xworm | b895ad7a2e10bc61670d50322612490e99a66cfd95a7a005a7ce5662617083f5

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexus Release/Nexus Release V1.7.exe
Size 20.1MB
Sample240614-v1l2zstdpn
SHA256 14a8a060706a3a20704260d43910fb96a7f727d399b08f946cc9a2db1875ee6e
MD5 253575deb2d3ea6f88d960bdd4199170
SHA1 7e0ecd244840472324d4ebec097c50983ddaec0d
SHA512 5833a87198ba997110f293a251394870035f247ba3aea4af6782ce5e1ae4dd5e8e163ccb53713435fe5b9e832bba5d23b3261b9e07a73e60bcd5bf622bd782e4
SSDEEP 393216:yuxL64bjP10Io0Yl/fsQ1s3dKHg8rYT3mH8Ac7wzli5fxslEe8OqF0EaVr5tye:RxPvW70YltWf8MT2HvcMzlcpsme8OqFO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

91.92.241.69:5555

Attributes

Install_directory
%ProgramData%
install_file
Windows Runtime.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/files/0x000c0000000233be-4.dat	family_xworm
behavioral4/memory/4712-12-0x00000000007D0000-0x00000000007E8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5056	powershell.exe
1156	powershell.exe
4864	powershell.exe
4924	powershell.exe
2964	powershell.exe
2264	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Nexus Release V1.7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	dllhost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	dllhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	dllhost.exe

Executes dropped EXE 5 IoCs

pid	Process
4712	dllhost.exe
2524	Nexus Loader.exe
2052	.exe
60	Windows Runtime.exe
5968	Windows Runtime.exe

Loads dropped DLL 18 IoCs

pid	Process
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe
2052	.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Runtime = "C:\\ProgramData\\Windows Runtime.exe"	dllhost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
64	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4712	dllhost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2264	powershell.exe
2964	powershell.exe
2964	powershell.exe
2264	powershell.exe
5056	powershell.exe
5056	powershell.exe
1156	powershell.exe
1156	powershell.exe
4864	powershell.exe
4864	powershell.exe
4924	powershell.exe
4924	powershell.exe
2152	msedge.exe
2152	msedge.exe
1848	msedge.exe
1848	msedge.exe
4864	identity_helper.exe
4864	identity_helper.exe
2304	msedge.exe
2304	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	dllhost.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4712	dllhost.exe
Token: SeDebugPrivilege	60	Windows Runtime.exe
Token: SeDebugPrivilege	5968	Windows Runtime.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 2264	4220	Nexus Release V1.7.exe	84
PID 4220 wrote to memory of 2264	4220	Nexus Release V1.7.exe	84
PID 4220 wrote to memory of 2264	4220	Nexus Release V1.7.exe	84
PID 4220 wrote to memory of 2964	4220	Nexus Release V1.7.exe	85
PID 4220 wrote to memory of 2964	4220	Nexus Release V1.7.exe	85
PID 4220 wrote to memory of 2964	4220	Nexus Release V1.7.exe	85
PID 4220 wrote to memory of 4712	4220	Nexus Release V1.7.exe	88
PID 4220 wrote to memory of 4712	4220	Nexus Release V1.7.exe	88
PID 4220 wrote to memory of 2524	4220	Nexus Release V1.7.exe	89
PID 4220 wrote to memory of 2524	4220	Nexus Release V1.7.exe	89
PID 2524 wrote to memory of 2052	2524	Nexus Loader.exe	90
PID 2524 wrote to memory of 2052	2524	Nexus Loader.exe	90
PID 4712 wrote to memory of 5056	4712	dllhost.exe	92
PID 4712 wrote to memory of 5056	4712	dllhost.exe	92
PID 4712 wrote to memory of 1156	4712	dllhost.exe	94
PID 4712 wrote to memory of 1156	4712	dllhost.exe	94
PID 4712 wrote to memory of 4864	4712	dllhost.exe	96
PID 4712 wrote to memory of 4864	4712	dllhost.exe	96
PID 4712 wrote to memory of 4924	4712	dllhost.exe	99
PID 4712 wrote to memory of 4924	4712	dllhost.exe	99
PID 4712 wrote to memory of 64	4712	dllhost.exe	102
PID 4712 wrote to memory of 64	4712	dllhost.exe	102
PID 1848 wrote to memory of 4280	1848	msedge.exe	111
PID 1848 wrote to memory of 4280	1848	msedge.exe	111
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113
PID 1848 wrote to memory of 3680	1848	msedge.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nexus Release\Nexus Release V1.7.exe
"C:\Users\Admin\AppData\Local\Temp\Nexus Release\Nexus Release V1.7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZABrACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHMAdABtACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcALgBnAGcALwBuAGUAeAB1AHMAbABvAGEAZABlAHIAIABSAHUAbgAgAEEAcwAgAEEAZABtAGkAbgAgAEkAZgAgAEkAbgBqAGUAYwB0AGkAbwBuACAARgBhAGkAbABzACcALAAnACcALAAnAE8ASwAnACwAJwBXAGEAcgBuAGkAbgBnACcAKQA8ACMAeQBmAGIAIwA+AA=="
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAZwBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AeAB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AZABhACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAZQByACMAPgA="
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Users\Admin\AppData\Roaming\dllhost.exe
  "C:\Users\Admin\AppData\Roaming\dllhost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Runtime.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Runtime.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Runtime" /tr "C:\ProgramData\Windows Runtime.exe"
    3⤵
    - Creates scheduled task(s)
    PID:64
- C:\Users\Admin\AppData\Local\Temp\Nexus Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Nexus Loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexus Loader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa917946f8,0x7ffa91794708,0x7ffa91794718
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,17060525219548835932,52234200561945233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,17060525219548835932,52234200561945233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,17060525219548835932,52234200561945233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,17060525219548835932,52234200561945233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,17060525219548835932,52234200561945233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,17060525219548835932,52234200561945233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,17060525219548835932,52234200561945233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,17060525219548835932,52234200561945233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,17060525219548835932,52234200561945233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2964

