Overview

overview

10

Static

static

3

cybq5uky7rf42l6y.exe

windows10-ltsc_2021-x64

10

cybq5uky7rf42l6y.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    189s
  • max time network
    464s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/09/2026, 14:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cybq5uky7rf42l6y.exe
  • Size 826KB
  • Sample260922-rtms6avwe1
  • SHA256 f44d60a940a34cc56e3da72b758eed75c3f66ee06e604996249617de00cbbf59
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryexecutionpersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 16 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\cybq5uky7rf42l6y.exe
    "C:\Users\Admin\AppData\Local\Temp\cybq5uky7rf42l6y.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
        PID:5688
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" 471|m0dDEgTj2/wilUgRT7lzezzDU162V67Y3hlC3BR/HfWF+gsk7qnCMd8GK5kTdmm4WindowsControl472|w91Waq66OEqO3egYC7c1RLBc7emmvCLfn8Kl8RZCAms=C:\Program Files\Searchx86.exe" enable=yes & exit
        2⤵
          PID:3736
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\Searchx86.exe" /RL HIGHEST & exit
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3772
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\Searchx86.exe" /RL HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3172
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\Searcherx86.exe" /RL HIGHEST & exit
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5932
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\Searcherx86.exe" /RL HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5520
        • C:\Program Files\Searchx86.exe
          "C:\Program Files\Searchx86.exe"
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1904
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            3⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:1852
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3336
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5196
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3760
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Loads dropped DLL
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:3696
        • C:\Users\Admin\Desktop\cybq5uky7rf42l6y.exe
          "C:\Users\Admin\Desktop\cybq5uky7rf42l6y.exe"
          2⤵
            PID:3272
          • C:\Users\Admin\AppData\Local\Temp\cybq5uky7rf42l6y.exe
            "C:\Users\Admin\AppData\Local\Temp\cybq5uky7rf42l6y.exe"
            2⤵
              PID:4760
            • C:\Users\Admin\AppData\Local\Temp\cybq5uky7rf42l6y.exe
              "C:\Users\Admin\AppData\Local\Temp\cybq5uky7rf42l6y.exe"
              2⤵
                PID:5144
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:2952
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3896
            • C:\Program Files\Searchx86.exe
              "C:\Program Files\Searchx86.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:5252
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
              1⤵
              • Loads dropped DLL
              PID:3728
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              1⤵
              • Loads dropped DLL
              PID:4260
            • C:\Program Files\Searchx86.exe
              "C:\Program Files\Searchx86.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3488
            • C:\Program Files\Searchx86.exe
              "C:\Program Files\Searchx86.exe"
              1⤵
                PID:2504
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                1⤵
                  PID:2400
                • C:\Program Files\Searchx86.exe
                  "C:\Program Files\Searchx86.exe"
                  1⤵
                    PID:4508
                  • C:\Program Files\Searchx86.exe
                    "C:\Program Files\Searchx86.exe"
                    1⤵
                      PID:4124
                    • C:\Program Files\Searchx86.exe
                      "C:\Program Files\Searchx86.exe"
                      1⤵
                        PID:3804
                      • C:\Program Files\Searchx86.exe
                        "C:\Program Files\Searchx86.exe"
                        1⤵
                          PID:2888

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              Windows Command Shell

                              1
                              T1059.003

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Active Setup

                              1
                              T1547.014

                              Winlogon Helper DLL

                              1
                              T1547.004

                              Event Triggered Execution

                              1
                              T1546

                              AppInit DLLs

                              1
                              T1546.010

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Active Setup

                              1
                              T1547.014

                              Winlogon Helper DLL

                              1
                              T1547.004

                              Event Triggered Execution

                              1
                              T1546

                              AppInit DLLs

                              1
                              T1546.010

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Modify Registry

                              3
                              T1112

                              Credential Access

                              Discovery

                              Peripheral Device Discovery

                              2
                              T1120

                              Query Registry

                              4
                              T1012

                              System Information Discovery

                              4
                              T1082

                              System Network Configuration Discovery

                              1
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              Lateral Movement

