maskgram_stealer | bbdfa2ddefb09f82e5c69f48d274228ef77ad84f61ae78b500ba71d525afaaff

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/04/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
Size 86.8MB
Sample260407-eke1qsf13p
SHA256 bbdfa2ddefb09f82e5c69f48d274228ef77ad84f61ae78b500ba71d525afaaff
MD5 9ddfb7cf08a3ac6848d7b8328a22d251
SHA1 080eac6d972c2582a411d34bd207bc43b086cb40
SHA512 dd5ea59fd0578fbd6fe75f1199b0380166d8069552493b19e7d6481a48703381b5bb5ee0760c6c042df0218d5274ba1ee559e689e477c1a897659a0353f649a4
SSDEEP 1572864:0EyQbuBJqUeSLAstlQd8eo0OKMhBGUhuGn0fXt8wrmjWVhEZWxQehNExbF:Dy8u6Y3tlQCoOLhEUhv0fXtwqhN+ePAF
TLSH
T1F3182202BA4A2A69C05AC8B0D2474A934F3130DB123BE5BF51E941743F9E7F49B3E795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

7e83a51c839b3d4fcfc0473890b46cda defense_evasion discovery execution maskgram_stealer vidar persistence privilege_escalation pyinstaller spyware stealer

Malware Config

Extracted

Family

vidar

Version

17.9

Botnet

7e83a51c839b3d4fcfc0473890b46cda

https://telegram.me/ho00rq
https://steamcommunity.com/profiles/76561198742173262

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0

Signatures

Detects MaskGramStealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/3404-726-0x0000000000400000-0x0000000000436000-memory.dmp	family_maskgramstealer

Detects Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/864-281-0x0000000140000000-0x00000001400E3000-memory.dmp	family_vidar_v15

MaskGramStealer
MaskGramStealer is an information stealer.
stealer maskgram_stealer
Maskgram_stealer family
maskgram_stealer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Users\\Public\\Music\\NetworkHelper\\MicrosoftService\\onedrive_service.exe"	onedrive_service.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Custom signature

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244a1-67.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/files/0x00070000000244a0-62.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Custom signature

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244a0-62.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	onedriveconect.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	dbcontroler.exe

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	onedriveconect.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	onedriveconect.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	onedriveconect.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	onedriveconect.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	dbcontroler.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	onedriveconect.exe

Looks for VMWare drivers on disk 2 TTPs 2 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	onedriveconect.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	onedriveconect.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	onedriveconect.exe

Modifies Windows Firewall 2 TTPs 6 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4576	netsh.exe
5456	netsh.exe
4364	netsh.exe
4852	netsh.exe
5372	netsh.exe
1392	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dbcontroler.exe

Executes dropped EXE 18 IoCs

pid	Process
2724	onedrive_service.exe
3404	settingkat.exe
864	settingvideo.exe
3432	onedriveconect.exe
5336	settingaudio.exe
3272	hostserv.exe
4084	rustcoregh.exe
6104	claudeupd.exe
1532	claudeupd.exe
5240	onedrive_service.exe
2556	EdgeUpdateSvc.exe
2272	hostserv.exe
5308	AdobeCloudSync.exe
2392	IntelGraphicsHost.exe
3012	claudeupd.exe
2956	claudeupd.exe
1996	dbcontroler.exe
4368	dbcontroler.exe

Loads dropped DLL 64 IoCs

pid	Process
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
1532	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe
2956	claudeupd.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemManager = "C:\\OneDriveTemp\\update_06ece6ef-e83d-40d1-a719-452c01e4c163\\dbcontroler.exe"	dbcontroler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderHelper = "C:\\Users\\Public\\Music\\NetworkHelper\\MicrosoftService\\onedrive_service.exe"	onedrive_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateModule = "C:\\Users\\Public\\Music\\USBProcess\\MicrosoftProcess\\hostserv.exe"	hostserv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\ProgramData\\Microsoft\\EdgeUpdateSvc.exe"	hostserv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SvcDrv462 = "C:\\Users\\Public\\Documents\\MonitorModule\\SecurityUpdater\\claudeupd.exe"	claudeupd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	pastebin.com
16	pastebin.com
54	pastebin.com
15	pastebin.com
59	pastebin.com
127	pastebin.com
130	pastebin.com
136	pastebin.com
143	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	checkip.amazonaws.com
131	checkip.amazonaws.com

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	onedriveconect.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5960	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00070000000244ac-82.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	settingaudio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustcoregh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5536	cmd.exe
5428	PING.EXE
1676	ping.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2148	chrome.exe
2352	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	settingkat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	settingkat.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	onedriveconect.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	onedriveconect.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	onedriveconect.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2920	ipconfig.exe
2860	ipconfig.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5428	PING.EXE
1676	ping.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5256	schtasks.exe
2212	schtasks.exe
5340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
2724	onedrive_service.exe
3432	onedriveconect.exe
3432	onedriveconect.exe
3432	onedriveconect.exe
3432	onedriveconect.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
3404	settingkat.exe
3404	settingkat.exe
4580	chrome.exe
4580	chrome.exe
3404	settingkat.exe
3404	settingkat.exe
3404	settingkat.exe
3404	settingkat.exe
3404	settingkat.exe
3404	settingkat.exe
3404	settingkat.exe
3404	settingkat.exe
1996	dbcontroler.exe
1996	dbcontroler.exe
1996	dbcontroler.exe
1996	dbcontroler.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5960	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
4580	chrome.exe
1096	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2920	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	88
PID 4456 wrote to memory of 5328	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	90
PID 4456 wrote to memory of 2724	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	94
PID 4456 wrote to memory of 3404	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	95
PID 4456 wrote to memory of 864	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	96
PID 2724 wrote to memory of 5372	2724	onedrive_service.exe	97
PID 4456 wrote to memory of 3432	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	100
PID 4456 wrote to memory of 5336	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	101
PID 4456 wrote to memory of 3272	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	102
PID 4456 wrote to memory of 4084	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	104
PID 2724 wrote to memory of 1392	2724	onedrive_service.exe	105
PID 4456 wrote to memory of 6104	4456	2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe	107
PID 6104 wrote to memory of 1532	6104	claudeupd.exe	108
PID 2724 wrote to memory of 4576	2724	onedrive_service.exe	109
PID 1532 wrote to memory of 5536	1532	claudeupd.exe	111
PID 2724 wrote to memory of 5456	2724	onedrive_service.exe	113
PID 5536 wrote to memory of 5428	5536	cmd.exe	115
PID 2724 wrote to memory of 4364	2724	onedrive_service.exe	116
PID 2724 wrote to memory of 4852	2724	onedrive_service.exe	118
PID 2724 wrote to memory of 2212	2724	onedrive_service.exe	120
PID 3432 wrote to memory of 2860	3432	onedriveconect.exe	124
PID 3432 wrote to memory of 720	3432	onedriveconect.exe	126
PID 3272 wrote to memory of 2472	3272	hostserv.exe	129
PID 3272 wrote to memory of 5340	3272	hostserv.exe	131
PID 3272 wrote to memory of 4756	3272	hostserv.exe	133
PID 3272 wrote to memory of 4052	3272	hostserv.exe	136
PID 3272 wrote to memory of 5960	3272	hostserv.exe	138
PID 3272 wrote to memory of 5520	3272	hostserv.exe	146
PID 3272 wrote to memory of 5256	3272	hostserv.exe	148
PID 3404 wrote to memory of 4580	3404	settingkat.exe	152
PID 4580 wrote to memory of 4148	4580	chrome.exe	153
PID 3404 wrote to memory of 4580	3404	settingkat.exe	152
PID 4580 wrote to memory of 3488	4580	chrome.exe	155
PID 4580 wrote to memory of 3488	4580	chrome.exe	155
PID 4580 wrote to memory of 2148	4580	chrome.exe	156
PID 4580 wrote to memory of 5972	4580	chrome.exe	157
PID 4580 wrote to memory of 5972	4580	chrome.exe	157
PID 4580 wrote to memory of 4320	4580	chrome.exe	158
PID 4580 wrote to memory of 5540	4580	chrome.exe	159
PID 4580 wrote to memory of 4320	4580	chrome.exe	158
PID 4580 wrote to memory of 5540	4580	chrome.exe	159
PID 4580 wrote to memory of 448	4580	chrome.exe	160
PID 4580 wrote to memory of 448	4580	chrome.exe	160
PID 4580 wrote to memory of 4700	4580	chrome.exe	161
PID 4580 wrote to memory of 4700	4580	chrome.exe	161
PID 4580 wrote to memory of 1468	4580	chrome.exe	162
PID 4580 wrote to memory of 1468	4580	chrome.exe	162
PID 4580 wrote to memory of 5228	4580	chrome.exe	163
PID 4580 wrote to memory of 5228	4580	chrome.exe	163
PID 4580 wrote to memory of 5240	4580	chrome.exe	164
PID 4580 wrote to memory of 5240	4580	chrome.exe	164
PID 4580 wrote to memory of 2408	4580	chrome.exe	165
PID 4580 wrote to memory of 2408	4580	chrome.exe	165
PID 3404 wrote to memory of 1096	3404	settingkat.exe	167
PID 1096 wrote to memory of 4860	1096	msedge.exe	168
PID 3404 wrote to memory of 1096	3404	settingkat.exe	167
PID 1096 wrote to memory of 2352	1096	msedge.exe	170
PID 1096 wrote to memory of 1248	1096	msedge.exe	171
PID 1096 wrote to memory of 1248	1096	msedge.exe	171
PID 1096 wrote to memory of 5164	1096	msedge.exe	172
PID 1096 wrote to memory of 5164	1096	msedge.exe	172
PID 1096 wrote to memory of 5164	1096	msedge.exe	172
PID 1096 wrote to memory of 1996	1096	msedge.exe	173
PID 1096 wrote to memory of 1996	1096	msedge.exe	173