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2466b996hcd5fh4417hb457he376ef39d8d9
1⤵
PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa917946f8,0x7ffa91794708,0x7ffa91794718
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4671106648085332184,11541174016147270810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,4671106648085332184,11541174016147270810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,4671106648085332184,11541174016147270810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:5372

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4b48ea36c64ff28165de2e6a46aacab9cf3425632330fe052332c3903a93e35d
MD5 f63324df07230038a686a2e9af6dbc7a
SHA1 070f016ca5e73a6a4383101c8a779dd0e0415a0f
SHA512 b12d7e8b09d6a33309b77cf6036aed75f80c2b7d5e8bbbaa4aad96797096541c5a6437e6e5a86bccbeef06c1a0b6da94d1d45107e89550f0c3a675f7a9ff7aba
SSDEEP 96:nrk+s1hJamwpvWMoiVmdeHBrzmUWQyV+VDCziEwb:nrk7zJamGWMXsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c1246661a406eb61f31e85f6cb63fde4209c76c7b1ac84a8887d95fd3b4a137d
MD5 327694fda9af9da41246b78781f80ed9
SHA1 272e6d2969b1d9e0c1770fb287764a74056a590c
SHA512 a0ec03d75164e0644c3c5f22e624201d8a369da889f80ec70b491aea16b1f825456dc0df1438eb53ffcf03a41b068da87d2bd10e0fd41a51d4cdd143c788a830
SSDEEP 96:nrkUs1hJamwpvWMoiVmdeHBrAgOryWQyV+VD7AiEwb:nrkFzJamGWMXrOrlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 28584e61534e7c6ec6665aa11d0a9d29619512ddef86bf4873e957818c9c4dca
MD5 ab53a1accbcab185c17538bd189ef026
SHA1 5b95c2881a7384ec6dfd5c75e020005c0c459878
SHA512 f63c2665df20a219e493bd2987992ff8b5c79f682dfce3afb86ba76dc217a9a047fb57869aabe6190d59589bb090bad1261d8a874c8813540e3f3d3b4733e586
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyHce2RU2Mj2J:A9iIxuERzA83h09RZxYyHCSyJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c4c0e23a4a989f33c07a3e3756835ad842b2d3bed0a876a1071f476a21ce4e70
MD5 ecd3ff3feeb64d7b3c8609bb791aab56
SHA1 78c99c8ff4d65863129fdd9bc0f5d96f7818ea82
SHA512 447664ac5c82a979f7d3dfdb18d709311ef115cf9a7ad51182929fe0b85ed4efe5397a94853708625cc5ac5e92b93290a20de58f58babdb7941a35c7fe5e9b25
SSDEEP 192:ToCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyHce2RU6Mj2K:z9iIxuERzA83h09RZxYyHCAyK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nexus Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Nexus Loader.exe
Size 20.0MB
SHA256 3538442d351366138a18f11275a3c74bea4eba45098a69af06cd62bb760a4291
MD5 b2dd28aba29ed0b482ea9943a5c84fa8
SHA1 83e2bec7caecfb7db2c3f21969347f022e1405d8
SHA512 3b8d469dc1323d620f52819b87e9bb7fd3cb032b60980bbf5cfc6b050df85fe64bc3eaa3e9951a7f6dc3cb1f0798c13516df3c6f61baf4b948406dc4bcd1bb27
SSDEEP 393216:fG6wtDLEYyHoG5BtAkClT+x72IjN0+v4aRhzZD0DopS1e1/sfFk1YiwStC:+6wRLEYtqtABlaxyC0+Lht0Doce1/cks
MD5 SHA1 SHA512 SSDEEP

Submit Download

_imaging.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PIL\_imaging.pyd
Size 2.2MB
SHA256 88718894be067dd54e7e07d4dffa8dfc39bed02de65ff92dc5922b2ad2407995
MD5 1d4aaaf3c2e8dbf96a39ddb901cdda82
SHA1 cf316bf88bfa0c6b207293533f1d2cecbd95e2d4
SHA512 e88c1f6507faa883f543d47e892f6a20b6547b29883982550d6772a742510b7570fe47f912da3630ec870669e07773ec4a3d1c38962cebf63bce23b9ac55efbe
SSDEEP 49152:So44Y8XtYnMa9lEIUQbqv4Q0QJmstacj:SEJQbqv4Q0Q1
MD5 SHA1 SHA512 SSDEEP

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_tkinter.pyd
Size 60KB
SHA256 336bd5bffdc0229da4eaddbb0cfc42a9e55459a40e1322b38f7e563bda8dd190
MD5 0f1aa5b9a82b75b607b4ead6bb6b8be6
SHA1 5d58fd899018a106d55433ea4fcb22faf96b4b3d
SHA512 b32ea7d3ed9ae3079728c7f92e043dd0614a4da1dbf40ae3651043d35058252187c3c0ad458f4ca79b8b006575fac17246fb33329f7b908138f5de3c4e9b4e52
SSDEEP 768:e9k8DRvbV/VKfBvrUx/l93WDtbBZeaWDyms5fTabInhkz0/AAZIAYSADG4yI8h:e1RvtV+BcAeaas5fuUnheurZIAYSMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
Size 25KB
SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
MD5 78d421a4e6b06b5561c45b9a5c6f86b1
SHA1 c70747d3f2d26a92a0fe0b353f1d1d01693929ac
SHA512 83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012
SSDEEP 384:XPjk/7e12hwheCZHqh1BeshphFIAmGcDG4y8JAgwhp:fUC2hwh9Hq3rHhFIAmGcDG4yMwh
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
Size 1.1MB
SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
MD5 a40ff441b1b612b3b9f30f28fa3c680d
SHA1 42a309992bdbb68004e2b6b60b450e964276a8fc
SHA512 5f9142b16ed7ffc0e5b17d6a4257d7249a21061fe5e928d3cde75265c2b87b723b2e7bd3109c30d2c8f83913134445e8672c98c187073368c244a476ac46c3ef
SSDEEP 12288:t0lBMmuZ63N6QCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uUs:ilBuVZV0m81MMREtV6Vo4uYUs
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_bksag3gr.wer.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bksag3gr.wer.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\.exe
Size 25.0MB
SHA256 3c305961fa7fa5ca379f06003c96986b2596734297b13e9671b9bb4f800992e1
MD5 05940e4570597685a3525a69d0677faf
SHA1 f514b6c95900b9815b2f28dfadb7cdf0514459cb
SHA512 d31c5c61f8fd0f633471b01c0c0f9eda3b2045d3cad0acc131dc62713c5efd4105d24b4cda2a61427987429a2f47c9a0d44a4fe1a794dd306e8de5c1c6ae1355
SSDEEP 98304:hwjoTC0hSvNZEmI4K9OtI/PmGOAPVizmY7lmYNF3SuxfmCaIczn1uerwLofxbGwQ:mkO0J4zM0zmkmYNYuxZ3cz1huc4X
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\VCRUNTIME140.dll
Size 94KB
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\_bz2.pyd
Size 78KB
SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
MD5 b45e82a398713163216984f2feba88f6
SHA1 eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839
SHA512 b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8
SSDEEP 1536:owz7h8B7BjhJCZePYgIjFNf8AnZydTBIAMVyyw:owz18BrJCJgIHEAodTBIAMVy
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\_hashlib.pyd
Size 57KB
SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
MD5 cfb9e0a73a6c9d6d35c2594e52e15234
SHA1 b86042c96f2ce6d8a239b7d426f298a23df8b3b9
SHA512 22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2
SSDEEP 768:13RNYlTw3glkXa/bNnVXP5ZV17reFyPXS9aEyp6fZIAYIPVDG4ywh2:2TRiXa/bNFLVFPXS93fZIAYI3yz
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\_lzma.pyd
Size 149KB
SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
MD5 5a77a1e70e054431236adb9e46f40582
SHA1 be4a8d1618d3ad11cfdb6a366625b37c27f4611a
SHA512 3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635
SSDEEP 3072:3o6xxrSqs+vs0H0q8bnpbVDbX5AyYCznfo9mNomenNjc3KBIAD15:3o6DrScRLCV3twYOmUQKt
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\_queue.pyd
Size 26KB
SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
MD5 c9ee37e9f3bffd296ade10a27c7e5b50
SHA1 b7eee121b2918b6c0997d4889cff13025af4f676
SHA512 c63bb1b5d84d027439af29c4827fa801df3a2f3d5854c7c79789cad3f5f7561eb2a7406c6f599d2ac553bc31969dc3fa9eef8648bed7282fbc5dc3fb3ba4307f
SSDEEP 384:ztfqkQfrUC+qFYS9F6N76r1PSMYpKnHgEFIAmUJDG4y8YSNhJl:zOrUC+Us6r1PSMjFFIAmUJDG4y4hP
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\_socket.pyd
Size 72KB
SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
MD5 5dd51579fa9b6a06336854889562bec0
SHA1 99c0ed0a15ed450279b01d95b75c162628c9be1d
SHA512 7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e
SSDEEP 1536:LmtpT7zWHzDfLrAe9/s+S+pBm/es6FIABwNyi:qTnzWzrAe9/sT+pBm/X6FIABwp
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\_ssl.pyd
Size 152KB
SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
MD5 11c5008e0ba2caa8adf7452f0aaafd1e
SHA1 764b33b749e3da9e716b8a853b63b2f7711fcc7c
SHA512 fceb022d8694bce6504d6b64de4596e2b8252fc2427ee66300e37bcff297579cc7d32a8cb8f847408eaa716cb053e20d53e93fbd945e3f60d58214e6a969c9dd
SSDEEP 3072:wYb/EGIexVYBgWHaCJaLuJ3TE8sOGH70NmHh4kwooSLteSdo9QBIAM73:wY7jIexVYKUazuJMOADtho9QO
MD5 SHA1 SHA512 SSDEEP

