danabot | 4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/11/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe
Size 664KB
Sample261108-d3vy8sty2k
SHA256 4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a
MD5 efb14a9e7ca709321a6a542ec3ce232a
SHA1 b1ec77519c64074eb63b7885a0a19e746806089e
SHA512 5f8208e6a38e640bc75ab82ce762ffdb5cc3d12dac12b23e1eb0d798dcc9f9280fed1e9e8438c8257aa3a731140edd8f6c522febe4e19448de2c6b5697ca6fd0
SSDEEP 12288:FaSEvXdRmb1k0tsqIZ4oOUkBlH7Jr7so0VrbncjM8Vfc8MDXgdLg8kFe9YO7DhDF:FaQk0Gl4ck/H717sN3cjMaf0Z7O715
TLSH
T165E40282EB5240C1E83F96B954395C1560F6FEAF95FCA03B32A6E30144A316B593787F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion discovery execution danabot persistence trojan upx

Malware Config

Signatures

Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboEx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboEx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboEx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboEx.exe

Downloads MZ/PE file 11 IoCs

flow	pid	Process
31	4116	WinComboEx.exe
15	4116	WinComboEx.exe
17	4116	WinComboEx.exe
19	4116	WinComboEx.exe
21	4116	WinComboEx.exe
25	4116	WinComboEx.exe
32	4116	WinComboEx.exe
13	4116	WinComboEx.exe
23	4116	WinComboEx.exe
27	4116	WinComboEx.exe
29	4116	WinComboEx.exe

Executes dropped EXE 5 IoCs

pid	Process
4044	Security_Module.dat
4116	WinComboEx.exe
5408	WinComboEx.exe
3888	WinComboEx.exe
2416	WinComboEx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinAutoStart = "\"C:\\ProgramData\\Virtual_Windows\\WinComboEx.exe\" "	WinComboEx.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 11 IoCs

execution

Visual Basic

T1059.005

pid	Process
1232	wscript.exe
5280	wscript.exe
5860	wscript.exe
4916	wscript.exe
3768	wscript.exe
6068	wscript.exe
5492	wscript.exe
6064	wscript.exe
4212	wscript.exe
1492	wscript.exe
2508	wscript.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4328 set thread context of 2632	4328	4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe	91
PID 4116 set thread context of 5408	4116	WinComboEx.exe	97
PID 3888 set thread context of 2416	3888	WinComboEx.exe	100

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4328-0-0x00007FF699360000-0x00007FF6994B1000-memory.dmp	upx
behavioral2/memory/2632-5-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2632-6-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2632-4-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2632-3-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2632-1-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2632-7-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2632-8-0x00007FF699360000-0x00007FF6994B1000-memory.dmp	upx
behavioral2/memory/4328-11-0x00007FF699360000-0x00007FF6994B1000-memory.dmp	upx
behavioral2/files/0x001100000001c2fb-13.dat	upx
behavioral2/memory/4116-14-0x00007FF6B4410000-0x00007FF6B4561000-memory.dmp	upx
behavioral2/memory/5408-17-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5408-20-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5408-21-0x00007FF6B4410000-0x00007FF6B4561000-memory.dmp	upx
behavioral2/memory/5408-19-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5408-18-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2416-30-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2416-29-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2416-28-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2416-27-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/3888-124-0x00007FF6B4410000-0x00007FF6B4561000-memory.dmp	upx
behavioral2/memory/4116-151-0x00007FF6B4410000-0x00007FF6B4561000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinComboEx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinComboEx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinComboEx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinComboEx.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
3888	WinComboEx.exe
3888	WinComboEx.exe
3888	WinComboEx.exe
3888	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4116	WinComboEx.exe
3888	WinComboEx.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4116	WinComboEx.exe
3888	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe
4116	WinComboEx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4116	WinComboEx.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 2632	4328	4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe	91
PID 4328 wrote to memory of 2632	4328	4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe	91
PID 4328 wrote to memory of 4088	4328	4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe	92
PID 4328 wrote to memory of 4116	4328	4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe	96
PID 4116 wrote to memory of 5408	4116	WinComboEx.exe	97
PID 4116 wrote to memory of 5408	4116	WinComboEx.exe	97
PID 3888 wrote to memory of 2416	3888	WinComboEx.exe	100
PID 3888 wrote to memory of 2416	3888	WinComboEx.exe	100