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-07_9ddfb7cf08a3ac6848d7b8328a22d251_akira_glassworm_icedid_luca-stealer_rusty-stealer.exe"
1⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:2920
- C:\Windows\system32\getmac.exe
  "getmac" /FO CSV /NH
  2⤵
  PID:5328
- C:\Users\Public\Music\NetworkHelper\MicrosoftService\onedrive_service.exe
  "C:\Users\Public\Music\NetworkHelper\MicrosoftService\onedrive_service.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_57001 dir=in action=allow protocol=TCP localport=57001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5372
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_57001 dir=out action=allow protocol=TCP localport=57001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1392
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_57002 dir=in action=allow protocol=TCP localport=57002
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4576
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_57002 dir=out action=allow protocol=TCP localport=57002
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5456
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_56001 dir=in action=allow protocol=TCP localport=56001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4364
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_56001 dir=out action=allow protocol=TCP localport=56001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4852
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /F /SC ONLOGON /TN WindowsUpdateAssist /TR C:\Users\Public\Music\NetworkHelper\MicrosoftService\onedrive_service.exe /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2212
- C:\Users\Public\Music\IntelDriver\MicrosoftModule\settingkat.exe
  "C:\Users\Public\Music\IntelDriver\MicrosoftModule\settingkat.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffb69cc728,0x7fffb69cc734,0x7fffb69cc740
      4⤵
      PID:4148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1924 /prefetch:2
      4⤵
      PID:3488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --force-high-res-timeticks=disabled --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2184 /prefetch:3
      4⤵
      System Time Discovery
      PID:2148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --force-high-res-timeticks=disabled --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2332 /prefetch:8
      4⤵
      PID:5972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3128 /prefetch:1
      4⤵
      PID:4320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3668 /prefetch:2
      4⤵
      PID:4700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4012 /prefetch:2
      4⤵
      PID:1468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:5228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3968 /prefetch:1
      4⤵
      PID:5240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1928,i,3843658452341828268,6453234188002096396,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4496 /prefetch:2
      4⤵
      PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1096240721984 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1096240721984\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7fffa3a0c188,0x7fffa3a0c194,0x7fffa3a0c1a0
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2648 /prefetch:3
      4⤵
      System Time Discovery
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2708 /prefetch:8
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2564 /prefetch:2
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3808 /prefetch:2
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4108 /prefetch:2
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3992 /prefetch:1
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4280 /prefetch:2
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4384 /prefetch:1
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4672 /prefetch:2
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5264 /prefetch:2
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4272 /prefetch:2
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5460 /prefetch:2
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5536 /prefetch:2
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5428 /prefetch:2
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2568,i,4628660658118080402,865840493745770025,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4244 /prefetch:1
      4⤵
      PID:4140
- C:\Users\Public\Videos\DriverHelper\USBDriver\settingvideo.exe
  "C:\Users\Public\Videos\DriverHelper\USBDriver\settingvideo.exe"
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Users\Public\Pictures\SecurityDriver\AudioManager\onedriveconect.exe
  "C:\Users\Public\Pictures\SecurityDriver\AudioManager\onedriveconect.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Checks system information in the registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\ipconfig.exe
    "ipconfig"
    3⤵
    - Gathers network information
    PID:2860
- - C:\Windows\system32\getmac.exe
    "getmac" /FO CSV /NH
    3⤵
    PID:720
- C:\Users\Public\Videos\GraphicsController\SecuritySupport\settingaudio.exe
  "C:\Users\Public\Videos\GraphicsController\SecuritySupport\settingaudio.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5336
- C:\Users\Public\Music\USBProcess\MicrosoftProcess\hostserv.exe
  "C:\Users\Public\Music\USBProcess\MicrosoftProcess\hostserv.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN AdobeCloudSync
    3⤵
    PID:2472
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN AdobeCloudSync /TR C:\ProgramData\Adobe\AdobeCloudSync.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5340
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN AdobeCloudSync
    3⤵
    PID:4756
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN AdobeCloudSync /FO LIST /V
    3⤵
    PID:4052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\OneDriveSync.lnk'); $Shortcut.TargetPath = 'C:\Users\Public\OneDriveSync.exe'; $Shortcut.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN DiagnosticsCloudHost
    3⤵
    PID:5520
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN DiagnosticsCloudHost /TR C:\ProgramData\Intel\IntelGraphicsHost.exe /F /RL HIGHEST /RU SYSTEM /SC DAILY
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5256
- C:\Users\Public\Documents\ServiceAdapter\AudioSupport\rustcoregh.exe
  "C:\Users\Public\Documents\ServiceAdapter\AudioSupport\rustcoregh.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4084
- C:\Users\Public\Documents\MonitorModule\SecurityUpdater\claudeupd.exe
  "C:\Users\Public\Documents\MonitorModule\SecurityUpdater\claudeupd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Users\Public\Documents\MonitorModule\SecurityUpdater\claudeupd.exe
    "C:\Users\Public\Documents\MonitorModule\SecurityUpdater\claudeupd.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 1 127.0.0.1 >nul
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:5536
    - - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5428
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\OneDriveTemp\update_06ece6ef-e83d-40d1-a719-452c01e4c163\check.bat
      4⤵
      PID:1248
    - - C:\OneDriveTemp\update_06ece6ef-e83d-40d1-a719-452c01e4c163\dbcontroler.exe
        
