hxxps://gofile[.]io/d/zLXErs

Resubmissions

21/05/2025, 00:25

250521-aqxerazpw26

20/05/2025, 18:45

20/05/2025, 01:38

20/05/2025, 01:31

20/05/2025, 00:07

Analysis

max time kernel
129s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2025, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/zLXErs
Sample250520-aee2bsfq4x

Score

9^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Loads dropped DLL 36 IoCs

pid	Process
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe
6608	whatareyou.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3564	powershell.exe
6784	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	api.gofile.io
15	api.gofile.io

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4588	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\clickslutbg_8065.jpg"	whatareyou.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "232"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133921732480615100"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000_Classes\Local Settings	firefox.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6608	whatareyou.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3564	powershell.exe
3564	powershell.exe
3564	powershell.exe
6784	powershell.exe
6784	powershell.exe
6784	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6608	whatareyou.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
5844	Process not Found
1356	Process not Found
4920	Process not Found
3372	Process not Found
4960	Process not Found
5300	Process not Found
1512	Process not Found
4912	Process not Found
7032	Process not Found
2228	Process not Found
2312	Process not Found
6660	Process not Found
5972	Process not Found
5172	Process not Found
6536	Process not Found
3356	Process not Found
4848	Process not Found
4936	Process not Found
5004	Process not Found
2576	Process not Found
2888	Process not Found
4608	Process not Found
1568	Process not Found
2908	Process not Found
2960	Process not Found
912	Process not Found
4180	Process not Found
5412	Process not Found
2148	Process not Found
5896	Process not Found
5888	Process not Found
5880	Process not Found
2816	Process not Found
5676	Process not Found
6416	Process not Found
5616	Process not Found
5612	Process not Found
7052	Process not Found
6452	Process not Found
1996	Process not Found
6620	Process not Found
5628	Process not Found
2812	Process not Found
2152	Process not Found
628	Process not Found
2980	Process not Found
5644	Process not Found
4892	Process not Found
3708	Process not Found
4836	Process not Found
4408	Process not Found
5636	Process not Found
3680	Process not Found
6032	Process not Found
4784	Process not Found
6800	Process not Found
5956	Process not Found
6832	Process not Found
6616	Process not Found
6004	Process not Found
6820	Process not Found
6808	Process not Found
5604	Process not Found
5884	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe
4876	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4876	firefox.exe
6092	whatareyou.exe
6608	whatareyou.exe
5712	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 400	3588	chrome.exe	87
PID 3588 wrote to memory of 400	3588	chrome.exe	87
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 4820	3588	chrome.exe	89
PID 3588 wrote to memory of 4820	3588	chrome.exe	89
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 2828	3588	chrome.exe	88
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90
PID 3588 wrote to memory of 3680	3588	chrome.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2312	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/zLXErs
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff97df9dcf8,0x7ff97df9dd04,0x7ff97df9dd10
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2068,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1980,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2228,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4416,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4744,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3308,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5320,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5436,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=208,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5856,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5036,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3440,i,10851781063906392388,6007710746809639293,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4556

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:720
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {1aea3153-16fd-4d1f-8f84-028988c794af} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27135 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {1719d3d8-f3ef-4271-8f7b-514484697f87} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27276 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {f7b628fb-5529-4192-a4c3-63ef064be375} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27276 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 4000 -initialChannelId {f8cc2680-20e2-464f-9956-2c9e66f5a87b} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4480 -prefsLen 34775 -prefMapHandle 4484 -prefMapSize 270279 -jsInitHandle 4488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4460 -initialChannelId {ffa6517e-9eb1-43ab-995f-f43e8fa5a65d} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5184 -prefsLen 35012 -prefMapHandle 5180 -prefMapSize 270279 -ipcHandle 5172 -initialChannelId {f4aef954-ea99-43ee-8637-4fd0a0c08f7b} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2720 -prefsLen 32900 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {1b467369-d02b-409f-a3f0-93a9d1b76b5a} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32900 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {dc38ed51-d253-4149-878b-f1f81b185ef0} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5032 -prefsLen 32900 -prefMapHandle 1636 -prefMapSize 270279 -jsInitHandle 1640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {a8edc8a2-7b2b-4df6-bc5f-c68999520bbb} -parentPid 4876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6964

C:\Users\Admin\Downloads\whatareyou\whatareyou.exe
"C:\Users\Admin\Downloads\whatareyou\whatareyou.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6092
- C:\Users\Admin\Downloads\whatareyou\whatareyou.exe
  "C:\Users\Admin\Downloads\whatareyou\whatareyou.exe"
  2⤵
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:6608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s C:\Users\Admin\clickslutbg_8065.jpg
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4588
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\clickslutbg_8065.jpg
      4⤵
      Views/modifies file attributes
      PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators"
    3⤵
    PID:852
  - - C:\Windows\system32\net.exe
      net localgroup Administrators
      4⤵
      PID:4608
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators
        5⤵
        
        PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Administrator /active:yes"
    3⤵
    PID:5408
  - - C:\Windows\system32\net.exe
      net user Administrator /active:yes
      4⤵
      PID:912
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Administrator /active:yes
        5⤵
        
        PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command " $nusnm = \"Administrator\" $nuspss = ConvertTo-SecureString \"Imaclickslut\" -AsPlainText -Force Set-LocalUser -Name $nusnm -Password $nuspss Remove-LocalGroupMember -Group \"Administrators\" -Member \"Admin\" Get-LocalUser "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name='Administrator' set FullName='exxaltia'"
    3⤵
    PID:6632
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name='Administrator' set FullName='exxaltia'
      4⤵
      PID:6816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-LocalGroupMember -Group \"Users\" -Member \"Admin\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "shutdown /l"
    3⤵
    PID:2208
  - - C:\Windows\system32\shutdown.exe
      shutdown /l
      4⤵
      PID:428

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38cb055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7ed98dda6117eec61369e51c470f9d18c81ade3d962368367f415025397a6c5d
MD5 0e5c04e1dbe2147e9f48481f2c7b242c
SHA1 9b910571101b99115ee4706fc9f900173ab52bb5
SHA512 c38f6c50be8160e8e03034dedfe68656644ba6fde77e26bc4f6f3c64d032f644d164aef2e71080011790618c6b4d0913be5fe66726496556dd5daa495e46ef0c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 a290f076175f142984f77bc24252fa9be13147a98a288e84efacf9af3854d378
MD5 fc3e3bab0d99e94e3ab90d8f184d7762
SHA1 0b2e81de6d684bebcc96ad5d44cb5d7a25d98abc
SHA512 9a051a7a0141bad0750e203b67d7beaa2c05813a366592785a1e1a04be0d533c91d14225b56a4063082b8e81e86e0b56f6703ef34e003fee8aaa10f8902097c9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6b143fc71bef291d4fe7a7db1b3f5edc04ce35576adde3f4daa33b7394b3f7b2
MD5 315bfc416f13e4e9f424bee9d2fe3419
SHA1 9e43397db2b66353c8099d8691bd2835454598d8
SHA512 cb2ec62de756d1454cd73621e89f90d02cd6b7fc0eda86f912ab75efd738ab664b511bd3920a303046ff24bcad97b626177315f1a6700a98a88a40a21c18c47b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 852B
SHA256 d2898125a489d0ecba5d6f480403860a82a6f5e6cf4b0de31a9b551da619cec1
MD5 0cfa1c10ad1bb6fe12a625b046324f19
SHA1 eaef8d012ccfb7738397f4de788f329dae0e52d7
SHA512 a96cd1327d9840e3fff89583ccb0c09dcdb296e90e1e63fe75458875ca73c0b6e908b48c0ff8da6037226f892f83ba10a381c7ec67d92b40b9d2bd1ab759d5bd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 101a57b9f16f3cc886780ba9dd6d1fbd306b49911133492384b80ef173010f35
MD5 bff1bf76b543e05e9bb0e0d948a97e45
SHA1 0696668be92a3afa77834cc1011ecffaf0c0fc2d
SHA512 e9a5360e87917bf00b28a9c0d5d14499c00e787978ba6ced13c5a639d65c213eb4c3ad57bab95783d41babaea5c40172e41f9d736b9a30cf4ff0a2c3b1a03d04
SSDEEP 192:WYssvYKKGQZ8PRpaBJHS+WNo9RCF+8Cjev2OAPpQyIsnA/g4:WYsswKVxXmRcMY+i2/Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 2f1c0d144e2f1959e8ccf5b6e5c1e3006800f54c3aa815b720c91841cd4510e4
MD5 17fdcb1ac151d5b189b2232e47f86780
SHA1 4f17d9d533ab114b9d5ebea12dc80800305f7479
SHA512 6a1b9d00bfa465d0499a9f216816e67ea75090154c74e28a7f89bf98fc38699108e51148871a5850978e781a115843875a017f5ea5ba6691fdfb0a7863776fc4
SSDEEP 384:LrTO7pLuLcC0D6Xp2PkXqKf/pUZNCgVLH2Hf1PKrU0hHGvGt+h7:L/O7pLuLrUop2PkXqKf/pUZNCgVLH2H3
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e1e14371eac70e9de24043b34af0d381a0c7e547f3038209fd18df2f3b444c89
MD5 8a3fb72ff3f12c05bd6e46a52a506a76
SHA1 da3b75d71d0a6484910055f3828342bdad7827bd
SHA512 56652fba96185ed7c6328f515ad0ca9eb2512f182a11b2216a827737407eae90679226a9337998838948332eafb6a26c15c90d33ffbe7eb10d72ad0378bbc9a6
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe63c9ce.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe63c9ce.TMP
Size 48B
SHA256 aacd53e38a98955137a0d89efdb6fa3f46c75ec98b17cbc9c9c6ffcddcbcaf0b
MD5 9bb1928f6c0992da2bd4c25144f7215d
SHA1 5092cb7f7b4984ff1ea1b4f25a0e5f9489a7fd49
SHA512 22c5169d64596f2a4657bf2d2248ab33e45fb0021d7944d27bd528dccf0fa73f0dd0acb51ce0bd7c9e3b4c6550598d4009e3b655ee74c26bc69156e2511419b9
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 a49efb51fd182b0fe1eb4346849a97f0740dad0019d02e6b6153ff0b45d2f7c9
MD5 fc62bb3f6b8ff340e78b6412ab7f9969
SHA1 8008df00472c8e02ca8ad79cd4eb280fcd4cb195
SHA512 e4d2442e62834cfd0767d083a127b0eced12e2f777082a12dd2d01bf9ae1c96e2d2bad677a004c9d7256c9a24804982dd2ca5180306c4a03883ce332913f2e60
SSDEEP 3:MsEllllkEthXllkl2zEklx3:/M/xT02znx3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 79KB
SHA256 ea780f84879a6646b96fc4da03ba28898b31f57e7b02a85ba13cd6604cc5da69
MD5 1d6321193d3ae582e8e2d1b7cadabff1
SHA1 2dce0d6502e9d4f47f4d663583391720eeb3fab2
SHA512 b992b8c3277cefb3cbdaacdbcd6b236a9a476b3ff83c39f4da39b8c82f54f84f288dc80919ff4c69568e886c6321c532a78ecd6d38407474ca07580f9db79e6a
SSDEEP 1536:gRL8O4rHoxDEPsiy8JZGp2IRFN9lWa0pnSRE1oHaO:WLrxDAhJ0p2IHlK4REyHaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 80KB
SHA256 7a9e9dd913597d0d0579dd60eb64046e7b4466a2923be59df9725a57ff11ef1b
MD5 f6d10a3c32d239fc4a6c96ea601df524
SHA1 9edc3a6413731dad48113ba2be6d795c71c7d5ab
SHA512 9c28505ddbfa202f7f23e66e5971aa52078808b16ad2f061dbcf68f4e460c7b731488a8d546088bbfd38bb540b5f149bc64f9f17bc4937a87e92d8750ebac673
SSDEEP 1536:PnL8O4rHoxDEPsiy8JZGp2IRFN9lWa0pnSRE1oHaO:PLrxDAhJ0p2IHlK4REyHaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 80KB
SHA256 e03cfa1ebef8636abee5b20b68f2d03d30080e82726f235a9dfc69262fc3507a
MD5 a6b601c1272768d045b157c7a18d383e
SHA1 1a12e9f3174176c5a7732957512e23654c7f5473
SHA512 a4abe8d03dd746b4fb1b78f9f9f7e7d23a756fd32b7c9fb3c1d2a62f5cfecae78a811d28507a9e0d6c567b2fcb61bc711467bcc9b7157d26752811b67a34d737
SSDEEP 1536:PFL8O4rHoxDEPsiy8JZGp2IRFN9lWa0pnSRE1oHaO:NLrxDAhJ0p2IHlK4REyHaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 80KB
SHA256 93c241dd3b8091ae97470c67cae403df5621d0b3c5240b4a89d12379142f302c
MD5 69a909e95333c7178cec73a474d02614
SHA1 fa2c16be9b6a4dbe1f084f0f1a1355a02797544e
SHA512 be0fb96a25c8e89e1229f1e53d2f25d82d398cafa606043366bda34c068912aa5035a44f78821905c46290cf35bb9c46f851f8e9226d07c4866337b7007eade7
SSDEEP 1536:gnL8O4rHoxDEPsiy8JZGp2IRFN9lWa0pnSRE1oHaO:2LrxDAhJ0p2IHlK4REyHaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Evil.jpg