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboEx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboEx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboEx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboEx.exe

C:\Users\Admin\AppData\Local\Temp\4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe
"C:\Users\Admin\AppData\Local\Temp\4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe
  "C:\Users\Admin\AppData\Local\Temp\4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe"
  2⤵
  PID:2632
- C:\Windows\SYSTEM32\citool.exe
  "citool.exe" -r
  2⤵
  PID:4088
- C:\ProgramData\Virtual_Windows\WinComboEx.exe
  "C:\ProgramData\Virtual_Windows\WinComboEx.exe"
  2⤵
  - UAC bypass
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4116
- - C:\ProgramData\Virtual_Windows\WinComboEx.exe
    "C:\ProgramData\Virtual_Windows\WinComboEx.exe"
    3⤵
    - Executes dropped EXE
    PID:5408

C:\ProgramData\Virtual_Windows\Security_Module.dat
C:\ProgramData\Virtual_Windows\Security_Module.dat
1⤵
- Executes dropped EXE
PID:4044

C:\ProgramData\Virtual_Windows\WinComboEx.exe
"C:\ProgramData\Virtual_Windows\WinComboEx.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3888
- C:\ProgramData\Virtual_Windows\WinComboEx.exe
  "C:\ProgramData\Virtual_Windows\WinComboEx.exe"
  2⤵
  - Executes dropped EXE
  PID:2416

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:6064

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2508

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4212

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1232

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5280

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1492

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5860

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4916

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3768

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:6068

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2D8C92D0.dat

Path C:\ProgramData\79867305\2D8C92D0.dat
Size 2B
SHA256 e79e418e48623569d75e2a7b09ae88ed9b77b126a445b9ff9dc6989a08efa079
MD5 06d49632c9dc9bcb62aeaef99612ba6b
SHA1 e91fe173f59b063d620a934ce1a010f2b114c1f3
SHA512 849b2f3f63322343fddc5a3c8da8f07e4034ee4d5eb210a5ad9db9e33b6aec18dea81836a87f9226a4636c6c77893b0bd3408f6d1fe225bb0907c556a8111355
MD5 SHA1 SHA512

Submit Download

692FE6C1.exe

Path C:\ProgramData\79867305\692FE6C1.exe
Size 31KB
SHA256 f5163ecb12e440d916b028faa34758a971f2396f12118ca0b40bdaead1108767
MD5 879da6ceee140f0900519b58ba2b135d
SHA1 66ede744b88285e8421f3bad8f3db8fa6e9ecd19
SHA512 203d85368ec0011be4be58ac34eca1f7fc9f3f2ce49c2df5f03cf4b253babe6fdf7b40a735881fa187ce82b3082080ea0d06c78cd6544ab436ee527f905b5a64
SSDEEP 384:zFfOFS0j9hkkh2ysKFQq2EuBORqO6h2I3XMwIYiOJ0Pi7kSJIVE8E9VF0NyFGS:zFEhkk6a+EbRb6cI3UYibPy2EL
TLSH
T12AE24C4DEE65088ADD635538F0E0461FD67572272BA092EF336D82990F437C13B6A39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

692FE6C1.vbs

Path C:\ProgramData\79867305\692FE6C1.vbs
Size 159B
SHA256 7628213bace2bd6dd8d27d49f61ed05a105af1dd731d2a3992158f5ce340af63
MD5 5dfd4b7844ef197f71d16ac01432ee61
SHA1 a5b194a52aad4475f43aca2098646c4ed918b52d
SHA512 bfca1a9bcf6806772363544f92b1b806f1975334c7b9fd14c2f8d8be937784677c1c0c9ddfe196cf088357e1a3e5f0013b9a4295f17405d57bbd403624995368
TLSH
T168C08C82492A8BC6B04B05E40320998C831AE938228C0037E98CC8DE100CA1C32AB3C1
MD5 SHA1 SHA512 TLSH