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\charset_normalizer\md.pyd
Size 10KB
SHA256 9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664
MD5 f33ca57d413e6b5313272fa54dbc8baa
SHA1 4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44
SHA512 f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32
SSDEEP 96:FL8Khp72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFaiHrmHcX6g8cim1qeSC:Zj2HzzU2bRYoe4Hmcqgvimoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

md__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\charset_normalizer\md__mypyc.pyd
Size 117KB
SHA256 ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051
MD5 494f5b9adc1cfb7fdb919c9b1af346e1
SHA1 4a5fddd47812d19948585390f76d5435c4220e6b
SHA512 2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794
SSDEEP 3072:YKBCiXU2SBEUemE+OaOb3OEOz0fEDrF9pQKhN:YJZ2zOfdQKX
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\python310.dll
Size 4.2MB
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5
SSDEEP 49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl86t.dll
Size 1.8MB
SHA256 224476bedbcf121c69137f1df4dd025ae81769b2f7651bd3788a870a842cfbf9
MD5 ad03d1e9f0121330694415f901af8f49
SHA1 ad8d3eee5274fef8bb300e2d1f4a11e27d3940df
SHA512 19b85c010c98fa75eacfd0b86f9c90a2dbf6f07a2b3ff5b4120108f3c26711512edf2b875a782497bdb3d28359325ad95c17951621c4b9c1fd692fde26b77c33
SSDEEP 24576:Lldauo6HQOZaWxCAnNDyY1vFsrOlwtJ6i/eFrrklM8Rc50mWszkwjLYfMiHrrTeC:Lld9QVyFrcM8RcxkwfGMiLrTzrSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

msgcat-1.6.1.tm

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl8\8.5\msgcat-1.6.1.tm
Size 33KB
SHA256 4fdf70fdcedef97aa8bd82a02669b066b5dfe7630c92494a130fc7c627b52b55
MD5 db52847c625ea3290f81238595a915cd
SHA1 45a4ed9b74965e399430290bcdcd64aca5d29159
SHA512 5a8fb4ada7b2efbf1cadd10dbe4dc7ea7acd101cb8fd0b80dad42be3ed8804fc8695c53e6aeec088c2d4c3ee01af97d148b836289da6e4f9ee14432b923c7e40
SSDEEP 768:joWBAxonz0L7KILBk0U8Vl9NFljRFpGA1TrPiBDxDFP8sCNl:MWBAxgzY7KIL7j1NFl1Fp11/PiBVBksU
MD5 SHA1 SHA512 SSDEEP

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl\auto.tcl
Size 20KB
SHA256 f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840
MD5 5e9b3e874f8fbeaadef3a004a1b291b5
SHA1 b356286005efb4a3a46a1fdd53e4fcdc406569d0
SHA512 482c555a0da2e635fa6838a40377eef547746b2907f53d77e9ffce8063c1a24322d8faa3421fc8d12fdcaff831b517a65dafb1cea6f5ea010bdc18a441b38790
SSDEEP 384:vyPcB5RJtAZ7SP9nYP9I5HU3mOuWzXBEWKYHEN+7yBtYSbI0QD+lM:AcB5RJtAFSPBYPN3mOuiVHEN+78YSbqT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl\encoding\cp1252.enc
Size 1KB
SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
MD5 5900f51fd8b5ff75e65594eb7dd50533
SHA1 2e21300e0bc8a847d0423671b08d3c65761ee172
SHA512 ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc
MD5 SHA1 SHA512

