50c12ad05321b2a27adfe2fe4e26486b9b41e8a6f9d28d5df01ed8747cd25b88

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe
Size 16.7MB
Sample261102-hdvdma1wcv
SHA256 50c12ad05321b2a27adfe2fe4e26486b9b41e8a6f9d28d5df01ed8747cd25b88
MD5 7a903c4676cf28cf6cbf1f60f9ed30dd
SHA1 51e8ce6cf2c8ef4620f7fbc6ccbd004c39b72e6b
SHA512 75b3f25238fa05fac50adb7c2aaba6b2519238e2928feffb99d72c84badd92692101e251bbd06c5467432912fe143cb6f8d742cc7e3f401d15487fa0e2209583
SSDEEP 393216:yjDzHUrioffrbE/mKfnJebr4tNMLT+9DNPM9M9:yPgnrbEusJQr4kLT+9hPM9k
TLSH
T14807129562B901B8E066D47C89828C5BE9FB7C09173975FB0970F95C1F3FAEA0638E11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4100 created 5932	4100	elevation_service.exe	81

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4340	attrib.exe
5600	attrib.exe

Executes dropped EXE 5 IoCs

pid	Process
5956	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
2684	Unneedednaturals3576.exe
420	Unneedednaturals3576.exe
612	Unneedednaturals3576.exe
2332	Unneedednaturals3576.exe

Loads dropped DLL 4 IoCs

pid	Process
2684	Unneedednaturals3576.exe
420	Unneedednaturals3576.exe
612	Unneedednaturals3576.exe
2332	Unneedednaturals3576.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6016	icacls.exe
4224	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1300	cmd.exe
1220	cmd.exe
2060	cmd.exe
4952	cmd.exe
2512	cmd.exe
5032	cmd.exe
3636	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1696-0-0x0000000000400000-0x0000000000452000-memory.dmp	innosetup
behavioral2/memory/1696-25-0x0000000000400000-0x0000000000452000-memory.dmp	innosetup

GoLang User-Agent 4 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	700	Go-http-client/1.1
HTTP User-Agent header	61	Go-http-client/1.1
HTTP User-Agent header	262	Go-http-client/1.1
HTTP User-Agent header	372	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2688	taskkill.exe
3300	taskkill.exe
4452	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
5956	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
5956	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
2684	Unneedednaturals3576.exe
2684	Unneedednaturals3576.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
5492	waitfor.exe
5492	waitfor.exe
420	Unneedednaturals3576.exe
420	Unneedednaturals3576.exe
5492	waitfor.exe
5492	waitfor.exe
5492	waitfor.exe
612	Unneedednaturals3576.exe
612	Unneedednaturals3576.exe
2332	Unneedednaturals3576.exe
2332	Unneedednaturals3576.exe