Submit Download

goufu.txt

Path C:\ProgramData\79867305\goufu.txt
Size 19KB
SHA256 871b494f18d3d59c002c9649b8b1687b4f64221e667766f586295e990e63a997
MD5 28803b727da907eafcb7a6152ad122ae
SHA1 6cd59c739ed4ddb5b8bb037e7b52add47df8e7f1
SHA512 709ab3b55e6bcc2266fcd17a66007c6a2fe95255871966b8564f1031c000632e9efccb92a9f8e50a4835c4d0de93030e8e01998230abfa1212913ffc57f43740
SSDEEP 384:aQPpBUst+AVhzGu5u0egzFyWVjcAhy86PMOOHYbHcUOvn0abovvkJ7nOk3675LtC:auIst+ASUuNgBAfPSvPo0k5dLXxLC
TLSH
T1929218021470C9C2E2797A443D4F519C92DFBE9E07C607B6942C37DEFCA8F2285A5A72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libluajit.dll

Path C:\ProgramData\79867305\libluajit.dll
Size 441KB
SHA256 6b53c5c6890c47de35244d5fba9c33501caa9e4fe2590699ef343d272064f710
MD5 82b9edd1c7e4411b10eb84b4a5b79b53
SHA1 a2f9788e506d344ce194ff1e85394d47ed82a2f4
SHA512 31c0a7114c984602b01afb7b100e5af8d67bcae7d16b60fe7ee270e1b39ae05bc899d89bc97db20e09cb7a8ee1f6d79f4da9c89440684e247b4a19b17c435729
SSDEEP 12288:1pfz+zp9E2Dsv7sm4TwE7asYQsk5HRvh/R:1pfz+DQQm4TwE78u5Hh
TLSH
T17CA45B49A6350969C9A780BC89671E0FDAB6BC4103609BDF17A4B7B71F37BC4163B324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\ProgramData\79867305\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Security_Module.dat

Path C:\ProgramData\Virtual_Windows\Security_Module.dat
Size 293KB
SHA256 2fb6068008c1df7a8687c9880d630b21709905927901a583bf04d24e8b00fef8
MD5 19e4b21665ccdd0286877992cf909bb2
SHA1 625f5d3e7a55f6673eaac9168f9d75218908ce37
SHA512 a6c5f69175d0cda39f564cf6f1eaefdbd67c3bf6488cd72e73539a4e2701a0495dd9e19a50626646e51e26d77d745f23db430a0b3b67f9a108bcaf19728e80ef
SSDEEP 6144:LYLBD0XQUsJhlk4Fw7NzzdqrnHWWJPzzeecqySUFk0r5Bz:LFik8w+JP/e9qy//z
TLSH
T10C54F182579454C1FDD359B0C0B4DA5BAEB3FA531B418ADF02A5C0784EA2BE06E3C5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinComboEx.exe

Path C:\ProgramData\Virtual_Windows\WinComboEx.exe
Size 664KB
SHA256 4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a
MD5 efb14a9e7ca709321a6a542ec3ce232a
SHA1 b1ec77519c64074eb63b7885a0a19e746806089e
SHA512 5f8208e6a38e640bc75ab82ce762ffdb5cc3d12dac12b23e1eb0d798dcc9f9280fed1e9e8438c8257aa3a731140edd8f6c522febe4e19448de2c6b5697ca6fd0
SSDEEP 12288:FaSEvXdRmb1k0tsqIZ4oOUkBlH7Jr7so0VrbncjM8Vfc8MDXgdLg8kFe9YO7DhDF:FaQk0Gl4ck/H717sN3cjMaf0Z7O715
TLSH
T165E40282EB5240C1E83F96B954395C1560F6FEAF95FCA03B32A6E30144A316B593787F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat

Path C:\ProgramData\h_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
Size 4B
SHA256 052de9490317b365d4355fd0e6ea4c540dff6cbc00c8c932f9294870a757a5a3
MD5 c63236e2f516e5f552bfb90e590008e6
SHA1 480e3fa1dc87a5b76aad413f5fffebeb32ae22c0
SHA512 676f9c4c978ee17d5033ef2e49491264c1d9190236cc6c04698a42fdb3fa5de2124c310c80c54279acb8a4b897af5e705a62b29240d6a02e94b6070affb6cfb3
MD5 SHA1 SHA512

