3a3ac7d29150412e7a3341c035f81f11ab220b6a4593015559d4f82e57b50f8c

Analysis

user interaction
yes
max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debug/net8.0-windows/JHNM_PowerShell.exe
Size 148KB
Sample260822-xbchcsszhs
SHA256 3a3ac7d29150412e7a3341c035f81f11ab220b6a4593015559d4f82e57b50f8c
MD5 6b784b944fe08191eff96753f79dbcdc
SHA1 c97afff51a01344d535366b68afd85ecfe83151e
SHA512 9fca9252065188d849c2ab78a5bcab4cc10bb744c1f24f24da027a97be9097fe01d56fd56ea424bc6259ce9d2096fcfcbbaa2cc75f04df0d64c120236e755f28
SSDEEP 3072:sqeXA/4yIg9vkNPNu6H6xCYOiVUE265fJa:svgvkNFNaxmNE/J
TLSH
T186E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	JHNM_PowerShell.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5728	powershell.exe
6076	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Debug\\net8.0-windows\\JHNM_PowerShell.dll"	JHNM_PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5728	powershell.exe
6076	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4524	cmd.exe
5312	cmd.exe
4468	cmd.exe
4056	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3728	3008	WerFault.exe	113

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2996	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	wmplayer.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3844	notepad.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5728	powershell.exe
5728	powershell.exe
2396	WMIC.exe
2396	WMIC.exe
2396	WMIC.exe
2396	WMIC.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
5728	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5728	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeIncreaseQuotaPrivilege	2396	WMIC.exe
Token: SeSecurityPrivilege	2396	WMIC.exe
Token: SeTakeOwnershipPrivilege	2396	WMIC.exe
Token: SeLoadDriverPrivilege	2396	WMIC.exe
Token: SeSystemProfilePrivilege	2396	WMIC.exe
Token: SeSystemtimePrivilege	2396	WMIC.exe
Token: SeProfSingleProcessPrivilege	2396	WMIC.exe
Token: SeIncBasePriorityPrivilege	2396	WMIC.exe
Token: SeCreatePagefilePrivilege	2396	WMIC.exe
Token: SeBackupPrivilege	2396	WMIC.exe
Token: SeRestorePrivilege	2396	WMIC.exe
Token: SeShutdownPrivilege	2396	WMIC.exe
Token: SeDebugPrivilege	2396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2396	WMIC.exe
Token: SeRemoteShutdownPrivilege	2396	WMIC.exe
Token: SeUndockPrivilege	2396	WMIC.exe
Token: SeManageVolumePrivilege	2396	WMIC.exe
Token: 33	2396	WMIC.exe
Token: 34	2396	WMIC.exe
Token: 35	2396	WMIC.exe
Token: 36	2396	WMIC.exe
Token: SeBackupPrivilege	4696	vssvc.exe
Token: SeRestorePrivilege	4696	vssvc.exe
Token: SeAuditPrivilege	4696	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2396	WMIC.exe
Token: SeSecurityPrivilege	2396	WMIC.exe
Token: SeTakeOwnershipPrivilege	2396	WMIC.exe
Token: SeLoadDriverPrivilege	2396	WMIC.exe
Token: SeSystemProfilePrivilege	2396	WMIC.exe
