xworm | e6bd9b2b687e9a2381b43d1fabeca64e5ed727676b5b9470220252e4098a22b6

Resubmissions

06/01/2025, 12:11

250106-pcnm1swlfz

11/06/2024, 17:39

240611-v8d2cavepb10

Analysis

max time kernel
351s
max time network
357s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexus Release.rar
Size 33.1MB
Sample240611-v8d2cavepb
SHA256 e6bd9b2b687e9a2381b43d1fabeca64e5ed727676b5b9470220252e4098a22b6
MD5 ebdab83af835d08bff846224db3f4083
SHA1 88ee2e0c51626b9263835591abdbaa494b7313c0
SHA512 4780d157e7883e604881685c55612ccb21b6a6e85a1cd2141e7a709348c9873dc16bddd04e2bf7cb66cb5458e56ba8b0dafcf8c2d80d5438283ad32acc3df446
SSDEEP 786432:t18J/dtaW3SYkjUjQZfeiQpFryUh5bQxou8MW:tu1tayB9QZFYsUHbQxoKW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

91.92.241.69:5555

Attributes

Install_directory
%ProgramData%
install_file
Windows Runtime.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023281-21.dat	family_xworm
behavioral2/memory/3916-58-0x0000000000260000-0x0000000000278000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4716	powershell.exe
4428	powershell.exe
4712	powershell.exe
3868	powershell.exe
4616	powershell.exe
2588	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Nexus Release V1.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	dllhost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	dllhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	dllhost.exe

Executes dropped EXE 10 IoCs

pid	Process
2204	Nexus Release V1.5.exe
3532	svchost.exe
3916	dllhost.exe
936	nexus.exe
3940	Windows Runtime.exe
5052	Windows Runtime.exe
4368	Windows Runtime.exe
3620	Windows Runtime.exe
5208	Windows Runtime.exe
876	Windows Runtime.exe

