f6196a80637663db8c0c54a54cc05f37a222e27de70148d713e9e25373741181

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
njCryper.exe
Size 15KB
Sample261107-t251tafd49
SHA256 f6196a80637663db8c0c54a54cc05f37a222e27de70148d713e9e25373741181
MD5 76ff3b075a35aa52cf3733a0a297f210
SHA1 e66ddfe1502b92611ce8a540e3aec94303e60009
SHA512 77c0553d5978ab765d3a704e58e7d3388dfc89b9f1b8392069a20a29d26c2a405fe15e229b1809aca18cabce76e3e69a4ffd301047821ca156bc6765ddd6f651
SSDEEP 192:jp9qLobo6a/wm0gF9LZaHahjlNxTUKRlwY1C6a8mjoQJvygw:jp9Dsh/wm0e9LZaHazNxTBMY1YbJvyg
TLSH
T185621829379C8A27C6BA17325CB3814453B5A9139422DBAF3CCD504B4FB23408762FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4376	222.exe
964	222.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a000000ffffffff	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000009a0ea36ff41dd0183ca165c0742dd015a2d195c0742dd0114000000	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	njCryper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	njCryper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	njCryper.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	njCryper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	njCryper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	njCryper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	njCryper.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	4364	dw20.exe
Token: SeBackupPrivilege	4364	dw20.exe
Token: SeBackupPrivilege	4364	dw20.exe
Token: SeBackupPrivilege	4364	dw20.exe
Token: SeBackupPrivilege	4364	dw20.exe
Token: SeBackupPrivilege	2424	dw20.exe
Token: SeBackupPrivilege	2424	dw20.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	njCryper.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2316	njCryper.exe
2316	njCryper.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 468	2316	njCryper.exe	95
PID 468 wrote to memory of 3156	468	csc.exe	97
PID 4376 wrote to memory of 4364	4376	222.exe	101
PID 964 wrote to memory of 2424	964	222.exe	104

C:\Users\Admin\AppData\Local\Temp\njCryper.exe
"C:\Users\Admin\AppData\Local\Temp\njCryper.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5u0pcfpn.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B0A.tmp" "c:\Users\Admin\Desktop\CSC4B09.tmp"
    3⤵
    PID:3156

C:\Users\Admin\Desktop\222.exe
"C:\Users\Admin\Desktop\222.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 872
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4364

C:\Users\Admin\Desktop\222.exe
"C:\Users\Admin\Desktop\222.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 852
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4B0A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4B0A.tmp
Size 1KB
SHA256 c6ae76651c4b570865befc764b0650313d81adab482650db8c8e5a709d834e64
MD5 1ff91559afa682989ef1368db89039a6
SHA1 33ae985b22f474dab13b460da57c7be67d1ffbc8
SHA512 b73011df544b4b476a51fb39d7536637938638fea43f962522ae03dcbf5dcca52ab94ede0c0261670707cd2ec17e6d194c44e4de7c9abd6a52c98bc1ba15bf80
TLSH
T159214C0953E9470AF0B38731A4FA132B9629FE94DEB2939F85C013191C51510EE71DB2
MD5 SHA1 SHA512 TLSH