        "dbcontroler.exe"
        5⤵
        Looks for VirtualBox Guest Additions in registry
        Looks for VMWare Tools registry key
        Checks BIOS information in registry
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1996
      - C:\Windows\system32\ping.exe
        
        "ping" -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1676

C:\Users\Public\Music\NetworkHelper\MicrosoftService\onedrive_service.exe
C:\Users\Public\Music\NetworkHelper\MicrosoftService\onedrive_service.exe
1⤵
- Executes dropped EXE
PID:5240

C:\ProgramData\Microsoft\EdgeUpdateSvc.exe
C:\ProgramData\Microsoft\EdgeUpdateSvc.exe
1⤵
- Executes dropped EXE
PID:2556

C:\Users\Public\Music\USBProcess\MicrosoftProcess\hostserv.exe
C:\Users\Public\Music\USBProcess\MicrosoftProcess\hostserv.exe
1⤵
- Executes dropped EXE
PID:2272

C:\ProgramData\Adobe\AdobeCloudSync.exe
C:\ProgramData\Adobe\AdobeCloudSync.exe
1⤵
- Executes dropped EXE
PID:5308

C:\ProgramData\Intel\IntelGraphicsHost.exe
C:\ProgramData\Intel\IntelGraphicsHost.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4508

C:\Users\Public\Documents\MonitorModule\SecurityUpdater\claudeupd.exe
C:\Users\Public\Documents\MonitorModule\SecurityUpdater\claudeupd.exe
1⤵
- Executes dropped EXE
PID:3012
- C:\Users\Public\Documents\MonitorModule\SecurityUpdater\claudeupd.exe
  C:\Users\Public\Documents\MonitorModule\SecurityUpdater\claudeupd.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2956

C:\OneDriveTemp\update_06ece6ef-e83d-40d1-a719-452c01e4c163\dbcontroler.exe
C:\OneDriveTemp\update_06ece6ef-e83d-40d1-a719-452c01e4c163\dbcontroler.exe
1⤵
- Executes dropped EXE
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

