5652617aaf4a1bb493a9f87715533c05c968e62a2fa4ade200d23da072bd0ddc

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
Size 5.9MB
Sample261024-slmc4afb79
SHA256 5652617aaf4a1bb493a9f87715533c05c968e62a2fa4ade200d23da072bd0ddc
MD5 4267baebad7adea79221d120262630f8
SHA1 51a2c35e6e13c78582da53cd4d2b30a7c4e07e09
SHA512 3450803c73ef82c452f66b29253547cf7aad82fa6086a139c0122789657d080d1f8b014244b82c8d65f5d396f2f33b23cc3eb1cb5edf98244ea821a65efa70dd
SSDEEP 98304:her6uFFkOuPe3cjOH6rgc+6X7ZmKdlhqap1ZcWDtIELv9VCOxeI+S0bIwrSwVNJe:Ur6uFFkOuPnOOv7ZHlLbjXLWjI+SvFCa
TLSH
T1DB56239296007376D41E8DFC151CC7BABA633CEE6D542C47128EF266B0FD1623A919CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 12 IoCs

pid	Process
3976	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
1264	nemu-downloader.exe
4284	crashpad_handler.exe
2884	ColaBoxChecker.exe
4936	HyperVChecker.exe
2960	HyperVChecker.exe
1960	HyperVChecker.exe
1596	icsys.icn.exe
2132	explorer.exe
4280	spoolsv.exe
1968	svchost.exe
5904	spoolsv.exe