Loads dropped DLL 58 IoCs

pid	Process
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe
936	nexus.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Runtime = "C:\\ProgramData\\Windows Runtime.exe"	dllhost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2308	schtasks.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	nexus.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	nexus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	nexus.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	nexus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	nexus.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	nexus.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	nexus.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	nexus.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	nexus.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	nexus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	nexus.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	nexus.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	nexus.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	nexus.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	nexus.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3916	dllhost.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4192	7zFM.exe
4192	7zFM.exe
2588	powershell.exe
2588	powershell.exe
4616	powershell.exe
4616	powershell.exe
2588	powershell.exe
4616	powershell.exe
4428	powershell.exe
4428	powershell.exe
4428	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
3868	powershell.exe
3868	powershell.exe
3868	powershell.exe
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
4192	7zFM.exe
4192	7zFM.exe
4192	7zFM.exe
4192	7zFM.exe
4192	7zFM.exe
4192	7zFM.exe
4192	7zFM.exe
4192	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4192	7zFM.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeRestorePrivilege	4192	7zFM.exe
Token: 35	4192	7zFM.exe
Token: SeSecurityPrivilege	4192	7zFM.exe
Token: SeDebugPrivilege	3916	dllhost.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	936	nexus.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	3916	dllhost.exe
Token: SeDebugPrivilege	3940	Windows Runtime.exe
Token: SeDebugPrivilege	5036	firefox.exe
Token: SeDebugPrivilege	5036	firefox.exe
Token: SeDebugPrivilege	5052	Windows Runtime.exe
Token: SeDebugPrivilege	4368	Windows Runtime.exe
Token: SeDebugPrivilege	3620	Windows Runtime.exe
Token: SeDebugPrivilege	5208	Windows Runtime.exe
Token: SeDebugPrivilege	876	Windows Runtime.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4192	7zFM.exe
4192	7zFM.exe
4192	7zFM.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
936	nexus.exe
5036	firefox.exe
936	nexus.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4192	4664	cmd.exe	92
PID 4664 wrote to memory of 4192	4664	cmd.exe	92
PID 4192 wrote to memory of 2204	4192	7zFM.exe	95
PID 4192 wrote to memory of 2204	4192	7zFM.exe	95
PID 4192 wrote to memory of 2204	4192	7zFM.exe	95
PID 2204 wrote to memory of 2588	2204	Nexus Release V1.5.exe	98
PID 2204 wrote to memory of 2588	2204	Nexus Release V1.5.exe	98
PID 2204 wrote to memory of 2588	2204	Nexus Release V1.5.exe	98
PID 2204 wrote to memory of 4616	2204	Nexus Release V1.5.exe	100
PID 2204 wrote to memory of 4616	2204	Nexus Release V1.5.exe	100
PID 2204 wrote to memory of 4616	2204	Nexus Release V1.5.exe	100
PID 2204 wrote to memory of 3532	2204	Nexus Release V1.5.exe	103
PID 2204 wrote to memory of 3532	2204	Nexus Release V1.5.exe	103
PID 2204 wrote to memory of 3916	2204	Nexus Release V1.5.exe	105
PID 2204 wrote to memory of 3916	2204	Nexus Release V1.5.exe	105
PID 3532 wrote to memory of 936	3532	svchost.exe	109
PID 3532 wrote to memory of 936	3532	svchost.exe	109
PID 936 wrote to memory of 1100	936	nexus.exe	111
PID 936 wrote to memory of 1100	936	nexus.exe	111
PID 3916 wrote to memory of 4428	3916	dllhost.exe	113
PID 3916 wrote to memory of 4428	3916	dllhost.exe	113
PID 3916 wrote to memory of 4712	3916	dllhost.exe	115
PID 3916 wrote to memory of 4712	3916	dllhost.exe	115
PID 3916 wrote to memory of 3868	3916	dllhost.exe	117
PID 3916 wrote to memory of 3868	3916	dllhost.exe	117
PID 3916 wrote to memory of 4716	3916	dllhost.exe	119
PID 3916 wrote to memory of 4716	3916	dllhost.exe	119
PID 3916 wrote to memory of 2308	3916	dllhost.exe	121
PID 3916 wrote to memory of 2308	3916	dllhost.exe	121
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 4248 wrote to memory of 5036	4248	firefox.exe	126
PID 5036 wrote to memory of 4484	5036	firefox.exe	127
PID 5036 wrote to memory of 4484	5036	firefox.exe	127
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128
PID 5036 wrote to memory of 2960	5036	firefox.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Nexus Release.rar"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nexus Release.rar"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Users\Admin\AppData\Local\Temp\7zO06029158\Nexus Release V1.5.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO06029158\Nexus Release V1.5.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAcQBsACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGMAbABkACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcALgBnAGcALwBuAGUAeAB1AHMAbABvAGEAZABlAHIAIABSAHUAbgAgAEEAcwAgAEEAZABtAGkAbgAgAEkAZgAgAEkAbgBqAGUAYwB0AGkAbwBuACAARgBhAGkAbABzACcALAAnACcALAAnAE8ASwAnACwAJwBXAGEAcgBuAGkAbgBnACcAKQA8ACMAdwBmAGMAIwA+AA=="
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2588
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAZABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAcwB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAbABpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGcAegBlACMAPgA="
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4616
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\nexus.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:936
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:1100
  - - C:\Users\Admin\AppData\Local\dllhost.exe
      "C:\Users\Admin\AppData\Local\dllhost.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Runtime.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Runtime.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4716
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Runtime" /tr "C:\ProgramData\Windows Runtime.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3948 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3904

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.0.604749332\2021032944" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd8f4009-0e53-4b58-8f02-b53f4cdb42b9} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 1964 2b3aeef6158 gpu
    3⤵
    PID:4484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.1.1237630913\990609611" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2340 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {159ddc63-cd26-4fac-9a45-258c281ffe25} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 2364 2b3ae833558 socket
    3⤵
    - Checks processor information in registry
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.2.975661154\1526704017" -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 3168 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {550b61b6-bf1b-4c3c-aa1b-5e675cf96fbf} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 3184 2b3b2db0258 tab
    3⤵
    PID:1408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.3.692389746\1724208927" -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3604 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6790311c-772c-4b0c-9158-ca5868f41706} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 3620 2b3a245d958 tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.4.438936832\1632862223" -childID 3 -isForBrowser -prefsHandle 4164 -prefMapHandle 4152 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fbd60dc-8882-4095-bb64-7fff81c145bd} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 4104 2b3b4c0b458 tab
    3⤵
    PID:5292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.5.848401884\464647260" -childID 4 -isForBrowser -prefsHandle 5052 -prefMapHandle 5032 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {096aff5b-c7c2-47e8-984f-5afc74e13e1d} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 5036 2b3b4086658 tab
    3⤵
    PID:5900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.6.728457764\1319917462" -childID 5 -isForBrowser -prefsHandle 5196 -prefMapHandle 5200 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2007c0cf-fc3a-4713-bb3c-ffd8b8509ce2} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 5076 2b3b4f48758 tab
    3⤵
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.7.1887022466\551763573" -childID 6 -isForBrowser -prefsHandle 5384 -prefMapHandle 5388 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a613bda2-5241-46d0-bf28-0a88f6060545} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 5468 2b3b54fce58 tab
    3⤵
    PID:5936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.8.1701822138\253029763" -childID 7 -isForBrowser -prefsHandle 5968 -prefMapHandle 5972 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5df0b48a-4c3b-4d1d-b6fb-be3eabe35680} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 5956 2b3b67df158 tab
    3⤵
    PID:5856