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl\http1.0\pkgIndex.tcl
Size 735B
SHA256 420c4b3088c9dacd21bc348011cac61d7cb283b9bee78ae72eed764ab094651c
MD5 10ec7cd64ca949099c818646b6fae31c
SHA1 6001a58a0701dff225e2510a4aaee6489a537657
SHA512 34a0acb689e430ed2903d8a903d531a3d734cb37733ef13c5d243cb9f59c020a3856aad98726e10ad7f4d67619a3af1018f6c3e53a6e073e39bd31d088efd4af
MD5 SHA1 SHA512

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl\init.tcl
Size 23KB
SHA256 61c55633fa048deb120422daed84224f2bb12c7c94958ca6f679b219cf2fa939
MD5 e10e428598b2d5f2054cfae4a7029709
SHA1 f8e7490e977c3c675e76297638238e08c1a5e72e
SHA512 88ef7628af5b784229dda6772c6ddd77905238a1648d4290b496eafeec013107437218e4834b7198aeb098bc854dcb9f18083c76dd5bf3ce9cedf3d5c9e4faae
SSDEEP 384:O8Oh2gWD8Ud4zaJqacMQsRNLKx32LgWMOFaBBf6/9IrO1zWq8oXbjdEfdQxAp12y:wOD8Ud4WJqJfcMOFt/9IrOBWq8oXwQxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl\opt0.4\pkgIndex.tcl
Size 607B
SHA256 eb9925a8f0fcc7c2a1113968ab0537180e10c9187b139c8371adf821c7b56718
MD5 92ff1e42cfc5fecce95068fc38d995b3
SHA1 b2e71842f14d5422a9093115d52f19bcca1bf881
SHA512 608d436395d055c5449a53208f3869b8793df267b8476ad31bcdd9659a222797814832720c495d938e34bf7d253ffc3f01a73cc0399c0dfb9c85d2789c7f11c0
MD5 SHA1 SHA512

Submit Download

package.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl\package.tcl
Size 22KB
SHA256 47b6af117199b1511f6103ec966a58e2fd41f0aba775c44692b2069f6ed10bad
MD5 55e2db5dcf8d49f8cd5b7d64fea640c7
SHA1 8fdc28822b0cc08fa3569a14a8c96edca03bfbbd
SHA512 824c210106de7eae57a480e3f6e3a5c8fb8ac4bbf0a0a386d576d3eb2a3ac849bdfe638428184056da9e81767e2b63eff8e18068a1cf5149c9f8a018f817d3e5
SSDEEP 384:I72oQXm9jcLyBLWueSzvAXMiow90l3NhETrh4NLTluYhoNL3ZAqYi:I72oQXmgyBCqvAcFw2dhOrh4NZVhoN3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl\tclIndex
Size 5KB
SHA256 962c60eb7e050061462ff72cec9741a7f18307af4aaa68d7665174f904842d13
MD5 996f74f323ea95c03670734814b7887f
SHA1 49f4b9be5ab77e6ccab8091f315d424d7ac183f3
SHA512 c4694260c733dc534dc1a70791fa29b725efd078a6846434883362f06f7bf080ca07478208b1909630e1b55fbdccf14484b78b0a5b8c6dad90f190c8c9d88a56
SSDEEP 96:esataNULULUVUhU5U1UIUZUJeUpgURUFD15Q0AkU6PkrBkGUjZKspDzmK5SMFTug:eNtEACkiwM3g4ePOiD15Q0AkU6PkrBkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tcl\tm.tcl
Size 11KB
SHA256 6c02298d56e3c4c6b197afc79ec3ce1fc37ae176dc35f5d7ac48246f05f91669
MD5 52db1cd97ceab81675e86fa0264ea539
SHA1 b31693b5408a847f97ee8004fed48e5891df6e65
SHA512 5032b0a79d0cd5a342af2f9edf8b88b7214e9aa61ba524a42c5be2286741e18fa380ad2d40dda9a0257afceed2ef6e48624013e854f37b5e41cb88a831ad04c9
SSDEEP 192:CnjVD6gOGFpvXKPrzYkWo55z3ovPvKvaWZPZ9W6TV9ujpZwiUK3mQ4ouPltqQvu9:CGQvX+XYkn59YvPSvDJTV91/4RuPltBC
MD5 SHA1 SHA512 SSDEEP

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk86t.dll
Size 1.5MB
SHA256 bd4443b8ecc3b1f0c6fb13b264769253c80a4597af7181884bda20442038ec77
MD5 e3c7ed5f9d601970921523be5e6fce2c
SHA1 a7ee921e126c3c1ae8d0e274a896a33552a4bd40
SHA512 bfa76b6d754259eabc39d701d359dd96f7a4491e63b17826a05a14f8fdf87656e8fc541a40e477e4fef8d0601320dd163199520e66d9ee8b5d6bb5cd9a275901
SSDEEP 24576:s0Ul9NGSzfPBTBi7OU987qBkS0Ahl+FUduBGdiuazMsR+tCJuLxTQVgkBcdi8yXb:sLrrXi7f87wkS0Ahl+FUduBGdiFwo4Q5
MD5 SHA1 SHA512 SSDEEP