Loads dropped DLL 5 IoCs

pid	Process
1264	nemu-downloader.exe
1264	nemu-downloader.exe
1264	nemu-downloader.exe
4284	crashpad_handler.exe
4284	crashpad_handler.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ColaBoxChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ColaBoxChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nemu-downloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nemu-downloader.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
1264	nemu-downloader.exe
1264	nemu-downloader.exe
1264	nemu-downloader.exe
1264	nemu-downloader.exe
1264	nemu-downloader.exe
1264	nemu-downloader.exe
1264	nemu-downloader.exe
1264	nemu-downloader.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
1596	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2132	explorer.exe
1968	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
2132	explorer.exe
2132	explorer.exe
4280	spoolsv.exe
4280	spoolsv.exe
1968	svchost.exe
1968	svchost.exe
5904	spoolsv.exe
5904	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5884 wrote to memory of 3976	5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe	90
PID 3976 wrote to memory of 1264	3976	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe	91
PID 1264 wrote to memory of 4284	1264	nemu-downloader.exe	92
PID 1264 wrote to memory of 2884	1264	nemu-downloader.exe	93
PID 1264 wrote to memory of 4936	1264	nemu-downloader.exe	96
PID 1264 wrote to memory of 2960	1264	nemu-downloader.exe	98
PID 1264 wrote to memory of 1960	1264	nemu-downloader.exe	100
PID 5884 wrote to memory of 1596	5884	2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe	104
PID 1596 wrote to memory of 2132	1596	icsys.icn.exe	105
PID 2132 wrote to memory of 4280	2132	explorer.exe	106
PID 4280 wrote to memory of 1968	4280	spoolsv.exe	107
PID 1968 wrote to memory of 5904	1968	svchost.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884
- \??\c:\users\admin\appdata\local\temp\2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
  c:\users\admin\appdata\local\temp\2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\AppData\Local\Temp\7z934A8F88\nemu-downloader.exe
    C:\Users\Admin\AppData\Local\Temp\7z934A8F88\nemu-downloader.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\7z934A8F88\crashpad_handler.exe
      C:\Users\Admin\AppData\Local\Temp\7z934A8F88\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/325/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=d7282c50f1b64296835edf7d19667322 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\dc75b2bc-a7a7-4358-fd78-fb1359f67733.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\dc75b2bc-a7a7-4358-fd78-fb1359f67733.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\dc75b2bc-a7a7-4358-fd78-fb1359f67733.run\__sentry-breadcrumb2 --initial-client-data=0x39c,0x3a0,0x3a4,0x378,0x3a8,0x748e4800,0x748e4818,0x748e4828
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\7z934A8F88\ColaBoxChecker.exe
      "C:\Users\Admin\AppData\Local\Temp\7z934A8F88\ColaBoxChecker.exe" checker /baseboard
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\7z934A8F88\HyperVChecker.exe
      "C:\Users\Admin\AppData\Local\Temp\7z934A8F88\HyperVChecker.exe"
      4⤵
      Executes dropped EXE
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\7z934A8F88\HyperVChecker.exe
      "C:\Users\Admin\AppData\Local\Temp\7z934A8F88\HyperVChecker.exe"
      4⤵
      Executes dropped EXE
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\7z934A8F88\HyperVChecker.exe
      "C:\Users\Admin\AppData\Local\Temp\7z934A8F88\HyperVChecker.exe"
      4⤵
      Executes dropped EXE
      PID:1960
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1596
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4280
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1968
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-22_4267baebad7adea79221d120262630f8_elex_swisyn_wannacry.exe
Size 5.8MB
SHA256 5031bc98e08029a0593319445f8f47416e34033207668bc19ea1f5b5908f331a
MD5 307973ff78fc4bbaf5ada2159b5c6377
SHA1 8f22ae9e938b8f6b905230a545f941b308fdea09
SHA512 5b193f6c20c31496b8955c053bc0bcbe4baf67285fff3c075bd86a4c464dc66a1c1d0d676278760a5f8c6a84c4d915d5d98320dda50508179a48195c37d9fdcd
SSDEEP 98304:wer6uFFkOuPe3cjOH6rgc+6X7ZmKdlhqap1ZcWDtIELv9VCOxeI+S0bIwrSwVNJ3:tr6uFFkOuPnOOv7ZHlLbjXLWjI+SvFCj
TLSH
T122562392D60173B5D41E5DFC122C87B6FD933CDE6D082C4A028EF2AAB1BD5612E849D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ColaBoxChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\ColaBoxChecker.exe
Size 4.0MB
SHA256 65aa91ee18b46603a5543fdd398d6331a9f77eb8a16a6933f2fe576fc62d6941
MD5 a6d0d421e32946a34de15e4e397ec0b0
SHA1 bc15a70e4d1f9815cfe8d2532d447f0702bb18f0
SHA512 b7817f72fabbf2017d91d48765b2bba83f784d7e02107695f8a7584f8834a12b0a745688d3cbede795b14afe7de4007442f8c96fcc0059b2af309c1ea1493e43
SSDEEP 49152:1gP8dFBouKaau2VgFLTeJxx8IHqQOPclSWkar66Dv4TpN1KjH304dAHRvOA:WP8dFuudB0gFLQ2QOQ660TpN1eX3dC
TLSH
T1DB167D31370BC135FF8281B7456DABAB437C8A650B7340DB92D42BBAD9352E22B35D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HyperVChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\HyperVChecker.exe
Size 118KB
SHA256 d545ed2dfc015f965d35dc4950fe773cb94103a685d3c25c4b44fcb466a85662
MD5 ba1dd89be69ee0e03af11d90785b5b00
SHA1 8d46e63b0b9635ebcf79ab46093832dc4936b800
SHA512 ca33b083b717c2cb1f40fe6eb96b52b71ede808c1d09c782d659aa7ab6034fa612326f17ad4db0b8ed9f1ae2e8633db54f89ea95536a856f338dfe3286e9d6f7
SSDEEP 3072:0wLn2WoLPivTkgxUJ8UrtmMx7bB5dSUo+WziN:Jn2WoLP++J8Upo+WM
TLSH
T193C37D57A3E434F9E17B9638C8910A49DB72B87207609FAF03A442961F637D25D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseboard

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\baseboard
Size 66B
SHA256 19592abcb417213c5dbfb6b632652cbc154084c3233cbd3b157f6f2e592b115c
MD5 90166040529ed2b690cb70419cdf166e
SHA1 1d82aa7c4acfe1d6cd4bc7dbf43dd835e8d0bd12
SHA512 0bdbd109eaa9f746bfe883c2d90cf713a5e7b2fc69a6c804714c7f4e71e4368eada5dccadd01a171702d9e5a37e6c50aa1a065ce5caa8ae1b3743a9a0adfec76
TLSH
T1BBA00238D2941C57806E44644039811359018D139B1929B1624A197C4B549962CDA69D
MD5 SHA1 SHA512 TLSH