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\Evil.jpg
Size 55KB
SHA256 3496388b91c5e50d928605a76e3e3105e4ceddcf7b0899a42dd7a21c1772517b
MD5 da526cff6c2f33f16a0df226584be2c5
SHA1 1b5b95dad86801296538de9234f4d1a63b5f100f
SHA512 9acc5fc5f156654c3a58406bd690fba465f8b51fc138ab06bd075329c4cecbd5d69ee3e23334a77670536cd0ea43b219615fb383460e2c7f9a0fe551695282ea
SSDEEP 1536:4xz1sHYiFRjOqRkMOlRJI7X4MfIeds8P1xdo/VlDWjmXAAn9KE09sum:4xziFoxlWocIP8PfduVRW+Z09Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\PySide6\Qt6Core.dll
Size 5.8MB
SHA256 22bd0ab935f63c060bf3d3696d3d2b10040103abbb8f1740305fab10c8aa7d10
MD5 50264f8e2f6c62e9ebac6a5e3bca0aff
SHA1 98fe868c92c69de60facacedc540c914762cb066
SHA512 62317aedaa24c5260a10890e2afe29721864b7221c9837d93eb29ea6086d65d1b7d7c355dc526b9b0a6d1abf69ac4b55f24f4720e4244d5e9b29ad8c677e1d49
SSDEEP 49152:Ek0ILGbaqhR9JaQsOkyGVMjHLBjALaZimO1xTpFY4hQ6/ZRZlm2/IGUgyp2hElHg:fopqpow14KOXKFdu9CwJsv6tJ42nW/3T
MD5 SHA1 SHA512 SSDEEP