checkos.bat

Path C:\OneDriveTemp\update_06ece6ef-e83d-40d1-a719-452c01e4c163\checkos.bat
Size 85B
SHA256 54dab0dbf73de81d5b13c9b54c94fdb5e5982fcc07448ad7fad43c3a8951e26e
MD5 58ab2b7d765696d818758799ab1099cd
SHA1 cc7df677ab03509dce2e186955ca1ec4c87063fc
SHA512 1777ec5bac6bb9749f149fdf2048d70ecb7836aa5541360d49c3dee3b71685aa59bb9635fe0e0dfcb05229b2508db01dfb2e1aac5bb5d0b20cd8da45b65df920
TLSH
T123A012C8036050011562108689701C483A4C4006A10A02123400D88D271CD3512974A8
MD5 SHA1 SHA512 TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4580240720531\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1096240721984\Crashpad\settings.dat
Size 280B
SHA256 fced714662a3dd69c5d2c4affcfeda7b2788fe8444c1f1ee3cfd8929910f8ee8
MD5 0d446b7af9df1e242d72582e5cb300d8
SHA1 02d8f212a29c05034ff11a8518d8ed0e5155ca68
SHA512 874fcdb3345eaefc7c304f464c4dc8e40ee8cc1facb931ab020764564dc3f4433032d452fec2a9f20db9af445bf2618823f315b517d39f92debb5fe9ee187a1f
TLSH
T1B7D0222BFBCB3200C20C30FE002C03000E0CC20822030388002880C22F2200000EACFB
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1096240721984\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1096240721984\Local State
Size 4KB
SHA256 8e36ba159471a38b2b96a2a967277f760e322352d472bf78e3c4280ae484894e
MD5 caf3f7343494fd335d0f523ca2432a7c
SHA1 8cf5d7f91c018f56393d8f37509df40d4f8a493a
SHA512 3880004cf2a52905fe631dd0c48ef638d21dabfca71d9da217ee7e5d327c6dfc30a00c3120a5846451d55a9f025be6ade3b10e9d4ba5c6d38ad3dbd8a3999916
SSDEEP 96:DqGNkrQsFfcxYZu58Frh/cInURcDotovJqDHBsnvgmfYTH0eUckEmSnq4a:GGN7d6rocDUwOhcfYj1uv
TLSH
T174A194326578AC77CEF29F45B48A2623AFB5312BE5957F98DADC1A1C00D76881381C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1096240721984\Local State
Size 3KB
SHA256 7ad605cea7263687778bcab02be60dd14920a1e39eff739ffbd714b4e61e834a
MD5 88a29c51bebc21c3e1d573e361efa599
SHA1 108266a78a17203df5ca5f4180464fab07f235a0
SHA512 9c2aa92ffd109dcda8232ac4f693d37445cad80d3716dc9f95e01e2a80db32da6d878e0b0f251bb0f8f045b91b58b285bc8e1299017fad5301880b32ac93291d
TLSH
T17F81943268687CB7DBF25F45B54A66239F75302BE6626B84DAC8131C00DB6581385C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe592234.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1096240721984\Local State~RFe592234.TMP
Size 1KB
SHA256 6d0bb317bde5973a3b2373c9f44efc2cee98f5e81b1acd17fbcd77046de4be2e
MD5 046c1595b4614a96eb0f5d5623b53595
SHA1 247d0e7e747b08707f38855831a3ad3fe12dd05d
SHA512 9b1aa672841b848da4d31459db526a3692c121a01faae1581e715248b3c5b8659cd4bbc6ea6aeca431c38abce8c87fb6fe1250379504f998cf99c626c94c6b3b
TLSH
T170319572A8AC2C73ECA21B56B78A73736D3430369257BB8C56CD060C01E768C5256D3B
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\_bz2.pyd
Size 82KB
SHA256 706d4a0c26dd454538926cbb2ff6c64257c3d9bd48c956f7cabd6def36ffd13e
MD5 59d60a559c23202beb622021af29e8a9
SHA1 a405f23916833f1b882f37bdbba2dd799f93ea32
SHA512 2f60e79603cf456b2a14b8254cec75ce8be0a28d55a874d4fb23d92d63bbe781ed823ab0f4d13a23dc60c4df505cbf1dbe1a0a2049b02e4bdec8d374898002b1
SSDEEP 1536:RS7z7Sj2u5in5IVfC83zYxzbdK87kW1IACVw7SyrxX:I7z+jum3MJdN7kW1IACVwX
TLSH
T1D0838C93A76165B5F46B82BA99C10323E730FD550350939FF384831B2F22F92BD6536A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\_ctypes.pyd
Size 122KB
SHA256 f20dfa748b878751ea1c4fe77a230d65212720652b99c4e5577bce461bbd9089
MD5 2a834c3738742d45c0a06d40221cc588
SHA1 606705a593631d6767467fb38f9300d7cd04ab3e
SHA512 924235a506ce4d635fa7c2b34e5d8e77eff73f963e58e29c6ef89db157bf7bab587678bb2120d09da70594926d82d87dbaa5d247e861e331cf591d45ea19a117
SSDEEP 3072:DGR936Xz4mHFK0K+bRFOoP+Szlf/EZZBKYyucV6rOoZIALPEA:qQHLK+bvvPNhf/Ei6CoX
TLSH
T1B3C36B07335400AAEBA35178C5B36F07DBB1B45B4B2093CF02A4C69A2F637936D6E756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\_lzma.pyd
Size 155KB
SHA256 6216173194b29875e84963cd4dc4752f7ca9493f5b1fd7e4130ca0e411c8ac6a
MD5 b71dbe0f137ffbda6c3a89d5bcbf1017
SHA1 a2e2bdc40fdb83cc625c5b5e8a336ca3f0c29c5f
SHA512 9a5c7b1e25d8e1b5738f01aedfd468c1837f1ac8dd4a5b1d24ce86dcae0db1c5b20f2ff4280960bc523aee70b71db54fd515047cdaf10d21a8bec3ebd6663358
SSDEEP 3072:Fik7me1FFD+znfF9mNo+Mu6tmxzE41IAZ1Ak:FikSiUNYO+J1E4b
TLSH
T1B3F34A92A394F4D5F7628C78D6624F17E7F678090310829A02CCD36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 7603e172853a9711fbdc53b080432ad12984b463768dbc3aa842a26f5b26ae23
MD5 a148dc22ea14cd5578de22b2dfb0917f
SHA1 eaccb66f62e5b6d7154798e596eabd3cef00b982
SHA512 4e3c927692fc41889b596273aea8bbd776cf7644dae26c411c12bda23cd3299a5c9adc06a930294310f002de74592a244767378fc9e37ec76e86bfa23f4c0478
SSDEEP 192:CFOhoWyhWoWGxVA6VWQ4OW4EpDYwuvyGI+X01k9z3ARfQvoSOJ:CFJWyhWwxdwmwaNrR9z2fAoS
TLSH
T10DA22A838DA89507F9EBAEB046E9D8437C3DABC3195091192AA4F51D1CE33D1EB1473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 c08be448195f46c4b423d0ce0c2cdc343e842ff1f91b16a8d3c09d5152150917
MD5 3095c9577395249e105410bdcc585f77
SHA1 7dfc0c81f8f28cbf36c5acdb83523569b430b944
SHA512 555568fc23ade238bcc13a447520d395546def4409a002d795dd3abea03b15321491bc63c97f4ed8eb78aa411a0b1267dce5c528e51dcac8ca9e93b8f5265786
SSDEEP 192:2WyhWmWGxVA6VWQ42W91CH+BEg7X01k9z3A7V3FumS:2WyhWSxdulR9zQNFVS
TLSH
T183A23C839BBC9103FE9BAE7042ADC9433C3E57D61E40906616E9F5482C97785AB2077E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 b44646453584305d4edf8ab5f5d1adea6b9650bd2b75f8486fc275be52b86433
MD5 a00ebd3cf88d668be6d62a25fa4fb525
SHA1 edb07eafd08991611389293e2be80f8ee98f1e62
SHA512 d63f0e9f2e079ee06aa3ab96a0bd2d169564896027b731ee2597327bdc55456c5fd0c2d8c7e68165fc80bbc3fe0c24a3388d4c3615f33fc9f9fc0b205ae9ba7a
SSDEEP 192:lWyhW/WvkJ0f5AbVWQ4+WeGTCYKKWDKHjj3SX01k9z3A8G3Uqc1Dy:lWyhWLaab4Tk+Hj+R9zQ/cI
TLSH