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3904 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
1⤵
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4972 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
1⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4916 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5400 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5688 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
1⤵
PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5632 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
1⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=5476 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
1⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5216 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=5112 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3640

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\5642b5966dee4bfab9e9890e8ef26bcd /t 4504 /p 3008
1⤵
PID:5672

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5208

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

97E21079D4338ED644D10F3CF8B6CCFD6F24DA5D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\97E21079D4338ED644D10F3CF8B6CCFD6F24DA5D
Size 60KB
SHA256 7c2cbdb6884fa92f7a8baf0a6c8b555d1939a9704f1c286ed25f320ae3415c93
MD5 64e2011d92455b4f4dd4948fed8c12c9
SHA1 7aee6f65da14118b4b267f396edf0854c6d4d6e3
SHA512 5428aa7292c29dd5ac812e5d7e024aeaafca5b493a32bf968f5f72c1d65ff419132c4a0fd0998853de6ad4af943bde43aca7c617b107a0a22e44abde7996ec87
SSDEEP 768:j/w9N+gEQgrahBlaeVmo2CgEQqrahBlaeVmo2T7UPFkzudgknkzudgO8eehq4w2j:E9blH7mld3H7mlT06TW6TOaBw2Xz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nexus Release V1.5.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO06029158\Nexus Release V1.5.exe
Size 33.1MB
SHA256 4763f3899de3f06d5598e165404dfb040d86961cb76c82fd153e9f8abff41712
MD5 44222f5b17b3cd5a6e0e9f3a8efce7ca
SHA1 3a7890ff8391ee849158ea1fa3fdd496ec00d3d7
SHA512 757da99975b8ce0efac615aea36d89811d0e3bdb47a94bd261ad28014d82c3d6d0b29ae9462240617fece6bc1686db4ef967faf51253488eccb827e7aa185307
SSDEEP 786432:mEpcxylSTtajAjj5Z2fQjcc54GqesS8sJpodQ+NWtPPAgnCaa:6WKjWO54GqesnssdQpwgnV
MD5 SHA1 SHA512 SSDEEP

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 3dbcb4d0070be355e0406e6b6c3e4ce58647f06e8650e1ab056e1d538b52b3d3
MD5 a442ea85e6f9627501d947be3c48a9dd
SHA1 d2dec6e1be3b221e8d4910546ad84fe7c88a524d
SHA512 850a00c7069ffdba1efe1324405da747d7bd3ba5d4e724d08a2450b5a5f15a69a0d3eaf67cef943f624d52a4e2159a9f7bdaeafdc6c689eacea9987414250f3b
SSDEEP 384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
Size 72KB
SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
MD5 5dd51579fa9b6a06336854889562bec0
SHA1 99c0ed0a15ed450279b01d95b75c162628c9be1d
SHA512 7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e
SSDEEP 1536:LmtpT7zWHzDfLrAe9/s+S+pBm/es6FIABwNyi:qTnzWzrAe9/sT+pBm/X6FIABwp
MD5 SHA1 SHA512 SSDEEP

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md.pyd
Size 10KB
SHA256 9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664
MD5 f33ca57d413e6b5313272fa54dbc8baa
SHA1 4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44
SHA512 f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32
SSDEEP 96:FL8Khp72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFaiHrmHcX6g8cim1qeSC:Zj2HzzU2bRYoe4Hmcqgvimoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