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\PySide6\QtCore.pyd
Size 3.4MB
SHA256 5ffca9585b99e8fea1cdd7cc91a2dfad77df2e20a527008bce89606796c009e7
MD5 068dccefd1e8988ed4cdee0f2c8e4e87
SHA1 d93e5003fa5eed5458898064cd72dc7937d00a7a
SHA512 7e85df428a64e449d20d9b1efc9cfe5d9b9d9ad64511d41c8b2f5a5292984487b73ecf32c377322c0a38f5bea34b075a0c23e39e304017c5a1d15efa537c4294
SSDEEP 49152:iHuQtjqn5FOkhXXc+B8hgxs+f+Eg1x/tyeAGX4cOmYtP7LZeFyAmNv+fFSrW7WB7:DBlLraJfBAl
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyside6.abi3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\PySide6\pyside6.abi3.dll
Size 230KB
SHA256 29dcdf12964dc885f0d2e3857c2a552bcc0e567630563effd102a275a2c52037
MD5 b0bd6e9faff4e802e9f124ceb8f5beba
SHA1 cf058141a751ab2b0b225a3e9c74b01d581845d9
SHA512 ad6511de3f0e67f9652a4da07841bdc4b93a5eded1b0f68115d0011e1f65d1b0abfb2b3817fa564c7341c92beeac17158b26f2f29b6995acf5cc4defc93f9cf9
SSDEEP 6144:bPCUrB+8V7P5bCvgZir9fn2BhaBmEn7OVGjHpeDrruaJtV:bPCUw7gZwfAhaBm/8J/oV
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\VCRUNTIME140.dll
Size 106KB
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\VCRUNTIME140_1.dll
Size 48KB
SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
MD5 cf0a1c4776ffe23ada5e570fc36e39fe
SHA1 2050fadecc11550ad9bde0b542bcf87e19d37f1a
SHA512 d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168
SSDEEP 768:a0Q4HUcGJZekJSam1BbuBSYcCZbiLzlSHji9z4GwZHji9znwT:afnDex5izbiLzlE+z4Gwl+zwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_asyncio.pyd
Size 63KB
SHA256 d1fb700f280e7793e9b0dca33310ef9cd08e9e0ec4f7416854dffaf6f658a394
MD5 511a52bcb0bd19eda7aa980f96723c93
SHA1 b11ab01053b76ebb60ab31049f551e5229e68ddd
SHA512 d29750950db2ecbd941012d7fbdd74a2bbd619f1a92616a212acb144da75880ce8a29ec3313acbc419194219b17612b27a1833074bbbaa291cdb95b05f8486ff
SSDEEP 1536:92icaMc9076gzE6+gTKnEzRIsOnev7SyP4xw:92icrclGE6+gTOEzRIsOn2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_bz2.pyd
Size 82KB
SHA256 ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
MD5 4438affaaa0ca1df5b9b1cdaa0115ec1
SHA1 4eda79eaf3de614d5f744aa9eea5bfcf66e2d386
SHA512 6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6
SSDEEP 1536:+O1z7poK78xa5yp6aclDqGihM8Vh948L5IsCVQ7SyhxG:31z9h9plDshvVhH5IsCVQk
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_ctypes.pyd
Size 120KB
SHA256 f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656
MD5 6114277c6fc040f68d25ca90e25924cd
SHA1 028179c77cb3ba29cd8494049421eaa4900ccd0e
SHA512 76e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d
SSDEEP 3072:T7u5LnIxdP3fPHW+gfLIhAxKpemWtIsLPKlY:Tw+3FgfLIhFemWeY
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_decimal.pyd
Size 247KB
SHA256 0f9c6cc463611a9b2c692382fe1cdd7a52fea4733ffaf645d433f716f8bbd725
MD5 be315973aff9bdeb06629cd90e1a901f
SHA1 151f98d278e1f1308f2be1788c9f3b950ab88242
SHA512 8ea715438472e9c174dee5ece3c7d9752c31159e2d5796e5229b1df19f87316579352fc3649373db066dc537adf4869198b70b7d4d1d39ac647da2dd7cfc21e8
SSDEEP 6144:3V9E1CyOa72oP+pG1/dgD09qWM53pLW1ADDtLRO75e:jEgyOa72jw1/d4VVhLE5e
MD5 SHA1 SHA512 SSDEEP

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_elementtree.pyd
Size 125KB
SHA256 2ebb2bc6ce26d25bc2ad471f9d7edc4684064afa606f046ebf0a39c75031cb53
MD5 be02ef37d9a1c127253bc5a84705a3b7
SHA1 c313d01f999791abc9e4a7982ee6a814f8fbe6ef
SHA512 2f582da0debbf5fb254e8d85e56765d2d59263a82fac91a75648575a8d95a814b231acc1a30c5bec3e3d087367996547c8affba2f09aff899a4123210e0451f9
SSDEEP 3072:L+oDNwPxv5OwEzYk2vmk4YkmQ9OPE1G7UrBvNpIs6fl/:VmPxv5DFk2vI6QEfQBvNG
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_hashlib.pyd
Size 63KB
SHA256 6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327
MD5 1524882af71247adecf5815a4e55366a
SHA1 e25014c793c53503bdff9af046140edda329d01b
SHA512 5b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a
SSDEEP 1536:nfKlLLgy209/MkZy6nR3JZlivy7OjZopRIsOI/7SyAxn4:fKBgy+IZlh7OjSpRIsOI/M4
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_lzma.pyd
Size 155KB
SHA256 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
MD5 737119a80303ef4eccaa998d500e7640
SHA1 328c67c6c4d297ac13da725bf24467d8b5e982e3
SHA512 1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c
SSDEEP 3072:2tZVL5rdV/REWWjAYyznf49mNo+RRApqc5IsZ1v8N:2tZV3pREMAYO+ElG
MD5 SHA1 SHA512 SSDEEP

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_multiprocessing.pyd
Size 33KB
SHA256 1d6f1e7e9f55918967a37cbd744886c2b7ee193c5fb8f948132ba40b17119a81
MD5 2ca9fe51bf2ee9f56f633110a08b45cd
SHA1 88ba6525c71890a50f07547a5e9ead0754dd85b9
SHA512 821551fa1a5aa21f76c4ae05f44ddd4c2daa00329439c6dadc861931fa7bd8e464b4441dfe14383f2bb30c2fc2dfb94578927615b089a303aa39240e15e89de5
SSDEEP 768:hXI6RwgJ5xeDTdywGnJ8BIsWt6F5YiSyvWKAMxkE9:pIoJ5UDTdywGJ8BIsWt6L7SyuoxB
MD5 SHA1 SHA512 SSDEEP

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_overlapped.pyd
Size 49KB
SHA256 cb68e10748e2efd86f7495d647a2774cea9f97ad5c6fe179f90dc1c467b9280f
MD5 ac053ef737e4f13b02bfa81f9e46170b
SHA1 5d8ebeb30671b74d736731696fedc78c89da0e1f
SHA512 6ac26f63981dc5e8dfb675880d6c43648e2bbe6711c75dcac20ebe4d8591e88fbfac3c60660ab28602352760b6f5e1cb587075072abd3333522e3e2549bfa02e
SSDEEP 768:A1MCcP4W1vqJiR5RMJl5XikC6r2lIsXtw5YiSyvUYAMxkEb:A1MiJifvkCllIsXti7SysGxf
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_queue.pyd
Size 31KB
SHA256 4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065
MD5 8bbed19359892f8c95c802c6ad7598e9
SHA1 773fca164965241f63170e7a1f3a8fa17f73ea18
SHA512 22ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0
SSDEEP 768:K+yFV6rXMmxU9tIsQUl5YiSyvYAMxkEl1C:K+wEXMWU9tIsQUr7SyexXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_socket.pyd
Size 77KB
SHA256 d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49
MD5 64a6c475f59e5c57b3f4dd935f429f09
SHA1 ca2e0719dc32f22163ae0e7b53b2caadb0b9d023
SHA512 cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973
SSDEEP 1536:zbflGOzI+Jmrc0r3uj+9/s+S+pzpDAiTFVf78tIsLwy7SyJx+:V/IMA3uj+9/sT+pztAYFVT8tIsLwyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_ssl.pyd
Size 172KB
SHA256 79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1
MD5 a0b40f1f8fc6656c5637eacacf7021f6
SHA1 38813e25ffde1eee0b8154fa34af635186a243c1
SHA512 c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713
SSDEEP 3072:LFIQQShnmJg0ADm8H4qIOuXo6XHFBN9d41Olh59YL48PMrN/WgAlNzn5IsC7/1a:GShmaJDm24q6o6XHR4BLrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\_tkinter.pyd
Size 62KB
SHA256 8e4cab61b3838f9545b5d1e0b287f18c22d360b8e6a8daca4178cc69df78f83d
MD5 89f47cd630f7dfa63268fbc52d04f9e9
SHA1 0cc250df4c2f44d8ca8820756f9f05df1e893e28
SHA512 bd2406ea0d5396df0153ac22ce55ca49615291ead6419a96e99007ac85059054a718c4f98942e0adb23da85899f145504b79772866d683a9a686fde6ade784e0
SSDEEP 768:99v6F7Q04EaJQCENX7Twu2zsdMT81LGAKLMP2SJxkfRIsOST5YiSyv6k1AMxkEW:nyF7XUEB7q81CvguSJORIsOSd7SyTNxq
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\base_library.zip
Size 1.4MB
SHA256 1c0e7388e7d42381fd40a97bd4dab823c3da4a3a534a2aa50e91665a57fb3566
MD5 908a4b6a40668f3547a1cea532a0b22e
SHA1 2d24506f7d3a21ca5b335ae9edc7b9ba30fce250
SHA512 e03950b1939f8a7068d2955d5d646a49f2931d64f6816469ac95f425bfeeabff401bb7dd863ad005c4838b07e9b8095a81552ffb19dbef6eda662913f9358af6
SSDEEP 24576:mQR5pATuz/R5lUKdcubgAnyfbPex0iwhFdYf9PLeeHHG:mQR5p1/RphC
MD5 SHA1 SHA512 SSDEEP

