Overview

overview

7

Static

static

5

HEU_KMS_Ac....0.rar

windows10-2004-x64

1

HEU_KMS_Ac....0.exe

windows10-2004-x64

7

out.exe

windows10-2004-x64

当前目�...��.cmd

windows10-2004-x64

6

当前目�...��.cmd

windows10-2004-x64

6

更新地�...��.jpg

windows10-2004-x64

1

更新日志.txt

windows10-2004-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    1799s
  • max time network
    1786s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 03:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    HEU_KMS_Activator_v64.0.0.exe
  • Size 4.5MB
  • Sample261102-dj2bxaev9z
  • SHA256 6ad72af453a9c4db99a30317e97689e893a110681e84655392865c8a813e8a5c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • AutoIT Executable 60 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • UPX packed file 60 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 31 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEU_KMS_Activator_v64.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\HEU_KMS_Activator_v64.0.0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\7Z.EXE
      "C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\7Z.EXE" x "C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\KMSmini.7z" -y -o"C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds" -p"2025Heu168"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2700
    • C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x64\kms_x64.exe
      C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x64\kms_x64.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\System32\cscript.exe //nologo //Job:WmiQuery "C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\xml\wim.xml?.wsf" Win32_ComputerSystem CreationClassName
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Windows\System32\cscript.exe
          C:\Windows\System32\cscript.exe //nologo //Job:WmiQuery "C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\xml\wim.xml?.wsf" Win32_ComputerSystem CreationClassName
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          • Reads the TCP/IP host and domain name from the registry
          PID:1052
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\System32\cscript.exe //nologo //Job:WmiQuery "C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\xml\wim.xml?.wsf" SoftwareLicensingService Version
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1092
        • C:\Windows\System32\cscript.exe
          C:\Windows\System32\cscript.exe //nologo //Job:WmiQuery "C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\xml\wim.xml?.wsf" SoftwareLicensingService Version
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          • Reads the TCP/IP host and domain name from the registry
          PID:3936
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\System32\clipup.exe -v -o
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2256
        • C:\Windows\System32\ClipUp.exe
          C:\Windows\System32\clipup.exe -v -o
          4⤵
            PID:4812
            • C:\Windows\System32\clipup.exe
              C:\Windows\System32\clipup.exe -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem3BA8.tmp
              5⤵
              • Checks SCSI registry key(s)
              PID:4392
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ver
          3⤵
          • Executes a command shell one-liner
          PID:1868
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell "(Get-AppxPackage -name 'Microsoft.Office.Desktop' | Select-Object -ExpandProperty InstallLocation)"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2096
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell "(Get-AppxPackage -name 'Microsoft.Office.Desktop' | Select-Object -ExpandProperty InstallLocation)"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2704
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x86\TSforge.exe" /igpk de52bd50-9564-4adc-8fcb-a345c17f84f9
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3260
          • C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x86\TSforge.exe
            C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x86\TSforge.exe /igpk de52bd50-9564-4adc-8fcb-a345c17f84f9
            4⤵
            • Executes dropped EXE
            PID:2620
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x86\TSforge.exe" /staticcid de52bd50-9564-4adc-8fcb-a345c17f84f9
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3316
          • C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x86\TSforge.exe
            C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x86\TSforge.exe /staticcid de52bd50-9564-4adc-8fcb-a345c17f84f9
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of AdjustPrivilegeToken
            PID:3816

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          sppc.dll
          • Path C:\Program Files\Microsoft Office\root\vfs\System\sppc.dll
          • Size 9KB
          • SHA256 52d35451da14b1cd489f9f5370f6ba7f7086c52f86b045c02229d706c3668e97
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GenuineTicket.xml
          • Path C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket.xml
          • Size 1KB
          • SHA256 02ca2563a58b733710bc9c759e1b7050fbe971dfd70ed2d7eeb460820fa41906
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HEU6400_Debug.txt
          • Path C:\Users\Admin\AppData\Local\Temp\HEU6400_Debug.txt
          • Size 285B
          • SHA256 2a3035c8e3bfb165e119851860d55d1c11a819a7038dbde5f15c8cf5a5a34e64
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HEU6400_Debug.txt
          • Path C:\Users\Admin\AppData\Local\Temp\HEU6400_Debug.txt
          • Size 623B
          • SHA256 2f03408a1f7ab7f62ef3729e264e56b6f800558d0a61d76ef023633fbe504094
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HEU6400_Debug.txt
          • Path C:\Users\Admin\AppData\Local\Temp\HEU6400_Debug.txt
          • Size 3KB
          • SHA256 cead548dbbd64ff62a98bf59694efdfa5e9cff2226953356b7e1807ff18a0534
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HEU6400_Debug.txt
          • Path C:\Users\Admin\AppData\Local\Temp\HEU6400_Debug.txt
          • Size 4KB
          • SHA256 9948f6607e042ea6ab394a5f7c87b2872004219e6fefbc6715afbacaf7367aca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScriptTemp.ini
          • Path C:\Users\Admin\AppData\Local\Temp\ScriptTemp.ini
          • Size 116B
          • SHA256 52b593ce635392278c80b4eaf701a5aa28dc9d0464110b6063d204dc78811f8e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScriptTemp.ini
          • Path C:\Users\Admin\AppData\Local\Temp\ScriptTemp.ini
          • Size 115B
          • SHA256 50242169a433c26f52e3a5af009c8523b8b6f11ce361009e1437664e78b1a1a6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_drpdjpf4.a4r.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_drpdjpf4.a4r.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7Z.EXE
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\7Z.EXE
          • Size 722KB
          • SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\1-1.bmp
          • Size 3KB
          • SHA256 8d3b094b0984a03453f11d7d587226f4e29665e1b0e04b76f009a8e8268fe18c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\1-2.bmp
          • Size 3KB
          • SHA256 1ec1312347fee5a7cddda9d264b536f2a230de13acbd024a967ff9bd6d607a5b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          12-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\12-1.bmp
          • Size 2KB
          • SHA256 9d7c6237e459455d792589c0d2ee7d5f02d0a62e403978d974b4049503eda4d2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          12-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\12-2.bmp
          • Size 2KB
          • SHA256 80e1b7511127d4b36fc7f5a16fbbffeddbca2bdfc44c010d02b4657c94f3d20d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          14-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\14-1.bmp
          • Size 3KB
          • SHA256 f6e73c93ce3c964a9e8969eff64bb12bd20685350b6dd8b2ef3d86f803dcbcc9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          14-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\14-2.bmp
          • Size 3KB
          • SHA256 fa993936d1682bbce788e759bd1b2635b987e535adab6002792d0c316df5863c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          15-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\15-1.bmp
          • Size 3KB
          • SHA256 fe17efd8e710e268b0b9c7374346e10c0e1f72927b3016c42a911d4c67e89439
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          15-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\15-2.bmp
          • Size 3KB
          • SHA256 85fba5bea5738ae5171a5807263d99ebb392719cc93dc0e10c12174bb974fbdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          17-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\17-1.bmp
          • Size 3KB
          • SHA256 de0640c44d43a43d2726e22ef87e80d9a571fa5b1682fd743f4be395526b6fa9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          17-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\17-2.bmp
          • Size 3KB
          • SHA256 c267701bfc6b785772abee5ac8eb83fb2c13c09385a2a2c4a1cd451a67e9cb96
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          18-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\18-1.bmp
          • Size 10KB
          • SHA256 ba227299b8ece4c92d50fe53601150834e08aaedb5aa8ebdc974de76ee044bb4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          18-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\18-2.bmp
          • Size 10KB
          • SHA256 f40d25ff245a97df52da27fdf5c77175620534276204354d3b39af4a1c26f8c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          19-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\19-1.bmp
          • Size 2KB
          • SHA256 11c8dddb5aaea4086b356fc2dbc81e2fdc1ea5a2fb1d7f3d800884461f88578b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\2-1.bmp
          • Size 3KB
          • SHA256 2c6ded923d9853647026dc1e71a276a4ed5594cb4b92ac673da1a748eac6e347
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\2-2.bmp
          • Size 3KB
          • SHA256 0fa6814298169bb6ba98a43b95f8e586c9ca7b35ea0e0a2252d1145f4af54da7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2-3.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\2-3.bmp
          • Size 3KB
          • SHA256 251dbb10854ceb2229d2bafd4afe0e953a392ba3b390aed65bdb83555d3a8563
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          20-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\20-1.bmp
          • Size 10KB
          • SHA256 9ccbafd452a42846a11c391581e0fe77a8f0f64b59fa351217ee3470df81ed40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          20-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\20-2.bmp
          • Size 10KB
          • SHA256 f11635d8d2f850bb29e14a5bc8eb855c9788e61881feaec0918bd0ae0acb3753
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          21-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\21-1.bmp
          • Size 2KB
          • SHA256 de3d69c9da80d614dcf1b88e70f0fd370a70baa92d025b878f38cc2c9cec5899
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          21-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\21-2.bmp
          • Size 2KB
          • SHA256 ed1793a63a1a8629a941288cdd6a08b2f2ea5e08fae014ff96390fc04d9e8da2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          25-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\25-1.bmp
          • Size 2KB
          • SHA256 1de2dc950007e4862c44193dc37e1aad861e9d35949630e3a6d1247cef4c5941
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          25-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\25-2.bmp
          • Size 2KB
          • SHA256 769922f1bf091061a1ded11903ecbdbf327aa741ce5418bcbe340ff1c9b7b2e8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          25-3.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\25-3.bmp
          • Size 2KB
          • SHA256 69a5fac70ba753bc850cbab54f8c55dd9e40fe6b45d10ac7cfee9dcd30ebe5e9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          3-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\3-1.bmp
          • Size 3KB
          • SHA256 98b285eb57bee3614cec6c1d0037420ac7c5c4e26b6fc20d59572ea9a11cf19a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          3-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\3-2.bmp
          • Size 3KB
          • SHA256 9fc99137a049f69c40050c4d37d51f70e5c15872f6c2886172fb4bd071fc290b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          3-3.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\3-3.bmp
          • Size 3KB
          • SHA256 46193fd3f44fee45b44e5c047f68944ed443717ce7060675992cb21e4ba8f366
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          4-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\4-1.bmp
          • Size 3KB
          • SHA256 25755db2351f0b97f1d90de0b3e5967d73411eb7ae7e8404b3f2f262b1507d57
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          4-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\4-2.bmp
          • Size 3KB
          • SHA256 b396ac8d18adf6288b05b603fe377ec062ef8cc1ae3dac765b17a9662456bf31
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          5-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\5-1.bmp
          • Size 1KB
          • SHA256 50dec083680509b4a2b10266d8366d36e7d044ffa9278b573c5361bcf821b5dd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          5-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\5-2.bmp
          • Size 1KB
          • SHA256 ac57b5eaf87a5f7b4d01cc253bf45afa0d7a7982f1a17bf1fca304fe0fa64af1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          6-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\6-1.bmp
          • Size 3KB
          • SHA256 c359b6f7e6ddb6f4bd9d003ca5df4cf0b2a92d3329d95c023bead0f3b0f8234d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          6-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\6-2.bmp
          • Size 3KB
          • SHA256 174393290f92feacf88f183b1b098c20d8df7f522505b39d6a7d011fcf67c5b7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\7-1.bmp
          • Size 3KB
          • SHA256 14f8e2863fe89119fc146f2b826f66ac1eb84fe90c275d94b428fd259e136195
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\7-2.bmp
          • Size 3KB
          • SHA256 958adf0643d2d66175955a0c450f5775c3c3b23c735ebffd680ed0e58bb583ac
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\8-1.bmp
          • Size 2KB
          • SHA256 e0acaf4e7d595ed260a175375d6893cbeda00357b1e9219624fd7d87a6d7e868
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\8-2.bmp
          • Size 2KB
          • SHA256 9cda34e03deb7d80c5364e9c0d3638282965d894bca88927cde268bf9d7f963a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\9-1.bmp
          • Size 2KB
          • SHA256 d8e86d29c0abd96dc92fdbe4c0b7bf30367401e63ba0c1ee11a9d6f169fca8c5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\9-2.bmp
          • Size 2KB
          • SHA256 53a4c25396160d3cb27d86093acfc43c6f540d8279e4fbad1172c9e784e3b38f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BACK1.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\BACK1.jpg
          • Size 70KB
          • SHA256 ba8e79f436d0fd2419f31ea1c454012152beeef047eee8806a16aaa6708dbe95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Close.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\Close.png
          • Size 2KB
          • SHA256 9340dc31559adcb6c8b6bf29d804decdda0dff9c429b4f8bab555e5df12ec64e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Color.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\Color.png
          • Size 3KB
          • SHA256 cc6acb7e4b6d46638a679e84fc57eb628627b3e0b8ed0d1fcaff0b38141a4f0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Min.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\Min.png
          • Size 1KB
          • SHA256 f5890aa38b08c3c481374f3e7134bd5495acdf03aeac5638a82c5e0d7069c8de
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Setting.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\Setting.png
          • Size 3KB
          • SHA256 609eb9cb9a47104a7e7406a807f6c925d5723ac09b0fb1a3099b184602026b12
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TAB1.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\TAB1.png
          • Size 1KB
          • SHA256 05229ce64196e94737b15fdb7528520c1c38d1c213400b8fbf60b7a374aa5ff7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TAB2.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\TAB2.png
          • Size 2KB
          • SHA256 4aebcf48107c9860780a93c51c7b073dedda1d510cd823d1af3873433ee52817
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TAB3.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\TAB3.png
          • Size 2KB
          • SHA256 f3496619eb3a00113b3136b9aee8c655536a079a02dd8cccd1b2c43b7823c9ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TAB4.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\TAB4.png
          • Size 2KB
          • SHA256 051f3169b18a4270f2ea60bf864bb33f3f555c389a82a6331368b9ea57c2ec6a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TAB5.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\TAB5.png
          • Size 3KB
          • SHA256 4ad11cac7dcb2656ca6329ce4dd26f59393cd172000a30534410438238587abc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TAB6.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\TAB6.png
          • Size 1KB
          • SHA256 d08dc3bf588a456fe88a285b2ffb9f1647af1359bd04c81f370467bd8624e0d6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          logo.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\logo.png
          • Size 20KB
          • SHA256 ac43814e162a722eda6e29e7704ae9cf12b4a7a7de2b29b7fd61410ee77d8c3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          skin.png
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\skin.png
          • Size 3KB
          • SHA256 ae44ed5edb883ff19c6b7e269f8eadbb591a92b21ba04880e3f57605552a9ae2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          smart-1.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\smart-1.bmp
          • Size 96KB
          • SHA256 8ebfdd8accd931ee381d898d0b1018f46eac5417dd8375a049922de5b4f1ecdd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          smart-2.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\smart-2.bmp
          • Size 96KB
          • SHA256 1a583e1f4a6b87ed4e7c19dd91832faeb85c35a54479490fcb78bdbccd819338
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          smart.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\pic\smart.bmp
          • Size 9KB
          • SHA256 8d09d5d58e3fc6fad5bf7ef4323cede12475a66105645589306ed5fe6c43b5b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kms_x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x64\kms_x64.exe
          • Size 2.1MB
          • SHA256 292bf7be646f436ef7cdf2837852d5453d998920099765d22165a29396a94dec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TSforge.exe
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x86\TSforge.exe
          • Size 15KB
          • SHA256 e275f18edc0a85c0112d39382d397afdaae867d5795a9be46470e0feb73db1d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TSforge.exe.config
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\x86\TSforge.exe.config
          • Size 188B
          • SHA256 2571a89bf768dae3c3ca3293aea4243acfcde511e1eddce33bebe4914be37806
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wim.xml
          • Path C:\Users\Admin\AppData\Local\Temp\_temp_heu168yyds\xml\wim.xml
          • Size 9KB
          • SHA256 e3e999580f18ea97f21cca0253685c3a01e885f0bba3a849f1585e74e1414fd9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          autB90.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\autB90.tmp
          • Size 2.4MB
          • SHA256 0bf13267fb26d6c57181a659e9841b9cdd03ec4d22cd4029f5a78c4decbe4e3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          autBEF.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\autBEF.tmp
          • Size 1.1MB
          • SHA256 9a16451c3cd87c9176aa3b68b776b4e9725d55e053d6a913b5bc51348f9f56cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tem3BA8.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tem3BA8.tmp
          • Size 582B
          • SHA256 72f2125b7d6681fa3e6284c64fcf7890f8ee9f7678f6b0a7e77c8d4b25b8a249
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1880-688-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-689-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-725-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-724-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-723-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-339-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-722-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-721-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-720-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-719-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-718-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-717-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-268-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-716-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-715-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-510-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-269-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-670-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-671-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-672-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-674-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-675-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-676-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-677-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-678-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-679-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-680-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-681-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-682-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-683-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-684-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-685-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-686-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-687-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-0-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-714-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-690-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-691-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-692-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-693-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-694-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-695-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-696-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-697-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-698-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-699-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-700-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-701-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-702-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-703-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-704-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-705-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-706-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-707-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-708-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-709-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-710-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-711-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-712-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/1880-713-0x00000000006A0000-0x0000000000FC6000-memory.dmp
          Download

          memory/2620-503-0x0000000000C70000-0x0000000000C7A000-memory.dmp
          Download

          memory/2620-504-0x000000001B6E0000-0x000000001B6FA000-memory.dmp
          Download

          memory/2704-380-0x00000287C74F0000-0x00000287C7516000-memory.dmp
          Download

          memory/2704-378-0x00000287C4520000-0x00000287C4536000-memory.dmp
          Download

          memory/2704-379-0x00000287ABEF0000-0x00000287ABEFA000-memory.dmp
          Download

          memory/2704-371-0x00000287ABF80000-0x00000287ABFA2000-memory.dmp
          Download

          memory/4392-331-0x0000027930F40000-0x0000027930F50000-memory.dmp
          Download

          memory/4392-336-0x0000027930F40000-0x0000027930F50000-memory.dmp
          Download

          memory/4392-332-0x0000027930F40000-0x0000027930F50000-memory.dmp
          Download

          memory/4812-329-0x000001B6A9B10000-0x000001B6A9B20000-memory.dmp
          Download

          memory/4812-330-0x000001B6A9B10000-0x000001B6A9B20000-memory.dmp
          Download

          memory/4812-338-0x000001B6A9B10000-0x000001B6A9B20000-memory.dmp
          Download