md__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd
Size 117KB
SHA256 ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051
MD5 494f5b9adc1cfb7fdb919c9b1af346e1
SHA1 4a5fddd47812d19948585390f76d5435c4220e6b
SHA512 2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794
SSDEEP 3072:YKBCiXU2SBEUemE+OaOb3OEOz0fEDrF9pQKhN:YJZ2zOfdQKX
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_uidrjq5g.psr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uidrjq5g.psr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 15257e96d1ca8480b8cb98f4c79b6e365fe38a1ba9638fc8c9ab7ffea79c4762
MD5 371776a7e26baeb3f75c93a8364c9ae0
SHA1 bf60b2177171ba1c6b4351e6178529d4b082bda9
SHA512 c23548fbcd1713c4d8348917ff2ab623c404fb0e9566ab93d147c62e06f51e63bdaa347f2d203fe4f046ce49943b38e3e9fa1433f6455c97379f2bc641ae7ce9
SSDEEP 96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Cipher\_raw_cbc.pyd
Size 12KB
SHA256 11dd1b49f70db23617e84e08e709d4a9c86759d911a24ebddfb91c414cc7f375
MD5 20708935fdd89b3eddeea27d4d0ea52a
SHA1 85a9fe2c7c5d97fd02b47327e431d88a1dc865f7
SHA512 f28c31b425dc38b5e9ad87b95e8071997e4a6f444608e57867016178cd0ca3e9f73a4b7f2a0a704e45f75b7dcff54490510c6bf8461f3261f676e9294506d09b
SSDEEP 192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Cipher\_raw_cfb.pyd
Size 13KB
SHA256 faa41385d0db8d4ee2ee74ee540bc879cf2e884bee87655ff3c89c8c517eed45
MD5 43bbe5d04460bd5847000804234321a6
SHA1 3cae8c4982bbd73af26eb8c6413671425828dbb7
SHA512 dbc60f1d11d63bebbab3c742fb827efbde6dff3c563ae1703892d5643d5906751db3815b97cbfb7da5fcd306017e4a1cdcc0cdd0e61adf20e0816f9c88fe2c9b
SSDEEP 192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 61c7a532e108f67874ef2e17244358df19158f6142680f5b21032ba4889ac5d8
MD5 c6b20332b4814799e643badffd8df2cd
SHA1 e7da1c1f09f6ec9a84af0ab0616afea55a58e984
SHA512 d50c7f67d2dfb268ad4cf18e16159604b6e8a50ea4f0c9137e26619fd7835faad323b5f6a2b8e3ec1c023e0678bcbe5d0f867cd711c5cd405bd207212228b2b4
SSDEEP 192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 3e0d07bbf93e0748b42b1c2550f48f0d81597486038c22548224584ae178a543
MD5 fee13d4fb947835dbb62aca7eaff44ef
SHA1 7cc088ab68f90c563d1fe22d5e3c3f9e414efc04
SHA512 dea92f935bc710df6866e89cc6eb5b53fc7adf0f14f3d381b89d7869590a1b0b1f98f347664f7a19c6078e7aa3eb0f773ffcb711cc4275d0ecd54030d6cf5cb2
SSDEEP 96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Cipher\_raw_ofb.pyd
Size 12KB
SHA256 c9f4c5ffcdd4f8814f8c07ce532a164ab699ae8cde737df02d6ecd7b5dd52dbd
MD5 4d9182783ef19411ebd9f1f864a2ef2f
SHA1 ddc9f878b88e7b51b5f68a3f99a0857e362b0361
SHA512 8f983984f0594c2cac447e9d75b86d6ec08ed1c789958afa835b0d1239fd4d7ebe16408d080e7fce17c379954609a93fc730b11be6f4a024e7d13d042b27f185
SSDEEP 192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
MD5 SHA1 SHA512 SSDEEP

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Hash\_BLAKE2s.pyd
Size 14KB
SHA256 fc296145ae46a11c472f99c5be317e77c840c2430fbb955ce3f913408a046284
MD5 9d28433ea8ffbfe0c2870feda025f519
SHA1 4cc5cf74114d67934d346bb39ca76f01f7acc3e2
SHA512 66b4d00100d4143ea72a3f603fb193afa6fd4efb5a74d0d17a206b5ef825e4cc5af175f5fb5c40c022bde676ba7a83087cb95c9f57e701ca4e7f0a2fce76e599
SSDEEP 192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Hash\_SHA1.pyd
Size 19KB
SHA256 a927548abea335e6bcb4a9ee0a949749c9e4aa8f8aad481cf63e3ac99b25a725
MD5 ab0bcb36419ea87d827e770a080364f6
SHA1 6d398f48338fb017aacd00ae188606eb9e99e830
SHA512 3580fb949acee709836c36688457908c43860e68a36d3410f3fa9e17c6a66c1cdd7c081102468e4e92e5f42a0a802470e8f4d376daa4ed7126818538e0bd0bc4
SSDEEP 384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ghash_portable.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Hash\_ghash_portable.pyd
Size 13KB
SHA256 8f3d92de840abb5a46015a8ff618ff411c73009cbaa448ac268a5c619cf84721
MD5 c4cc05d3132fdfb05089f42364fc74d2
SHA1 da7a1ae5d93839577bbd25952a1672c831bc4f29
SHA512 c597c70b7af8e77beeebf10c32b34c37f25c741991581d67cf22e0778f262e463c0f64aa37f92fbc4415fe675673f3f92544e109e5032e488f185f1cfbc839fe
SSDEEP 192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
MD5 SHA1 SHA512 SSDEEP