T195A22BD29ABCA043FEEA6D7092E8D9433C3D57D75D44906A0988F4481983785EF24B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 7388a019922e9a0a3d05a8605a5307e3141b39f7d57b7faca5d34e72adfd5fa5
MD5 98340ffd2b1d8affef27d4b1260aeac5
SHA1 b428b39aa814a7038a1ddff9b64b935f51833a26
SHA512 6165c5be0360d55403e9dfd4e9df4ff9a12e5fb6057ed9278da09e688751487e46d9dd64949375c00764cbb4355cc13a1ea714055050f2ab7d432977b8443f81
SSDEEP 192:mDzmxD3T4qPWyhWtWvkJ0f5AbVWQ4OWpjL+CjH64NPsWFX01k9z3A/jMzy6oQfKg:uzQ5WyhW9aabOH+qaq1FR9zFzy6o+
TLSH
T10EA22A8287AC9043F9ABBE7063A8D9437C3C6BD7294091591598F95838977C1EF34B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 41c5c577fea3ce13d5beb64ce0920f1061f65bcf39eafa8cd3dfc09ff48bcf76
MD5 abf9850eb219be4976a94144a9eba057
SHA1 3d8c37588b36296240934b2f63a1b135a52fcee2
SHA512 dfaafb43ce7f05b2db35eac10b314fb506c6aada80f6c4327b09ec33c170478ebd0eea19f1c6ca2e4832bfa41f769046deca8f15d54b7966134d166ee6036bda
SSDEEP 192:IaNYPvVX8rFTseWyhWGWvkJ0f5AbVWQ4OWKuWrg4NPsWFX01k9z3A/jMzyVy4Jt/:+PvVXIWyhWmaabiq1FR9zFzyVy0t/
TLSH
T1CEC2EA93D9A4E297F8CFAE7151A5C8436C3853D70414818A1BD8A75C3CE7386D7A8AAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 3e3eb284937b572d1d70ce27be77b5e02eb73704c8b50feb5eb933db1facd2fc
MD5 2b36752a5157359da1c0e646ee9bec45
SHA1 708aeb7e945c9c709109cea359cb31bd7ac64889
SHA512 fc56080362506e3f38f1b3eb9d3193cdb9e576613c2e672f0fe9df203862f8a0f31938fa48b4ff7115dfe6016fa1fd5c5422fdc1913df63b3fde5f478a8417a1
SSDEEP 192:WzGWWyhWLWGxVA6VWQ4+W8ksj6IVnKaQwP7yX01k9z3ATESQ:WKWWyhWrxdME6zaHeR9zKe
TLSH
T15CA23AC28AA85442F99BBD7052F8C147BC3D67D79950916506E9F58C28833C6EF2073E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
SSDEEP 384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
TLSH
T1DE8218C1DABCE043FDC7ADB06298DA877D3CA7C31D10815A00A9F6A92CD73D59B14A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 47dfbe1ecc8abc002bd52dcd5281ed7378d457789be4cb1e9bee369150d7f5c8
MD5 567ff20a8d330cbb3278d3360c8d56f5
SHA1 cdf0cfc650da3a1b57dc3ef982a317d37ffb974d
SHA512 1643e900f13509f0ef9c7b7f8f2401fb3b6f2c0c39b512c623615df92b1e69df042ef1a0c6aace82173ce5d4d3c672c1636d6ee05545ce5c3b7374ab745e0e87
SSDEEP 192:J3WyhWMRWGxVA6VWQ4OWdRzPyGI+X01k9z3ARfQvaB:J3WyhW4xdOLNrR9z2fAa
TLSH
T119A22A91DA6C9547F9EB6E7042E9D9837C3DA7C71950C06A0AE4F5481CA33C1EB24B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 8fcc9a97a8ad3be9a8d0ce6bb502284dd145ebbe587b42cdeaa4262279517c1d
MD5 a8b967b65232ecce7261eaecf39e7d6d
SHA1 df0792b29c19d46a93291c88a497151a0ba4366d
SHA512 b8116208eb646ec1c103f78c768c848eb9d8d7202ebdab4acb58686e6f0706f0d6aaa884e11065d7ece63ebbd452f35b1422bd79e6eb2405fb1892758195ccbb
SSDEEP 192:mdxltWyhWPoLWvkJ0f5AbVWQ4+WbfiYKKWDKHjj3SX01k9z3A8G3UqcHmczE:mdxltWyhWgfaabn+Hj+R9zQ/cH9
TLSH
T178A23A9BCBBCA143FEABAD7052E4D9433C3D67C6190091661A98F1981993391DB34F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 0dff50774693fcb71782b5e214419032a8c00b3031151d93be5c971b6f62cd45
MD5 5872cb5ca3980697283aab9007196ae6
SHA1 26e8de47d9bee371f6c7a47f206a131965b6b481
SHA512 9b3e2fa9f66d29bfc7a4ca5d673b395bcda223a85fd06c94a11217047c1a312148c9c6270d7f69dfef06b25f8b5ad46717a829bde55f540c804a4ba4c4af070c
SSDEEP 192:bsWyhWJKWGxVA6VWQ4mWGAJSh+kSobX01k9z3AITaNRkXE:IWyhWJ+xdwSK+R9zrTyWXE
TLSH
T1CFA22A828ABC9143FEEB6E7042A8D5833C3D97D76910806616D4F58C1CDB7D5EB20B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 de3d2c5519f74a982f06f3f3fda085571c0cdcf5ad8d2d331c79d9c92062bdc3
MD5 d042aa497ce2a9f03296f8de68ed0680
SHA1 f483a343a18b960630ccf0e6de2f82883550f3bf
SHA512 4e157c8701860982ce0dec956fe4bfb684d2db3eaa9e784f179d385be905fd0551ba90cc27c54179fc39a693d9c742364f2bf1a5444424ba5eae38103b5f0e02
SSDEEP 192:nTvuBL3BBL8WyhWEWGxVA6VWQ4aWkFAmm2oRanX01k9z3AXmTNS:nTvuBL3BWWyhW0xdpzoRoR9zmMNS
TLSH
T16DA21AC28AAC9143F9EAAD7042A5D8873C3D67C79911D46946D8F65C2CE33C1EB2077E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 642b01bb93d2cb529acf56070d65aae3202fd0b48d19fd40ec6763b627bcbee6
MD5 3589557535bba7641da3d76eefb0c73d
SHA1 6f63107c2212300c7cd1573059c08b43e5bd9b95
SHA512 7aedf3cf686b416f8b419f8af1d57675096ab2c2378c5a006f6ecbf2fe1ad701f28b7be8f08c9083230cf4d15d463371e92a6032178cd6c139d60b26fbd49b06
SSDEEP 384:dnaOMw3zdp3bwjGzue9/0jCRrndb7WyhWmxdjOOP5AR9zhCa:sOMwBprwjGzue9/0jCRrndbh9BOOPO9b
TLSH
T150A22982D694D20BF88DED71306BD4873C3957C6581295A603E5FF2839E3386EB6076D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 3500935e638f7d0ae2bf564bf77f9329811329261185fcdb9cd702b999889ffd
MD5 064fb2e1b5e90796a68d1edf91269ad3
SHA1 6e3a8c568f038879b7b102975a4471b2489f5493
SHA512 821f091529d45531811a73664473cebb372a310d855e1a4c1a028ad4dc7d36146d3030dcf10de8a4a4bf16fb535fe3d0d2e1fcd22959690842388abb177b0036
SSDEEP 192:yAWyhWKWGxVA6VWQ4aW1n4h+kSobX01k9z3AITQTGUBAPy:yAWyhW+xd7K+R9zrTQGUBAPy
TLSH
T14FA23C8686BC9407FDABAD7052A9CA537C3E57D75C90806512E4E1081CE33D5EB2077E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 75652caf05e86adc88ed214fd208b4a289489cac2b28fd358e302e2e7c3c338f
MD5 d1bc9b3a7aa94d10c41fa16210aa9dba
SHA1 a358b824b1f26ead420d2100e5f1a3fb74af2b7a
SHA512 149478dfca0165d5a68e89070017cda3400926284eaa2143a810138ff710079cde413c031721de5b58cb834f03d4c5df5b4bd6c2bdb65687755ad77cae778b30
SSDEEP 192:uWyhWrLWvkJ0f5AbVWQ4OW1aX5F5CrIYYDX01k9z3AFZaLSq:uWyhWzaab35G7YDR9zua3
TLSH
T1C5A22AD595688142FDAF6EB042E8D9433C3D97CB2A41816656D8FD982CD37C0EB34A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 77fc9adf1a734d9717700b038b98b4337a494fc4f7e1e706c82e97dbca896fd8
MD5 4f1303827a67760d02feb54e9258edb1
SHA1 340d7029c39708d14da79b12a0e2ed0a8bc7c020
SHA512 20f067d1c2749c709e4fc45da8d9eb5b813f54d0e09fa482d00bc4a7e5744c587d0afc00cdd5263b4223fe94baa3f8ca110d010339f9e3f1c6b2700888dbe3d0
SSDEEP 192:KEFPiWyhWohWvkJ0f5AbVWQ46WKxzw7aaXYKKWDKHjj3SX01k9z3A8G3UqcQxeZ:VFqWyhWo5aabxdgT+Hj+R9zQ/ct
TLSH
T133A24AC29ABCA103FADA7D7042E8E8673C3C57E71C40906A1698F64829D7741FB14B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 34f560c3e56f40db5df695c967b6e302e961085bc037bb9a1c2d2c866a9df48f
MD5 73586decad3b3d90653750504b356a5c
SHA1 39a7ee1660ca1291314ef78150e397b1d8683e03
SHA512 9ec299e930d2b89ad379613f8fa63669ec7c858da8a24608b92175f42b0be75f8aa2e1727dabf7638ae9d2942d03840f288eab53f2c9f38dbea1325f1ea8b22b
SSDEEP 384:nck1JzNcKSIAWyhWq+xdGA7OOP5AR9zhCaopy:XcKSBiTOOPO9zXQy
TLSH
T1FBA22CD585ACD283F8CEAD706265D9573D3A838A1D29807106E8F19C3DFB3C2D62423D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 ba9fbd3a21879614c050c86a74ad2fffc0362266d6fa7be0ef359de393136346
MD5 774aa9f9318880cb4ad3bf6f464da556
SHA1 3a5c07cf35009c98eb033e1cbde1900135d1abf8
SHA512 f7b57afb9810e3390d27a5469572fb29f0f1726f599403a180e685466237dff5dec4fdce40105ef1bb057e012d546308213e7cec73e0d7d3c5815eec8189a75d
SSDEEP 192:l/DfIegWyhWCWGxVA6VWQ4OW5FJxcVO2dPaIAX01k9z3A0Dean:l/DfIegWyhWmxdsaOOP5AR9zhCan
TLSH
T148A219C19A6C9443F8EBAE7052B9E9873C3E97C76920C06615E8F15C1DD7382FB2066D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-profile-l1-1-0.dll
Size 21KB
SHA256 4c425fbb8d2319d838733ab9cec63a576639192d993909e70cf84f49c107f785
MD5 1be729c6d9bf1b58f435b23e7f87ba49
SHA1 4b2df3fab46a362ee46057c344995fa622e0672a
SHA512 ceccc5ff2bd90a91cfbb948f979576795ff0a9503ddaafd268c14306f93d887975bd376b62ed688be51bb88b3a0c54ef332be93b4b0d8737b5ab70a661b11416
SSDEEP 192:PWyhWInWGxVA6VWQ42Wdl7jjH+BEg7X01k9z3A7V3JwSL:PWyhWIfxdajsR9zQNJwC
TLSH
T193A22C82D7789043FEAAAE7052A8C9437C3E67C65E10D06715E9F5981C933C5AF2077E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 21KB
SHA256 d9c6f93c4972db08c7888d55e8e59e8aba022d416817d65bc96e5a258c859b5f
MD5 0b30c6862b5224cc429fe2eb2b7bf14b
SHA1 5c3affa14e3bfdafe09e9841a2920b57c7fcbc56
SHA512 b378f2a2812245ea948d81a925d041dbd7e7a8fb2770cf7dd47643da20f5c685c6121479f95b293177a9480290b17c49e7b4fc10d33734cf883d2c614daae1bf
SSDEEP 192:cGeVjWyhWqsWGxVA6VWQ4eWkR7O2dPaIAX01k9z3A0Dea79VPtcnShB:cGeVjWyhWqMxdF7OOP5AR9zhCa79VSSH
TLSH
T1E5A22BD6AA684002FDDAAE7042ADD99B7D3E5BC66894D07205D8F4981C933C0EF20B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-string-l1-1-0.dll
Size 21KB
SHA256 eadf535795df58d4f52fc6237fe46feb0f8166daca5eaaa59cec3cee50a9181d
MD5 b65933f7bcadc7072d5a2d70ecba9f81
SHA1 c53561755b9f33d0ae7874b3a7d67bedcb0129d8
SHA512 4cbb8bda8609404fe84ca36a8cbfe1d69c55dee2b969231b2fa00ca9139d956196a2babbb80a1a2bb430a34e6bd335294f452bcbe9e44411561ebdf21e4aba91
SSDEEP 192:kZyMvrNWyhWlWGxVA6VWQ42WEyzQTb8o+X01k9z3AC7HAXx:kZyMvJWyhWxxdmI+R9zFsB
TLSH
T192A23BA2D7789542FDEBAE7002A9D9837C3E67D72A10907A15D8F40C18533C5EB24B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-synch-l1-1-0.dll
Size 21KB
SHA256 9d3f803dc791d2ff2e05059f9bb9207cc8f4134e1ac05f20edd20cfadd6e72c0
MD5 bccc676f2fb18c1a1864363e5a649a88
SHA1 a095a83a32a4a65fe16aa0be9a517239fac5db0d
SHA512 55aab9fa6f7c4904e4beea4ce250f45fb71c2dd6a6f099f4017101ebc45c0a6e303b6a222f49c971992cafe8988a042b7ef8e94671be858c926105021514737a
SSDEEP 384:Okwidv3V0dfpkXc0vVaC4WyhWXxdAQ4HR9zmLbe:ZHdv3VqpkXc0vVajg54x9zA6
TLSH
T1AEA22882C6E4A64BF9AFDDB002EAC1537C3857C64A10C43611D9E61C3DE33D4EB25A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-synch-l1-2-0.dll
Size 21KB
SHA256 a24dd6afdb4c4aa450ae4bc6a2861a49032170661b9c1f30cd0460c5dc57e0f7
MD5 b962237df7ea045c325e7f97938097cb
SHA1 1115e0e13ecc177d057e3d1c9644ac4d108f780a
SHA512 19ac4cccaaa59fbae042d03ba52d89f309bd2591b035f3ec3df430ff399d650fcf9c4d897834a520dea60dc0562a8a6f7d25a1fffcd32f765a4eaffe4c7d5ea2
SSDEEP 192:utZ3FWyhW3tWvkJ0f5AbVWQ42Wa+YcTH+BEg7X01k9z3A7V3lmG8D/:utZ3FWyhW39aabYYZR9zQNlmG8z
TLSH
T1DBA24B97D7989143FA9AADB083D9C4837C3D1BC60A10506616E9F1582CE73C5EB20F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-sysinfo-l1-1-0.dll
Size 21KB
SHA256 abe4c1464b325365d38e0bc4ae729a17a7f6f7ba482935c66e6840e1b0d126c5
MD5 e4893842d031b98cac1c6f754a2a3f8d
SHA1 2b0187134e40d27553a85dd4ec89dd6c40e58a24
SHA512 fc61a66fdc7213857f204bd0b20671db7092e0010e07b5e0e8e8408ace8ac5b6e696a7d9fc969233b2b3ad5dae4d3b291b007ff27a316e7fb750bfc93257c532
SSDEEP 192:dgdKIMFqumaRWyhWZWGxVA6VWQ42W1Q3AQTb8o+X01k9z3ACQK6+HJJB3:yW7RWyhWNxdS3I+R9zFdr3
TLSH
T137A22BA3DAB8E102FCEB6E3011DAD6873C3967D65911C12A06D4F61C6DA37C5E72063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-timezone-l1-1-0.dll
Size 21KB
SHA256 00d9a7353be0a54c17e4862b86196a8b2bc6a007899fa2fbe61afd9765548068
MD5 b9a20c9223d3e3d3a0c359f001ce1046
SHA1 9710b9a8c393ba00c254cf693c7c37990c447cc8
SHA512 a7d5611c0b3b53da6cac61e0374d54d27e6e8a1af90ef66cd7e1b052f906c8b3f6087f4c6de0db3ae0b099df7689ecde6c815a954b728d36d9d3b5d002ccf18e
SSDEEP 192:+N9WyhW1WGxVA6VWQ42WgD6NoyUs+OX01k9z3AvqJgUm:+rWyhWhxd/2oiR9z9aUm
TLSH
T1F8A219D3C7A88402FCEE6F7042E9D9537D3967E65C50D06A0AE6E44C2CDB7949B20A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-core-util-l1-1-0.dll
Size 21KB
SHA256 de47c1f924dc12e41d3a123b7dcce0260e7758b90fb95ec95c270fc116fc7599
MD5 f7fdc91ac711a9bb3391901957a25cea
SHA1 1cebc5497e15051249c951677b5b550a1770c24f
SHA512 0e03c998622d6bf113e8d3b4dab728974391efecf59df89f938bd22240488e71885c05fb0fa805948b3d9645758409a0966299b26625aa36e3fd6e519ee22769
SSDEEP 192:WWyhWcWGxVA6VWQ4+WsEYKKWDKHjj3SX01k9z3A8G3Uqcu1cYv:WWyhWcxd6+Hj+R9zQ/cOv
TLSH
T15CA229938AB89443FDAAAD7042E9CE433C3D57CA5950A06516D8F1481D933E2EB24B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-crt-conio-l1-1-0.dll
Size 21KB
SHA256 da8fd2fe08a531d2331c1fbee9f4ae9015b64f24a2654a7f82418c86b4ab6909
MD5 9eb2c06decaae1a109a94886a26eec25
SHA1 307ce096bee44f54a6d37aab1ef123fb423ed028
SHA512 7e701cb00a4cab8d5b3ecf55a16fef0103f9be1aa3fd7b53c7bab968708c21e8d1c763ad80a7a8d6c76dd45ddd244c9c9e8944455c2025b4195660b61ac1e8b7
SSDEEP 192:qvYWyhW36WvkJ0f5AbVWQ42WpDZ9H+BEg7X01k9z3A7V3yXmnJ:xWyhW3CaabWZyR9zQNnJ
TLSH
T1F1A22B83A6EC9503FA96AA70A3F9DAC37D3D17C22A4070664895F45838C77D5BF2063D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-crt-convert-l1-1-0.dll
Size 25KB
SHA256 fb9dd774b25ab8e661c922caffb976c37a4d10a631ab65665da60016ef0c4d7c
MD5 87e2934e49d7d111f383673f97d5029e
SHA1 267603d5510b775de3667f7d92bfaa3bd60e6533
SHA512 e6025ad419359ad3e06cc7a3b3b7436464dbbc71b91653833575264a5f8b0d781844a411bcd915d404b9a8c0a056eaf6d4d412723936845b53bfb5368bf5f7a7
SSDEEP 192:U9cyNWyhWQWGxVA6VWQ42WSFvQTb8o+X01k9z3ACVhjT4:9yNWyhWoxdDvI+R9zFn/4
TLSH
T103C2C75396E46F66EADF177220FE8BE729391781269042B4C643E50C3843792BDA7C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-crt-environment-l1-1-0.dll
Size 21KB
SHA256 4bb9d36e0e034652f2331ddb43ee061608f436cbc9e5771b4d27b28fa10f5248
MD5 e41612752a7dfbbe756322cf48e106b9
SHA1 0ec106e926c9837a43e1d7ec8d1a5f03edd5ec3d
SHA512 9bed9399e896d1cc58cc06e8d7ec6cc3345be6d15ca307c670e0f282c9ebe48a6cc1b145c2ecf94d84214cddff8f0d0d720ea984478c74c98e2499c2184638c9
SSDEEP 192:/WyhWnWGxVA6VWQ42WwLGH+BEg7X01k9z3A7V3VoB8:/WyhWfxdJR9zQNVF
TLSH
T1DEA2298287B88543FEDB6E7082B9DA833C3957C65A0090360AA5F55C2C97795BF2073E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-crt-filesystem-l1-1-0.dll
Size 21KB
SHA256 e13edab280e7b3410d7f4ce30a8e8cae64f38652d770fc3bf223206f0c57aaa5
MD5 102a8c01049ef18cc6e8798a9e5d57f4
SHA1 9adef547e03032d8c5525cc9c7d4512fbeb53948
SHA512 a9fbc726f33399f55f70967f3f1bf374589eaad9581d9e94228d39afa06cdce31ed25bdc04805aad361c7cafbeb56ca39f6693259d67457199d4423a61b32263
SSDEEP 192:MpUEpnWlC0i5CVWyhWYWGxVA6VWQ4aWJpaAmm2oRanX01k9z3AXm47Kr:MptnWm5CVWyhWAxdPzoRoR9zmnKr
TLSH
T12CA2F88346E87E02EDAB1F7152FDDBDB3E3D1B86154242629196B41C39D33807F2266A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-crt-heap-l1-1-0.dll
Size 21KB
SHA256 6a24e9cfb0efd9e1b90053d4ebd87fc35144e61ae3f6555c7d400542d648e2b5
MD5 4b038cdc70357d2dec440717ac344a52
SHA1 f67ba87f6830858845a5763381a47893af061bf8
SHA512 9557f15fa3c06de89ea8be0c959b94575a1c4587151687730f9e66fed095feb882d43ea32262000f871e6d860ce0c6c341cf5509a6ce81866f6d0efacb8526fe
SSDEEP 192:evh8Y17aFBR4WyhWn8WvkJ0f5AbVWQ4+WkY4YKKWDKHjj3SX01k9z3A8G3Uqc++V:oLNWyhW4aaboK+Hj+R9zQ/coP
TLSH
T1B7A23CD386EC5543F9ABAF7052F4DA873C3E57C66D4090668556F09829833C0BF21B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\api-ms-win-crt-locale-l1-1-0.dll
Size 21KB
SHA256 e0e02ea6c17da186e25e352b78c80b1b3511b5c1590e5ba647b14a7b384af0f8
MD5 75f1a5f65790560d9544f3fb70efba51
SHA1 f30a5751901cfffc250be76e13a8b711ebc06bcc
SHA512 b7e285ca35f6a8ae2ccbe21594d72152175301a02ad6b92fe130e1e226a0faad1bfad1bd49857401549c09b50feee2c42c23ca4c19b2845cad090f5b9e8e8f63
SSDEEP 192:LU7WyhWwWGxVA6VWQ4mWFWRPedZmp8TKjX01k9z3AZjTK3:yWyhWIxdcdsWAR9zWjTe
TLSH
T116A21983C6ACA443F99A7EB005F8D6477D3E27C65901902605D6F5882C8339CFA2573E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\base_library.zip
Size 1.3MB
SHA256 390883f9de4552c173a0b3959fa3f00ba092d9a67193a808b80f2c4b6b3a7387
MD5 5c5b49e1ec82b7b5d62fd1b943db571d
SHA1 dae00a2c6b21cb798850ef1b1a5dfa9669d08e40
SHA512 2768425cd35c7f666d1d9de34ae64383c7cafd9ff312ebde6b1904f6ffc858e5c7c69741d5dcd95d31c7bcdff130b1d769e3deb6c81c1bd7fc640963fbc9ed1b
SSDEEP 12288:uFHtzJYTq+zYgEkA1qJuAIaYcLlVzjhgMHKPbdmjttcY+bssF+qYnf1dxOmgR0f:wtJjaYcPzyWKPbdmjttcY+4IqxHC0f
TLSH
T1C955D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\python3.dll
Size 66KB
SHA256 a59487ea2c8723277f4579067248836b216a801c2152efb19afee4ac9785d6fb
MD5 6271a2fe61978ca93e60588b6b63deb2
SHA1 be26455750789083865fe91e2b7a1ba1b457efb8
SHA512 8c32bcb500a94ff47f5ef476ae65d3b677938ebee26e80350f28604aaee20b044a5d55442e94a11ccd9962f34d22610b932ac9d328197cf4d2ffbc7df640efba
SSDEEP 768:LV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/u:LDmF61JFn+/OHZIAL0R7SyHxy
TLSH
T183637012BB54F8A3DBFA69FC39D199CD542B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\python312.dll
Size 6.7MB
SHA256 789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
MD5 550288a078dffc3430c08da888e70810
SHA1 01b1d31f37fb3fd81d893cc5e4a258e976f5884f
SHA512 7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723
SSDEEP 49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
TLSH
T193665A127298C0B9D967A1B4CD13C28FE7B17C51BF10530B31AAB36E2F737A2465A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61042\ucrtbase.dll
Size 992KB
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
SSDEEP 24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
TLSH
T12425AE68F66C0AA9D07BE17CC91B550FE9B23406477096DB03E64BB93E2B7D5163B320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_czvbkbbj.q5f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_czvbkbbj.q5f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~update.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\~update.tmp.exe
Size 803KB
SHA256 c3eede99459a16ca90f7cc62cdae861967413dc1cb5d6393e86f146beaef734f
MD5 14d56915a9c755d780cce18f57152c6d
SHA1 e713f0625d93d51dc5a02c5d03c12134c0375093
SHA512 a391a7bf6cd3a17c7d8bc219ae93bd02125ff971651fc6eeac7d6fe557aab7b8c24da428060d293695f437f21faf2cb5664c8643ce293ae4382eee2052ebfbf3
SSDEEP 12288:Jfu8vPy3bCDOES775bv572iWflBexWhfQu881Fc+1RRn7WcMO0aEicIS:JmkOpEs7dv5Of6xW9HVP1RRnycM1eS
TLSH
T15305D015BE9918EDD0ABC034830646675A32B8860B31BAFF42D542392F6EBF56F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.test_write_access