Suspicious behavior: MapViewOfSection 1 TTPs 6 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2684	Unneedednaturals3576.exe
4100	elevation_service.exe
4100	elevation_service.exe
420	Unneedednaturals3576.exe
612	Unneedednaturals3576.exe
2332	Unneedednaturals3576.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	3300	taskkill.exe
Token: SeDebugPrivilege	4452	taskkill.exe
Token: SeDebugPrivilege	2684	Unneedednaturals3576.exe
Token: SeShutdownPrivilege	4100	elevation_service.exe
Token: SeShutdownPrivilege	5492	waitfor.exe
Token: SeDebugPrivilege	5492	waitfor.exe
Token: SeDebugPrivilege	5492	waitfor.exe
Token: SeBackupPrivilege	6068	vssvc.exe
Token: SeRestorePrivilege	6068	vssvc.exe
Token: SeAuditPrivilege	6068	vssvc.exe
Token: SeDebugPrivilege	420	Unneedednaturals3576.exe
Token: SeDebugPrivilege	4344	whoami.exe
Token: SeDebugPrivilege	612	Unneedednaturals3576.exe
Token: SeDebugPrivilege	2332	Unneedednaturals3576.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5956	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5492	waitfor.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 5956	1696	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe	89
PID 5956 wrote to memory of 2688	5956	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	90
PID 5956 wrote to memory of 3300	5956	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	93
PID 5956 wrote to memory of 4452	5956	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	95
PID 5956 wrote to memory of 2684	5956	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	97
PID 4100 wrote to memory of 1300	4100	elevation_service.exe	100
PID 1300 wrote to memory of 5492	1300	cmd.exe	102
PID 4100 wrote to memory of 1220	4100	elevation_service.exe	103
PID 5492 wrote to memory of 4492	5492	waitfor.exe	105
PID 1220 wrote to memory of 6016	1220	cmd.exe	106
PID 4100 wrote to memory of 2060	4100	elevation_service.exe	107
PID 4100 wrote to memory of 5600	4100	elevation_service.exe	110
PID 4100 wrote to memory of 4340	4100	elevation_service.exe	112
PID 4100 wrote to memory of 4520	4100	elevation_service.exe	114
PID 5492 wrote to memory of 4584	5492	waitfor.exe	116
PID 4952 wrote to memory of 420	4952	cmd.exe	122
PID 5492 wrote to memory of 2512	5492	waitfor.exe	124
PID 2512 wrote to memory of 916	2512	cmd.exe	125
PID 2512 wrote to memory of 4344	2512	cmd.exe	126
PID 5032 wrote to memory of 612	5032	cmd.exe	129
PID 3636 wrote to memory of 2332	3636	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5600	attrib.exe
4340	attrib.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5932
- C:\Users\Admin\AppData\Local\Temp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe
  "C:\Users\Admin\AppData\Local\Temp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\is-0LO7B.tmp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-0LO7B.tmp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp" /SL5="$40182,17059979,292352,C:\Users\Admin\AppData\Local\Temp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Unneedednaturals3576.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2688
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Unneedednaturals3576.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3300
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Unneedednaturals3576.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4452
  - - C:\Drivers\LucasEvident\Unneedednaturals3576.exe
      "C:\Drivers\LucasEvident\Unneedednaturals3576.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2684
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:4492
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:4584
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:916
    - - C:\Windows\System32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:6016
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  PID:2060
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:4224
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5600
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4340
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn xkMnIkMjiRjMOCxSbLogznQW /tr "cmd /c cd /d \"C:\Drivers\LucasEvident\" && start \"\" \"C:\Drivers\LucasEvident\Unneedednaturals3576.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4520

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:3880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\LucasEvident" && start "" "C:\Drivers\LucasEvident\Unneedednaturals3576.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Drivers\LucasEvident\Unneedednaturals3576.exe
  "C:\Drivers\LucasEvident\Unneedednaturals3576.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:420

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\LucasEvident" && start "" "C:\Drivers\LucasEvident\Unneedednaturals3576.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Drivers\LucasEvident\Unneedednaturals3576.exe
  "C:\Drivers\LucasEvident\Unneedednaturals3576.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:612

C:\Windows\system32\schtasks.exe
schtasks /query /tn xkMnIkMjiRjMOCxSbLogznQW
1⤵
PID:3300

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\LucasEvident" && start "" "C:\Drivers\LucasEvident\Unneedednaturals3576.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Drivers\LucasEvident\Unneedednaturals3576.exe
  "C:\Drivers\LucasEvident\Unneedednaturals3576.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:2332

C:\Windows\system32\schtasks.exe
schtasks /query /tn xkMnIkMjiRjMOCxSbLogznQW
1⤵
PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unneedednaturals3576.exe

Path C:\Drivers\LucasEvident\Unneedednaturals3576.exe
Size 2.5MB
SHA256 8352aa0225b6caa141823edf9da1e6a82cf1b8e54c6b3cabae848605bbe7ac3a
MD5 451eae0ae45a9027f239ffcedb0afb6a
SHA1 608024f42be86c5eee1ef47803e07d39bb839c4a
SHA512 b84fd69f0d110b5a383b5753778ec148f1a018f5f26a66cc2d99f9d697abd14b6e7e6d0c0b8065d5b08184db933120ed30952536b0d63b52a6eb5b59a7dddd19
SSDEEP 49152:JkIe/Smnix+rEPYZL4hRyAlScIt1/hCQZGEAmL:LDooyM/d7O
TLSH
T10DC5499521B801ADE076C57C89858D5BE5FB7C0D173979FB01A0B9581F3FBEA0A38E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UntwistCanola5872.7S