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Protocol\_scrypt.pyd
Size 12KB
SHA256 b1bab0e04ac60d1e7917621b03a8c72d1ed1f0251334e9fa12a8a1ac1f516529
MD5 ba46602b59fcf8b01abb135f1534d618
SHA1 eff5608e05639a17b08dca5f9317e138bef347b5
SHA512 a5e2771623da697d8ea2e3212fbdde4e19b4a12982a689d42b351b244efba7efa158e2ed1a2b5bc426a6f143e7db810ba5542017ab09b5912b3ecc091f705c6e
SSDEEP 192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 0828cad4d742d97888d3dfce59e82369317847651bba0f166023cb8aca790b2b
MD5 4d9c33ae53b38a9494b6fbfa3491149e
SHA1 1a069e277b7e90a3ab0dcdee1fe244632c9c3be4
SHA512 bdfbf29198a0c7ed69204bf9e9b6174ebb9e3bee297dd1eb8eb9ea6d7caf1cc5e076f7b44893e58ccf3d0958f5e3bdee12bd090714beb5889836ee6f12f0f49e
SSDEEP 96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
MD5 SHA1 SHA512 SSDEEP

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 70d90ddf87a9608699be6bbedf89ad469632fd0adc20a69da07618596d443639
MD5 8f4313755f65509357e281744941bd36
SHA1 2aaf3f89e56ec6731b2a5fa40a2fe69b751eafc0
SHA512 fed2b1007e31d73f18605fb164fee5b46034155ab5bb7fe9b255241cfa75ff0e39749200eb47a9ab1380d9f36f51afba45490979ab7d112f4d673a0c67899ef4
SSDEEP 96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\_bz2.pyd
Size 78KB
SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
MD5 b45e82a398713163216984f2feba88f6
SHA1 eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839
SHA512 b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8
SSDEEP 1536:owz7h8B7BjhJCZePYgIjFNf8AnZydTBIAMVyyw:owz18BrJCJgIHEAodTBIAMVy
MD5 SHA1 SHA512 SSDEEP

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\_cffi_backend.pyd
Size 177KB
SHA256 52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
MD5 ebb660902937073ec9695ce08900b13d
SHA1 881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA512 19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24
SSDEEP 3072:rZ1fKD8GVLHASq0TTjfQxnkVB0hcspEsHS7iiSTLkKetJb9Pu:rZNRGVb9TTCnaZsuMXiSTLLeD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\_hashlib.pyd
Size 57KB
SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
MD5 cfb9e0a73a6c9d6d35c2594e52e15234
SHA1 b86042c96f2ce6d8a239b7d426f298a23df8b3b9
SHA512 22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2
SSDEEP 768:13RNYlTw3glkXa/bNnVXP5ZV17reFyPXS9aEyp6fZIAYIPVDG4ywh2:2TRiXa/bNFLVFPXS93fZIAYI3yz
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\_lzma.pyd
Size 149KB
SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
MD5 5a77a1e70e054431236adb9e46f40582
SHA1 be4a8d1618d3ad11cfdb6a366625b37c27f4611a
SHA512 3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635
SSDEEP 3072:3o6xxrSqs+vs0H0q8bnpbVDbX5AyYCznfo9mNomenNjc3KBIAD15:3o6DrScRLCV3twYOmUQKt
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\_queue.pyd
Size 26KB
SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
MD5 c9ee37e9f3bffd296ade10a27c7e5b50
SHA1 b7eee121b2918b6c0997d4889cff13025af4f676
SHA512 c63bb1b5d84d027439af29c4827fa801df3a2f3d5854c7c79789cad3f5f7561eb2a7406c6f599d2ac553bc31969dc3fa9eef8648bed7282fbc5dc3fb3ba4307f
SSDEEP 384:ztfqkQfrUC+qFYS9F6N76r1PSMYpKnHgEFIAmUJDG4y8YSNhJl:zOrUC+Us6r1PSMjFFIAmUJDG4y4hP
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\_ssl.pyd
Size 152KB
SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
MD5 11c5008e0ba2caa8adf7452f0aaafd1e
SHA1 764b33b749e3da9e716b8a853b63b2f7711fcc7c
SHA512 fceb022d8694bce6504d6b64de4596e2b8252fc2427ee66300e37bcff297579cc7d32a8cb8f847408eaa716cb053e20d53e93fbd945e3f60d58214e6a969c9dd
SSDEEP 3072:wYb/EGIexVYBgWHaCJaLuJ3TE8sOGH70NmHh4kwooSLteSdo9QBIAM73:wY7jIexVYKUazuJMOADtho9QO
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

