4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/11/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe
Size 1.7MB
Sample261108-e3hvcaxway
SHA256 4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e
MD5 8a03f554f74e136bf50df1c2372674e8
SHA1 57f47f794e222a5f9ceb69aa102f7aab7368d98e
SHA512 c47f59e9726cddcc82ab0058a90b55edbc819ff5b44af2f3d4efed9aef5bc6d72184308db66408ec53ed8880b4e4ba920187c432568868241346d3aeb19b34f4
SSDEEP 24576:/LPMZeO0fWRYfUuyn8/8pUEqnF7pmK/yjbqStJa0://Om5pm8/8pUEqnF7pmK/rS
TLSH
T1E1854C1378BE93CEE604E3360783E141E4EF9DE55F919FC9A0CAC1E5D4693621E942A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboExt.exe

Downloads MZ/PE file 16 IoCs

flow	pid	Process
39	1800	WinComboExt.exe
41	1800	WinComboExt.exe
45	1800	WinComboExt.exe
37	1800	WinComboExt.exe
14	1800	WinComboExt.exe
20	1800	WinComboExt.exe
22	1800	WinComboExt.exe
25	1800	WinComboExt.exe
29	1800	WinComboExt.exe
35	1800	WinComboExt.exe
16	1800	WinComboExt.exe
18	1800	WinComboExt.exe
27	1800	WinComboExt.exe
31	1800	WinComboExt.exe
33	1800	WinComboExt.exe
43	1800	WinComboExt.exe

Executes dropped EXE 5 IoCs

pid	Process
948	Security_Module.dat
1800	WinComboExt.exe
5244	WinComboExt.exe
6056	WinComboExt.exe
3920	WinComboExt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinAutoStart = "\"C:\\ProgramData\\Virtual_Windows\\WinComboExt.exe\" "	WinComboExt.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 17 IoCs

execution

Visual Basic

T1059.005

pid	Process
1488	wscript.exe
4460	wscript.exe
3424	wscript.exe
2892	wscript.exe
3664	wscript.exe
4592	wscript.exe
3240	wscript.exe
5936	wscript.exe
3680	wscript.exe
2508	wscript.exe
1268	wscript.exe
5428	wscript.exe
3684	wscript.exe
5920	wscript.exe
2476	wscript.exe
1496	wscript.exe
2408	wscript.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4328 set thread context of 2780	4328	4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe	89
PID 1800 set thread context of 5244	1800	WinComboExt.exe	95
PID 6056 set thread context of 3920	6056	WinComboExt.exe	98

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2780-4-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2780-7-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2780-3-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2780-1-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2780-0-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2780-2-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5244-14-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5244-16-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5244-15-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5244-13-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/3920-25-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/3920-24-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/3920-23-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/3920-22-0x0000000140000000-0x000000014002C000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinComboExt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinComboExt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinComboExt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinComboExt.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
6056	WinComboExt.exe
6056	WinComboExt.exe
6056	WinComboExt.exe
6056	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1800	WinComboExt.exe
6056	WinComboExt.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1800	WinComboExt.exe
6056	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe
1800	WinComboExt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1800	WinComboExt.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 2780	4328	4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe	89
PID 4328 wrote to memory of 2780	4328	4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe	89
PID 4328 wrote to memory of 4940	4328	4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe	90
PID 4328 wrote to memory of 1800	4328	4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe	94
PID 1800 wrote to memory of 5244	1800	WinComboExt.exe	95
PID 1800 wrote to memory of 5244	1800	WinComboExt.exe	95
PID 6056 wrote to memory of 3920	6056	WinComboExt.exe	98
PID 6056 wrote to memory of 3920	6056	WinComboExt.exe	98

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboExt.exe

C:\Users\Admin\AppData\Local\Temp\4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe
"C:\Users\Admin\AppData\Local\Temp\4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe
  "C:\Users\Admin\AppData\Local\Temp\4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe"
  2⤵
  PID:2780
- C:\Windows\SYSTEM32\citool.exe
  "citool.exe" -r
  2⤵
  PID:4940
- C:\ProgramData\Virtual_Windows\WinComboExt.exe
  "C:\ProgramData\Virtual_Windows\WinComboExt.exe"
  2⤵
  - UAC bypass
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1800
- - C:\ProgramData\Virtual_Windows\WinComboExt.exe
    "C:\ProgramData\Virtual_Windows\WinComboExt.exe"
    3⤵
    - Executes dropped EXE
    PID:5244

C:\ProgramData\Virtual_Windows\Security_Module.dat
C:\ProgramData\Virtual_Windows\Security_Module.dat
1⤵
- Executes dropped EXE
PID:948

C:\ProgramData\Virtual_Windows\WinComboExt.exe
"C:\ProgramData\Virtual_Windows\WinComboExt.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:6056
- C:\ProgramData\Virtual_Windows\WinComboExt.exe
  "C:\ProgramData\Virtual_Windows\WinComboExt.exe"
  2⤵
  - Executes dropped EXE
  PID:3920

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4592

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1488

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5428

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2892

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3240

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4460

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5936

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3684

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5920

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3680

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3664

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2508

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2476

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1268

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1496

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3424

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2D8C92D0.dat

Path C:\ProgramData\79867305\2D8C92D0.dat
Size 2B
SHA256 e79e418e48623569d75e2a7b09ae88ed9b77b126a445b9ff9dc6989a08efa079
MD5 06d49632c9dc9bcb62aeaef99612ba6b
SHA1 e91fe173f59b063d620a934ce1a010f2b114c1f3
SHA512 849b2f3f63322343fddc5a3c8da8f07e4034ee4d5eb210a5ad9db9e33b6aec18dea81836a87f9226a4636c6c77893b0bd3408f6d1fe225bb0907c556a8111355
MD5 SHA1 SHA512

Submit Download

692FE6C1.exe

Path C:\ProgramData\79867305\692FE6C1.exe
Size 31KB
SHA256 f5163ecb12e440d916b028faa34758a971f2396f12118ca0b40bdaead1108767
MD5 879da6ceee140f0900519b58ba2b135d
SHA1 66ede744b88285e8421f3bad8f3db8fa6e9ecd19
SHA512 203d85368ec0011be4be58ac34eca1f7fc9f3f2ce49c2df5f03cf4b253babe6fdf7b40a735881fa187ce82b3082080ea0d06c78cd6544ab436ee527f905b5a64
SSDEEP 384:zFfOFS0j9hkkh2ysKFQq2EuBORqO6h2I3XMwIYiOJ0Pi7kSJIVE8E9VF0NyFGS:zFEhkk6a+EbRb6cI3UYibPy2EL
TLSH
T12AE24C4DEE65088ADD635538F0E0461FD67572272BA092EF336D82990F437C13B6A39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

692FE6C1.vbs

Path C:\ProgramData\79867305\692FE6C1.vbs
Size 159B
SHA256 7628213bace2bd6dd8d27d49f61ed05a105af1dd731d2a3992158f5ce340af63
MD5 5dfd4b7844ef197f71d16ac01432ee61
SHA1 a5b194a52aad4475f43aca2098646c4ed918b52d
SHA512 bfca1a9bcf6806772363544f92b1b806f1975334c7b9fd14c2f8d8be937784677c1c0c9ddfe196cf088357e1a3e5f0013b9a4295f17405d57bbd403624995368
TLSH
T168C08C82492A8BC6B04B05E40320998C831AE938228C0037E98CC8DE100CA1C32AB3C1
MD5 SHA1 SHA512 TLSH

Submit Download

goufu.txt

Path C:\ProgramData\79867305\goufu.txt
Size 19KB
SHA256 871b494f18d3d59c002c9649b8b1687b4f64221e667766f586295e990e63a997
MD5 28803b727da907eafcb7a6152ad122ae
SHA1 6cd59c739ed4ddb5b8bb037e7b52add47df8e7f1
SHA512 709ab3b55e6bcc2266fcd17a66007c6a2fe95255871966b8564f1031c000632e9efccb92a9f8e50a4835c4d0de93030e8e01998230abfa1212913ffc57f43740
SSDEEP 384:aQPpBUst+AVhzGu5u0egzFyWVjcAhy86PMOOHYbHcUOvn0abovvkJ7nOk3675LtC:auIst+ASUuNgBAfPSvPo0k5dLXxLC
TLSH
T1929218021470C9C2E2797A443D4F519C92DFBE9E07C607B6942C37DEFCA8F2285A5A72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libluajit.dll

Path C:\ProgramData\79867305\libluajit.dll
Size 441KB
SHA256 6b53c5c6890c47de35244d5fba9c33501caa9e4fe2590699ef343d272064f710
MD5 82b9edd1c7e4411b10eb84b4a5b79b53
SHA1 a2f9788e506d344ce194ff1e85394d47ed82a2f4
SHA512 31c0a7114c984602b01afb7b100e5af8d67bcae7d16b60fe7ee270e1b39ae05bc899d89bc97db20e09cb7a8ee1f6d79f4da9c89440684e247b4a19b17c435729
SSDEEP 12288:1pfz+zp9E2Dsv7sm4TwE7asYQsk5HRvh/R:1pfz+DQQm4TwE78u5Hh
TLSH
T17CA45B49A6350969C9A780BC89671E0FDAB6BC4103609BDF17A4B7B71F37BC4163B324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\ProgramData\79867305\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Security_Module.dat