Submit Download

baseboard

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\baseboard
Size 114B
SHA256 fe9b79db238a5d965f27b27aaa0b9644e45745be3a207bf433cc3e513189890a
MD5 79c7435f7756a180b755b80e86ccf9dc
SHA1 a1dbbda9fb705097157be88ac2b59af858a92d22
SHA512 efe503b0b026062ee6f4d94d63b78a02063411ed9d002c44d28a58f62391103bcc99a1f860d932b1a967919c2831ad749d3fad8b612c11d21a820d13fc0dec25
TLSH
T1E1B01238D2D37C03D02F5504003E449A26005C379B106DB137055A7C0B4C87B3F9B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\config.ini
Size 346B
SHA256 d2de6d14503fee031f5452a5b30ba67b1a5b82897c274450fb93ada5c7698c0e
MD5 d8a1b3836de9450944d1049ac3368beb
SHA1 5fcd1a8f52085b306a15d3fc30851877537f5193
SHA512 b5d382014e9e4e5c4bf6cbf9f3a9b58b40adfa89deec6dafbe6f2ee9b19c434d31bb44da85a3d2c5d4c37eb9f54c2156f1f7570fbc2cb04551fc874b02c5f4c4
TLSH
T11EE0127D16128917F6007FCD254B3301BD3AF1F37E408090EA68A5B6B933D66D22380B
MD5 SHA1 SHA512 TLSH

Submit Download

crashpad_handler.exe

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\crashpad_handler.exe
Size 542KB
SHA256 9769c585019a1a19d96dc0f378bd90240015a54ba77288b2efc995f791a49bc0
MD5 9ba1e7d7bfce0e9e0d52f33ef5e01e91
SHA1 5e301c6d74602e30ecabd1e445dc334440b2e07c
SHA512 aeb4c76a23bf8664c140035491f3747a6a39b4f118dd12177e5b0aff021d33ff7a3903af22dc37cb350e582ca94dcdc6d64cb204c11f50b2caa7acf643dae00e
SSDEEP 12288:reAQnPupDjbkEW1b4uifVysTVRAtCX/BJ2LoUG3zi8SrcOTFJMjlgPrdhfbTh0aI:reAQn2ptXX5J6Gj/SrcOTFJMjlgPrdhW
TLSH
T12CC48D707A2AC136D25291F15C59EBF790AC991A4B7308C3B3C95B396A712D32F32937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\msvcp140.dll
Size 427KB
SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
MD5 77e799e61066dfb983babee530e22fd1
SHA1 659484995b44b5d6e7d22d52abbfa2f68e27d32e
SHA512 e942da491509ce781abc2ea099fea110df076d264053b92a836428fcae82e29e07351f6678aa884ec26dd12230c864d3bfbd1058ecc94c89baa0cd5dd1826744
SSDEEP 12288:+LxU+0XySH2CyKSPRBb22umby6hUgiW6QR7t5s03Ooc8dHkC2eskI4j:wxUwSH2CyKaBb22umb203Ooc8dHkC2e7
TLSH
T121943932BB460DF1E48913B971C9472193FAFC610362E3C397DAF1262F566C6A633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nemu-downloader.exe