nexus.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\nexus.exe
Size 37.0MB
SHA256 41f7a63a0f786d751c009fe4b06b7c8755a7aaaf82a252da6878e0a1b967608d
MD5 a7940c3b4fa027664ab5c18bc794bf36
SHA1 b7a678427915eeb55b9da86c057a7fd3d61bdd15
SHA512 30fcc79f07123ac078177a69dc1ae4146934ae6f60e4317ac1183058da26bf69fbf23a4d5d5b1e788253ddfcbd0b8c932a4a41f47d78f8407bc4a14627e9fb1c
SSDEEP 196608:DO1z/dON1XsuNni4lErynr+J366zdYZczo+ucYXBD:IuBTl+67czo9cYX
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\python310.dll
Size 4.2MB
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5
SSDEEP 49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\select.pyd
Size 25KB
SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
MD5 78d421a4e6b06b5561c45b9a5c6f86b1
SHA1 c70747d3f2d26a92a0fe0b353f1d1d01693929ac
SHA512 83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012
SSDEEP 384:XPjk/7e12hwheCZHqh1BeshphFIAmGcDG4y8JAgwhp:fUC2hwh9Hq3rHhFIAmGcDG4yMwh
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\unicodedata.pyd
Size 1.1MB
SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
MD5 a40ff441b1b612b3b9f30f28fa3c680d
SHA1 42a309992bdbb68004e2b6b60b450e964276a8fc
SHA512 5f9142b16ed7ffc0e5b17d6a4257d7249a21061fe5e928d3cde75265c2b87b723b2e7bd3109c30d2c8f83913134445e8672c98c187073368c244a476ac46c3ef
SSDEEP 12288:t0lBMmuZ63N6QCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uUs:ilBuVZV0m81MMREtV6Vo4uYUs
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3532_133626012310114217\vcruntime140.dll
Size 94KB
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path C:\Users\Admin\AppData\Local\dllhost.exe
Size 74KB
SHA256 49c175257966f191a2abce16d8533d359fc27ecf6512da870a9c59937914d5f7
MD5 cc7686bf7c7d81f59196d5cc3cab3348
SHA1 ac39079f223f87d404c421c48239f913b12f00a8
SHA512 940cfb37c1f5e5dbd86cc14d5a0a85dfaf889754051d4fc0d0afbe7bedceaec91b5f36b873b5e24cd081432db1b7d61df72a198681b9ab8e3a9b57197cfb58ae
SSDEEP 1536:IaMDvberZcH8cgbcfXijn1Q6VZAvO1krRCD:2Dva1cWbcPerEO1krRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 5c0f6f17e29d51847d715d9c1fd91edf1d04847184681e13ac2611f5bc1a3c72
MD5 797922be06f08802cceb035fbdd73135
SHA1 7f4c908be0a5b8a1afd2d80a769a44dd933e5c1f
SHA512 4ac07dac164c9bed986360dbfbf9cf99e9a5a87de2434c53541dbb96f120b539901753e7f0a45b49bea9ff730abd67ba501b18ac606a985501da2d5e6f1fbd44
MD5 SHA1 SHA512

Submit Download

59888351-9f26-4666-9a67-ec0352ad4771

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\59888351-9f26-4666-9a67-ec0352ad4771
Size 746B
SHA256 6bdfc34a711a79a90ac07466d41af0db8e5a0d1f0adcb1e8af7f544f2796c9a7
MD5 d2c4841ca759d6621851f1fa1dded68d
SHA1 9bf343a1554ed651c069a8b321f82a5014fd8beb
SHA512 7cbe5002a31c589660d8f5cf48170c9de337363395b3cf1dfd755e3a983ca3f2e4a9e243a26d404e1019e5daa2609f70213485ce04c9cb608ba4a1b7868bce5f
MD5 SHA1 SHA512