Path C:\Drivers\LucasEvident\UntwistCanola5872.7S
Size 4.4MB
SHA256 f1aba076bead8cf9ef350e7b5579a5d1484e8d7d3df4c8bcba0d47eeaa2dc2af
MD5 2bec92f70fa0afc9508a924c8701680e
SHA1 6858e299b984f3f24e676772427801d0ad1cf4ab
SHA512 56ab6635e868f10cf05f917154605f74ab0b9612153694622e547f668a27164f2f0ffb39fe9398757237e3df4e7d9216f2d729e91653063ee6a6809dcd82bde7
SSDEEP 49152:xFPlwyUQwpNRY2HCOX/tHmBWaPt8ETGuCDxnHdpj:6RQONRY2PtwWM8gG5nHd
TLSH
T10826BF3132016919E06F431AD0B85E1CD6BC6A4D677A5B8C4E63FFE63E56702EB7818C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 15KB
SHA256 e33288b5c547d41b964acb0ca5ab2369f732f9184ae04099c7f178cd0413c74e
MD5 88a35f1c11c145340423ae90dfb666d4
SHA1 dca2c5ac97215b2a73ed9446b3dbb359ecec8105
SHA512 5967416f2bf30c12f30f5e8181d9894d7b3bd5d23473c43c878b532d714f581612578e76bf9b1ca60b8afa61e9ae7a6fbf02cac6dda200180a3c4b6eee75d769
SSDEEP 384:T909NWLjv8FID0TOzFkwNxAwTJljYw1Tl:J09QL8ozFugJpYY
TLSH
T13672CF9B61F6F6521B45E0C0405CE682F2DA1FD67302BC77B2B5920E6DCE3BE5989C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 16KB
SHA256 f89fff307f575fc2fe77cb14d51ed145a69ca4c82a8b867d75780b8b4228fd39
MD5 afd4c5d205da3e28a60295c22adcc6df
SHA1 da3d432753ef6e8707fc447f870725e08ff2aa00
SHA512 51e8861d4d5eea6515748eb775736b0b94c48e74eb03a33833d7aef231fc777d36906a1157837d71fa65a9e4a16eb3fb2437f655e1ba5e08d2e46ab3f7932508
SSDEEP 384:T909NWLjv8FID0TOzFkwNxAwTJljYw1To:J09QL8ozFugJpYL
TLSH
T15472CFDBA1E6F6521B45E0C4405CE682F2D61EC77202BC77B2B5A20E7DCE3AE5999C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 28KB
SHA256 a64a9ba364d8781af5b449face66a16c3453cd6f96a735117ce19ac6496c67e9
MD5 9a95db87bb716ceb7549964ac7c2d29a
SHA1 4c4a1a4133ed12033f6c325e7db16084a82aa2eb
SHA512 19931b71afb7d20690f0d80ce9e1a5ecb48dba2a4d90531ed16457be02ff51277034006f2db11a71dce5aacd1521a37fa2a72ff073ff5b221addc9978a76320e
SSDEEP 768:J09QL8ozFugJpY3dhVfknS/J0XMiLPK1n/fGC2o:JGi80jfShWS/J0X5PKxfF
TLSH
T10AD2D08362E6F345235075C4408CAA90F3C90EDA72416DB376A66A0FBD4D32F9BCED14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 29KB
SHA256 bf649bab3e4680d2090d71393e95753d24bb5468dee7cabfe35d3360f043f1b3
MD5 5acf448b31b8ceb4bb03522638543f30
SHA1 3d5b473238a7b57d2a71e4f04644589c12373af1
SHA512 a27bd3e895e4841ae32c5207c0b98ac7c861e0f792c3fd3aef4b84b63cedfa61f066371aca39eefd359e61e495fa91eb1d81d1fb9427380ebd04f7f8af2369c5
SSDEEP 768:J09QL8ozFugJpY3dhVfknS/J0XMiLPK1n/fGC2ji:JGi80jfShWS/J0X5PKxfCi
TLSH
T1D2D2D08362B6F3412350B5C8508CAAD1F3C80DD632852CB376A66A0EBD4D76FA7CE914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 41KB
SHA256 69d736e315fb9aa62feb3a2b9cfa140686e40cbaf6c5ede77eb1007bd324b4fe
MD5 14267055bd710d7135a0d7a5b8f474ab
SHA1 e0c6916c8787b0c0310102f7a26377786d7a3cdd
SHA512 136041695d12754832c97c85164e20f3810e26a25886e002a4da409627e1085e56b721c5e329d642f2f9fc38e4c390c55fcb41cf702491a8f46dfd858a615da5
SSDEEP 768:J09QL8ozFugJpY3dhVfknS/J0XMiLPK1n/fGC2j+n76AjW1bIN+yIn:JGi80jfShWS/J0X5PKxfC+n7JjwIN+nn
TLSH
T12013E05372B6B7400340A5D8508CE9C1F2C95DC932412DBA7A66A64E7D1EB7FABDED00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 0079d840b60c24f56ddb1b134a5af5bc12c0e3f10aec7272ff729c34c963f321
MD5 c86b553f5323703b01c61fe48a50d414
SHA1 9186eb3c30c20bc31c44579b28ae966ec0712b32
SHA512 bd6d4da5aa5e7cd4bd984523072fb3086c9dfbbb4df6312e4e8addd3ce028146495022c25ca26bbbb5de6eedeb5b38ce5a8cc4ee21d20db6de79d87047e8645d
SSDEEP 768:J09QL8ozFugJpY3dhVfknS/J0XMiLPK1n/fGC2j+n76AjW1bIN+yIQ9JQU:JGi80jfShWS/J0X5PKxfC+n7JjwIN+nE
TLSH
T1EE13E15732A6B640034065D8808CE9C1F2C99DC972411DBB7A66A74E7D0EB3FE7DED00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 55KB
SHA256 5e66329d7fd8c461e98e68264ea935bbc0f63ceefe2d09a0a1045e52120182da