Submit Download

button.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\button.tcl
Size 20KB
SHA256 2f013b643d62f08ddaaa1dea39ff80d6607569c9e1acc19406377b64d75ccf53
MD5 cf6e5b2eb7681567c119040939dd6e2c
SHA1 3e0b905428c293f21074145fe43281f22e699eb4
SHA512 be03edea59be01d2b8de72b6ebe9dceb13d16c522bb5c042cdae83c84eafc6ac7b3650bf924f5f84f4f126634f9d17d74d087316d289f237129921a89aa4e0c8
SSDEEP 384:8zVtoY3wFnq+j4SpEdPmVmZ6/IVKuzmSaox2ESo+VtocUP5wFnq+j4SpEdPmV8Zd:coahPSFMmfoz4oFXhPovzmToQBy0zm2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

entry.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\entry.tcl
Size 17KB
SHA256 dd351da6288cf7e9f367fd97c97cb476193ff7461b25e31667e85fe720edea04
MD5 1d9ff9bb7fedb472910776361510c610
SHA1 c190dd07bcc55741b9bdfc210f82df7b7c2fac81
SHA512 85d25622f4e0c9517d8caa454ec4e81c8cbbec25e418f5a2d885d5561999cfb3c3026aac8bf1ca6f9b40993802fda86d60ff8fd2e30a77d56f1c1914af695f03
SSDEEP 384:P1eFkH2fRdOnOeQod3tCAERebMIDlXVQgXwVviK:PMFDqUy8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\icons.tcl
Size 10KB
SHA256 a78388d68600331d06bb14a4289bc1a46295f48cec31ceff5ae783846ea4d161
MD5 2652aad862e8fe06a4eedfb521e42b75
SHA1 ed22459ad3d192ab05a01a25af07247b89dc6440
SHA512 6ecfbb8d136444a5c0dbbce2d8a4206f1558bdd95f111d3587b095904769ac10782a9ea125d85033ad6532edf3190e86e255ac0c0c81dc314e02d95cca86b596
SSDEEP 192:TJjPyYK20kt4zHIXM2MxGwwOw0ac5lCssUOixDgzAjTXBHVXPZmEhr:pO2gz6MioacR2iBgzsFHX5r
MD5 SHA1 SHA512 SSDEEP

Submit Download

listbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\listbox.tcl
Size 14KB
SHA256 b92526a55409c67473740551ca128498824d25406e3cc9bb0544e8296d3c5de4
MD5 b3b6a3bd19ddde4a97ea7cf95d7a8322
SHA1 2f11d97c091de9202f238778c89f13a94a10d3be
SHA512 f2bc1fbbd20132725d283b9fab20c3e38ed185a62297e1418572c03fa90b3f813b878be281bb4bdfa1c813b7ee7eff11cbb2f89b5411b1707d90b0e5fd746fb3
SSDEEP 384:ZBjtAc4YusFvbaK6UFchqHjNw8wSdy+1a22YDE/q:ZFa5UBjW8RQcf
MD5 SHA1 SHA512 SSDEEP

Submit Download

menu.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\menu.tcl
Size 37KB
SHA256 588727079af7ecc44755efe33ebb7414ad2ee68390fc249ce073d38e03c78a4e
MD5 12ec5260eb7435c7170002e011fe8f17
SHA1 e88f5423a7133784a1a2d097c4e602e5de564034
SHA512 5848e5a642f0cfba8b456a6dcef711737229e5f59beb7981a52440a47f5ba9ec85374be8e8b1ccdd952ac71164da04ff88ef07204fd62509952db2cdb6503700
SSDEEP 768:0K5IzCpFl9tVbQDBTofDMpSCeihpzuxdyQYEuH9DInS3Z11:0K5i8PD7WuxdRYxH7JX
MD5 SHA1 SHA512 SSDEEP