Token: SeSystemtimePrivilege	2396	WMIC.exe
Token: SeProfSingleProcessPrivilege	2396	WMIC.exe
Token: SeIncBasePriorityPrivilege	2396	WMIC.exe
Token: SeCreatePagefilePrivilege	2396	WMIC.exe
Token: SeBackupPrivilege	2396	WMIC.exe
Token: SeRestorePrivilege	2396	WMIC.exe
Token: SeShutdownPrivilege	2396	WMIC.exe
Token: SeDebugPrivilege	2396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2396	WMIC.exe
Token: SeRemoteShutdownPrivilege	2396	WMIC.exe
Token: SeUndockPrivilege	2396	WMIC.exe
Token: SeManageVolumePrivilege	2396	WMIC.exe
Token: 33	2396	WMIC.exe
Token: 34	2396	WMIC.exe
Token: 35	2396	WMIC.exe
Token: 36	2396	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5728	powershell.exe
Token: SeSecurityPrivilege	5728	powershell.exe
Token: SeTakeOwnershipPrivilege	5728	powershell.exe
Token: SeLoadDriverPrivilege	5728	powershell.exe
Token: SeSystemProfilePrivilege	5728	powershell.exe
Token: SeSystemtimePrivilege	5728	powershell.exe
Token: SeProfSingleProcessPrivilege	5728	powershell.exe
Token: SeIncBasePriorityPrivilege	5728	powershell.exe
Token: SeCreatePagefilePrivilege	5728	powershell.exe
Token: SeBackupPrivilege	5728	powershell.exe
Token: SeRestorePrivilege	5728	powershell.exe
Token: SeShutdownPrivilege	5728	powershell.exe
Token: SeDebugPrivilege	5728	powershell.exe
Token: SeSystemEnvironmentPrivilege	5728	powershell.exe
Token: SeRemoteShutdownPrivilege	5728	powershell.exe
Token: SeUndockPrivilege	5728	powershell.exe
Token: SeManageVolumePrivilege	5728	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	wmplayer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3844	4648	JHNM_PowerShell.exe	89
PID 4648 wrote to memory of 4056	4648	JHNM_PowerShell.exe	90
PID 4648 wrote to memory of 4524	4648	JHNM_PowerShell.exe	91
PID 4648 wrote to memory of 4468	4648	JHNM_PowerShell.exe	92
PID 4648 wrote to memory of 5312	4648	JHNM_PowerShell.exe	93
PID 4468 wrote to memory of 5728	4468	cmd.exe	100
PID 5312 wrote to memory of 6076	5312	cmd.exe	101
PID 4056 wrote to memory of 2996	4056	cmd.exe	102
PID 4524 wrote to memory of 2396	4524	cmd.exe	103
PID 3008 wrote to memory of 5300	3008	wmplayer.exe	114
PID 5300 wrote to memory of 3700	5300	unregmp2.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Debug\net8.0-windows\JHNM_PowerShell.exe
"C:\Users\Admin\AppData\Local\Temp\Debug\net8.0-windows\JHNM_PowerShell.exe"
1⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SYSTEM32\notepad.exe
  "notepad.exe" C:\Users\Admin\Desktop\README.txt
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  PID:3844
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2996
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5728
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableBehaviorMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6076

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Users\Admin\AppData\Local\Temp\Debug\net8.0-windows\JHNM_PowerShell.dll
C:\Users\Admin\AppData\Local\Temp\Debug\net8.0-windows\JHNM_PowerShell.dll
1⤵
PID:1688

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Enqueue -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    PID:3700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 3136
  2⤵
  - Program crash
  PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3008 -ip 3008
1⤵
PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 da7351fb146be5bce0e5409535fd9a700af07ac5abd3151a45b1c4999c159b41
MD5 cde52b673089ff505925409f3103488d
SHA1 c4e03ec00034a837881089880f05000b46b44d19
SHA512 469046aecc44087da9da29fe2b76c160063dd97b2a1d28ea7b0ac6d489b224a8f623c33d1868d6aa89c6aeb9079f75804f59b7422cd991c06bf0ea83a07a3458
SSDEEP 768:Ff0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3r:F69tQeoVYocxYCutFCJGAKt
TLSH
T186C4FE37A470A098DF3C35B1E2AC6B8CBD72641A12E006421F74B57F7A337D99A0B5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 c61a43d594c9a7c211439a75f0651313001fe18b8599f36ba7416f2acff4334f
MD5 c0da9c11ce2874e2cc1f8dcc102a3a71
SHA1 97154ed8802c2aa534ae4b08f1debd4095f3146d
SHA512 2608f665b78063a8812aef065b78be5a601da2a1be6a2bbba884acbb9f7243bdb272b4580bf45fc8f541be10984e85b94139f886aefcd1b7085d78d0d5241cb1
SSDEEP 768:b0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba2:lZP2tFP3vqY8IqEMaTaBacg
TLSH
T11E257337D190B0C5CE2C7171E9ED8F09BA33A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uapnhkjr.tk2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uapnhkjr.tk2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 ea30a61a29b7c0c8500ab32425b165de7667bab9f850a8e8de2d8173081d707b
MD5 49537e4133b9d346f63b347300c353dc
SHA1 b3dd92c3d5be324cf5241da2cec6c1e0ff706bfa
SHA512 7f4cd1515ae6cfa8140196fe5beac6e18b9e3d588f20044615a06c8bb377d0c8cdf3125ef2c5402dfdd58f4d27f8da0a175446a4c63ca3a3e5dbed87745a1ee4
TLSH
T105217C574A0AE4B5CD6287B369CC8A2773B6A7CE5354D015738AE01E895113F233D17D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 cbc11eb48172affe009e9a79582de8bfb5e5b36a0a06393bab866a8dc04da093
MD5 1cf5a1e2d7a3900746e67ce0dd422b6a
SHA1 48d3d4bc313caaa6e59ac08b1876325a3f70db49
SHA512 b30b40fc648c3b7670087e92dab04fe9adc88578b7c588ad006633a868215287a3bbacf177480413ec41147e1fc1643f033bf1b247329fa83d9db4d1d91012db
TLSH
T17671ED1167E5610AE1A38573BC37B706BF35F806A708864F418DD11A0CA5900B87B77F
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 bfe207b4d701b4ea283de6ad980ab77c4c5cdd4c432ed81645a22d7454a45037
MD5 6b9da1037db6d48b0f7abf5f4c73feb0
SHA1 faaefad52f61f0fdfa47e77ba305663bf8986913
SHA512 3a5d38d18cf47e51bfd2d4870780478dbe4141e95cc67eb10c801f47d3ccb7fde05eaf00a8069309a30793183658857177c522d306c89d2138c9921501e345b0
TLSH
T1D831FC1163E1110AE1A38473BC37B7067B35FC06A608860F018DD1190C64904793B77F
MD5 SHA1 SHA512 TLSH

Submit Download

README.txt

Path C:\Users\Admin\Desktop\README.txt
Size 121B
SHA256 4db73f914a1494bbb05cfd1e57ccddbafaead2f33fd6b6c1db742d21392f0370
MD5 d583b3039868020b5fb41fe462a71d9d
SHA1 7747647597d9000d49b007b3a02e60491db52209
SHA512 920dd51e1a03f938350d28ae37703531a51239c0113e53ec09a567495fdd8c26f2ad385006daac0f03327be11bd2e23e1b8b3063979c7f2473672614f1b8a7af
TLSH
T166B02B6F780FDD0081D021C1178AF08EF3006B05410147003C0480CE1020585C5C3868
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1688-130-0x000001D5BAF10000-0x000001D5BAF1A000-memory.dmp

Download

memory/3008-204-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-210-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-178-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-179-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-180-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-181-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-182-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-184-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-183-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-185-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-187-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-186-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-190-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-189-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-188-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-191-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-192-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-195-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-194-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-193-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-197-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-196-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-198-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-200-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-199-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-202-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-201-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-205-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-176-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-203-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-207-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-206-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-209-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-177-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-208-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-212-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-211-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-214-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-215-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-213-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-217-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-216-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-219-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-220-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-218-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-222-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-221-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-224-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-225-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-223-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-227-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-226-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-229-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-230-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-228-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-232-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-231-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-233-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-235-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/3008-234-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-237-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-236-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-238-0x0000000009860000-0x0000000009870000-memory.dmp

Download

memory/3008-175-0x0000000009850000-0x0000000009860000-memory.dmp

Download

memory/5728-127-0x000001DEF59F0000-0x000001DEF5A12000-memory.dmp

Download

memory/5728-133-0x000001DEF5A50000-0x000001DEF5A6E000-memory.dmp

Download

memory/5728-134-0x000001DEF5E10000-0x000001DEF5EC2000-memory.dmp

Download

memory/5728-137-0x000001DEF5A70000-0x000001DEF5A7A000-memory.dmp

Download