MD5 f225a45bce35c8645437f19643a9b994
SHA1 bb66f9f3f811acd584b00f216950f5308a721de9
SHA512 96958f6aa3b32df8339f37b17e7831fb6e665e15072616362d412dacf8423dde97068c8d4e9df482d565d420d1a608c0aa91a2b7196585f4ee5f65d8a82d1486
SSDEEP 1536:JGi80jfShWS/J0X5PKxfC+n7JjwIN+nQgdLN2cpOTBxGH:Yv0TOWS85MfnysOXdLNfpIe
TLSH
T11643F2273267B2C007506098804CDAD2F2C95DDC32911DFA6A99966D6E5FBBFA7CEC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 3KB
SHA256 6f1ceedcb5fb5ede0f1b9ec3f0ff369a3ed88d0a88523ce63cd12e5f358c3d8e
MD5 18bb32d814a6e52ac96efb545b7bfd7e
SHA1 0833658448e9997bb5a3a0c6ce853b09ba4535d1
SHA512 fbfa1bd02d11221c28eab0438b04b089d8f3cd0aae4bf08df03905fde3b3af4148af8394f6ecfcec35d6c6e1c91f3a2b824b0fa9eb046c8b34a9e313cf8e109a
TLSH
T18E612B51B2E3F2433795E9602018D30075A80A9133D73B63F2A4609D39ED27E2C9AD61
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 76KB
SHA256 823f541447e0c29f1d27ef9751fe6775b473a2dfb9648b487b6f4f5e6f7fd116
MD5 206c0d47e4d8d27d5e149220e39c22be
SHA1 4bb68c5f6a41de18c0a940d830df96a92965f0ae
SHA512 2aa3082977bdc8d018f6ce5bbe63dedfb12cdc38bc3560477ed32efcb40f8bfc0d14f4e9201dd0e16a5c0f7743b6cf0120ba04b67b42312efcbc9875e967f90e
SSDEEP 1536:JGi80jfShWS/J0X5PKxfC+n7JjwIN+nQgdLN2cpOTBxGngwNW61yZWFhQv:Yv0TOWS85MfnysOXdLNfpImrg61yr
TLSH
T16F73012B637B76C0571051688588E981F2C559E873910CBBB7499628BE4FBBFA3CEC44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 104KB
SHA256 53824343e23d4d56b1f937fb4245cba6424b424af5640e6845f93dcb5f6a2b6c
MD5 042fe0f6272d69fe59dbe23b5afc8ae5
SHA1 e5a7790fe42be96d10e4bb539f8f0f333ab2da0e
SHA512 0a58e52fafde1d9f36d56685ca8c43383177f3161d48b14b1afa2fa5d9c8398a4895f305ea32d335d313d81f280751945104a4bd033d63f45b87ea5d5b5ca5a4
SSDEEP 3072:Yv0TOWS85MfnysOXdLNfpImrg61yWjGSVyZLysMe:akHS6NbImP/qSV1e
TLSH
T1AAA3025B66AB72D0579071A088C8FC82F2C154D932821DB76B485619AE4FBFFD7CEC44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 17KB
SHA256 80ce2057d4d683b91c3ee4ece639106a11d191f87809b0940bcfecacdd773b02
MD5 675a026a22672c7b9a2ff94a8b6a418d
SHA1 569c248529e8a1fd352e45d9beab734601ccad26
SHA512 7f7f490e8c37f968036638bed8f3969c891b74e42e9c0ddbedd43f40a978648ab8874651a56d082661a3f36f6c189bcafee9ce023efd5e76f34555c826082f4f
SSDEEP 384:T909NWLjv8FID0TOzFkwNxAwTJljYw1TQn1Hg:J09QL8ozFugJpY3dg
TLSH
T1DB82D0CBA2E1F6521745B1D4404CE6C2F2D11ED77202AC7772A5D20E7D8A3AE5A99C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 28KB
SHA256 e0f45d2889837f4405fe98c28b1ecdd707e8cc06295a0883ed043c06425be263
MD5 d043c539145b5fd883d1714f32459e16
SHA1 c87a61acc2ee9f4141e0cb9c4806f06aa449c47c
SHA512 f4ec0f576548471bd8d5a55372b7fdcc166451f148bbb21b8f3195ee67d504c888e0310fb0cc4f481157dc3e6e122c79340a964233fb645efd5e140b6b4cf9a8
SSDEEP 768:J09QL8ozFugJpY3dhVfknS/J0XMiLPK1BpCzf5o:JGi80jfShWS/J0X5PK4f+
TLSH
T1F1D2D08362E6F345235075C4408CAA90F3C90EDA72416DB376A66A0FBD4D32F9BCED14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 29KB
SHA256 6d4cbcecc6d7ee3c51a40202181a14916cfbb79023fa8de6a5c098a62754a5f9
MD5 52224f18a931baf3a8eac3ca3cb4c162
SHA1 4c146bca6c435a0aa1a4049fa739d16807d4621b
SHA512 7f985898850c825e5a7a2233f4047ff7df2eefc59b98989c493bb85ae8883653c75b24d798ab068e09b7176ccbbbbe287e982c7c2b2b9910a4fa31b5ed9ba056
SSDEEP 768:J09QL8ozFugJpY3dhVfknS/J0XMiLPK1BpCzf5ji:JGi80jfShWS/J0X5PK4fBi
TLSH
T14ED2D08362B6F3412350B5C8508CAAD1F3C80DD632852CB376A66A0EBD4D76FA7CE914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 41KB
SHA256 3ff206702e6e5c9245f70716ad031fe47f94ddf054f1fa286d20217cfecde5af
MD5 d40520ab7d4a728186f64d98a36a492e
SHA1 1444fd5605da31ffebbbbb710dc496fe8fb271c1
SHA512 289874be38a98bbb49d740f7cf338c075cf755b63452bfa38de41f5441971b2859530d570eabc9264e8dab27414ebf27aee1cf2f4afcc9400e4b352f04574337