Submit Download

panedwindow.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\panedwindow.tcl
Size 5KB
SHA256 4adf738b17691489c71c4b9d9a64b12961ada8667b81856f7adbc61dffeadf29
MD5 2da0a23cc9d6fd970fe00915ea39d8a2
SHA1 dfe3dc663c19e9a50526a513043d2393869d8f90
SHA512 b458f3d391df9522d4e7eae8640af308b4209ce0d64fd490bfc0177fde970192295c1ea7229ce36d14fc3e582c7649460b8b7b0214e0ff5629b2b430a99307d4
SSDEEP 96:PmpWHrga3awUrH6kdX3pBz6tkm71cHXYV23EmkiYlgfY8:+pWHrP36r6kJ3pBetkm6HXVUmPYlgfY8
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\pkgIndex.tcl
Size 372B
SHA256 e0bac49b9a3f0e50be89f692273cea7b7462bfc3e054f323261ef99b708c70a3
MD5 d942ff6f65bba8eb6d264db7d876a488
SHA1 74d6ca77e6092d79f37e7a1dcd7cced2e89d89cb
SHA512 3ac7d992300252109606074aefb693a31cd5cceffb6d7b851a2c8895a0d5e165a139b7038657306128af39c44785b7b4da35b8e1aeb4c30f3f7e7cfcfb789c4c
MD5 SHA1 SHA512

Submit Download

scale.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\scale.tcl
Size 7KB
SHA256 58c662dd3d2c653786b05aa2c88831f4e971b9105e4869d866fb6186e83ed365
MD5 1ce32cdaeb04c75bfceea5fb94b8a9f0
SHA1 cc7614c9eade999963ee78b422157b7b0739894c
SHA512 1ee5a187615ae32f17936931b30fea9551f9e3022c1f45a2bca81624404f4e68022fcf0b03fbd61820ec6958983a8f2fbfc3ad2ec158433f8e8de9b8fcf48476
SSDEEP 192:q1xTLI9LUAp8cZIQ+Umuy9vYE2dLTaQfiwHZeABypyTtB:HUN1Umn2dKuHIpCB
MD5 SHA1 SHA512 SSDEEP

Submit Download

scrlbar.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\scrlbar.tcl
Size 12KB
SHA256 189e7ee4b67861001c714a55880db34acf7d626a816e18b04b232af9e6e33e81
MD5 b44265f793563ad2ad66865dec63b2c2
SHA1 23e6f7095066ed3b65998324021d665d810e6a93
SHA512 3911b13f42091620d8d96ed0cc950792175f88399912092161e1a71f564c7e72b6d448d3b761b6b6b73400ccc8fabd94cb3bfcc8cb3ad8ebdb590c3ffc623dfb
SSDEEP 192:AfVS+eVmN0KQ0v0QIIVjvrpQQtfJMZqSwiXEfY4yhIa7yLIVNpIgdWmD3T1gFpN:MNDQw7IIVHGOfmkSwORVqaGcV4q7kpN
MD5 SHA1 SHA512 SSDEEP

Submit Download

spinbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\spinbox.tcl
Size 15KB
SHA256 5d6e939b44f630a29c4fcb1e2503690c453118607ff301bef3c07fa980d5075a
MD5 9971530f110ac2fb7d7ec91789ea2364
SHA1 ab553213c092ef077524ed56fc37da29404c79a7
SHA512 81b4cec39b03fbeca59781aa54960f0a10a09733634f401d5553e1aaa3ebf12a110c9d555946fcdd70a9cc897514663840745241ad741dc440bb081a12dcf411
SSDEEP 192:aR1yvxxVRQRrclOniQ14Yvg5bbVFMio1UF9w9P75uaMY+c6RhO1ON6Ql4qRiZ0NO:MyF5XVF61iwZ75/YRhO464z8wdEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

text.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\text.tcl
Size 32KB
SHA256 f26ed909a962d02bc03585a6c756f4fe992c311c7f53648137e427747120b441
MD5 33230f852aac8a5368aeba1834dcec77
SHA1 beba97c48a110f4a9fe86f60e5fd4ca6ac55e964
SHA512 caac54334c4eb439c18f03eeb5de83aa6bbd6bb07b760a40c60f2d34f5ee1fdd542f83ad427059863f96b0a8f2cb96658171a7cd0c0c2c49e002bd02e6d418f6
SSDEEP 384:Th9XGSuWsNGbWBFFRzGagUNKEFx8wredkG/gVVFaO/2bembFWaHnla98ffRiqiPp:T8zNGuF6uNdyO4OYa98ffRUAlde
MD5 SHA1 SHA512 SSDEEP

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\tk.tcl
Size 23KB
SHA256 3e998b41ab23677db31902e1e876e644b279b2e6d8896443f6c434352801cdd1
MD5 25094462d2ea6b43133275bf4db31a60
SHA1 6bb76294e8fdf4d40027c9d1b994f1ab0014b81b
SHA512 8bdae921f367b864ea7f36c9a549ee870d4e4e3c6e942d70722a84ae6b23ff00a33638d8ca8f3b9b8fe084875ba7c8976975849f4dc47cdb5671df47af68cfab
SSDEEP 384:dWAlIQ7ylH462gngqeObubqLwvoGah0QSA4jLGn3WB0MCdPAWBL+g190K5TzMSWa:dWOIQulHokh0QzMemB0MCBL+g1bEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