Submit Download

222.exe

Path C:\Users\Admin\Desktop\222.exe
Size 3.9MB
SHA256 d53b5e883a87aed5f8a496fd2b235cd5fc93b7dde58cd93ee8765afdafbad096
MD5 08b0370fb2551c0b086abf34e296d0f0
SHA1 948f3a7c4e28c71096633c6be3f8eb2ca28ac55f
SHA512 5836f1a3c32937b5b3d6a0bbcaa3bda1073b086fa103e626c20de1c87c636b73d375cb4933321d735a7c75b08c9526c4128545d51a747ccb2a18faeb6061f19a
SSDEEP 98304:NEFP99UKRfO9OjKDqel8EDAm/xO/wXYSY+al:QoAO9dueGEDAZII/hl
TLSH
T10316331C7A87C515EE0AE332D8CB943F6BD06A8160581F51E525F616B8BE022857FCFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5u0pcfpn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5u0pcfpn.0.cs
Size 1KB
SHA256 d73ff970afb020805ce26a2f85e5526ec50955ee81b9b155a1045f9a66bf7359
MD5 098f746ddbba5ede31eab077f9aef91d
SHA1 7d9c706efa7cfdc75d18b4a1391ac54af61afcc4
SHA512 c75d6be46c03d71a65cd293a4f57c9f0741d924a74cba508f7731e9f1482562843b46a5ebaf9a94f6b3d7d7f74a7a3c572b7e05ab95b4d5028fb5628934bea8f
TLSH
T1A4417F602D5EEB970EB3623BAD22860CFB2641B3929D5B1939CE89018F354545374E5C
MD5 SHA1 SHA512 TLSH

Submit Download

5u0pcfpn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5u0pcfpn.cmdline
Size 271B
SHA256 d93126e689c7495b6af74a9bcb9cb9bf695228158241b6fed610b6f0c3dbb33f
MD5 507888ee7edca97c96f412ec3bae0ade
SHA1 8042cddbeb7bd4493a184902091df3b65b950315
SHA512 d754540719d217170ccd33497981e5ac21dee9e4081234699aaec196ce48b4d0dda36fad0a0091d2c1b50f7bfd973d1c9a4c87451b1a3440187bb6e2f80eed9c
TLSH
T1D5D02B2A126EC79C11E8201750E1C1EC02B24F232C14796495B0840DA5770596FF1B97
MD5 SHA1 SHA512 TLSH

Submit Download

G8HESX1H

Path \??\c:\Users\Admin\AppData\Local\Temp\G8HESX1H
Size 3.9MB
SHA256 7283b68df85e6a73e74f1598702b556e11d048ecbaeb2354e7c2cc9a8ae1bd32
MD5 1238662f03be54a30837780419664d39
SHA1 928ccd9c2de675cc2d7d48bb7015a428e8a83725
SHA512 5b130a59c0fb7a4d8db4708cb91eaeac008e0b61722a85f7cf8f0ae41ae8007cd8b84252b18b8ae6b024847ab4656ff1da230b10da25f7591c19baa5bd08c3d0
SSDEEP 98304:WEFP99UKRfO9OjKDqel8EDAm/xO/wXYSY+al/:ZoAO9dueGEDAZII/hl/
TLSH
T14716331C7D87C515AE0AE222D8CB943F6BD06A81605C1F51E129F616B8BE032857FCFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC4B09.tmp

Path \??\c:\Users\Admin\Desktop\CSC4B09.tmp
Size 628B
SHA256 8809e79341d163ef39e680cdeb0cf76388cd8ac5e20250c7605cd6f43862234a
MD5 893b12cef985df55e33293d1b798e25e
SHA1 e53f43ae7c3c52693f90cb47fddfa8a02d09391a
SHA512 8a4a0563def3aa6c1d55195697855374b37bd34cbcf7982e4497ca0765c436e7a6787bd27e06bb16e952f3394f51ff185871c67c6d8b7e0f57bf85ecbde83882
TLSH
T16AF0584DB3F8120EF0F38B30B9F643639069BCA4DD7293ED98C003092824510AA62EB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-33-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/468-25-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-12-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-17-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-10-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-11-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-0-0x00007FFAB1DD5000-0x00007FFAB1DD6000-memory.dmp

Download

memory/2316-13-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-14-0x00007FFAB1DD5000-0x00007FFAB1DD6000-memory.dmp

Download

memory/2316-15-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-16-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-9-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-18-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-8-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-7-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-6-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-5-0x0000000001210000-0x0000000001218000-memory.dmp

Download

memory/2316-4-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-3-0x000000001B470000-0x000000001B50C000-memory.dmp

Download

memory/2316-2-0x00007FFAB1B20000-0x00007FFAB24C1000-memory.dmp

Download

memory/2316-1-0x000000001BB30000-0x000000001BFFE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads