danabot | 6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe
Size 1.2MB
Sample261108-e5cfcahx7w
SHA256 6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9
MD5 cf11a3ffbec4e1e7fc4719c165dd9377
SHA1 cd1f4af2116be1e655d06d6462ae24f7d96334ee
SHA512 278b94d49788dfbb761b0c72b2e511416d6ad3fc7fd2b5acbd84cb6441e96542a4202a9b83858a08144d03e93a044924709d3fa8fdd4b23e3e7eff885077383f
SSDEEP 12288:6IuINCGGFCZDnisipgOhaVlax1XgsgFik8w+JP/e9qy//bS4+JxBUqkMKUqCuDDy:Puys9p7WhT8H/e9qybStJa0OK
TLSH
T1CF459D16B1F8C3E9F09AD43586A0A705D1FF78672F117E4BC1A4E215EF3A6B02F65260
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion discovery execution danabot persistence trojan upx

Malware Config

Signatures

Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboExt.exe

Downloads MZ/PE file 14 IoCs

flow	pid	Process
23	5600	WinComboExt.exe
25	5600	WinComboExt.exe
27	5600	WinComboExt.exe
9	5600	WinComboExt.exe
13	5600	WinComboExt.exe
28	5600	WinComboExt.exe
30	5600	WinComboExt.exe
32	5600	WinComboExt.exe
34	5600	WinComboExt.exe
11	5600	WinComboExt.exe
15	5600	WinComboExt.exe
17	5600	WinComboExt.exe
19	5600	WinComboExt.exe
21	5600	WinComboExt.exe

Executes dropped EXE 5 IoCs

pid	Process
3668	Security_Module.dat
5600	WinComboExt.exe
3320	WinComboExt.exe
1788	WinComboExt.exe
5592	WinComboExt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinAutoStart = "\"C:\\ProgramData\\Virtual_Windows\\WinComboExt.exe\" "	WinComboExt.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 14 IoCs

execution

Visual Basic

T1059.005

pid	Process
3560	wscript.exe
772	wscript.exe
4664	wscript.exe
5936	wscript.exe
3712	wscript.exe
4144	wscript.exe
5204	wscript.exe
4712	wscript.exe
5104	wscript.exe
2072	wscript.exe
2076	wscript.exe
3140	wscript.exe
1264	wscript.exe
5384	wscript.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 2644	1416	6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe	89
PID 5600 set thread context of 3320	5600	WinComboExt.exe	95
PID 1788 set thread context of 5592	1788	WinComboExt.exe	98

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2644-4-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2644-3-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2644-2-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2644-7-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2644-1-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/2644-0-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/3320-15-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/3320-16-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/3320-14-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/3320-13-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5592-24-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5592-23-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5592-22-0x0000000140000000-0x000000014002C000-memory.dmp	upx
behavioral2/memory/5592-25-0x0000000140000000-0x000000014002C000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinComboExt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinComboExt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinComboExt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinComboExt.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
1788	WinComboExt.exe
1788	WinComboExt.exe
1788	WinComboExt.exe
1788	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5600	WinComboExt.exe
1788	WinComboExt.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5600	WinComboExt.exe
1788	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe
5600	WinComboExt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5600	WinComboExt.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2644	1416	6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe	89
PID 1416 wrote to memory of 2644	1416	6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe	89
PID 1416 wrote to memory of 4184	1416	6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe	90
PID 1416 wrote to memory of 5600	1416	6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe	94
PID 5600 wrote to memory of 3320	5600	WinComboExt.exe	95
PID 5600 wrote to memory of 3320	5600	WinComboExt.exe	95
PID 1788 wrote to memory of 5592	1788	WinComboExt.exe	98
PID 1788 wrote to memory of 5592	1788	WinComboExt.exe	98

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WinComboExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinComboExt.exe

C:\Users\Admin\AppData\Local\Temp\6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe
"C:\Users\Admin\AppData\Local\Temp\6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe
  "C:\Users\Admin\AppData\Local\Temp\6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe"
  2⤵
  PID:2644
- C:\Windows\SYSTEM32\citool.exe
  "citool.exe" -r
  2⤵
  PID:4184
- C:\ProgramData\Virtual_Windows\WinComboExt.exe
  "C:\ProgramData\Virtual_Windows\WinComboExt.exe"
  2⤵
  - UAC bypass
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5600
- - C:\ProgramData\Virtual_Windows\WinComboExt.exe
    "C:\ProgramData\Virtual_Windows\WinComboExt.exe"
    3⤵
    - Executes dropped EXE
    PID:3320

C:\ProgramData\Virtual_Windows\Security_Module.dat
C:\ProgramData\Virtual_Windows\Security_Module.dat
1⤵
- Executes dropped EXE
PID:3668

C:\ProgramData\Virtual_Windows\WinComboExt.exe
"C:\ProgramData\Virtual_Windows\WinComboExt.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1788
- C:\ProgramData\Virtual_Windows\WinComboExt.exe
  "C:\ProgramData\Virtual_Windows\WinComboExt.exe"
  2⤵
  - Executes dropped EXE
  PID:5592

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:772

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5104

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4664

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2072

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2076

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5936

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3712

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4144

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5204

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4712

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3140

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1264

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5384

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2D8C92D0.dat

Path C:\ProgramData\79867305\2D8C92D0.dat
Size 2B
SHA256 e79e418e48623569d75e2a7b09ae88ed9b77b126a445b9ff9dc6989a08efa079
MD5 06d49632c9dc9bcb62aeaef99612ba6b
SHA1 e91fe173f59b063d620a934ce1a010f2b114c1f3
SHA512 849b2f3f63322343fddc5a3c8da8f07e4034ee4d5eb210a5ad9db9e33b6aec18dea81836a87f9226a4636c6c77893b0bd3408f6d1fe225bb0907c556a8111355
MD5 SHA1 SHA512

Submit Download

692FE6C1.exe

Path C:\ProgramData\79867305\692FE6C1.exe
Size 31KB
SHA256 f5163ecb12e440d916b028faa34758a971f2396f12118ca0b40bdaead1108767
MD5 879da6ceee140f0900519b58ba2b135d
SHA1 66ede744b88285e8421f3bad8f3db8fa6e9ecd19
SHA512 203d85368ec0011be4be58ac34eca1f7fc9f3f2ce49c2df5f03cf4b253babe6fdf7b40a735881fa187ce82b3082080ea0d06c78cd6544ab436ee527f905b5a64
SSDEEP 384:zFfOFS0j9hkkh2ysKFQq2EuBORqO6h2I3XMwIYiOJ0Pi7kSJIVE8E9VF0NyFGS:zFEhkk6a+EbRb6cI3UYibPy2EL
TLSH
T12AE24C4DEE65088ADD635538F0E0461FD67572272BA092EF336D82990F437C13B6A39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

692FE6C1.vbs

Path C:\ProgramData\79867305\692FE6C1.vbs
Size 159B
SHA256 7628213bace2bd6dd8d27d49f61ed05a105af1dd731d2a3992158f5ce340af63
MD5 5dfd4b7844ef197f71d16ac01432ee61
SHA1 a5b194a52aad4475f43aca2098646c4ed918b52d
SHA512 bfca1a9bcf6806772363544f92b1b806f1975334c7b9fd14c2f8d8be937784677c1c0c9ddfe196cf088357e1a3e5f0013b9a4295f17405d57bbd403624995368
TLSH
T168C08C82492A8BC6B04B05E40320998C831AE938228C0037E98CC8DE100CA1C32AB3C1
MD5 SHA1 SHA512 TLSH

Submit Download

goufu.txt

Path C:\ProgramData\79867305\goufu.txt
Size 19KB
SHA256 871b494f18d3d59c002c9649b8b1687b4f64221e667766f586295e990e63a997
MD5 28803b727da907eafcb7a6152ad122ae
SHA1 6cd59c739ed4ddb5b8bb037e7b52add47df8e7f1
SHA512 709ab3b55e6bcc2266fcd17a66007c6a2fe95255871966b8564f1031c000632e9efccb92a9f8e50a4835c4d0de93030e8e01998230abfa1212913ffc57f43740
SSDEEP 384:aQPpBUst+AVhzGu5u0egzFyWVjcAhy86PMOOHYbHcUOvn0abovvkJ7nOk3675LtC:auIst+ASUuNgBAfPSvPo0k5dLXxLC
TLSH
T1929218021470C9C2E2797A443D4F519C92DFBE9E07C607B6942C37DEFCA8F2285A5A72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libluajit.dll

Path C:\ProgramData\79867305\libluajit.dll
Size 441KB
SHA256 6b53c5c6890c47de35244d5fba9c33501caa9e4fe2590699ef343d272064f710
MD5 82b9edd1c7e4411b10eb84b4a5b79b53
SHA1 a2f9788e506d344ce194ff1e85394d47ed82a2f4
SHA512 31c0a7114c984602b01afb7b100e5af8d67bcae7d16b60fe7ee270e1b39ae05bc899d89bc97db20e09cb7a8ee1f6d79f4da9c89440684e247b4a19b17c435729
SSDEEP 12288:1pfz+zp9E2Dsv7sm4TwE7asYQsk5HRvh/R:1pfz+DQQm4TwE78u5Hh
TLSH
T17CA45B49A6350969C9A780BC89671E0FDAB6BC4103609BDF17A4B7B71F37BC4163B324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\ProgramData\79867305\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Security_Module.dat

Path C:\ProgramData\Virtual_Windows\Security_Module.dat
Size 293KB
SHA256 2fb6068008c1df7a8687c9880d630b21709905927901a583bf04d24e8b00fef8
MD5 19e4b21665ccdd0286877992cf909bb2
SHA1 625f5d3e7a55f6673eaac9168f9d75218908ce37
SHA512 a6c5f69175d0cda39f564cf6f1eaefdbd67c3bf6488cd72e73539a4e2701a0495dd9e19a50626646e51e26d77d745f23db430a0b3b67f9a108bcaf19728e80ef
SSDEEP 6144:LYLBD0XQUsJhlk4Fw7NzzdqrnHWWJPzzeecqySUFk0r5Bz:LFik8w+JP/e9qy//z
TLSH
T10C54F182579454C1FDD359B0C0B4DA5BAEB3FA531B418ADF02A5C0784EA2BE06E3C5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinComboExt.exe

Path C:\ProgramData\Virtual_Windows\WinComboExt.exe
Size 1.2MB
SHA256 6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9
MD5 cf11a3ffbec4e1e7fc4719c165dd9377
SHA1 cd1f4af2116be1e655d06d6462ae24f7d96334ee
SHA512 278b94d49788dfbb761b0c72b2e511416d6ad3fc7fd2b5acbd84cb6441e96542a4202a9b83858a08144d03e93a044924709d3fa8fdd4b23e3e7eff885077383f
SSDEEP 12288:6IuINCGGFCZDnisipgOhaVlax1XgsgFik8w+JP/e9qy//bS4+JxBUqkMKUqCuDDy:Puys9p7WhT8H/e9qybStJa0OK
TLSH
T1CF459D16B1F8C3E9F09AD43586A0A705D1FF78672F117E4BC1A4E215EF3A6B02F65260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat

Path C:\ProgramData\h_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
Size 4B
SHA256 052de9490317b365d4355fd0e6ea4c540dff6cbc00c8c932f9294870a757a5a3
MD5 c63236e2f516e5f552bfb90e590008e6
SHA1 480e3fa1dc87a5b76aad413f5fffebeb32ae22c0
SHA512 676f9c4c978ee17d5033ef2e49491264c1d9190236cc6c04698a42fdb3fa5de2124c310c80c54279acb8a4b897af5e705a62b29240d6a02e94b6070affb6cfb3
MD5 SHA1 SHA512

Submit Download

s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat

Path C:\ProgramData\s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
Size 817KB
SHA256 ecf870eb81001d048143e14ddea8d88f584a4d4e1e2bc0ebd4f8660090e9d398
MD5 25250562f71dc0217126146313eff0fb
SHA1 d5fc66d9f5c7eb5ef493944e97ce44d9ef330c04
SHA512 f2ccf34d4e40fbe52f17ae7462f03a97ed311a4c7704c788ce8a27c18aca90f5fe1a996908014d61e29051f10733ebc364cbf9a6e4488e8e7bf2979099628660
SSDEEP 12288:+ztuAc8wcI9NBJoKVIfgNM3l01aFqifeBaYs:+ztuAPwNBJo5fCM3lyaFp
TLSH
T1E5056D16A7A500B9E8B7C1388A574E16F7B2B8050364A7DF03A04AEB5F777E05B3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1788-115-0x00007FFD66860000-0x00007FFD66AC3000-memory.dmp

Download

memory/1788-85-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-114-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-94-0x00007FFD66860000-0x00007FFD66AC3000-memory.dmp

Download

memory/1788-95-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-96-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-97-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-98-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-99-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-100-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-102-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-103-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-104-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-105-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-106-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-107-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-101-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/1788-108-0x0000019464360000-0x00000194643FE000-memory.dmp

Download

memory/2644-5-0x000001B6C6250000-0x000001B6C6275000-memory.dmp

Download

memory/2644-4-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2644-0-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2644-2-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2644-7-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2644-6-0x000001B6C7D50000-0x000001B6C7D51000-memory.dmp

Download

memory/2644-3-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/2644-1-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/3320-15-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/3320-16-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/3320-13-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/3320-14-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5592-25-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5592-22-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5592-23-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5592-24-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/5600-58-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-124-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-53-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-52-0x00007FFD66860000-0x00007FFD66AC3000-memory.dmp

Download

memory/5600-65-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-63-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-61-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-60-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-113-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-56-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-54-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-29-0x0000000180000000-0x000000018003A000-memory.dmp

Download

memory/5600-40-0x00007FFD268D0000-0x00007FFD268E0000-memory.dmp

Download

memory/5600-125-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-127-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-123-0x00007FFD66860000-0x00007FFD66AC3000-memory.dmp

Download

memory/5600-126-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-55-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-116-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-117-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-129-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-130-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-134-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-133-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-132-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-131-0x000002665F500000-0x000002665F55C000-memory.dmp

Download

memory/5600-43-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-66-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-64-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-62-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-59-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-57-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download

memory/5600-112-0x000002665F430000-0x000002665F4CE000-memory.dmp

Download