Submit Download

74e2ea74-f85a-46b1-afaf-46385da63e7b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\74e2ea74-f85a-46b1-afaf-46385da63e7b
Size 11KB
SHA256 67fc9b778abfa11d98107f38cfa65b297eb26d9db1035cff419a4caf2c872e72
MD5 ca68caa0835d12f3ea1564547523655a
SHA1 7b84765e4f4cc4ac2b8d3bad2ffc488fd6be4f8d
SHA512 309a6107ee296e0dd77dbe7e42fc365804bcf0f8b30ce68091cfbe8f4607de273867d6b41f24df39688a649277d40c13c718e17eaa2826f7ed4cb35609a72f15
SSDEEP 192:7KYkRWHOVGK8zZrHOy7pMiWhBR/aQIj674YPp02zfhJ6+tEb4oQEN8BiwEmOnXAF:OXj0Xk
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 6KB
SHA256 0c0f706fe0a67435c156cef42133eb42ec5f32ad5d8b2d912f3fba3faf5461af
MD5 e3bdaae1726b4ee07c5916aa326abc50
SHA1 7f5054e482db0ae0eb5e1db746e7f4e9799ff2b8
SHA512 fd71d5307b76aa55edd726d5ea1a67223b8fe84b576d7fd81b7dcff61f4c4fe2d4782ab03c0965ccb1c647f5cc67a7ca4ab07709ca1a1ebb6db65f3cdd06693d
SSDEEP 96:xHGgxnUTeqGqpdIle4eOTzSzPXAnpjaHhE2u5DtBBw8H7kL:3xnIRpdIle4exPXThExXBBw8H+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 6KB
SHA256 f734c2d2740c4ca99d2915e110402ba206dd092a52f9e1e0a929c57cf435397d
MD5 a824b6183f387c83f5cf5ae16aa4c1d7
SHA1 89ee5c34f35e21b33e6e0af604ccf45fb8c99e38
SHA512 a7582f489068d20e694e0e2bd34c902c50bfddfed79d75a1ff8759dd046896f1bf192e891f158b67990b606c47950ae5214a5ada1d32657fafefc881c121036e
SSDEEP 96:xHGg5nUTeqGqpdIofeOTzSzPXAnpj/HhE2u5DtABw8H7kW:35nIRpdIofexPX8hExXABw8H3
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Size 6KB
SHA256 b4d3c519dacd10e5319f9c488e5bacf5a36bf35d96a8e6fda0d9d25097aee791
MD5 f90c69d4717cfc81509815c74b81c610
SHA1 de6d0dbc44d8a28e72882675277ec3df990d6c39
SHA512 576fb060425cc03964e14ba5de9580d1e42c11a36711c81fd09d50bd7ede88835f64c0c836d91c68cc5b4b71f034fbc11fbbc17b6023d9c592ea259be5a45f51
SSDEEP 96:xHGg5nUTeqGqpdIle4eOTzSzPXAnpjaHhE2u5DtABw8H7kW:35nIRpdIle4exPXThExXABw8H3
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Size 6KB
SHA256 6e7d7ae2a48fc74fec4017b5b3097a10a72512872b6e413f370e1c21a0567096
MD5 4cf8c9f2f7b551c0a70cbc2efb30233f
SHA1 89d79ec34a9232131a1774bfe50c3f168b385267
SHA512 e592eabfff65070752e98738e4a8aa5f106e74b4ff8e4b0c4b93a766b9676faa090197a8c22c32bdf2055f917ac14227c777b389257556d3c5ff72cccf004e34
SSDEEP 96:xHGg5nUTeqGqpdIofeOTzSZ2PXAnpj/HhE2u5DtABw8V7kW:35nIRpdIofe32PX8hExXABw8V3
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 fc831dd0705be5dd2602f3116e0c9d4effabe48c745210af031b1e4636744de0
MD5 72cc1ca4efbf2fa117f39b766542e130
SHA1 bde456aa2589e2b21895a2fcb87bbed2b1997714
SHA512 51a041f2e917373b822c2a22276d2cf7f6731194f7265b10a4a7cdd0555eef9c2fc23629d77c6a1f4fef065f34926ac426f53cdf94b19372f8da0484cba138b5
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 e1b8535aa67ce7fb569364b43705c5182bbda800fec09a4e4dfe71dacf1ec6ea
MD5 bd64d25001a65a866ae8235695a35461
SHA1 fe580d1166e44ec25149f9e527bf4dddbc0c000e
SHA512 2320f6373e1afe06c83c33a9843fcd6e036090c53d5c9b96af09a7faa930d1e733cbdbec6eb6dc1b3b36ba6df08ad1d593bd824dc107cc6eb3513c046a516d18
SSDEEP 96:ZIqMhRZKk8EMJF7k7aMZk0zf8W8Qge3ZwS2sIP1a0g:ZIqMh3RgFfMZkcuemIMa0g
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 b5df17cf12302b99fd405241d64f606eabc62ace710e8306931df2c27cbcdbf7
MD5 f04511913d0a129652ba436315b09c4b
SHA1 5871a9fe02115a5a2287176bba49193a59e0e287
SHA512 43bd73bb2350f311314344d28c67639f3c642b81bcec28301591b80086dbd54d9f28fb003af5dbddebaaa6e4c3c9ad7293f3da292044ec55e3d09cea891eae3d
SSDEEP 96:jvIqMhRZAMN8EMJF7AOMZk0zf8W8Qge3ZwS28vOTq+JTZ:jvIqMhfNRgFnMZkcuemAvl+JTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 3f67c498ce3fc1bee01523d350c3a47b7b892c22a545048b866953e158c94a9b
MD5 3106089a6dd7cd45ac1f126eb3db97e3
SHA1 f613142ca8772cc34d940ba88c5c5094c9097947
SHA512 443b6c10bc265e1a212008e1713fdaad8b584c14cfd0196e9fcee61cfaba073f1c39a3f59beb025063cd4b8b702b9b66f4ed0550dfb22b731cc3b0369694b29e
SSDEEP 96:jvIqMhRZEMN8EMJF7AOMZk0zf8W8Qge3ZwS28vOTq+JTZ:jvIqMhzNRgFnMZkcuemAvl+JTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore.jsonlz4
Size 4KB
SHA256 58694412d85a076bfad6f1e59b3ff388c13ac81f005b3005afc29f17b052d0c2
MD5 cc1d3393c9d06ab078fd28cb4bbfce17
SHA1 14972870dd983dbfea0693933f499115ee663b7d
SHA512 d69353a8e8318cf2cf4cc3a18f915c18e778f53e3a2258b170a47ce59c9fdf6df90d9eefe2fa4f24577468380af936243686a4120aa93f43f5c42a904f66c691
SSDEEP 96:qIqMhRZ/MN8EMJF7AOMZk0zf8W8Qge3ZwS28oru:qIqMhMNRgFnMZkcuemAoC
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 33.0MB
SHA256 bad905acaa547a246c37c06b39f0d6f473489a6a1900245548a6341a87bb8a77
MD5 28fdeaf0607d576de1b00981421e03c8
SHA1 71cad5e001a788429639eb721585a5cafbff488b
SHA512 915e9867450c4cd78ec42a779f4a53e86e4645a0c6f65a37d6818d086db2bc90afb116786a53daf041277eede1920053d083d548d6ba33314abf095887792bb0
SSDEEP 786432:P4e7SQ07lbcghmYr/6f5FfbWipHqIMy8AZj5HX7kaeVppOh+:Pv7SQ0ZbrUYrefBqUZj5HX7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2588-1139-0x0000000006860000-0x000000000687A000-memory.dmp