fonts.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\ttk\fonts.tcl
Size 5KB
SHA256 0eb518251fbe9cf0c9451cc1fef6bb6aee16d62da00b0050c83566da053f68d0
MD5 7017b5c1d53f341f703322a40c76c925
SHA1 57540c56c92cc86f94b47830a00c29f826def28e
SHA512 fd18976a8fbb7e59b12944c2628dbd66d463b2f7342661c8f67160df37a393fa3c0ce7fdda31073674b7a46e0a0a7d0a7b29ebe0d9488afd9ef8b3a39410b5a8
SSDEEP 96:Nduphbitcq1Zs/ZrBiZy227IhLkdhetOstWGbRafkeHH+4:3CheHvsbiZyDmJbRa3+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ttk.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_2524_133628596650288323\tk\ttk\ttk.tcl
Size 4KB
SHA256 61baa0268770f127394a006340d99ce831a1c7ad773181c0c13122f7d2c5b7f6
MD5 e38b399865c45e49419c01ff2addce75
SHA1 f8a79cbc97a32622922d4a3a5694bccb3f19decb
SHA512 285f520b648f5ec70dd79190c3b456f4d6da2053210985f9e2c84139d8d51908296e4962b336894ee30536f09fae84b912bc2abf44a7011620f66cc5d9f71a8c
SSDEEP 96:53a25129CKELfMonw+PzpaVnNqovaq2126262R2D2q2k2j+/2FhbtpGt0vcWOQRg:53j5MoKE7JEnN7CTMDDA6Tlj+uFhbttK
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path C:\Users\Admin\AppData\Roaming\dllhost.exe
Size 74KB
SHA256 49c175257966f191a2abce16d8533d359fc27ecf6512da870a9c59937914d5f7
MD5 cc7686bf7c7d81f59196d5cc3cab3348
SHA1 ac39079f223f87d404c421c48239f913b12f00a8
SHA512 940cfb37c1f5e5dbd86cc14d5a0a85dfaf889754051d4fc0d0afbe7bedceaec91b5f36b873b5e24cd081432db1b7d61df72a198681b9ab8e3a9b57197cfb58ae
SSDEEP 1536:IaMDvberZcH8cgbcfXijn1Q6VZAvO1krRCD:2Dva1cWbcPerEO1krRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2264-1051-0x0000000006B30000-0x0000000006B4A000-memory.dmp

Download

memory/2264-1087-0x0000000008910000-0x0000000008EB4000-memory.dmp

Download

memory/2264-21-0x0000000005920000-0x0000000005F48000-memory.dmp

Download

memory/2264-65-0x00000000056A0000-0x00000000056C2000-memory.dmp

Download

memory/2264-67-0x00000000058B0000-0x0000000005916000-memory.dmp

Download

memory/2264-66-0x0000000005840000-0x00000000058A6000-memory.dmp

Download

memory/2264-86-0x0000000006150000-0x00000000064A4000-memory.dmp

Download

memory/2264-1088-0x0000000007A40000-0x0000000007AD2000-memory.dmp

Download

memory/2264-1050-0x0000000007CE0000-0x000000000835A000-memory.dmp

Download

memory/2964-376-0x0000000006380000-0x00000000063CC000-memory.dmp

Download

memory/2964-1095-0x00000000078F0000-0x00000000078F8000-memory.dmp

Download

memory/2964-1090-0x0000000007900000-0x0000000007996000-memory.dmp

Download

memory/2964-1091-0x0000000007870000-0x0000000007881000-memory.dmp

Download

memory/2964-1092-0x00000000078B0000-0x00000000078BE000-memory.dmp

Download

memory/2964-1093-0x00000000078C0000-0x00000000078D4000-memory.dmp

Download

memory/2964-1094-0x00000000079A0000-0x00000000079BA000-memory.dmp

Download

memory/2964-1065-0x00000000075C0000-0x0000000007663000-memory.dmp

Download

memory/2964-20-0x0000000004DC0000-0x0000000004DF6000-memory.dmp

Download

memory/2964-1089-0x00000000076E0000-0x00000000076EA000-memory.dmp

Download

memory/2964-374-0x0000000006340000-0x000000000635E000-memory.dmp

Download

memory/2964-1063-0x0000000006950000-0x000000000696E000-memory.dmp

Download

memory/2964-1053-0x00000000755B0000-0x00000000755FC000-memory.dmp

Download

memory/2964-1052-0x0000000006910000-0x0000000006942000-memory.dmp

Download

memory/4712-2044-0x00007FFA948E0000-0x00007FFA953A1000-memory.dmp

Download

memory/4712-1064-0x00007FFA948E0000-0x00007FFA953A1000-memory.dmp

Download

memory/4712-12-0x00000000007D0000-0x00000000007E8000-memory.dmp

Download

memory/4712-11-0x00007FFA948E3000-0x00007FFA948E5000-memory.dmp

Download

memory/5056-2003-0x0000017041DD0000-0x0000017041DF2000-memory.dmp

Download