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\nemu-downloader.exe
Size 3.5MB
SHA256 1a155769da623d402e66ef58216b943695f60bb60f3b753de0b3710145543f85
MD5 3c537170505cfb8876f907b1d26d0463
SHA1 53e03b7429bd1e6b903a0aa85e04e328d22fc1a6
SHA512 fd2627931ae3252280f2e83fdd3e4ac4a5d596d7b35b2396c0faa5abeab813816fba70fc866b7824e397470e5172490b9e8bbf76f8733e2f89c681366f6af646
SSDEEP 98304:o6jDk4I4kbMYYuaaICbnKVyP6Jpg/i25uI75h6uFFkOuPXn:o6jDk4mbM5966Jpg/i28u6uFFkOuPX
TLSH
T190F57C01B691913AF9F305BE89BD561F883D7E31071880C793C8595E2AB5DE27E31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\sentry.dll
Size 223KB
SHA256 2e108ccbbd47997978512835013d06500bef5575f29cb937f623d30596662819
MD5 2c886b7927c0748042a5e294fba28e52
SHA1 8f4723d26f334f98349e237fb58e6df7791c24fe
SHA512 2667bca82d042cbb0f8d1140ee74efdd8e7d4e81881b7ecee337ea03506533055c382f176ee34ece15245584163d7ff3c796a1612cf5b38d060d6dcabe387c7a
SSDEEP 6144:BzEuxVrnhbnA4bWqkr3hRpR31HoXr4cDfSNEaFDRXtJ:BzfxVrnhbAVFVKX8SfSNEaFldJ
TLSH
T139248EA13715CE7ED79F03F4A8FB6BBB853951190B7285C3E3492F6856310C22B3661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\skin.zip
Size 398KB
SHA256 aa40840b724a3c1e1d2d567b7b03b077bbd813268224273511826c5bd4454c10
MD5 d5a974d94c01a270a6f3d5816d2417bf
SHA1 4afe596d9d62b539e861dc66ef963198e320d386
SHA512 9e53dccd2a240985efccb85962a76ac1a07a2260e03171cf02058e7fe362b7efaea7eb0f7860cd8b0109e9a6f60ced7ff6e211108b7ce981cfc3039e730e4d2d
SSDEEP 6144:kRsoSTx0vEyyfDRqwg/d1SQC+HxzG96e3Pi1GG1x8ZFE7gI8L:csfDLpg/d5CAD8jE7gFL
TLSH
T19A8412DFF721A08AC69FA778510700526D3E5897C531BB4A1CB248645BCFEF406AA39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z934A8F88\vcruntime140.dll
Size 75KB
SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
MD5 dff7397268e74ff615529032a9af2ccb
SHA1 68a671e4634825684494e45d7724a64b5146b3eb
SHA512 c0928d3c0e997bcc082530ff565569267f9e307f45f796a0f62c76f66c6121674d87123af19993f2b9f40dd7f059d1ded51c29d5d11b8dc47802cc83690e6d0f
SSDEEP 1536:c6H1qvERANBw6qntn64lqVwhNDyUZXRqtnHEecbCBg6yzT:c6HMMRANK6qtnsVON7JYkecbCBQ
TLSH
T1FE739E5274C48272C5AE4AB9017AF612663DAA604FD15FDB7FD8598C9B79BC0EF30203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 a3eb384377b18cfc4fb3b4e4ace2f61c2ed564a0fd8f50eb9032e8f1a4d3c367
MD5 ee4bc5032b02f2c828dad7118d0076a4
SHA1 863e24e644af2bb57b494ab12331783e07a451fd
SHA512 ec016f025dbf5e6eb9c74339de502bd1e0c730d6b7bf46f438450ebe4eb1c9f18e021555a7f3cbc1d9697a2ff145417b30ea67b50f740637f889a9a35dd7abbe
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVUvg88888888888f:UVqoCl/YgjxEufVU0TbTyDDalWT
TLSH
T186D30A27BE11A02FD85186F22CB9D63E79211F291BD5BD0B629A7F0026F5507B5F120F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 b3f2db504a1b108e20e85d5233b417846a67a888d5fe2505241a0f4e09281038
MD5 dd4d85c85778a6fa971d15061017776c
SHA1 00a404e1d0eca9835cb393d27cb28c7973b945ba
SHA512 bfc23aa4332e823b44de81190c421f9c2dde6e0673d783da84c5e6f8138e1df282eaa53164be880c309750e631e162e7001e6ab4dd38d169a3b93d085b5b9206
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVUvz:UVqoCl/YgjxEufVU0TbTyDDalWz
TLSH
T169D3F9277F10602FDA52C5F228D5E66E7A225E351BF0AC4776A6BB0064F224375F260F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 57b6a51f4c0a08f20398effc7fbb665527ad81c61c8bfdd8464f57bac8b4c36f
MD5 9223a6c35dd24eb423d0eb5ba4933059
SHA1 f5c8cb15f12bd86c569a3dbc0e2d0849fc47fd66
SHA512 3e6b4a6e3f3051cc2e6c7b174ca68a4fb1521e7cda45243a8d8d71692521d9afc154153ba4003b40d2e918928841f85ce1312b59e58a19e021979a4fee68969d
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVUvK:UVqoCl/YgjxEufVU0TbTyDDalWK
TLSH
T12DD32B33AE50506FE426C6F22CAAD66EBE221E350BE8ED077B95F70125B550375F021B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 b1c941f9a4b6b521501e61c55ea0ccc5a038b3243cf15deb6702707043b7a1bd
MD5 7ff6fb08c048307c81dd3d9a1b8974f9
SHA1 76d4954078361b7dd4ec5702853cfa2863702804
SHA512 ad988da7a3d45598dc6c210d703caeb0b4c0615d8106167772e317fb7e05a39e90446f1dc79cfe9f73e1b04bc618d24aad987bbed3d134ac222cc9ae1eaec7bb
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVUvX:UVqoCl/YgjxEufVU0TbTyDDalWX
TLSH
T113D31B2BBE10607EDC66C9F06CA99A6AB9110F353BD4BD0B76A5FB41267110372F520F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-207-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1968-210-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2132-180-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2132-209-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4280-206-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5884-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5884-208-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5904-205-0x0000000000400000-0x000000000041F000-memory.dmp

Download