SSDEEP 768:J09QL8ozFugJpY3dhVfknS/J0XMiLPK1BpCzf5j+n76AjW1bIN+yIn:JGi80jfShWS/J0X5PK4fB+n7JjwIN+nn
TLSH
T16013E05372B6B7400340A5D8508CE9C1F2C95DC932412DBA7A66A64E7D1EB7FABDED00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 2KB
SHA256 6d0616a72451168df11c63820a97e59a9cb1674a033277a07f1b7bf5c09a3a2a
MD5 e78a5d06b1b4a778226940009365dd17
SHA1 078284834829f5c540f77960355e138bda3ab893
SHA512 a4a77a89bfe6dee542b363a45a54ab66d37c335cb8b0afcab26448a03330d4a01d48950735866a68bc037d1ab0c9d998cf2516da43dcd61dfcab75ca0fe3e205
TLSH
T146513951B1E3B2433BA9E6A020089300B59C069177D33A6BF2A4105E78ED37E3C4AD25
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 43KB
SHA256 4829c8e4b7236ee32843cc2e616cf25a0524ab2b0fbbc36e8fb7c7875e6e4252
MD5 6efe147aa5350e08a3c9a203ad436752
SHA1 327e154d7e206da9c2287f12733baecc8d42d18d
SHA512 1a5da7b8a7ad4fab49be11835e5a4b6a02ae17d7c39d8ee3f1b1659539bc64b72489413d6d5ad3ff10d571fa76cc022eb45f5f3716dcf39649e705844a7006c5
SSDEEP 768:J09QL8ozFugJpY3dhVfknS/J0XMiLPK1BpCzf5j+n76AjW1bIN+yIQ9JQU:JGi80jfShWS/J0X5PK4fB+n7JjwIN+nE
TLSH
T11613E15732A6B640034065D8808CE9C1F2C99DC972411DBB7A66A74E7D0EB3FE7DED00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 55KB
SHA256 a23e39012f8b1e7f7d607bd0d04396a7cd0617e993a421ceebdb1a33f70d88b7
MD5 8423a6ec4878360cc11f28ae119d3a58
SHA1 2f1a0ae791b85f0de2e2a42191cb92bd472fc4fb
SHA512 1dc08f518f0c7583cd3bd6016cde24fde7b35a786fc5f724ee78aae7ad1ee5b821b87e576745d6482cda315388ecd150b243bfb1801d83651bd68d86a4a65caf
SSDEEP 1536:JGi80jfShWS/J0X5PK4fB+n7JjwIN+nQgdLN2cpOTBxGH:Yv0TOWS85TfaysOXdLNfpIe
TLSH
T1B343F2273267B2C007506098804CDAD2F2C95DDC32911DFA6A99966D6E5FBBFA7CEC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 748570601de442d58d929a362de15ad31aa262b47b7b64d183e22982907b7a4d
MD5 20bf6db9246c6492277eb2f916b8d079
SHA1 6f8243b94b12d93266ef74ac502c8563f70446d3
SHA512 5a317986aacfaf37e39298932e15557c90594af08fb60f3cb4a6bd3fc35062c8412916b5852ecc8e26a421e18e5915cd4a0da59250478654e9d704bbd8d491da
TLSH
T175817D9472CBB3033BE9E5602418A300B19D05A177D37DB3D3A4608D79ED27E385AE64
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 4KB
SHA256 0adf3109d9ea910c9b375bd692a047197a184f6aa9da3871e1bf42abc26f6e1a
MD5 f9ef5e8215e3c888125b373b0a908038
SHA1 ac6f3ed105007b6394e12849c333f85588189a1d
SHA512 63014116d99f7f68b4ab06fb4f2e44fb7196291c65e07d39a2c1b183084fa92ab25d3663b1a21aaecd63a6518c03ea2a3dd47b354bad6207512ff0260bb70920
SSDEEP 96:Qub9XVFYUGOw6ek8x5228m+IinthwlO424au9GcG:QEVlX96x522N+NnLou4augcG
TLSH
T1ACA16DA572D7B6437FEAF140249CE310B1DD05D5729379B3D2A0208CBAE927E7846EA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 76KB
SHA256 ce4b0af5109b2fc75ed668b6f3a941d1dcdc95a2973d2de086b8adfcb1b9a592
MD5 3f819e4d5effb095348417544e333209
SHA1 1986cdcb1b16134a291cbd9524c5d90ae18836d6
SHA512 880bb31cc0b7bf081ff6d6246ae7b5bd69a7b3fe6c683826b3b6d0cc80c494f4b6c5c399cd348308133e18de7b46872d0c66fd10e31d54ee1ee2f11dbc8dbce6
SSDEEP 1536:JGi80jfShWS/J0X5PK4fB+n7JjwIN+nQgdLN2cpOTBxGngwNW61yZWFhQv:Yv0TOWS85TfaysOXdLNfpImrg61yr
TLSH
T17473012B637B76C0571051688588E981F2C559E873910CBBB7499628BE4FBBFA3CEC44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 104KB
SHA256 7973e82560f542c2366c345de65e74670f42d8b334728b092b914b880093bd80
MD5 b98bc03746049b1e6e0453614d7846e7
SHA1 b5437a5ac9606e2ea635741def8682c56b48e9d8
SHA512 89f2b88b75f3d4bd9c25d74297555cb2c8c4ca9155320434c93a078848ae682162e2a2addd4e1746191e02c9902924403951ffb04881a071f42091317d80680e
SSDEEP 3072:Yv0TOWS85TfaysOXdLNfpImrg61yWjGSVyZLysMe:akHSoNbImP/qSV1e
TLSH
T153A3025B66AB72D0579071A088C8FC82F2C154D932821DB76B485619AE4FBFFD7CEC44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderJamie-3125.WLv2

