcWPaLw+ACk
TLSH
T1C67423180097108BB5A1E3E3285F2DD14473F27A2E51FE1C2E5C7AA5E6F12758FA96F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportInstall.winsys

Path C:\Users\Admin\Documents\ExportInstall.winsys
Size 9KB
SHA256 5ccbcf4530878d619bd43ccbd1882087a7fa9b49860bde4f364380ce0bc56d8e
MD5 3f902edaeba87f0a955b0c34ddff9d97
SHA1 4cf4618bc678d0badaf9d00afb71e175cc04e49a
SHA512 aecea4881e0ec51ba19202e57338b64d880397b7a836d2444efa24b9f9cc5a87249221ae4d3db49d5e6b869dc9f0d1b31127201c3e08d42bf6bd7d1a7bd15e8c
SSDEEP 192:SRwYhb6/LuJW2Y8gr04R38HE7wAL0k+dPqWsu7mO+BG7:FGpJZgrd58klL0k+jr7YG7
TLSH
T1D412C0B7E2E8D30DCB00E556C17C7C689444E3A094F1706A138DB4A7D4EAF557483979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindAssert.winsys

Path C:\Users\Admin\Documents\FindAssert.winsys
Size 531KB
SHA256 bdbdc0a476e42e7ba604f4b94cc4b6ae279db2a812ef16559978755854d85846
MD5 c60ea5962ed2d209a402c9a7aa6d6766
SHA1 675bf3b0ce6f94a625cee38f01578591c40c1ed1
SHA512 9a699b1bf34322abc3b89dd77091bea8c1c80691d5dc3ac6d6de88795c7e133430ee412c3d3a01de4f11797946beb915a2f2a0b818b02e119b1f090fa2f094cf
SSDEEP 12288:PnBZrAQRDcPKSjewZozvElik6tSkzAtFD2cKCLtMGsf2:PnBtAQGvrSIYIkzGD4CLO+
TLSH
T14DC4234A08EA319710CE33BCE5CA6EFA6DC504737A01927E7BB1D5CCD2029676F188D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetTest.winsys

Path C:\Users\Admin\Documents\GetTest.winsys
Size 11KB
SHA256 5c6e4e9051f2e8a11041b62f48385db49476e2529975f8d9bcf88c633858caca
MD5 61171c0eeb69e7ae7a0b2cd221c750d6
SHA1 faf576d7243f652e7dbc3110f5f483c4d6611e93
SHA512 673e13880d355f1f153133c3319f4c79a2c7c74bc523fd9a5e3c822706df4fb3497d5189e1a6cd02a49a635f2e8ae8e37930efb0f0e13bb2781c6ea7a107968b
SSDEEP 192:eOR5jy8cZACoEAHD1g/cngg5lMW9Y81nOBF4ah3WuO/e+DaBFyOoWK5HwF5oeoj2:eOR8ZQEUg/2LMAjVIXmuO0XojwJojgSi
TLSH
T12C32BFFBAEC59FC69B09DE0C4C8041E1E2F6FEA9BD0F05219D25E9F4E5806AC1596630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinWait.winsys

Path C:\Users\Admin\Documents\JoinWait.winsys
Size 201KB
SHA256 f8006ced5dedb611c5f90d45ccc99f5df5bac959f24a68b684d76e6232f6bc67
MD5 b4bca427b2c2b95fe813f309b38abec8
SHA1 4b0e964101a2c87c9c46e9c9495b477177fbde16
SHA512 810be161bc0bdec5c74dcd8e3c81304548c3a551c8cfe296b0854894fa1da3aed679b1845fbe2ace5530e7ae136afa49e9ba08773dcd0c66c7367a707fdabd0e
SSDEEP 6144:pdRnagu1g2ErqYoo8tpgzPzhchkoFlHYne:pygu1g2ErqYxzPzCFpX
TLSH
T1AD1423F2FD6AED2F22BF164C0BA50D76600B4C6886CD1BC757CA927FB2081999598C43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockInvoke.winsys