Download

memory/2588-1138-0x0000000007C30000-0x00000000082AA000-memory.dmp

Download

memory/2588-82-0x0000000005510000-0x0000000005532000-memory.dmp

Download

memory/2588-1163-0x0000000008860000-0x0000000008E04000-memory.dmp

Download

memory/2588-1164-0x00000000077D0000-0x0000000007862000-memory.dmp

Download

memory/2588-47-0x0000000005540000-0x0000000005B68000-memory.dmp

Download

memory/2588-631-0x0000000005CB0000-0x0000000005CCE000-memory.dmp

Download

memory/2588-673-0x00000000065D0000-0x000000000661C000-memory.dmp

Download

memory/3916-58-0x0000000000260000-0x0000000000278000-memory.dmp

Download

memory/4428-1153-0x000001FB1FE30000-0x000001FB1FE52000-memory.dmp

Download

memory/4616-1152-0x00000000073E0000-0x0000000007483000-memory.dmp

Download

memory/4616-1140-0x00000000071A0000-0x00000000071D2000-memory.dmp

Download

memory/4616-1180-0x0000000007770000-0x000000000777E000-memory.dmp

Download

memory/4616-1167-0x0000000007730000-0x0000000007741000-memory.dmp

Download

memory/4616-1166-0x00000000077C0000-0x0000000007856000-memory.dmp

Download

memory/4616-1165-0x00000000075A0000-0x00000000075AA000-memory.dmp

Download

memory/4616-1193-0x00000000077B0000-0x00000000077B8000-memory.dmp

Download

memory/4616-1151-0x00000000067B0000-0x00000000067CE000-memory.dmp

Download

memory/4616-1191-0x0000000007860000-0x000000000787A000-memory.dmp

Download

memory/4616-1141-0x0000000070B50000-0x0000000070B9C000-memory.dmp

Download

memory/4616-1190-0x0000000007780000-0x0000000007794000-memory.dmp

Download

memory/4616-26-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/4616-102-0x0000000005B00000-0x0000000005B66000-memory.dmp

Download

memory/4616-112-0x0000000005BA0000-0x0000000005C06000-memory.dmp

Download

memory/4616-140-0x0000000005C10000-0x0000000005F64000-memory.dmp

Download