Path C:\Drivers\grandkidlimiting99\SpiderJamie-3125.WLv2
Size 10.3MB
SHA256 2604761e24c7656dbd77883217eb6131f499c0792863e17c5dbfaedd66208ee0
MD5 69c414daf9537b09ef0395c7509e8442
SHA1 6afb2e678322de1860db6cd1421b7cc95fd2e29e
SHA512 93495652ae6eab038a071045c3e049e348b94598a867f19708c21ec1a1f653257ec32ad7cee14f839b376f024d84db045f18dd91389c27e8d2894cf8b6850401
SSDEEP 196608:0E7P4mMFeJLvS282g/58hhga/LN8pCawXhnrvVHVl4+pHhVIuMG:LbMFeJSZhkjN9frvpVK+MG
TLSH
T148B633BB497810CB6413B2DF526BE74FCF2B6188348AF9D5B39609D877425C85382CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-0LO7B.tmp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
Size 1.3MB
SHA256 0d1e8f273e0cfc9830f586ff1f9d609e5e343e7f3278fac244fe0f9d51067192
MD5 2dcebddd6debdeebbb007275bbdf2274
SHA1 72c0fe4db672eb3c0c5ec3348b55a683914c1262
SHA512 61cc7da92181066bb2b9faf454f38b1304a1a3abccdb61d08adde854894c9364a5131b682c90a687a21f73e99e24e3bce43013e1345968b2c2c11ebc71c6faba
SSDEEP 24576:qEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsytKL/b7x9ln:HdmbjTKlD00tKND
TLSH
T118555C26E7A24533D4732E758C67D16858367E212FB4D48A7EB99F0C4E38B80BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LGI.dat