Path C:\Users\Public\.test_write_access
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

claudeupd.exe

Path C:\Users\Public\Documents\MonitorModule\SecurityUpdater\claudeupd.exe
Size 17.2MB
SHA256 95df095014c50083be957dfae97e383d17400dbb918c82cdc95ebfe9e903481f
MD5 ec024d96bd6c34cf004a1cb4c5315080
SHA1 8d4a8ba979c50de6f27c3a7653ab6aa2c50228cf
SHA512 7f8261121e131f2fe9aaa60e435271027f07762039edd52b394b2b72ff450c7abdf7b22025c07820471a3762ea4f85e9e6aa0b0dc43b78d7a92ac82030c34e0b
SSDEEP 393216:dqgG83524dL01+l+uq+Vv+1+TtIiFMXvB5IjWqQlz15dssQbdF+da:0GVR01+l+uqgv+1QtIH/3ILQBds5F+da
TLSH
T17507334D72B518B9D6D1E23341A248366B72DC8417E2CA9F03FD33951EBBE658D32E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rustcoregh.exe

Path C:\Users\Public\Documents\ServiceAdapter\AudioSupport\rustcoregh.exe
Size 5.8MB
SHA256 984e415b8002eab2bc3a75f8f5fa6c1107f547a6644ead3703cecf7426a19c70
MD5 a42036a50e3b7d2dff7b8aae2ee9860b
SHA1 14bb613c50280ba31a7c126ed0bb6762dd8758a5
SHA512 f869ef48a0b242ee3c9fca1664a4ed49d4029c18ac9afdc7979d7211d2a7e800457756d228baeed00a1deafa815c3f8c63c9480403feef248d1f8b1e4074a7bc
SSDEEP 98304:3PYGySkMwK3HqiclYNfCCek67trvLnxkX6lt4api0W0vCZz2q14FSuM40J8S3ByF:/Ro/K3q/CexNVcufi04aoGSxj8Sk
TLSH
T1D8563303FC95662DE5BE01F3483EDB155C6BE8504F20D9D307D47A8AEAB82E3027D59A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingkat.exe

Path C:\Users\Public\Music\IntelDriver\MicrosoftModule\settingkat.exe
Size 615KB
SHA256 81ce2a25003fdeb06711190ccbf5dc45c33773f4ee7a11b72c53535333e281a3
MD5 ad5b081e856ee406b5e079ff7ccb50ee
SHA1 c0ef441307356fb2ff095b5e176bf708314f109b
SHA512 9d9e9e7af192f53beedfe462f0fce3a459a4d12b7017154c4161c2fbeec84b1b5eca4e7d7324d46a0cce7d4de17d15e5ca95e54296fc1a0315132b544fa3fcb5
SSDEEP 12288:jdjgrGnB2AP7WO1GellTz4UdirHjWocdh:pj2Gnh7/Pllzg4h
TLSH
T1CAD48D03FA6475F6D74282B570064B47FF76BCA41332EAAB14A8B15C3B371786B3A650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostserv.exe

Path C:\Users\Public\Music\USBProcess\MicrosoftProcess\hostserv.exe
Size 2.4MB
SHA256 5a4033aa864e8c6e3cf8c973b426aff8128a3397feb65fc5de4e3a9fb41ebb6e
MD5 9eb13e6c32407722cf725c28eb2540c0
SHA1 74dcf10e01e0cbf28388286555e02a6532e07c16
SHA512 eb216a63e4415cbcace5ec67c391844e164aa7b22bcf01d0842290d030d9257fb1b3966d518756a544656c54d0e68cc8f987bba30938c50b8cbeb9a654757496
SSDEEP 49152:xveMSYTUBAGcW3o1hRbw50878am22QWHCGcOeQK5xIaRYIU6iG:xmXjkbXzEQKn+G
TLSH
T139B58D03F59585EAC89DC47883579637BB32B8890730BBEB2BD48A212E57F906F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onedriveconect.exe

Path C:\Users\Public\Pictures\SecurityDriver\AudioManager\onedriveconect.exe
Size 3.4MB
SHA256 3d85ed30ec30155a8812ddf0fa9a57fc8e239215c6f30c989a28018548827e41
MD5 94eb0a35783365922800397028096f93
SHA1 f8ce0adbd10fc30fd059ed91c35c8a7ac7d29afd
SHA512 1e5258c14921d4ad848db48792db4400507c149794d5f01db1ce4ed1145a701d70e69f3ad0b22bebce9d35facae405b0de6b1276925d88efa9fdf4c2839df1ea
SSDEEP 49152:EOnBfUBGeWsBxdWgOPZ/UjPnBGMhduCLizOU2ZuLbycAGfWivibIWYIU6iX:EOOB71Zh1mF/fdiBn+X
TLSH
T103F56C43F7D585E9C09DC13C8356D232A6B6BC8A4620B2AB17EEDE232E66F505F4D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingvideo.exe

Path C:\Users\Public\Videos\DriverHelper\USBDriver\settingvideo.exe
Size 1.5MB
SHA256 c83fba7688402451e648f810ed0fdae19e6e12e5444207657f3673e7636ba323
MD5 0bcff8261e83c45b4f84d963fd82c036
SHA1 d993143558df856311c378b5f96db85cd9114377
SHA512 4136161b51f1a9f8c5dc71786681294ecf505e7129d74cfda457e188705fcea5e02fa242aa2b92ce6e79558c29fd9c15b8a5ae30715a3e7361a837c0985dc506
SSDEEP 24576:wddIkU6jjybuk6OHl9JwIEhGhTkZJxTWAIqRs:w0D6g6qMI4esTQqR
TLSH
T14E655C43F5A0726BC34202B6700B6787FB76B774223A4577447AA27C320712967BB9F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingaudio.exe

Path C:\Users\Public\Videos\GraphicsController\SecuritySupport\settingaudio.exe
Size 1.7MB
SHA256 623c2e578d3323a07268dafa6d2da21abb1356fa6e28acb6bbeca28420ffd392
MD5 84be31e2d26e866618b86578905d3f28
SHA1 bee7a64fd81f240064820532cdc3f7456e372a4d
SHA512 f1fa49b0119e92a245be065043cff7785aa2a07d66e43c7d89b3632f6df8e0463861cc283d2859f1c9e32a20e89d72e6a964b9ca96e32c5eac099e41dfb77afb
SSDEEP 12288:QqO89sEBnf2xeFydL5X/Kp/m5tCHC4qsNYrN0abTbnZ5nrr2xqEO4kW/HjxtjxYr:4esUOxwyrXTL4qXZDTbnqxqEvN/ndk
TLSH
T1B9854C43F5A43627C38213B2701B979BFB7ABA38227B49B354B8859C334712963771E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/864-281-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/864-193-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1532-309-0x00000000648C0000-0x000000006496A000-memory.dmp

Download

memory/1532-914-0x0000025E92AD0000-0x0000025E92BFA000-memory.dmp

Download

memory/1532-905-0x0000025E92AD0000-0x0000025E92BFA000-memory.dmp

Download

memory/1532-308-0x0000025E92AD0000-0x0000025E92BFA000-memory.dmp

Download

memory/1532-734-0x0000025E92AD0000-0x0000025E92BFA000-memory.dmp

Download

memory/1780-575-0x0000024A6C200000-0x0000024A6C3A1000-memory.dmp

Download

memory/2724-299-0x00000199A96D0000-0x00000199A9730000-memory.dmp

Download

memory/2724-300-0x00000199A97A0000-0x00000199A9876000-memory.dmp

Download

memory/2956-880-0x0000024D877A0000-0x0000024D878CA000-memory.dmp

Download

memory/2956-881-0x00000000648C0000-0x000000006496A000-memory.dmp

Download

memory/3012-882-0x0000015913060000-0x000001591318A000-memory.dmp

Download

memory/3404-726-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3404-293-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3404-298-0x0000029A516B0000-0x0000029A516B1000-memory.dmp

Download

memory/3404-671-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3404-670-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3404-669-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3404-668-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4456-1-0x000001EA84350000-0x000001EA84351000-memory.dmp

Download

memory/4456-2-0x000001EA84350000-0x000001EA84351000-memory.dmp

Download

memory/4456-0-0x000001EA84350000-0x000001EA84351000-memory.dmp

Download

memory/4508-667-0x00000296F70D0000-0x00000296F7271000-memory.dmp

Download

memory/5960-335-0x000001AA4E7C0000-0x000001AA4E961000-memory.dmp

Download

memory/5960-331-0x000001AA689E0000-0x000001AA68A02000-memory.dmp

Download

memory/6104-341-0x000001D967540000-0x000001D96766A000-memory.dmp

Download

memory/6104-307-0x000001D967540000-0x000001D96766A000-memory.dmp

Download