Submit Download

clickslutbg.jpg

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\clickslutbg.jpg
Size 627KB
SHA256 9d1ee2ce7d0470768e02615aaa9eaa5a0946f466b36e4dc88187fd57dfe7e0ce
MD5 cacdec53f8e32aa2a343e5bbfd62c6b7
SHA1 f731a0ed686afeb3d2db4d61fdae3c8bf1438444
SHA512 c5f48f8c8d57731219ecc8ed33aaccb6784b50cc318ff2ef64fc9a668f4cb3bda2ddb362c3981582fb2d6398a0dbca8bc2ae537821e47f6ec91ceb37d0c010a8
SSDEEP 12288:aEjgZoVT+4DWUeXF79gA4t+pOxPIQNil7T8GeVxyYmB4H+LxkHWV8bI3p/dShOk0:aEgoE11XFIt+cxPIlFAGmy3B4H72sItF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\libcrypto-3.dll
Size 4.9MB
SHA256 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
MD5 7a6a8c2a8c379b111cdceb66b18d687d
SHA1 f3b8a4c731fa0145f224112f91f046fddf642794
SHA512 f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5
SSDEEP 98304:OH+jTaoFABs2NPAE7uLcdKmj8waP31CPwDvt3uFlDC:kQ+Bs2NQcdKmj8waP1CPwDvt3uFlDC
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\libssl-3.dll
Size 771KB
SHA256 b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10
MD5 64acb046fe68d64ee475e19f67253a3c
SHA1 d9e66c9437ce6f775189d6fdbd171635193ec4cc
SHA512 f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766
SSDEEP 6144:9jurAr6yUDGpdXh3Mr3r0oARnjmeUl4XOnZiRtw036WgfCBL5JyJ/OiFe9XbI:9MT6h3M7VxKXOrqdeOiFe9Xb
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\pyexpat.pyd
Size 194KB
SHA256 91fe5b1b2de2847946e5b3f060678971d8127dfd7d2d37603fdcd31bd5c71197
MD5 cdcf0e74a32ad7dfeda859a0ce4fcb20
SHA1 c72b42a59ba5d83e8d481c6f05b917871b415f25
SHA512 c26fdf57299b2c6085f1166b49bd9608d2dd8bc804034ebb03fb2bba6337206b6018bf7f74c069493ffae42f2e9d6337f6f7df5306b80b63c8c3a386bce69ea6
SSDEEP 3072:ZKABBH4pwa0bGheNSeFPyP7pgE7xhAq36exBce56iXfVhyAJ1Ohc2gZtIsLh5Aj:ZBBHCqGheNSe9YeE7/AqV1XfPym2yk
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\python3.dll
Size 65KB
SHA256 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423
MD5 0e105f62fdd1ff4157560fe38512220b
SHA1 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c
SHA512 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de
SSDEEP 768:ow/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS7:P/5k8cnzeJptIsL0t7Sym1xm
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\python311.dll
Size 5.5MB
SHA256 de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
MD5 58e01abc9c9b5c885635180ed104fe95
SHA1 1c2f7216b125539d63bd111a7aba615c69deb8ba
SHA512 cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081
SSDEEP 98304:BBduVia4N3NWLvJP8IjF/d/aHMMwuPQyFF+RdioiZPbwappjDq:BBduVv4N3ILvJ8M/4wZy3+RdioiZPbwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\select.pyd
Size 29KB
SHA256 e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279
MD5 653bdccb7af2aa9ccf50cb050fd3be64
SHA1 afe0a85425ae911694c250ab4cb1f6c3d3f2cc69
SHA512 07e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277
SSDEEP 384:dEeecReJKuHq1W57AvB0EZtIsQGQHQIYiSy1pCQvC5HAM+o/8E9VF0Ny5X3:XeUeJPHqoGDtIsQGq5YiSyvmAMxkE/3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\shiboken6\MSVCP140.dll
Size 552KB
SHA256 1581edb56de506b5761ec323fe2c33b5754ea24913fe56e8bd9caeea4510c7b1
MD5 3f2711e68c5e3abc8b6542397204d90d
SHA1 77385fc9062b9e23a2c03baeb5d745b9a540dc01
SHA512 8dfe8a4b83a4cf6ed73aabdc2ec4a0501af2321e758aa53d95524fd757d55035ab209626719ffef5a3b6f0038e30b7f5c4b85d8b3605ccfba3791b89ecf08985
SSDEEP 12288:+wcdhIRlPcUQE15atagQa443wQEKZm+jWodEEVE/x2f:+P5QarwQEKZm+jWodEE24f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shiboken.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\shiboken6\Shiboken.pyd
Size 32KB
SHA256 3c7bd6e76d550fe2cdc09d55d9d963901808f53821ba73638f50a0b5edac3ad3
MD5 b91550ac586d2756daeccced03217e53
SHA1 b77ca214e3674b2a7c8518b47e0aa5343eab665c
SHA512 4e928c742024884706f7d72271ee92cf6af37dcbb9fc38f0ef2d668fa34cfbaa40e3553d772ca9e0506b621e5f24dd66c43290a4d49be673c3c72415f2cbfe8f
SSDEEP 384:I+sHLVLzhBejQiKIJm2Um4WDa9xzfVEFP27xWkVbGW/JrZWv6vAW9NfNQe:bsHJPEzCm44yRNgKxnVbGYJ9y6YWNGe
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\shiboken6\VCRUNTIME140_1.dll
Size 40KB
SHA256 9e079e055785e4789d2ed308852d875cf70be7cb53d334a9af15ff14f4673d91
MD5 b2671b632966978db04375a3b82262a7
SHA1 93724832707db234d866bc3457f954e6ccf78552
SHA512 34e450248f89e08b3e0bee6de83ee160dfe29a13362bf4859912b9dab0010622a3796ffe68fbafff4e8c6e4aef6adebf669f0a40df5219b5243553b01b376a7b
SSDEEP 768:wPIyGVrxmKqOnq4j3z6S6t7CkgKxnVbGYJd0Nt:fBr89uWZ1CkgKxngGW
MD5 SHA1 SHA512 SSDEEP