Path C:\Users\Admin\Documents\LockInvoke.winsys
Size 431KB
SHA256 dc8f2bf78dd768388ba6b797b950d2b5c5f22c76052d0b2eb321c0118bab7322
MD5 4c28d7c1889cbf5602f13c8f5e0a87e1
SHA1 3f5940c9c8417e65d1327828119d16532514e2e5
SHA512 9597e371c92a7c4bad58bc484aab415db371dced2b8814287c56a6a5edbeab758664523e1b3203d6357f7c388cc6bac50ca5be7114e20bc0f1bdaf085a9fecaf
SSDEEP 6144:QHAF2yH3wMsXfaz4pu0IQ7m4re/T5EJIRMhsgwe8F8e0iasR79HY+Mcu+dUhbqUV:+G3mplIQa4A5rehsR86f4cRUV
TLSH
T1BA9423314AF1D868930B919286EC17DB5D0925C9FB78A872D78D43C013BEAADF59B7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Open Notebook.winsys

Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.winsys
Size 6KB
SHA256 b8f94a5a726f3439eb408ad337bc4699c10a6d6f1c087feec4b7a1a75b7a5cec
MD5 5444527d863214207b944251e9fa4135
SHA1 bf652545ed8da5f8736880a442a0fe6ef64fa984
SHA512 1aec5d10ac6f56dd2929698dd6a1498a93885fb2de875251aba67ee82adebb7e331e486709cc4c5a3589e023274524e3850a2debec9e839fd80f78d01660a10b
SSDEEP 192:LoBMco8DvHoxn/YC/7DyXb26mQGhUmTCmS:2oovIxAU7Dyq6mQs2mS
TLSH
T1EED18EC3D6F5311AF59C25995051A7C04C5DFBC44A4F42A03CA9B6AF28A850E14AEF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Quick Notes.winsys

Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.winsys
Size 351KB
SHA256 539d262f92af87336fcaca387fa2459a6733149b7e223302e18d1e8d3f7306af
MD5 f3b15f898f4527e32ad482f2b7b069cf
SHA1 a2fc933cadf99fd3a7a0b8e443b8837e5aba68b7
SHA512 effb8480b50fdfe7cd73c5c110f6c1f709716939391f4b489f29b773a85187b6f6db8be33270a9fcff9c0a8e83c619ec8d904b29f211d032dcbe23f82632d4b5
SSDEEP 6144:8t8Noe+jnxKe1jLMGbotzDgPo5uF8n9qb5Mr3DbJknxugCrhMnVB26+1:hNVMnxDMGWF5uFblMzqxe2y6s
TLSH
T19474232878BD57FC04996D0601FE06AF30266CBB4DB6225ABFC650E6191CE57F8EB10D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Quick Notes.winsys

Path C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.winsys
Size 5KB
SHA256 bfe6ce1c9394fa0a3ebbadc5317a5fb5231611652ef7241d552da1501e2757d8
MD5 3dd42ce3a14eff7a970e39490a043b6a
SHA1 d647f22ff96280afeb9970afabf6e85939bd5709
SHA512 365d28dc1a54bf7c910d815d3011d18094545fb41a0af1b26e1ba1ba59a2fc3c39e0e6bf40d7050fa202564685dc7454600b8593fbc79b66cd95f5d73881c1c3
SSDEEP 96:96A+tb+lKbXfaHda4TsdQaRjr+bAELKre+u6z/xEI05HbmtPImMH2uaEFKwr:96ltbFjaHdFsdQa5GAELIe+uq1T+mpuB
TLSH
T103B19EC9938414D1C8CF4DC7B1775609A6C035C9076AE6220A94C9FFFB1D275B909A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outlook Data File - ifohxzenwk.winsys

Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - ifohxzenwk.winsys
Size 265KB
SHA256 e0a414a946d2b19b367cdb2067e2568e9cefb9dfaa7ea34c90508909803b336a
MD5 2d80ac838fc3eb333b0b72f3b0453656
SHA1 f2a73f15c9722934e0618d399ef2ce202ca7aab7
SHA512 78613901903365d2c65437ea6deb6013f5e935aff8181c1e76eabf8b22b6374bbf2507407d386a843fe605b31d9e0a48a275426d034b0883900f3cfe46acae76
SSDEEP 6144:rWspf/+V6u4E3AtaXklTMyqn2+qc6SKyM7VGmCBhSwbBTE11:iqn+V6u4EDXkltqfthXM7S3RNC
TLSH
T14E44236B0ACD6DB47F16CA662EFC2F0FF4A173597421D1A21ACF94513B631022E78572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.winsys