Path C:\Users\Public\Pictures\Runtime\LGI.dat
Size 32B
SHA256 70847b7984040ea8799807b653d61f973b2bc358bddcdc04e266b0abb653b3f7
MD5 169fd776e0c7bf14f8fc337722386d20
SHA1 45790889d50a53930e017e1669cfaded8a3ef2ac
SHA512 2bc320c7f1040dd8ee2da4569815820395cdce38d5b5afe6495a9405a0bf426214a2b20f9a7a1b7d57d0df872a65bad4109b459a781f04f9b58fe346acac02c2
MD5 SHA1 SHA512

Submit Download

memory/420-513-0x000002A0625A0000-0x000002A0627CC000-memory.dmp

Download

memory/612-741-0x000001B3E79A0000-0x000001B3E7BCC000-memory.dmp

Download

memory/1696-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1696-25-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/2332-970-0x000001729E9D0000-0x000001729EBFC000-memory.dmp

Download

memory/2684-27-0x0000022C74130000-0x0000022C7435C000-memory.dmp

Download

memory/4100-370-0x0000025C128F0000-0x0000025C129DB000-memory.dmp

Download

memory/4100-173-0x0000025C12800000-0x0000025C128E9000-memory.dmp

Download

memory/4100-175-0x0000025C128F0000-0x0000025C129DB000-memory.dmp

Download

memory/4100-200-0x0000025C128F0000-0x0000025C129DB000-memory.dmp

Download

memory/4100-229-0x0000025C128F0000-0x0000025C129DB000-memory.dmp

Download

memory/4100-281-0x0000025C128F0000-0x0000025C129DB000-memory.dmp

Download

memory/5492-315-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-442-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-441-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-440-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-435-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-434-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-321-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-320-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-314-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-287-0x0000020A3CFA0000-0x0000020A40211000-memory.dmp

Download

memory/5492-279-0x0000020A3BD90000-0x0000020A3CF98000-memory.dmp

Download

memory/5956-24-0x0000000000400000-0x0000000000556000-memory.dmp

Download

memory/5956-6-0x0000000002470000-0x0000000002471000-memory.dmp

Download