3c0d1a07b6e4164588a5cda78a77e574663e810736802ad4caaa0ae6244ec51f

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe
Size 15.1MB
Sample261030-e3lk8swt8p
SHA256 3c0d1a07b6e4164588a5cda78a77e574663e810736802ad4caaa0ae6244ec51f
MD5 b6045afbf4b6ff62d0428bf92f872d41
SHA1 861a91f8bd5fd7190d13a833241eb5271481ff25
SHA512 54c84080344468c873c3086af5e03726e3b833f29ea0508ccadbccf4e76ad4102356e083c34b7c29d503b7431c72bdb3c101e457d2eb1adf20772a07a46e631d
SSDEEP 393216:x2hmUhp2U7rKN53cv7f+z4ShyxegIJFfoBti:xYcvRS7+zryxeg4Ffgs
TLSH
T1D3F6230576A624BDC05AC4B0835285539E6134CB1FB5BAEF0DE4E22D3FBA9F41F39624
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5580 created 5140	5580	elevation_service.exe	80

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2304	attrib.exe
992	attrib.exe

Executes dropped EXE 5 IoCs

pid	Process
4276	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
3680	Trapshydration1653.exe
440	Trapshydration1653.exe
1060	Trapshydration1653.exe
1952	Trapshydration1653.exe

Loads dropped DLL 4 IoCs

pid	Process
3680	Trapshydration1653.exe
440	Trapshydration1653.exe
1060	Trapshydration1653.exe
1952	Trapshydration1653.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3364	icacls.exe
1876	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5412	cmd.exe
1924	cmd.exe
3732	cmd.exe
3804	cmd.exe
4772	cmd.exe
1128	cmd.exe
5872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1228-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral2/memory/1228-32-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	201	Go-http-client/1.1
HTTP User-Agent header	56	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4720	taskkill.exe
3168	taskkill.exe
5604	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4276	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
4276	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
3680	Trapshydration1653.exe
3680	Trapshydration1653.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
440	Trapshydration1653.exe
440	Trapshydration1653.exe
3720	waitfor.exe
3720	waitfor.exe
1060	Trapshydration1653.exe
1060	Trapshydration1653.exe
3720	waitfor.exe
3720	waitfor.exe
1952	Trapshydration1653.exe
1952	Trapshydration1653.exe
3720	waitfor.exe
3720	waitfor.exe

Suspicious behavior: MapViewOfSection 1 TTPs 6 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3680	Trapshydration1653.exe
5580	elevation_service.exe
5580	elevation_service.exe
440	Trapshydration1653.exe
1060	Trapshydration1653.exe
1952	Trapshydration1653.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	taskkill.exe
Token: SeDebugPrivilege	3168	taskkill.exe
Token: SeDebugPrivilege	5604	taskkill.exe
Token: SeDebugPrivilege	3680	Trapshydration1653.exe
Token: SeShutdownPrivilege	5580	elevation_service.exe
Token: SeShutdownPrivilege	3720	waitfor.exe
Token: SeDebugPrivilege	3720	waitfor.exe
Token: SeDebugPrivilege	3720	waitfor.exe
Token: SeBackupPrivilege	5420	vssvc.exe
Token: SeRestorePrivilege	5420	vssvc.exe
Token: SeAuditPrivilege	5420	vssvc.exe
Token: SeDebugPrivilege	440	Trapshydration1653.exe
Token: SeDebugPrivilege	1808	whoami.exe
Token: SeDebugPrivilege	1060	Trapshydration1653.exe
Token: SeDebugPrivilege	1952	Trapshydration1653.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4276	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3720	waitfor.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 4276	1228	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe	89
PID 4276 wrote to memory of 4720	4276	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	90
PID 4276 wrote to memory of 3168	4276	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	93
PID 4276 wrote to memory of 5604	4276	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	95
PID 4276 wrote to memory of 3680	4276	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	97
PID 5580 wrote to memory of 3732	5580	elevation_service.exe	100
PID 3732 wrote to memory of 3720	3732	cmd.exe	102
PID 5580 wrote to memory of 3804	5580	elevation_service.exe	103
PID 3804 wrote to memory of 1876	3804	cmd.exe	105
PID 5580 wrote to memory of 4772	5580	elevation_service.exe	106
PID 3720 wrote to memory of 4736	3720	waitfor.exe	108
PID 4772 wrote to memory of 3364	4772	cmd.exe	109
PID 5580 wrote to memory of 992	5580	elevation_service.exe	110
PID 5580 wrote to memory of 2304	5580	elevation_service.exe	112
PID 5580 wrote to memory of 3712	5580	elevation_service.exe	114
PID 3720 wrote to memory of 356	3720	waitfor.exe	118
PID 1128 wrote to memory of 440	1128	cmd.exe	123
PID 3720 wrote to memory of 5872	3720	waitfor.exe	124
PID 5872 wrote to memory of 1424	5872	cmd.exe	125
PID 5872 wrote to memory of 1808	5872	cmd.exe	126
PID 5412 wrote to memory of 1060	5412	cmd.exe	129
PID 1924 wrote to memory of 1952	1924	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2304	attrib.exe
992	attrib.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5140
- C:\Users\Admin\AppData\Local\Temp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe
  "C:\Users\Admin\AppData\Local\Temp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Users\Admin\AppData\Local\Temp\is-DTDNR.tmp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-DTDNR.tmp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp" /SL5="$400B4,15432248,119296,C:\Users\Admin\AppData\Local\Temp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Trapshydration1653.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4720
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Trapshydration1653.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3168
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Trapshydration1653.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5604
  - - C:\Drivers\WitchFabrics\Trapshydration1653.exe
      "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:4736
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:356
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5872
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1424
    - - C:\Windows\System32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:1876
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:3364
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:992
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2304
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn PyPTPQuSMDoKzHnsxlAuLpXt /tr "cmd /c cd /d \"C:\Drivers\WitchFabrics\" && start \"\" \"C:\Drivers\WitchFabrics\Trapshydration1653.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3712

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:120

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5420

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\WitchFabrics" && start "" "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Drivers\WitchFabrics\Trapshydration1653.exe
  "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:440

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\WitchFabrics" && start "" "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Drivers\WitchFabrics\Trapshydration1653.exe
  "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1060

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\WitchFabrics" && start "" "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Drivers\WitchFabrics\Trapshydration1653.exe
  "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1952

C:\Windows\system32\schtasks.exe
schtasks /query /tn PyPTPQuSMDoKzHnsxlAuLpXt
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AndersonRoles-5278.D9s

Path C:\Drivers\WitchFabrics\AndersonRoles-5278.D9s
Size 4.4MB
SHA256 c22a0b6e6bb6a5b27590d84e85025c7767496df85ea0b5d898cc77e3bb9c32b5
MD5 de700f5d45328690629efdee2760fa14
SHA1 7c663ecec8d1e0b8f7d3be7bfb2e69f5b54e1c1f
SHA512 e69b067773038436518f8d33524afb0f862c845f19f336d829821758c71d8b8b598b59b46957bd6d8cab6adf8f58a0a3f968ab3d448e82f9faae99744132dbbb
SSDEEP 49152:GqzuxHcpEym5CRrCp1n5KlcJcQy2HmrRN9/ZmIHiPi:Osl1Rr25KlcJc4HmrRNTmICPi
TLSH
T1E226BF312151AA15E06F4316E1F84E0CC6BD6A4993BB8E9C9F13BAF67E46701FE3815C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trapshydration1653.exe

Path C:\Drivers\WitchFabrics\Trapshydration1653.exe
Size 1.1MB
SHA256 9284b0767d36c3e35cc05f50131e7b30688ad20236b7d1534cf40f8dc3adc12d
MD5 16c6b6ac0eb49905a7239b710f1fd980
SHA1 2e3a7c84940479f15f2c032a9e7ec4338be001c5
SHA512 c6fcbb142c494d1dff6abba0704b0e93bdcad68bd3f64aa31e0a1c5072f4f053b865503a4caefe70b6075d259808472a57ab4b00518993a5f47239ac1bb4c597
SSDEEP 24576:H8q9/yCM7Yymw2SzTrLBeDRegM+CyQBC1japLEWP8wncYUkrpieOwGpwY:cA/QNmVyeDRhRiC1japLEWP8wncYUkr+
TLSH
T1A0455B15775A65ECC09AC470838285636EA138CB0F35BEEF45C4A2393F7AAF45F39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 16KB
SHA256 de95df1615d25299ef746e9305cda82506223bcf9afa11e7de86f75bbe1be946
MD5 adc7f735cb6365829e4352a5e05376f1
SHA1 7a2923d83f4ebd80dc49ecc51c8b719c559bf427
SHA512 77dc563a2a1e46156115c151e060b8126424704346a2efd3d35b0431c34d2caa18f34cdf7528f6b87955e27e3f244996e4d15ef798fbdb396f3edd38c25bfd92
SSDEEP 384:wSkkCV5zLEK/ZuDWkFfK+z8YV+A32xAKuQ3YUB9AXL:AB5/rZtkVjzNCJ1a
TLSH
T12072C073740ABED369C49893944AC0D2F2EE98E07901DDF076485381DEB9BE505E62E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 17KB
SHA256 0f42740d2f32a8ada037c4d6e6bc7a93614c03c9527aa67c9a925decba56052e
MD5 04d9e885a75f2700492b56ce3b314d9e
SHA1 73a8267b3892ea504d78994c27a2fa408b62310d
SHA512 fcc8d95a9b939ba24d9acc9640a3e01f2a22a0b74865dc4391c31f23c4cc53f7dac416ff26f0f66e003e36258765c586108b11961f9c0ff5d9a7a8f40c4d53d4
SSDEEP 384:wSkkCV5zLEK/ZuDWkFfK+z8YV+A32xAKuQ3YUB9AXEVL:AB5/rZtkVjzNCJ1x
TLSH
T14A82C0B7740AFED368C49853D44BC0D2F3DA98E07902DDF0B6445381DEA9BA505D52E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 17KB
SHA256 1a00c1271c317ae783ed92cc1f1ffd2f29de1be0a992114ffdc686449f66d03e
MD5 33cef3dce8953a34ed02177a1befcd58
SHA1 5118ae888b16226d0c8b88f25b24a3e276b25837
SHA512 04a4c81375c9821f173f64ef3fdc27389cfbc3ac4b9a62ef5ad536222059c93815431ff97ccdb241fd5046cc88db839f7cbd1b98e770d5f664d3a9886be75deb
SSDEEP 384:wSkkCV5zLEK/ZuDWkFfK+z8YV+A32xAKuQ3YUB9AXEVZ:AB5/rZtkVjzNCJ1D
TLSH
T10782C0A6340AFAE36CC49853D44BC0D1F3E998E07902DDF47A085391DEB9BE605D52E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 30KB
SHA256 011c915ecc317a2ab4ad6efe245807f4bd35dce9e9607f81208ce58f442b57fe
MD5 cb9d1ba7ecfb2106f03fd5a540e8fad4
SHA1 a28674ac13c35237f1663d6ee06655f60f1194ee
SHA512 99b92384753b56112ac22dc6e24f6d0377e1905d9f476b5994f3ee4abec9475070b668137a24e1e4af166b0884aea07c71a3dd77f485d3084d11bae38c1781f8
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEBkAcy6RLcQyZGP:EtFtkVjRCJp48LEKAcyDGP
TLSH
T1CCE2E0637B42B6C77CC49853C48BD095FBFD18D5BD02EEB06B18A1D5ED388A40ADA2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 34KB
SHA256 a6be750c540f6a5c814e6bd947fdbdbce1c7ff2aeda07aac101d7b3e75a78b17
MD5 92e3e769f64470af5d48a4b336e44210
SHA1 cc63cb6aea8a224a3faca4f26bcb61a18488e2c4
SHA512 7596983ecb459cc763ab97b531dc1968df6e427493ba460bea545bde518dc3b916116d830f924f9d9f36585ec1c9e0532354d1d35cdd1f15d73e5ba335bad6f8
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEBkAcy6RLcQyZGvoTGOX8yF:EtFtkVjRCJp48LEKAcyDGwTGOFF
TLSH
T11CF2E1637B42BACBACC48862C48BD094FBFC18E57D02FFB07A18A1D5DD389A509D52D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 34KB
SHA256 81575baa03ae0ea75858f3f90d14b9710c87460a884287cab73d9a0065c1de9b
MD5 43738a119a4a863a7de18a4acc27af85
SHA1 2a88c7b928260b01615ab6dc817733e0aa94fcc1
SHA512 96f9400e5b1e613f2f1124bf434eff387d29fb2fdbb25f0ebd0cf2e5602982b633e37e828f7b4485e2967bacda48ed91097944c5af08dc19dc0be3f10cc98da8
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEBkAcy6RLcQyZGvoTGOX8yB6Q:EtFtkVjRCJp48LEKAcyDGwTGOFB/
TLSH
T1D0F2E0577742B6C7ACC48862888BD094F7FC08E57D02FFF07A18A195DE38DA50AD52D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 d72c65ad8aab5bfc1359ae6a06f9b525688ab6b477cbc70e36e4475fac6701be
MD5 f108964d25eebd4ea4412ead5a481b68
SHA1 2c16bdf009aba056d9cfaea22ae3160ab935f5fa
SHA512 e17b2cf7282fd0ad4ddc9279f4774e2b5a3f809babe6e2429b70c39d24300b54eb37814f0041a7caca9c0f0ef4f336f60d7a7aa8178df164ce3110fc98dae13f
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEBkAcy6RLcQyZGvoTGOX8yB62h17:EtFtkVjRCJp48LEKAcyDGwTGOFB9hB
TLSH
T131F2F0177743B6C7ACC488A2C48BD198F7FD08E97A02FFB07A187095DE289A509C52C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 36KB
SHA256 00760442e7a3dfb78b3edcf928c3883352633927bbdd662687593b6e48b1e7a8
MD5 19e9704d2e6b723f1413d7b4649c659d
SHA1 b0d8ab173a57ce4bac352c31c88affe8db7a8466
SHA512 0c01b7359940150b01bfd38204ea162772869ed88fea469fe4e0c6368bf13bcf6da3bebf9d028f5b47a8459e23d77b684e6a4e6da4804f857b60a6dcb1a0d8e1
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEBkAcy6RLcQyZGvoTGOX8yB62h1B:EtFtkVjRCJp48LEKAcyDGwTGOFB9h7
TLSH
T120F2F0577742B6C7ACC498A2C48AD0A8F7FD08E83D02FBB07B28B1D5DD28DA509D52D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 41KB
SHA256 601bdae445307df227c36d04c7a0e8b0bdcc65408ed2182d23844a5d8cac2f6c
MD5 9a1ed6dae31b1b1825c2a0e53edb5e54
SHA1 d2816489868c0944bfca3fa32722e00cfad2cf18
SHA512 9e24001f993feecfd22e6066786ed43371cfd56897666978698ca59cec6d693106b2344d5ed89ce4b5a100d44b969a4ad2632bca572815e7904291d577905485
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEBkAcy6RLcQyZGvoTGOX8yB62h1GAi+kp/gvi8KjB:EtFtkVjRCJp48LEKAcyDGwTGOFB9hwAC
TLSH
T139130157B742B5C7ACC09492C0CAC0A4FBFD48D47902FBF0672960D5EE399A905D12C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 1KB
SHA256 228789491fd6f204bb5fdd93ca243b417df2249fd4074025d7a665a5be7f985e
MD5 648c1eac0f9f40e0501458319f1c1c24
SHA1 d3077b028d34d224fcafbfea3ae8ae0461ef9c34
SHA512 6a16bf1763951f54356ab2be9464d486d452dbb6b362b8737a655b0681e8dac8be2c679d2c2086957a9d61a6bcef88a92241a03ba0efdd23e23be6b4e4f36f92
TLSH
T197310C30B5065DA539F385D1671048D41D9E7FF1B450666410DCA5C0DC6CD7D8EBB2BD
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 8832218ecfdfbac188fbd2ba8cbc84f3f93cb0df44aa7f0d138c292299ee4101
MD5 92aef02fdcd4a48f2fb236873062efae
SHA1 f7443fc2cd4770c358931239501325eb29d966d5
SHA512 c6b362561c5b1812cdfab85a022e9c6295cec4a6ee908c5056ce54032b793d426503346b1dba35a07a521796735d27beb2359be0ae3c987333778d05b3740b73
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEBkAcy6RLcQyZGvoTGOX8yB62h1GAi+kp/gvi8KjP/y:EtFtkVjRCJp48LEKAcyDGwTGOFB9hwA1
TLSH
T11B13F157B743B5D378C0A492C0DAC0A4FFFD08D8B952FFB0665960D59E3A9E901C22D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 51KB
SHA256 9e025c49a3143ebb3aa28f0fde6f5100f58f1c89032a40a16ea48c95f8a5e6a0
MD5 17bcde7956d586aed61989a76fc300b2
SHA1 2082e6790c52d864ff43832c9a2d03facb978d01
SHA512 55540068660565988a67adc0f3c3e38e1450654686f61202a0c9f9003e99887b8c921522fdcfb0700836e99f5256d7a9df39edbec21cba14fd57065dccee7b5d
SSDEEP 1536:EtFtkVjRCJp48LEKAcyDGwTGOFB9hwA9fvi8EPf5lm2mxpN:DVjRY48LwFB9hXfvNEnq2mxj
TLSH
T10D3301877683B5D3BCC068E38096C0A4FBFC08D8BA91EBB0A75130969E369DA05C11D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 3KB
SHA256 4315e90ee97412cd0e0806fd8e9aa7da5b8da0e6aa5c9692dd30ee5b76280e79
MD5 1f082f61c56f73b7e278d3fe02484bce
SHA1 08f472fca59ca12706659c1260a93c101ff099df
SHA512 4f66a748ce299d3fda9c573ff32f60aab6782a94c494d3346bd5ce17f1e0f31aee2798489ed4b0cece59d1b51a3b1dd5a440b88ba8ab8763f75577b4c6cb01a8
TLSH
T15B616D31310A8DA779E55AD11900C0D55BDA6AB33070A57841CCBCE8EC9D6AD09E723E
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 4KB
SHA256 5752647d950538c5f8f72193ea0bf2aeca201cc0c958291a723f608fc3af031e
MD5 be11c2e7d902832c9852faa844d17a2a
SHA1 8c574a751a81c3d7f1b863d911522923c93e6a49
SHA512 b5e4a494c0d9f897ead8e1a50f3133eebc48644f4bcfca7707188915e50256f49c8e1e71be855c71d4762de3aaf2566bb9395f6a1dda03f13a44139ec1ee590e
SSDEEP 96:QYgbBi6Sr5A0y5qOtskgoI8SUWpwtHVVbborUT57GIrvBLEv:QLVgkzz9IbLpwB4K57xFLEv
TLSH
T1BC917B3376498EA335E259D04805D1D27BDAAAB27030E5F401CCBCF0EC9C2A906E327E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 77KB
SHA256 5d5d2e6b273bd3affeb475188de87c0a05dc23bd4eedf99bcff207defbbaafd1
MD5 390b8677741d017618ff14abedccfae1
SHA1 564c7c5eac5e85cd07624c98c05851a3bf11dfff
SHA512 436f2aa5ba40cea26092d099656b6f2e353530ab5d46352b63d9b179002f5275548f3b8bda73a7f0f9102eadc051fba3a0193c5ecdd2616a460165b8b8e230da
SSDEEP 1536:EtFtkVjRCJp48LEKAcyDGwTGOFB9hwA9fvi8EPf5lm2mxpD3f707kKOHxWy7wYwD:DVjRY48LwFB9hXfvNEnq2mxB34kKUBAD
TLSH
T15673029B7492FAC3A8C042E39156C095FBFD04C5BA81EB70AB1070C57E7AAE605D10E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 101KB
SHA256 24a669b4a95da272d09d22a470f91a38ea1356bf289fb163080ba2d827e08712
MD5 a31f3b0672b78e2d00ea1470a0b72031
SHA1 17fb00bc5c60e67e34aeba34f37feec3375f6780
SHA512 86fbaa9f0797459e20a9e668bf5b67435193842ef26f70e9bb385db8b312639c76b0ef1e9add12759ffcb454a5e1cb16cb25b1882fb7f2ee9073bf2fa8c9b55b
SSDEEP 3072:DVjRY48LwFB9hXfvNEnq2mxB34kKUBAAPskXVMf:DhG48Yb11n2K39KUpL2f
TLSH
T1DCA312DB6592F6C268D041E34A83C088FBFE04D67989DEB07A50B04A6E76BE715D01F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 30KB
SHA256 e025975665f41c4aeefdb226680bda318f16c57629d83b57e705ff8978ab16c3
MD5 8d2d8976425502664491f420bd64772b
SHA1 7281d1ce24ea71cd6e3958590ff37dc496b6a4cb
SHA512 067e705287fbeb592003bbdd7d169b1a9302f8db01daf9afb549a87526adb8765d7781576768c609b043c72c4211082b3bc887c6e75b9a6877a33d8b6014c290
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEB5IAP6RLcQyZGP:EtFtkVjRCJp48LEzIAPDGP
TLSH
T1B4E2E0637B42B6C77CC49853C48BD095FBFD18D5BD02EEB06B18A1D5ED388A40ADA2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 34KB
SHA256 d64f8cefe57ac0f6e07aeb655796dc7f407725d0e1176d269411b1a74aedcccc
MD5 b14879ac8192e08e477595f5bd62307b
SHA1 3360937709da6e9d20f022f6960aeb9f4b737795
SHA512 33229558e5ec364bb545cf49570b99e8e6dbc3ab29bb170267656a70ee9fded14ca56efbea0bf7d71b07d955b7f3027fd1079132db0bb685239a06e5ec2beeb5
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEB5IAP6RLcQyZGvoeTOX8yF:EtFtkVjRCJp48LEzIAPDGweTOFF
TLSH
T1A1F2E1637B42BACBACC48862C48BD094FBFC18E57D02FFB07A18A1D5DD389A509D52D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 34KB
SHA256 678e2c381032b9006a2afe943024689a8049c4e5cc63db972b9f064f32d6eac6
MD5 c024617f7612b68867db7b0a73b95f66
SHA1 43dd53f721ffe55fab9fb63a309106a2991cd774
SHA512 a3e5a4d95616d093533eb7d6d30093adcfe61e6a0d166ae3c381e9c8f56210d09287d63e5d87ed4f2d31bd75d5691b95f5471681363c928b710c2c6e0e31c351
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEB5IAP6RLcQyZGvoeTOX8yB6Q:EtFtkVjRCJp48LEzIAPDGweTOFB/
TLSH
T1B9F2E0577742B6C7ACC48862888BD094F7FC08E57D02FFF07A18A195DE38DA50AD52D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 35KB
SHA256 308a4acb93e753da8eb03606026349f2867d3a944a86a81affe2ea84ec7bc8d4
MD5 da297804c5b2fcedae3a46ac191b269b
SHA1 15f3277ef4b62ce6932681ac2e49c2f1e2951d22
SHA512 d6f49d74d2af7c97d45d9bc7fa2d6a04ff736e2e6c9922a9c585a8eb4eccbf239003149a92855a2c97fb60a4d21866291bc2d3907dded607e16509f96eb8c979
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEB5IAP6RLcQyZGvoeTOX8yB62h17:EtFtkVjRCJp48LEzIAPDGweTOFB9hB
TLSH
T1D1F2F0177743B6C7ACC488A2C48BD198F7FD08E97A02FFB07A187095DE289A509C52C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 36KB
SHA256 a4b6cd532d47207e8889715f80b13d8c1da68d02941978a9cba4c680f97ac0cd
MD5 4546efc42af79c20b0d6fd131574f51b
SHA1 056806085fcbe3a8dac2e5e32fefe179d5a1f594
SHA512 8a28df9ccbbfa2cb5868605c2ab83e12d666f61e92658814f57925f68d62b51f2f938a01e76c514072ad36d893fa8c7a2c885dce450c1922442d87cf6d3de798
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEB5IAP6RLcQyZGvoeTOX8yB62h1B:EtFtkVjRCJp48LEzIAPDGweTOFB9h7
TLSH
T12AF2F0577742B6C7ACC498A2C48AD0A8F7FD08E83D02FBB07B28B1D5DD28DA509D52D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 41KB
SHA256 2cc144e27a39687bd92587c9f061100bc7353a93895a52b9f2133fad09d07860
MD5 3c8b26c6cef8c637c234cbe0e5cf2637
SHA1 4aa1218ab3143b13f51de153365f166349d5648d
SHA512 599f9db73bdc2a4b25115438d0b7accb1dedf6f6feeacabb10fd26582a8845158cd48e2b01461cfb915d2764d8ae81a8e3a7bda5a72ecf30ba2d33747772a9f2
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEB5IAP6RLcQyZGvoeTOX8yB62h1GAi+kp/gvi8KjB:EtFtkVjRCJp48LEzIAPDGweTOFB9hwAC
TLSH
T172130157B742B5C7ACC09492C0CAC0A4FBFD48D47902FBF0672960D5EE399A905D12C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 43KB
SHA256 7d7c81f48db887f58936b0d8e138a62400cd8944e0474cb7a2cfe1940112d66c
MD5 98f037775e45fbe32d4ee600c8172376
SHA1 e64af8991f95186868778d8fe3d59cb0a9b5904d
SHA512 8cf51c73353654497e521762f154af57d0492bddba0cb410ece8c49fa411fa0b4daa1fc63b4f51fbf7cc731913a678dd331240ccf2726a878aa1afb7584b35de
SSDEEP 768:AB5/rZtkVjzNCJ1Ai48LEB5IAP6RLcQyZGvoeTOX8yB62h1GAi+kp/gvi8KjP/y:EtFtkVjRCJp48LEzIAPDGweTOFB9hwA1
TLSH
T11113F157B743B5D378C0A492C0DAC0A4FFFD08D8B952FFB0665960D59E3A9E901C22D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 51KB
SHA256 e95719d7d5a3058bc1e2d2bbf7e8eeda1837cfef9ddcc58d57b6a84ed85121f3
MD5 d6883b0274eb56f8f7f08277c77e9481
SHA1 32053ef8dc86bd17f83666c733b6b3d57b64f6cb
SHA512 3e2b9bb32ce44d9c36e83cc9548ffe3b149152404d56589a2b5f1d56c9690fe804675e8f6a2db519ee4956d165c196a13abb26ebfb7b08efe998f0ff43fc165b
SSDEEP 1536:EtFtkVjRCJp48LEzIAPDGweTOFB9hwA9fvi8EPf5lm2mxA:DVjRY48LwFB9hXfvNEnq2mxA
TLSH
T1EE3302877783B6D37CC068E38096C064FBFC08D8BE81EBB06A5170D69E7A9E605C15D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 2KB
SHA256 1b8af885fb1698bf1c449d98179903e282cd209774fa1e97485f92e4bd306f23
MD5 d9f3ad097f6f8782ef1ce2cfcf1c3822
SHA1 bd5517e2c2282693181b981ca2c9f71d9f5213c2
SHA512 58bd4aa309673cea50cd04e2a9ad19f4a16404e2a9e386d5c941da2dc0c27a1e176260a8e7f88e465612ed09896f6e90d4185291d095ea539c7fd48c6b6f89a0
TLSH
T160515C3174098EB63DE699D14D00C0D407ED66F27420A27852CCA9D8ECED9991AE723C
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 77KB
SHA256 8afa0ce675702df4e2bc573c44d59f9f01c8db6769204ea65d1251b944295373
MD5 1175a0ca2340db42c2abf99ddbff712e
SHA1 08afecb110b0fe608feb6d16b954f1ca5fca4d1b
SHA512 42fa7d0e3fb7a01c068e8ac54e3163834a34fb9401c4cf93a65f335827bf9d239cc1d3c8370a33cc24cfcf2ea869365e8948d4e2868ca783d051064dffe99287
SSDEEP 1536:EtFtkVjRCJp48LEzIAPDGweTOFB9hwA9fvi8EPf5lm2mxpD3f707kKOHxWy7wYwD:DVjRY48LwFB9hXfvNEnq2mxB34kKUBAD
TLSH
T18E73029B7492FAC3A8C042E39156C095FBFD04C5BA81EB70AB1070C57E7AAE605D10E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 101KB
SHA256 5bd8c66b593a7d5804d8775dbf4cf4721155631da9cd3a6d967a06b254b466f8
MD5 9f92bdf3703ffe7ad71ac3096a3799c9
SHA1 a34d1fb2cfa2fed486d7b0b1c250f3029d800c35
SHA512 7e7a66b8540a6c7effb67af826eaaa3f59e01779f21adefa2a4572f7550cb00c9a999b5af711365eec3b469c95c929c18ad90756e0209acf4729d6c4348c4d4a
SSDEEP 3072:DVjRY48LwFB9hXfvNEnq2mxB34kKUBAAPskXVMf:DhG484b11n2K39KUpL2f
TLSH
T111A312DB6592F6C268D041E34A83C088FBFE04D67989DEB07A50B04A6E76BE715D01F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GraveReforms1747.1GY

Path C:\Drivers\givinglounge8\GraveReforms1747.1GY
Size 10.3MB
SHA256 2604761e24c7656dbd77883217eb6131f499c0792863e17c5dbfaedd66208ee0
MD5 69c414daf9537b09ef0395c7509e8442
SHA1 6afb2e678322de1860db6cd1421b7cc95fd2e29e
SHA512 93495652ae6eab038a071045c3e049e348b94598a867f19708c21ec1a1f653257ec32ad7cee14f839b376f024d84db045f18dd91389c27e8d2894cf8b6850401
SSDEEP 196608:0E7P4mMFeJLvS282g/58hhga/LN8pCawXhnrvVHVl4+pHhVIuMG:LbMFeJSZhkjN9frvpVK+MG
TLSH
T148B633BB497810CB6413B2DF526BE74FCF2B6188348AF9D5B39609D877425C85382CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DTDNR.tmp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
Size 1.1MB
SHA256 cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839
MD5 129b8e200a6e90e813080c9ce0474063
SHA1 b5352cdae50e5ddf3eb62f75f2e77042386b8841
SHA512 10949e7f0b6dd55e0a5d97e4531ef61427920cccc2136c0dd3607cdc79afa0d8a7178965a07039948da97f0200ead8fe5a54921620c943c7fc76dd5ef5a7c841
SSDEEP 24576:WEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsyb7xyx:bdmbjTKlD00R
TLSH
T17C453A22A3D68433D5732E758D6BC2945C367E202FA4D48A7EF89E0C4E79B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-509-0x00000225EB9F0000-0x00000225EBC1D000-memory.dmp

Download

memory/1060-735-0x000001E374960000-0x000001E374B8D000-memory.dmp

Download

memory/1228-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1228-32-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1952-960-0x000001F8A8900000-0x000001F8A8B2D000-memory.dmp

Download

memory/3680-27-0x0000025EA9930000-0x0000025EA9B5D000-memory.dmp

Download

memory/3720-368-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-462-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-375-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-425-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-438-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-370-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-303-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-445-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-439-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-369-0x0000015E9F320000-0x0000015EA2591000-memory.dmp

Download

memory/3720-301-0x0000015E9E110000-0x0000015E9F318000-memory.dmp

Download

memory/4276-26-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/4276-6-0x0000000002460000-0x0000000002461000-memory.dmp

Download

memory/5580-354-0x0000023289D30000-0x0000023289E1C000-memory.dmp

Download

memory/5580-280-0x0000023289D30000-0x0000023289E1C000-memory.dmp

Download

memory/5580-230-0x0000023289D30000-0x0000023289E1C000-memory.dmp

Download

memory/5580-197-0x0000023289D30000-0x0000023289E1C000-memory.dmp

Download

memory/5580-175-0x0000023289D30000-0x0000023289E1C000-memory.dmp

Download

memory/5580-173-0x0000023289C40000-0x0000023289D29000-memory.dmp

Download