Path C:\Users\Admin\Documents\desktop.winsys
Size 1KB
SHA256 7cdbb0a5f0c61d3d6af03fe3a038cfe87799ccef553eec35eff16ba9d5ac58c4
MD5 fe8a82d00bdfb12f6d8a3873d90eb4be
SHA1 ee9d0f841d709855bbd320dea9214d5af3cad1ee
SHA512 1f93165bb02d09fdec82ffa36fc94017b1c8c77234703f7a33d7010eabb779be024caabea4a19d438deb3fac94b3bb2a0db5b394ad7dc73222b30903d91b8da3
TLSH
T18D1186509AC0FD6A39754FE25665DC95FABC740ECD0B92BC40B9B48BE1C8985C824230
MD5 SHA1 SHA512 TLSH

Submit Download

BackupOptimize.winsys

Path C:\Users\Admin\Downloads\BackupOptimize.winsys
Size 437KB
SHA256 c39f53293b4c7d334af0e89978fd32364d30cd86ed5b65fcea9e0a448a762d47
MD5 1e4bb3ee083a870a67939fbd2830714f
SHA1 b72f8dd414390839a5f146577872bb91b9b08243
SHA512 9e21e7dacc650e75d148343370218f825e6c33111ea8929311e8d937d43f3426bd8967d0c21fc189ea511f4532cb5405dbf546da86d20d4240640591dc7c0694
SSDEEP 12288:Ky5HF6J/79hDQGavVUobtLZeENRYVpuKAwo0t6xB8:7acpvK8nlAp0W8H8
TLSH
T1ED942328B7D71D4D346CCD1B8601B6A729BF9793B716403023FAE21255538E5ED883BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockConnect.winsys

Path C:\Users\Admin\Downloads\BlockConnect.winsys
Size 720KB
SHA256 6d92757b76c7efc738aea8a198d25c863945dd87416dfe06619dd6ef67f1c651
MD5 a729b2e31fc606dbe113ea412b79035b
SHA1 8f0c227795c70f45d16df8b3cb948014878720dc
SHA512 88a530d21e966561b6489d70e8e3546aa9551e5e0a17741ed74da85bc1e138f563348b6ecbfa371047d2aa8b7981d0073db7ab5d64d879501914cef5a18c3674
SSDEEP 12288:lE+Ilz00ahSbzroTGuhbwJPzS5SgJdOiIPITmj8iZBvDHFRtO7WEUnvNOSBWKxbw:4lz1fo64bU25JdOfITmIMLlRtOR61OJx
TLSH
T1E1F42335974171BC70EAF8E5A2C73A23FB328159D53D878B95E9339132F09862CF119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointSwitch.winsys

Path C:\Users\Admin\Downloads\CheckpointSwitch.winsys
Size 760KB
SHA256 3add5fc24a05610a5b05503319b370218cc9875f6c28a7b0d4f601454e035a72
MD5 9c6e126d446c797654e01ace0f041252
SHA1 42082651302b5e19c243bca2fc64cb540ec7424c
SHA512 296296db44f0aa6df4063f94aa5527e5b541bd9abae62808a1bb78334999e453602a0ae0660cb0e9ff9fcaf6a510fa4fd842ff2886797e9de6dcc0e17e9ffaea
SSDEEP 12288:3yqvI/mEjb/NEMoi4gdauEqUtrMnimEQEnRVm7hGbOTHiqTOjULL4WY0RIQ2:VvI+Ej2DihREvtrZRVmiOTHT4UoZ0CQ2
TLSH
T155F433356FBE7736E985A448D260B1947FE4DBA404A729E1871FF0F4E4A80354ABC80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearStart.winsys

Path C:\Users\Admin\Downloads\ClearStart.winsys
Size 626KB
SHA256 e555589383e66c1dc8ae7e91cc125183e7848bcd03c5f9e8d2f8157a8e10dbba
MD5 5e92361ca495adc18426e762fac6895c
SHA1 b6e1c24d38e7eafac44cc8a33cf2030a091a687a
SHA512 9f948df3ada8abdb11c5bae48c1d26668c388c7e48440160a118a5f966b028566795f0f2220ec748e63cf8d8310b4b593dba64d40ace51264e6a049e46f3b843
SSDEEP 12288:X8dVL8uDnc+qKpvkAAs8xuBJ4GAmXBkSBGaP1r0YsXRX+m2DzIh:MzVnfIJxuimxkXaP2vRX+2h
TLSH
T101D4231C3343A03F01F3855DA7022684F1FAD3B1D5AB33AB2A51AB660F59E3DC9985E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteDeny.winsys