Submit Download

shiboken6.abi3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\shiboken6\shiboken6.abi3.dll
Size 361KB
SHA256 9c419a4975a639b05e7397bbf48647dc2893de9122ae0bf810978349dd78852f
MD5 46ae8a67cc2de336fb5814fe0d8fbae3
SHA1 11e937fd8d1c6903d9519313cf2d7c8616a869bf
SHA512 87d0bd5ab68221b537b72350cdcc9f894434465ac70607b2a94af657bb9b28fd18d80b37fbbe23c5050989542ee46b0443781004f3cf503b878ca3cc2c0bfd92
SSDEEP 6144:PRU5ESGlSwzNkTdN5M2JoKXbKZVD/AbrBHKoei5SQDM/Fa:pU5qwwzNQ75eZFA193ca
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\tcl86t.dll
Size 1.8MB
SHA256 a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6
MD5 ac6cd2fb2cd91780db186b8d6e447b7c
SHA1 b387b9b6ca5f0a2b70028ab2147789c4fe24ef7a
SHA512 45b24ca07a44d8d90e5efeded2697a37f000b39d305fe63a67292fdd237de3f8efd5e85b139b5702faa695f9f27f12f24ac497e005e2f3c24c141d7cd85305b6
SSDEEP 24576:6NJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBHU:6Ngjid2LD5W4ac6xdLvIkhHP4ATdeDZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\tk86t.dll
Size 1.5MB
SHA256 20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94
MD5 499fa3dea045af56ee5356c0ce7d6ce2
SHA1 0444b7d4ecd25491245824c17b84916ee5b39f74
SHA512 d776749effa241ba1415b28d2fcff1d64ed903569a8c4e56dfddd672a53b2f44119734b1959b72a9b3f4060bb2c67b7dea959cc2d4a8e9f781f17009c6840fc1
SSDEEP 24576:q1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58aVJkwd98ydeyRP/oAT:qIyQD9FU43GLUKuPO6EinYTVAFSvESaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60922\unicodedata.pyd
Size 1.1MB
SHA256 b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532
MD5 1905b5d0f945499441e8cd58eb123d86
SHA1 117e584e6fcc0e8cfc8e24e3af527999f14bac30
SHA512 ed88cd7e3259239a0c8d42d95fa2447fc454a944c849fa97449ad88871236fefdafe21dbfa6e9b5d8a54ddf1d5281ec34d314cb93d47ce7b13912a69d284f522
SSDEEP 12288:P3EYbfjwR6nbsonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1JD:PUYbMB0IDJcjEwPgPOG6Xyd461JD
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_gcbe24h1.mhd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gcbe24h1.mhd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 99e6a7e9ceed7ba205e0e9add4b7d1bbd875bc1b59a299c56138fcd1c74d087e
MD5 f272f2b7cc48fa06df461c2b4195a059
SHA1 e0cfef525c4b9e9ffca5d55694e926478fb90844
SHA512 dbfcb6336843ae10bc98ffed51fac715d2901d9de3e92688ace58354489d26be40f35e6a32ed3c46db8b4791a848efed03f3c0f7a138a5ba4a0a4652d7c4ee25
SSDEEP 768:0HIiX0QNMGcmhuE9RJgMy5FbPbUb7b3TEv:eIiX5R9Pe
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 5677d81ed3db9ae07b4b31734c0314893f9f1da47c6824bbdbdec3211f6f9673
MD5 cbe0dc5be95a47e0796b3fb491adccab
SHA1 842a892e8c095524dd262a4d48f979fc1890124f
SHA512 b9f4ddc6b1da8c653436c2900fac2a10591198377452d79a83a39068225a7e6478fd230a631be108104b3c687d78b018295e3207c4f175a6a31b9a45a33a2711
SSDEEP 768:NqqIiX0QNMGcmhuE9RJgMy5FbPbUb7b3XEv:/IiX5R9PS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 3a4061517d4f84a3bacec15a6a211becfd78469f60ee3da036230f231a8a03f5
MD5 55621568859e93171d3aad4a9bdf196a
SHA1 93bf2bfeb332967679e4709b081c59c8ac41c9b8
SHA512 56a4a37d5129cd81740df03b13940d2c35844a2738b378b357fbd5ce9984431824746e8022d8967ff4cc245002d281d3c9bade371200b4e3d770a25fbeb02ebf
SSDEEP 768:CIiX0QNMGcmhuE9RJgMy5FbPbUb7b3tiKEv:CIiX5R9P6
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d99a60d8ce7c5afb4a259a0fd3232af9ed9070571039db27a98f7ed60b2fd9c8
MD5 1cd1ab783c0f10344da0f3d63497d096
SHA1 9110e0e450c7181c7d8c53ce0aff1891b348dc9f
SHA512 337e0baee9930cf27bdccae9ae7283f525648a87153c96e708cc44dbd29996b91e5ac5ad36527eede76bc45b74c84a29726480f44b4c012f0231127236176770
MD5 SHA1 SHA512

Submit Download

0f064e85-e09b-43af-8e6f-aa73b731fde3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\datareporting\glean\pending_pings\0f064e85-e09b-43af-8e6f-aa73b731fde3
Size 2KB
SHA256 328bd602eea79185378b245d29a2074b498ef81b2f43e57f80de536e167fdd55
MD5 57ec7c7f4a91b1562aa314d7fa5a16ac
SHA1 4da0b009588660b7da8c01adeef332a840df19d5
SHA512 bd0b5b627e8eb5c236fe512661b8cfd1dd79cb0416f191e9e93508f8fe8a2fb8ddb4e362accc0f23f5a68c74f88b96beeb0b675afeb0453a3011875626a39b2b
MD5 SHA1 SHA512

Submit Download

2f0ba23f-4d34-4dae-baa8-46ac195eee03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\datareporting\glean\pending_pings\2f0ba23f-4d34-4dae-baa8-46ac195eee03
Size 235B
SHA256 9d064e371ae130c7e8818cd9ad0010135ec300ea145dda50fb9f48f3d37bc87f
MD5 5d4d5604b262d5c0ed3157ef8dd4db9a
SHA1 4437ffb85dafd9a97d44cbda40336a8dd88d53f5
SHA512 5fbbd0464838fb4ef7ec4f26b3d7b4a1ea798d8b6ffa88fa4cf7302ef2cf1364254bed21809f02faade3176eb82287d0c09a1cecfc5cf63fb3625ed5c721c6e5
MD5 SHA1 SHA512

Submit Download

3f6fbcd9-acba-4208-8570-1717d01b2835

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\datareporting\glean\pending_pings\3f6fbcd9-acba-4208-8570-1717d01b2835
Size 886B
SHA256 0ba56d9cdb0a814b01e6337ac2779d2e72eb0d44c8f3d5f27fc873d3eb84ecd9
MD5 2e6ef7e78a2a2d5c1f9a2bc8739e3f25
SHA1 59073bb7c1e58f45af82257115ef249b938ee3b8
SHA512 92ff2c51e39dc92adb2f240e8315e8cbc3ed7cb071b8392a6ec0a91212ce4127b883adb6747fb0a5f055ec068a200e24d718c232fb2433dfe6d3ca11fa894ac9
MD5 SHA1 SHA512

Submit Download

e5de6d28-9ddf-4c32-8661-5831fd7c7574

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\datareporting\glean\pending_pings\e5de6d28-9ddf-4c32-8661-5831fd7c7574
Size 871B
SHA256 510984ff6a03864ff0b64093a1743d953427ff2e6a9d0c97b387c999c5bdcd60
MD5 715dbe03f4af9b225bc96b30a559b385
SHA1 328ddd3883ab43cd84902a8e348c4ac93ea26cbb
SHA512 f5d90510cdd8993bc060bffe8a593f6434b40b13b55e4c80558a4f3597bd7d76a73ee1811c888ea6427e8e404c6ee1da40b7878c9f5fa19447a4d45a7e298e96
MD5 SHA1 SHA512

Submit Download

f31d582b-d180-4b2e-9b20-20d9c0a534bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\datareporting\glean\pending_pings\f31d582b-d180-4b2e-9b20-20d9c0a534bf
Size 235B
SHA256 a477d4c1b77e764a7bfc0eee0216760890e6b14d9c10539700482ac899b441bc
MD5 6b373b6755b7347ad1577840bbf63230
SHA1 46b25dbb87fb18c2e2a463fb74df4ca438b92510
SHA512 6796c861a4824320d42c616521420c9e0d28c162770abb011f941406af307d7177f41566a1c912cfdb78999d02c3367a530167a2510a5a2551996eac1a037d66
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\prefs.js
Size 6KB
SHA256 2256e8461f379491f574dcba2e000c6400974e134fee61305a29d5f13ef75c0d
MD5 bb878f681bcc7ca58ea3362f83d64fe9
SHA1 0736272b3e2416a8ea536a349943b2898c0de275
SHA512 92de5152f830f2861454d0b0d6ecb7e5b028d37213fff8c27e856111aa06ae6606850a08ec745f97d8d3fd1b87c6cfba369a8d32cf8543460c751c0c51dc92a6
SSDEEP 96:xHBUTUuqGqAfalk3V1zSJk1SSlqdv9jIfn7XHJcLE7LBw88n8L4cnmgIX:f5RAfaa3VzSSJjXJcEfBw88Pf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xtmph1o1.default-release\prefs.js
Size 6KB
SHA256 0a1acbf22027d0dec5ece1915c3e9bc7b52e65ab1634932450ef37eae39b816d
MD5 9d3003c4215ef3645f9a484d7f289a7b
SHA1 df38852f60281620d4a860f5cda311d9a8b6bf39
SHA512 92a16100d8b6d977d39e0a939ad17ffd1e16bf4ce8ce015ec93d594eea8bdd5c1dc3a858a4ab989e9aecb4fb6afb091bed845ece3a2cc801ed2e29b16f5b1f31
SSDEEP 96:xHBUTUuqGqAfasNy1zSJk1SSlqdv9jIfn7XHJcLE7LBw88n8L4cnmgIX:f5RAfasNyzSSJjXJcEfBw88Pf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3564-1844-0x00000232EE780000-0x00000232EE7A2000-memory.dmp

Download

memory/3564-1854-0x00000232EE190000-0x00000232EE1AC000-memory.dmp

Download

memory/6608-1841-0x00007FF96E460000-0x00007FF96EA63000-memory.dmp

Download

memory/6608-1842-0x00000000655C0000-0x0000000065669000-memory.dmp

Download

memory/6608-1840-0x00007FF96F7C0000-0x00007FF96FB37000-memory.dmp

Download