Submit Download

s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat

Path C:\ProgramData\s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
Size 817KB
SHA256 ecf870eb81001d048143e14ddea8d88f584a4d4e1e2bc0ebd4f8660090e9d398
MD5 25250562f71dc0217126146313eff0fb
SHA1 d5fc66d9f5c7eb5ef493944e97ce44d9ef330c04
SHA512 f2ccf34d4e40fbe52f17ae7462f03a97ed311a4c7704c788ce8a27c18aca90f5fe1a996908014d61e29051f10733ebc364cbf9a6e4488e8e7bf2979099628660
SSDEEP 12288:+ztuAc8wcI9NBJoKVIfgNM3l01aFqifeBaYs:+ztuAPwNBJo5fCM3lyaFp
TLSH
T1E5056D16A7A500B9E8B7C1388A574E16F7B2B8050364A7DF03A04AEB5F777E05B3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-30-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2416-27-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2416-28-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2416-29-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2632-3-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2632-4-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2632-6-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2632-5-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2632-8-0x00007FF699360000-0x00007FF6994B1000-memory.dmp

Download

memory/2632-2-0x0000022688F10000-0x0000022688F11000-memory.dmp

Download

memory/2632-9-0x0000022688DD0000-0x0000022688DF5000-memory.dmp

Download

memory/2632-1-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2632-7-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/3888-108-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-112-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-124-0x00007FF6B4410000-0x00007FF6B4561000-memory.dmp

Download

memory/3888-121-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-122-0x00007FFA53F40000-0x00007FFA541A3000-memory.dmp

Download

memory/3888-92-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-101-0x00007FFA53F40000-0x00007FFA541A3000-memory.dmp

Download

memory/3888-102-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-103-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-104-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-105-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-107-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-106-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-109-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-110-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-115-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-111-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-114-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/3888-113-0x0000020496D90000-0x0000020496E2E000-memory.dmp

Download

memory/4116-59-0x00007FFA53F40000-0x00007FFA541A3000-memory.dmp

Download

memory/4116-72-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-120-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-14-0x00007FF6B4410000-0x00007FF6B4561000-memory.dmp

Download

memory/4116-64-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-50-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-60-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-63-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-65-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-66-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-67-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-68-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-69-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-71-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-61-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-36-0x0000000180000000-0x000000018003A000-memory.dmp

Download

memory/4116-47-0x00007FFA13FB0000-0x00007FFA13FC0000-memory.dmp

Download

memory/4116-70-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-73-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-119-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-62-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-135-0x0000018567530000-0x000001856758C000-memory.dmp

Download

memory/4116-136-0x0000018567530000-0x000001856758C000-memory.dmp

Download

memory/4116-125-0x0000018567450000-0x00000185674EE000-memory.dmp

Download

memory/4116-134-0x0000018567530000-0x000001856758C000-memory.dmp

Download

memory/4116-133-0x0000018567530000-0x000001856758C000-memory.dmp

Download

memory/4116-126-0x0000018567530000-0x000001856758C000-memory.dmp

Download

memory/4116-138-0x0000018567530000-0x000001856758C000-memory.dmp

Download

memory/4116-139-0x0000018567530000-0x000001856758C000-memory.dmp

Download

memory/4116-141-0x0000018567530000-0x000001856758C000-memory.dmp

Download

memory/4116-140-0x0000018567530000-0x000001856758C000-memory.dmp

Download

memory/4116-132-0x00007FFA53F40000-0x00007FFA541A3000-memory.dmp

Download

memory/4116-151-0x00007FF6B4410000-0x00007FF6B4561000-memory.dmp

Download

memory/4328-0-0x00007FF699360000-0x00007FF6994B1000-memory.dmp

Download

memory/4328-11-0x00007FF699360000-0x00007FF6994B1000-memory.dmp

Download

memory/5408-18-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5408-19-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5408-21-0x00007FF6B4410000-0x00007FF6B4561000-memory.dmp

Download

memory/5408-20-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5408-17-0x0000000140000000-0x000000014002C000-memory.dmp

Download