Path C:\Users\Admin\Downloads\CompleteDeny.winsys
Size 424KB
SHA256 b28203bd25f4cf1597b4370b12a74fc4df0f1b8c5682a9a27265ba72645f75fd
MD5 b0450d25b108109e4ee6a5c5a329cb19
SHA1 cd50c00b76b16ee22a8fbdc209a8a54fffedcd52
SHA512 131205b3c07de38a30eb16a5f9abe0d9623197d0bfdd5f4ff104416da1b3fe12e4e7577587495fce73b3e5ec9eb1ba22444b9af5f5b95be63cbc0ca2bb9786d4
SSDEEP 12288:Sn/ffFuW4ftNeVJXwCPU539oJIOeWWjag6yALsax1p0rbb8k:S/1znJgCPAo5et6yAFxWbb8k
TLSH
T19894230A3FEDCE7EC1B419C57500CE27247D9A93F2C7868E21B17A0519AFE58ED8E941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressTest.winsys

Path C:\Users\Admin\Downloads\CompressTest.winsys
Size 491KB
SHA256 01fe2f7996ac4ed06a8eb681d28713e7d86b5a0afc8cfce0f32f501062a3bc39
MD5 e640758effa353361ec4fae33097a244
SHA1 f87a918859e476ab32d6baa14a795efbe93160b2
SHA512 61f0c7c2ee92f91bac1abece0ba14f386954ccea7c4a284ec54865464b48e991f2320b8d4b9c32b376be039665c0eea2ec6d7467be8dda623579ccdd0a0772d8
SSDEEP 12288:o3kyQKjmSiNWxBjHytD9Niw/PPOSYTCXIRk89or3wOU0hgbo6Ycv:wkDKJ/j8riwoTgt8Qgiyo6Vv
TLSH
T1DDB42326389848FF2AE847F35D03689FA4583E9B64B07CB44D1EB6C16F1D4DE165E08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmStop.winsys

Path C:\Users\Admin\Downloads\ConfirmStop.winsys
Size 464KB
SHA256 f720d83e870f7923f957123676a0dbe424b8099baa4cbb54bf9f44f47e01d489
MD5 b6ae779a5cf4a51f2c47be5d4dc925dc
SHA1 aa5f1d3bacea3f52403888d28baa86bfd864b7fd
SHA512 70f694f9c9449546b8cf454b303f4fab9dcdcb43544a6c8451f29ee97ff9f863e8dca9ab05860df9c1d9a3d1e3345b57436477558ca1920b1a4e9dc5acf6a565
SSDEEP 12288:QC6iFFQEiGAXP5u0InFSWoo4vjtLDiaxsePl:QsJnFS8M1DZsyl
TLSH
T1AFA423DE646C2D0DF63E84646C716E6EC468A90DEC3098BEDE0A353179CBC4D5C4BAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectCompare.winsys

Path C:\Users\Admin\Downloads\ConnectCompare.winsys
Size 599KB
SHA256 aae5d4c2fbc35e4e3fdc707fdd90402028dcc967655807f78b4e64399905dcb2
MD5 3a29f166679cae7cc59c4dbb59baa96a
SHA1 550d4ea5b0561c44aa12d2e8c90b70471cc5aee0
SHA512 88b966407dbc2ae320a69eea66a438cf25c7cbff5579fdd82feadf87b908c8d1156871115f5dc86614d1be699e4cc5b68c94a97ec065b391ef68b5431c452732
SSDEEP 12288:GzpVTbghb0QO86/L0Emhf5vbMRhw7WjUFVJO9j1KHxIqeTK:aa0QO8+L0Emhf9bMROWQFS952eW
TLSH
T150D4238573969851F03808772C2DC1C521C74BED1ADFA16CA6731CA8DE8B9F68BC9877
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromResolve.winsys

Path C:\Users\Admin\Downloads\ConvertFromResolve.winsys
Size 276KB
SHA256 32eade0c66c951fb54bab973bf78e01624e821d8570d40b2c92ea398f98854a4
MD5 1934bfb23845a30f5d550bd3e1d1443a
SHA1 41255c92e4b66e0fbafdf922711380dec7138e07
SHA512 d29a0ab32eccedb0c8cdf0896f678aa0b1d55034b3e9ac0a9386cd138f76769c2ea96e5b90f1956ed4a540ad343045a5679e81077010c0af547170ab03082c1d
SSDEEP 6144:ke72mLOlCRyU98GAMSBMf6kdofxMo4/v5PDRbGa:k3sRyq7StE+P4nHia
TLSH
T1C35423940B33DA0C5281A5760CD0FA891B98A1AC69A90002D4DEF3B796F1FDFDF56C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyGet.winsys

Path C:\Users\Admin\Downloads\CopyGet.winsys
Size 356KB
SHA256 5c9cf68fb0d8cf230d50e8344e992e94bc22f31309721d0909924fbb765e623e
MD5 6389b2ed9bfecb7b1ed73203ede41816
SHA1 c1413bb65254d0c639e160c614dc686d58daaa71
SHA512 d80360d7957825f54dd739356302a9170e2f8bd587234dcfe1e761d76f01f335edd284be75f442c26ba153331f6586dd11beaf1fbf4741d2d32b84a109d52e69
SSDEEP 6144:YJBY97G/bSQxrTnFqtv0ncsl/ISvBpLgFvUu321uG9OB43ByUoa0CD5dwp0TAr:uY9K/bJFSgcslZvBlml21uGM43wUDGpX
TLSH
T13F7423A265576D5E038101FAB462E60EB9E527A7AF24C2FFDBC0BB74197CE6010811E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyUnlock.winsys

Path C:\Users\Admin\Downloads\DenyUnlock.winsys
Size 585KB
SHA256 3fde3f51eb61a586bca3ec78aef5db0d8344ff81fdd4ab84acf06978c829ce8b
MD5 d27314f4cef46a04bfe7e988754cfe7a
SHA1 db577a65b02082e7c5bb0ed03d5aedb04b4ecdd5
SHA512 ee208ede26d67d700b2a3938314129462715360b38be4a5cdd5cda8576fcdff728d82492aabb5d72f7513bad601fc47d78ed3aea273161548c6597daf097e576
SSDEEP 12288:CiysHtY2wjHGBXwg5A3tIOoNGYr9r1YoDznTJsHKm96OBAOikg7Vy5H:BCMBNnrN1YmTJNO9i9Zi
TLSH
T1A2D423B68769DA0279E206D46DF10F65A43F672B06C4A46B0953260DC1B33DECFA29DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountRedo.winsys

Path C:\Users\Admin\Downloads\DismountRedo.winsys
Size 706KB
SHA256 59c783bd02c978678bcac0979aec15e54056706efce969444de77a3a6e3f6572
MD5 3f5b225fb0988ec1348d526ee9b43bfa
SHA1 e6820a53fea1d1ca0e61d1d4f0ca69d08f575bf9
SHA512 abd48110e2f35ffaeef78e5a978100cbd8cc3e08f43026220ba6c0d9eb590578297c2024e96acfa2c4cd16c1103682270236cd64fc88016a2fef7678b2fd4d0c
SSDEEP 12288:GR1OFUs87+FxunOMQbJEoyaTazNbTbP/f8qu2A3+x81eXZ8HwQJYj3c1j1hx:GqKsL5MeJ1TebHH0qZvY6Z8LRhZ
TLSH
T1A0F433F4E2AA134E9E52638400F98DD71BEE1FBBD0593105F0E6F4CE6E94995F8807A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnablePush.winsys

Path C:\Users\Admin\Downloads\EnablePush.winsys
Size 639KB
SHA256 71fba58f4630c589ceadabe122240d9f94a2c163bee1e3bdcc2531762d07c297
MD5 0953dc14ff0c410aa71e53520a5c96e5
SHA1 b5c54d3fa2732110227cf76bc859f0f5a5e87450
SHA512 aadeea9e5d3939efd3b23090d6c9d6a8dfaf6fc39ba61cca51613887110ed4ab0003e9f57eb5d3f91baea23a4ccb62b39616ca659b336dc32b8aaec2870df751
SSDEEP 12288:ia+2lymDrS07ra/fiNyere3J6+wR+/m3aSdYlwWJBfFlQv70Xv:TRlv5rapYeZ6+wA/3AYlwWDFlQv2
TLSH
T142D42378831E8381F3AF1D9A4524FEA8B4F60E5EAF4DF815D25E060F908636E451726F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitBackup.winsys

Path C:\Users\Admin\Downloads\ExitBackup.winsys
Size 397KB
SHA256 dcbcb4e13596ac576da3d3a09e43f68aa603b5fd591fa9349198de62d6f37feb
MD5 4fba3328c35f6bca1d2fb2279267ee39
SHA1 acb78d9424b5fd5789885f7052dfcd897e3242b1
SHA512 7abd79cc942a79cee0a12299f1eb23a6a0c65845555501572ce67940947c80a5c5941f03c792013a26f7c5621fed78337f12722a4cbaa91390f1b72c534f5f86
SSDEEP 6144:Vbko8QQKC/kY9E4hHQXgz7In49ftb18XtC5C2GvbLuGnJofpLq6po09O6tx0tnP2:tk0Q7cuEiwXitbq8GzNJof8d6tx0uV
TLSH
T1008423201E1D7CB441FD3231A61D28135809B24CE1F8DDBFCA5E9BD07AE5A297E6E42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindHide.winsys

Path C:\Users\Admin\Downloads\FindHide.winsys
Size 666KB
SHA256 e96330a57da2566d8225002e22932bd7b2fa88f87202b99fa004021026e3c092
MD5 0abc94645695bacb13052f9f31915880
SHA1 7bd5888db96bb71e8b879551863cdc8351f75419
SHA512 6e01f6d1b8802d6fa516fe495797a83649a3b9e09319eb0ff771e10b8bd2186a5071b3c07835195564ccb5f4c8d5da14d4640b41d09ff1182919556f0dadc738
SSDEEP 12288:TOUcAkHuWN9MVEiAWyLG1bHG3FL8EMjvAu06ZEqN7OoSXvgUj8rfaPiLybrlAvk:TOUcAON9M0Wj43KEyAubNifXvgr7aaUX
TLSH
T10BE433BFEECB8356EBF578D8DA342960041F117AC47E682F50590E663CC88F6658EE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinOpen.winsys

Path C:\Users\Admin\Downloads\JoinOpen.winsys
Size 733KB
SHA256 00dfafa91ab42c3c8c625685a8eacf43c6f5987bf48a9df137918db37b0e70fd
MD5 85c24d56c66ff08c96ace9590830e3df
SHA1 d8f4ad2ac2127ae58ba427e21d421a8898806e5e
SHA512 bc23a28c44cfc6a1dee90fa1d61cda0e8e708c54434d9506ee9ba09306f175dd694cb507b2f1a65748ff923f3aaa956ff3ca12d773ded86c4308e259fd45553d
SSDEEP 12288:3abiz7iWJbPF5UFrldTMBg8bbF36szcgIIobEiJSb36C5UgE24TNrcVWf0vmCVzT:3fHiWJbP/UFrr0RvzcgmESo60g2GTC9T
TLSH
T13BF4230B5A9ABF597F1316501F5CEFA18EB60866D7756F2332CBF04E8E84890F907660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.winsys

Path C:\Users\Admin\Downloads\desktop.winsys
Size 1KB
SHA256 3dc5908081c6fad94159e6563adcbfb12e9c1a9fd6023327491a286191cc08b8
MD5 36081cb66ffbede43fd3f74c31b68d95
SHA1 fb1eb2b33149c53d77f8f3a006c95fbc83fd247a
SHA512 1b8e788d9b7532b3506c43a3d00be5ad8d5afe7d6f54708bc0c8f2711dfa850b173c606684e57dc20c23a90311944dc0b5a302a8f044fe02804e979ff85ba2a4
TLSH
T1CC11B9B866F4E5B2D1942505A0F4CBCF546B2FC9C0A50352ABD6256ACDDA080674087B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5736-359-0x0000027A216D0000-0x0000027A216D1000-memory.dmp

Download

memory/5736-361-0x0000027A216D0000-0x0000027A216D1000-memory.dmp

Download

memory/5736-368-0x0000027A216D0000-0x0000027A216D1000-memory.dmp

Download

memory/5736-370-0x0000027A216D0000-0x0000027A216D1000-memory.dmp

Download

memory/5736-369-0x0000027A216D0000-0x0000027A216D1000-memory.dmp

Download

memory/5736-367-0x0000027A216D0000-0x0000027A216D1000-memory.dmp

Download

memory/5736-365-0x0000027A216D0000-0x0000027A216D1000-memory.dmp

Download

memory/5736-366-0x0000027A216D0000-0x0000027A216D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads