63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
Size 1.4MB
Sample261011-e7mdbsv1fs
SHA256 63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d
MD5 de64eb005fe16f786bf10c4d2d2d996b
SHA1 3c9094b502c70a886ed6e2e4719b18cd183fe1cc
SHA512 3ef81e76ea680ee57408f3ec55626bc73ec275005fa4b45b947b4fefed03b9f0447d26ab1b19b33b581aba996de86a4301caf761e0db06e32c137ed2e679780c
SSDEEP 24576:gcbD/3VMirnzYaONuiL2CvWbOaLJL42MzBc3FnVYHtYt+8qf92GLgdmRV4+Ikp4:gcbzV/rnzu3L1vIRM63FKHGv29FCGVT4
TLSH
T15B65125279804031DD2E1B7569A2AB30973E7E307FB4CBCF4B547A2AABB70D1A534613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "2"	Wub_x64.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WaaSMedicSvc\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k wusvcs -p"	Wub_x64.exe

Executes dropped EXE 1 IoCs

pid	Process
6040	Wub_x64.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WubBlockLists	Wub_x64.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Wub_x64.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2976	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Wub_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Wub_x64.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MoNotificationUx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Family Model Stepping	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Meta Data	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MoNotificationUx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MoNotificationUx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Record Type	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Record Version	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Preferred Record Version	reg.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MoNotificationUx.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Firmware Record Version	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Environment	reg.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MoNotificationUx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MoNotificationUx.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	reg.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MoNotificationUx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Source	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Configuration Used	reg.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MoNotificationUx.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6040	Wub_x64.exe
6040	Wub_x64.exe
6040	Wub_x64.exe
6040	Wub_x64.exe
6040	Wub_x64.exe
6040	Wub_x64.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeRestorePrivilege	6040	Wub_x64.exe
Token: SeTakeOwnershipPrivilege	6040	Wub_x64.exe
Token: SeDebugPrivilege	6040	Wub_x64.exe
Token: SeSecurityPrivilege	6040	Wub_x64.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeManageVolumePrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeManageVolumePrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeManageVolumePrivilege	4496	TiWorker.exe
Token: SeBackupPrivilege	4496	TiWorker.exe
Token: SeRestorePrivilege	4496	TiWorker.exe
Token: SeSecurityPrivilege	4496	TiWorker.exe
Token: SeDebugPrivilege	6040	Wub_x64.exe
Token: SeAssignPrimaryTokenPrivilege	6040	Wub_x64.exe
Token: SeIncreaseQuotaPrivilege	6040	Wub_x64.exe
Token: 0	6040	Wub_x64.exe
Token: SeSecurityPrivilege	4288	TiWorker.exe
Token: SeRestorePrivilege	4288	TiWorker.exe
Token: SeBackupPrivilege	4288	TiWorker.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5596	MoNotificationUx.exe
4800	MoNotificationUx.exe
756	MoNotificationUx.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5596	MoNotificationUx.exe
4800	MoNotificationUx.exe
756	MoNotificationUx.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2976	1792	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe	90
PID 2976 wrote to memory of 4432	2976	cmd.exe	92
PID 2976 wrote to memory of 5428	2976	cmd.exe	93
PID 2976 wrote to memory of 6032	2976	cmd.exe	94
PID 2976 wrote to memory of 6040	2976	cmd.exe	95
PID 6040 wrote to memory of 3032	6040	Wub_x64.exe	105
PID 6040 wrote to memory of 5548	6040	Wub_x64.exe	107
PID 6040 wrote to memory of 4920	6040	Wub_x64.exe	109
PID 6040 wrote to memory of 5248	6040	Wub_x64.exe	111
PID 6040 wrote to memory of 5916	6040	Wub_x64.exe	113
PID 6040 wrote to memory of 4860	6040	Wub_x64.exe	115
PID 6040 wrote to memory of 5472	6040	Wub_x64.exe	118
PID 6040 wrote to memory of 2732	6040	Wub_x64.exe	120
PID 6040 wrote to memory of 2504	6040	Wub_x64.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
"C:\Users\Admin\AppData\Local\Temp\63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\on.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\bcdedit.exe
    bcdedit
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\reg.exe
    reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:5428
- - C:\Windows\SysWOW64\find.exe
    find /i "x86"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6032
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Wub_x64.exe
    Wub_x64.exe /E
    3⤵
    - Modifies security service
    - Sets service image path in registry
    - Executes dropped EXE
    - Indicator Removal: Clear Persistence
    - Drops file in System32 directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6040
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\Report policies" /enable
      4⤵
      PID:3032
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /enable
      4⤵
      PID:5548
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /enable
      4⤵
      PID:4920
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\Start Oobe Expedite Work" /enable
      4⤵
      PID:5248
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScanAfterUpdate" /enable
      4⤵
      PID:5916
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_LicenseAccepted" /enable
      4⤵
      PID:4860
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_OobeAppReady" /enable
      4⤵
      PID:5472
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /enable
      4⤵
      PID:2732
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\UUS Failover Task" /enable
      4⤵
      PID:2504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s PushToInstall
1⤵
PID:2960

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\uus\AMD64\MoNotificationUx.exe
C:\Windows\uus\AMD64\MoNotificationUx.exe /ClearActiveNotifications /CV /e/svw77uUiDiE6o.1.0.0
1⤵
- Checks processor information in registry
PID:2932

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\uus\AMD64\MoNotificationUx.exe
C:\Windows\uus\AMD64\MoNotificationUx.exe /NotificationState
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5596

C:\Windows\uus\AMD64\MoNotificationUx.exe
C:\Windows\uus\AMD64\MoNotificationUx.exe /NotificationState
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4800

C:\Windows\uus\AMD64\MoNotificationUx.exe
C:\Windows\uus\AMD64\MoNotificationUx.exe /NotificationState
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6c0r4q0b.tmp

Path C:\Users\Admin\AppData\Local\Temp\6c0r4q0b.tmp
Size 18KB
SHA256 7cda69a9623825130dc5a0f4b19c383197c55a93664ee4f68c2e1d201c9741f6
MD5 e271af82f26e2ea669c08049c4367de3
SHA1 bc27b67df570f92c72e96068ac60ae543220af0a
SHA512 b0ea7d0d35ad84634c71669d81957610fbe8a347024b3b37b5d6705792faf14c60e43b4be17a486cb0e4c24271470746c3693194cc2c7f83a8ac20d9cd69138c
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

ON.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ON.bat
Size 594B
SHA256 86877c90449356ba689357ff43f6dca354471a1ea496813ae1702412dbff8fc9
MD5 c3c5d0dd95336584c71ca6cd93d39d7d
SHA1 db5294d52978375aa6e637431667c4b5635db7b2
SHA512 3aa68e4b56387872b68c079870078cb85d9d935b087e68727971618282629d9a4423f5414b736970e4df0f6434591eb177b8d5742cf730745211aae05f4f882a
TLSH
T1FAF0E1169413EA51BFDE7377D126B44AB39FC3862CB2F2D17086B5EAE04404B6D21A98
MD5 SHA1 SHA512 TLSH

Submit Download

Wub.ini

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Wub.ini
Size 97KB
SHA256 e850fb7ed6f9ef030b35c35ae372a463cde1bf21aaad77bf0b1a14bb4685512c
MD5 fea895a01f99dde827d7ae1254be5609
SHA1 1dd250b4842abe9765ab02f0480aa36637e8c705
SHA512 ee810467b21087227cc3d2ec6e706bf44a19fbcefc843ccce1765325b0ee43130c34ca70a9707d585cc4a6533add4a2778de683c5b8a5778e0f52bc3f3a57dfe
SSDEEP 3072:IsRhs8Y6aeg3r3wgjkyIFJ6QT3yc8Bi3r/ZpHn:MqJ6K
TLSH
T1EBA3361752FA4119F6F3AB40E9B40E721B3A7D92A93CD44C0EC51D5C09F4A90A963FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wub_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Wub_x64.exe
Size 939KB
SHA256 187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2
MD5 9d6778f7f274f7ecd4e7e875a7268b64
SHA1 452fa439f1cc0b9fcc37cf4b8cfff96e8cc348aa
SHA512 d51df55a5f903ec624550e847459bfa52fb19e892a58fe2de41251d9d98890b36f26a4950ad75f900de0311b5330066aaece11ec5e549d5b3867a61a344e0b87
SSDEEP 24576:12DW/xbqX2YIbzQsu3/PNLIQFHyBvGThpZY9:12EmXGQsW/PN0QNlZI
TLSH
T1D4159E59F6E444B9C47FE17ACE46C22BE2F1B809537597CF06A04E6A1F23BD06936321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download