Path C:\ProgramData\Virtual_Windows\Security_Module.dat
Size 293KB
SHA256 2fb6068008c1df7a8687c9880d630b21709905927901a583bf04d24e8b00fef8
MD5 19e4b21665ccdd0286877992cf909bb2
SHA1 625f5d3e7a55f6673eaac9168f9d75218908ce37
SHA512 a6c5f69175d0cda39f564cf6f1eaefdbd67c3bf6488cd72e73539a4e2701a0495dd9e19a50626646e51e26d77d745f23db430a0b3b67f9a108bcaf19728e80ef
SSDEEP 6144:LYLBD0XQUsJhlk4Fw7NzzdqrnHWWJPzzeecqySUFk0r5Bz:LFik8w+JP/e9qy//z
TLSH
T10C54F182579454C1FDD359B0C0B4DA5BAEB3FA531B418ADF02A5C0784EA2BE06E3C5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinComboExt.exe

Path C:\ProgramData\Virtual_Windows\WinComboExt.exe
Size 1.7MB
SHA256 4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e
MD5 8a03f554f74e136bf50df1c2372674e8
SHA1 57f47f794e222a5f9ceb69aa102f7aab7368d98e
SHA512 c47f59e9726cddcc82ab0058a90b55edbc819ff5b44af2f3d4efed9aef5bc6d72184308db66408ec53ed8880b4e4ba920187c432568868241346d3aeb19b34f4
SSDEEP 24576:/LPMZeO0fWRYfUuyn8/8pUEqnF7pmK/yjbqStJa0://Om5pm8/8pUEqnF7pmK/rS
TLSH
T1E1854C1378BE93CEE604E3360783E141E4EF9DE55F919FC9A0CAC1E5D4693621E942A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat

Path C:\ProgramData\s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
Size 817KB
SHA256 ecf870eb81001d048143e14ddea8d88f584a4d4e1e2bc0ebd4f8660090e9d398
MD5 25250562f71dc0217126146313eff0fb
SHA1 d5fc66d9f5c7eb5ef493944e97ce44d9ef330c04
SHA512 f2ccf34d4e40fbe52f17ae7462f03a97ed311a4c7704c788ce8a27c18aca90f5fe1a996908014d61e29051f10733ebc364cbf9a6e4488e8e7bf2979099628660
SSDEEP 12288:+ztuAc8wcI9NBJoKVIfgNM3l01aFqifeBaYs:+ztuAPwNBJo5fCM3lyaFp
TLSH
T1E5056D16A7A500B9E8B7C1388A574E16F7B2B8050364A7DF03A04AEB5F777E05B3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1800-43-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-126-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-131-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-133-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-134-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-132-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-130-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-129-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-29-0x0000000180000000-0x000000018003A000-memory.dmp

Download

memory/1800-123-0x00007FFD9EBE0000-0x00007FFD9EE43000-memory.dmp

Download

memory/1800-66-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-55-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-52-0x00007FFD9EBE0000-0x00007FFD9EE43000-memory.dmp

Download

memory/1800-65-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-64-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-63-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-62-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-61-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-60-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-59-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-58-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-57-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-56-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-54-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-53-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-40-0x00007FFD5EC50000-0x00007FFD5EC60000-memory.dmp

Download

memory/1800-71-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-70-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/1800-117-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-125-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-124-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-127-0x000002BD10E50000-0x000002BD10EAC000-memory.dmp

Download

memory/1800-116-0x000002BD10A30000-0x000002BD10ACE000-memory.dmp

Download

memory/2780-2-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2780-7-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2780-6-0x000002E3C1AF0000-0x000002E3C1AF1000-memory.dmp

Download

memory/2780-5-0x000002E3C1580000-0x000002E3C15A5000-memory.dmp

Download

memory/2780-3-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2780-1-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2780-0-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2780-4-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/3920-25-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/3920-24-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/3920-23-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/3920-22-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5244-16-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5244-14-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5244-15-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5244-13-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/6056-105-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-107-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-90-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-101-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-109-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-103-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-102-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-114-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-106-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-112-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-113-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-115-0x00007FFD9EBE0000-0x00007FFD9EE43000-memory.dmp

Download

memory/6056-108-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-110-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-111-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-99-0x00007FFD9EBE0000-0x00007FFD9EE43000-memory.dmp

Download

memory/6056-100-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download

memory/6056-104-0x0000023433EE0000-0x0000023433F7E000-memory.dmp

Download