                              Collection

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              Searchx86.exe
                              • Path C:\Program Files\Searchx86.exe
                              • Size 826KB
                              • SHA256 f44d60a940a34cc56e3da72b758eed75c3f66ee06e604996249617de00cbbf59
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Searchx86.exe.log
                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Searchx86.exe.log
                              • Size 1KB
                              • SHA256 29d02afb829467cbd7db970ff3e1471b688384b0c50ad147100d5ed950e68435
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              start.bin
                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start.bin
                              • Size 6KB
                              • SHA256 47f6bd1b7b38ad7d71f4997af14d71dab45601ad98d8df1220f468fdea615735
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              www.bing[1].xml
                              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\AIIFWDBM\www.bing[1].xml
                              • Size 11KB
                              • SHA256 1e0743da4f75161c0636dc5424027007353aa923078d03b591cbf2e192c6ac4b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Zrtu2hQ08VU_1.bytecode
                              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\854BE740-0006-470C-BB0C-6EE249E0E26F\Zrtu2hQ08VU_1.bytecode
                              • Size 143KB
                              • SHA256 f10ee27e547046bfdbd3f11d12bb2599d921baf47fe0302612738fd301de3c9d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Zrtu2hQ08VU_1.metadata
                              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\854BE740-0006-470C-BB0C-6EE249E0E26F\Zrtu2hQ08VU_1.metadata
                              • Size 192B
                              • SHA256 da60b774b403fada3dde098827a45b7c2530a30af2897a23dda0c8ce91b3da5c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              SearchHoverUnifiedTileModelCache.dat
                              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                              • Size 20KB
                              • SHA256 88bd0d7ab7fa62f7cc4c25b21e0c609031b8c495fe78eaa796963c72b534fc6f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              SearchHoverUnifiedTileModelCache.dat
                              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                              • Size 21KB
                              • SHA256 fabdf3a099a8504ce21b376083c93deba085a1b5f7334bf3e0765555e7d9e277
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              53dEtUrhAV5kBHY-GXbgbWghcig.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A1YKYJ8G\53dEtUrhAV5kBHY-GXbgbWghcig.br[1].js
                              • Size 1KB
                              • SHA256 25fb7bf394d8d314dbc01f3c4b85f20dd82e9feb70c3e8f5129eeb7ebd478352
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              CAqnViw894py2O7caCC0LjCMgbY.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A1YKYJ8G\CAqnViw894py2O7caCC0LjCMgbY.br[1].js
                              • Size 130KB
                              • SHA256 9059157417e9577c24480e543c66d037f9c1e504df1aad4a1a5455ddf79930b4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Wtg8_WZN_3ZI_OutEfpr7w52k1w.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A1YKYJ8G\Wtg8_WZN_3ZI_OutEfpr7w52k1w.br[1].js
                              • Size 56KB
                              • SHA256 e692b550938e66c04e21c2e01380b6ab6f6e4a53ff17681d51d8332736c7f51f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              g_K57Her52bUpG_Zn3U0D9pNyb8.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A1YKYJ8G\g_K57Her52bUpG_Zn3U0D9pNyb8.br[1].js
                              • Size 75KB
                              • SHA256 7b7d3853cdd0298fc17973fbae9240f03ab18ab3eb6b04e96cc331d453331027
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              jmA3BASGGQP6fujXEHFHx-dppZU.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A1YKYJ8G\jmA3BASGGQP6fujXEHFHx-dppZU.br[1].js
                              • Size 135KB
                              • SHA256 5fc03d527d1baca4bb9aa5785d6ac2c480fa298d5780df148b6ede80eebd8356
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              3CXzOctRkkq39HinuD99Ne6QTy4.br[1].css
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A20YW3HN\3CXzOctRkkq39HinuD99Ne6QTy4.br[1].css
                              • Size 315KB
                              • SHA256 842189dd86c9bf800ab74646b64ef6670e26c949892aad1a67fd89ad052b2ee7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              5ycqGbqKeb9cV_wF_5hnj4CZMhM.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A20YW3HN\5ycqGbqKeb9cV_wF_5hnj4CZMhM.br[1].js
                              • Size 179KB
                              • SHA256 568d9f5a0b833dc11064eba9655e231a6339bec1b16dc40933362152cd1ae326
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              8QIYLVa87TU-cDq2MV8zUDRGtGA.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A20YW3HN\8QIYLVa87TU-cDq2MV8zUDRGtGA.br[1].js
                              • Size 206KB
                              • SHA256 0e4ea34fc079c358ee7876ca977528b51a905f89c86ec651d937a697fc576d6f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EECf5dBhdpnQPuzeEu9Sb41Zwsc.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A20YW3HN\EECf5dBhdpnQPuzeEu9Sb41Zwsc.br[1].js
                              • Size 21KB
                              • SHA256 f006bd30e4da1cf6ee2e1e52dc4784bf9289c6117ed54f42388158e74d26ae78
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Rb1K_ypI00kZ3LkmSwL6-3QBiig.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A20YW3HN\Rb1K_ypI00kZ3LkmSwL6-3QBiig.br[1].js
                              • Size 86KB
                              • SHA256 58ab00e3fdc66054afd5914eee5f9b4962d2c77279aecc12f2c7a3c1f835794a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Ss9vBwGfidmLZ5v4YWul_p4q6Ac.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A20YW3HN\Ss9vBwGfidmLZ5v4YWul_p4q6Ac.br[1].js
                              • Size 32KB
                              • SHA256 47556a26a60f87f96dd26b3955a55309827dc85b6fdea88d20a696430b9409f5
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              XyKCjwLVtTFXDBMGzoF85JIJ8G0.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A20YW3HN\XyKCjwLVtTFXDBMGzoF85JIJ8G0.br[1].js
                              • Size 409KB
                              • SHA256 4b39038e7f3d3e4e3ef36f3d669574db35fd98c304156632b9b7b067539453cc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              pDwvLkUFstEF3TLqd2P5V7buRhI.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\A20YW3HN\pDwvLkUFstEF3TLqd2P5V7buRhI.br[1].js
                              • Size 1KB
                              • SHA256 1586c957e99af271c2f866ca5dd76c4a2c6d3bec1d4e6e471bbe7f5290bcbfc3
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              ANzUnPnVY0oL0XWxs0RLJxjJLUo.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\FYDOBO66\ANzUnPnVY0oL0XWxs0RLJxjJLUo.br[1].js
                              • Size 20KB
                              • SHA256 38edf0f961c1ccb287880b88f12f370775fc65b2e28227eee215e849cdbe9bbc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DKsE3SyhVIjZH9mpM4Nc3LQ7l5I[1].css
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\FYDOBO66\DKsE3SyhVIjZH9mpM4Nc3LQ7l5I[1].css
                              • Size 15KB
                              • SHA256 fcee9301e6c08f566ed9a3812a525a4b7177cc66406f64d8ca10eb59b3394768
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              GUoUZWLNYdQOyU2LLXHTTxDX-l8.br[1].css
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\RA08P0J1\GUoUZWLNYdQOyU2LLXHTTxDX-l8.br[1].css
                              • Size 331KB
                              • SHA256 e0ae981e44291ab6107fe198f4077aeaf039445bdbb4e5e5cc4bb83efd2b48ff
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              u1hY9K4TIx_z51-qq5CJMghPAOU.br[1].js
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\RA08P0J1\u1hY9K4TIx_z51-qq5CJMghPAOU.br[1].js
                              • Size 62KB
                              • SHA256 9d4ffcfb038e9c94ebdc76c05e07e1c97e624941f266e284382a0d04d571ac8e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
                              • Size 951B
                              • SHA256 5e62225236418f417a71bd6a51b37b839b1fd82fb5af56d196b3b49765786391
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
                              • Path C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
                              • Size 438B
                              • SHA256 e16be276ea6daf855954517c32e084dca382a414df76b0dca3aad244a05b0c09
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              f01b4d95cf55d32a.automaticDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                              • Size 9KB
                              • SHA256 76dbd7146e4a28648be05fa397a490fd32d3fc5df0747dbda32e0ed37ce22843
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              junk.dll
                              • Path C:\Windows\junk.dll
                              • Size 58KB
                              • SHA256 bd02435863c792fd6247bcc1242b12dca250a7db42cb8aa3e41170880881dadc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              memory/1852-267-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/2504-596-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/2796-0-0x0000022BD7DF0000-0x0000022BD7EC4000-memory.dmp
                              Download

                              memory/2796-2-0x0000022BF2630000-0x0000022BF2640000-memory.dmp
                              Download

                              memory/2796-1-0x0000022BF2630000-0x0000022BF2640000-memory.dmp
                              Download

                              memory/2888-854-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/3272-725-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/3488-570-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/3696-234-0x0000000003660000-0x0000000003661000-memory.dmp
                              Download

                              memory/3696-231-0x0000000001840000-0x0000000001841000-memory.dmp
                              Download

                              memory/3696-238-0x0000000003680000-0x0000000003681000-memory.dmp
                              Download

                              memory/3696-500-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/3696-228-0x0000000001830000-0x0000000001831000-memory.dmp
                              Download

                              memory/3696-229-0x0000000001830000-0x0000000001831000-memory.dmp
                              Download

                              memory/3696-230-0x0000000001840000-0x0000000001841000-memory.dmp
                              Download

                              memory/3696-239-0x0000000003680000-0x0000000003681000-memory.dmp
                              Download

                              memory/3696-232-0x0000000003650000-0x0000000003651000-memory.dmp
                              Download

                              memory/3696-233-0x0000000003650000-0x0000000003651000-memory.dmp
                              Download

                              memory/3696-235-0x0000000003660000-0x0000000003661000-memory.dmp
                              Download

                              memory/3696-236-0x0000000003670000-0x0000000003671000-memory.dmp
                              Download

                              memory/3696-237-0x0000000003670000-0x0000000003671000-memory.dmp
                              Download

                              memory/3728-543-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/3760-75-0x000001FFA8600000-0x000001FFA8700000-memory.dmp
                              Download

                              memory/3760-108-0x00000200A9340000-0x00000200A9360000-memory.dmp
                              Download

                              memory/3760-67-0x000001FF960C0000-0x000001FF961C0000-memory.dmp
                              Download

                              memory/3760-77-0x000001FF960C0000-0x000001FF961C0000-memory.dmp
                              Download

                              memory/3760-69-0x000001FF960C0000-0x000001FF961C0000-memory.dmp
                              Download

                              memory/3760-56-0x000001FF96270000-0x000001FF96370000-memory.dmp
                              Download

                              memory/3760-107-0x00000200A9380000-0x00000200A93A0000-memory.dmp
                              Download

                              memory/3760-199-0x00000200BB620000-0x00000200BB720000-memory.dmp
                              Download

                              memory/3804-827-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/3896-288-0x000002823DE00000-0x000002823DF00000-memory.dmp
                              Download

                              memory/3896-290-0x000002823DE00000-0x000002823DF00000-memory.dmp
                              Download

                              memory/3896-293-0x000002825F7D0000-0x000002825F8D0000-memory.dmp
                              Download

                              memory/3896-332-0x00000282612F0000-0x0000028261310000-memory.dmp
                              Download

                              memory/3896-400-0x0000028362B60000-0x0000028362C60000-memory.dmp
                              Download

                              memory/3896-333-0x000002823E930000-0x000002823E950000-memory.dmp
                              Download

                              memory/4124-772-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/4260-542-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/4508-744-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/4760-800-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/5144-801-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download

                              memory/5252-520-0x00007FF803030000-0x00007FF803046000-memory.dmp
                              Download