f21c2d19f52c1148c35417dc3cebe937b0e6c7d4ffb92614c447169739d519a0

Analysis

max time kernel
300s
max time network
269s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KawaiiLauncher.exe
Size 204.3MB
Sample260425-txd2jadx3t
SHA256 f21c2d19f52c1148c35417dc3cebe937b0e6c7d4ffb92614c447169739d519a0
MD5 68b43d0b1a74e955afdd80a6aec2b5f0
SHA1 b3e907baaad2580cf405c0f922316894afa8808a
SHA512 3a81254d6ab3fdbe048ed8ff9c115732ea390b5c8b22136ad4f351d56a3001d438af9f331eef28276e2e859e2e01f87be4e1d59c88ddbfe7a347cdc872e15fb1
SSDEEP 1572864:WKJebtd8k43qrSB3JAkcEAarI353fqrV2Ntrd0DMTlQAGrR/v9dCo0r3XXJqWuDY:kxk3JZIXlovhG9
TLSH
T146A87C03E2DA01D9C05DD175575A9633FEB1B8094724B6DF2B940B922F76EE82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery persistence spyware stealer

Malware Config

Signatures

Loads dropped DLL 58 IoCs

pid	Process
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe
1508	Extractor.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.KawaiiLauncher = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\KawaiiLauncher.exe\""	KawaiiLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.KawaiiLauncher = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\KawaiiLauncher.exe\""	KawaiiLauncher.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4736	KawaiiLauncher.exe
4552	KawaiiLauncher.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1480	tasklist.exe
1492	tasklist.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	KawaiiLauncher.exe
File opened for modification	C:\Windows\SystemTemp	KawaiiLauncher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	KawaiiLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	KawaiiLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	KawaiiLauncher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe
936	Extractor.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4132	KawaiiLauncher.exe
Token: SeCreatePagefilePrivilege	4132	KawaiiLauncher.exe
Token: SeIncreaseQuotaPrivilege	3384	WMIC.exe
Token: SeSecurityPrivilege	3384	WMIC.exe
Token: SeTakeOwnershipPrivilege	3384	WMIC.exe
Token: SeLoadDriverPrivilege	3384	WMIC.exe
Token: SeSystemProfilePrivilege	3384	WMIC.exe
Token: SeSystemtimePrivilege	3384	WMIC.exe
Token: SeProfSingleProcessPrivilege	3384	WMIC.exe
Token: SeIncBasePriorityPrivilege	3384	WMIC.exe
Token: SeCreatePagefilePrivilege	3384	WMIC.exe
Token: SeBackupPrivilege	3384	WMIC.exe
Token: SeRestorePrivilege	3384	WMIC.exe
Token: SeShutdownPrivilege	3384	WMIC.exe
Token: SeDebugPrivilege	3384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3384	WMIC.exe
Token: SeRemoteShutdownPrivilege	3384	WMIC.exe
Token: SeUndockPrivilege	3384	WMIC.exe
Token: SeManageVolumePrivilege	3384	WMIC.exe
Token: 33	3384	WMIC.exe
Token: 34	3384	WMIC.exe
Token: 35	3384	WMIC.exe
Token: 36	3384	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3384	WMIC.exe
Token: SeSecurityPrivilege	3384	WMIC.exe
Token: SeTakeOwnershipPrivilege	3384	WMIC.exe
Token: SeLoadDriverPrivilege	3384	WMIC.exe
Token: SeSystemProfilePrivilege	3384	WMIC.exe
Token: SeSystemtimePrivilege	3384	WMIC.exe
Token: SeProfSingleProcessPrivilege	3384	WMIC.exe
Token: SeIncBasePriorityPrivilege	3384	WMIC.exe
Token: SeCreatePagefilePrivilege	3384	WMIC.exe
Token: SeBackupPrivilege	3384	WMIC.exe
Token: SeRestorePrivilege	3384	WMIC.exe
Token: SeShutdownPrivilege	3384	WMIC.exe
Token: SeDebugPrivilege	3384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3384	WMIC.exe
Token: SeRemoteShutdownPrivilege	3384	WMIC.exe
Token: SeUndockPrivilege	3384	WMIC.exe
Token: SeManageVolumePrivilege	3384	WMIC.exe
Token: 33	3384	WMIC.exe
Token: 34	3384	WMIC.exe
Token: 35	3384	WMIC.exe
Token: 36	3384	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5056	WMIC.exe
Token: SeSecurityPrivilege	5056	WMIC.exe
Token: SeTakeOwnershipPrivilege	5056	WMIC.exe
Token: SeLoadDriverPrivilege	5056	WMIC.exe
Token: SeSystemProfilePrivilege	5056	WMIC.exe
Token: SeSystemtimePrivilege	5056	WMIC.exe
Token: SeProfSingleProcessPrivilege	5056	WMIC.exe
Token: SeIncBasePriorityPrivilege	5056	WMIC.exe
Token: SeCreatePagefilePrivilege	5056	WMIC.exe
Token: SeBackupPrivilege	5056	WMIC.exe
Token: SeRestorePrivilege	5056	WMIC.exe
Token: SeShutdownPrivilege	5056	WMIC.exe
Token: SeDebugPrivilege	5056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5056	WMIC.exe
Token: SeRemoteShutdownPrivilege	5056	WMIC.exe
Token: SeUndockPrivilege	5056	WMIC.exe
Token: SeManageVolumePrivilege	5056	WMIC.exe
Token: 33	5056	WMIC.exe
Token: 34	5056	WMIC.exe
Token: 35	5056	WMIC.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
4132	KawaiiLauncher.exe
2456	KawaiiLauncher.exe
2456	KawaiiLauncher.exe
2456	KawaiiLauncher.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4736	4132	KawaiiLauncher.exe	78
PID 4132 wrote to memory of 2344	4132	KawaiiLauncher.exe	79
PID 4132 wrote to memory of 2444	4132	KawaiiLauncher.exe	80
PID 2444 wrote to memory of 3384	2444	cmd.exe	82
PID 4132 wrote to memory of 1636	4132	KawaiiLauncher.exe	84
PID 1636 wrote to memory of 5056	1636	cmd.exe	86
PID 4132 wrote to memory of 4048	4132	KawaiiLauncher.exe	87
PID 4048 wrote to memory of 1492	4048	cmd.exe	89
PID 2456 wrote to memory of 4552	2456	KawaiiLauncher.exe	92
PID 2456 wrote to memory of 4828	2456	KawaiiLauncher.exe	94
PID 2456 wrote to memory of 1732	2456	KawaiiLauncher.exe	93
PID 4828 wrote to memory of 4924	4828	cmd.exe	96
PID 2456 wrote to memory of 5116	2456	KawaiiLauncher.exe	97
PID 5116 wrote to memory of 3940	5116	cmd.exe	99
PID 2456 wrote to memory of 1692	2456	KawaiiLauncher.exe	100
PID 1692 wrote to memory of 1480	1692	cmd.exe	102
PID 4132 wrote to memory of 4328	4132	KawaiiLauncher.exe	103
PID 4328 wrote to memory of 2000	4328	cmd.exe	105
PID 2000 wrote to memory of 936	2000	Extractor.exe	106
PID 2456 wrote to memory of 3856	2456	KawaiiLauncher.exe	107
PID 3856 wrote to memory of 1736	3856	cmd.exe	109
PID 1736 wrote to memory of 1508	1736	Extractor.exe	110

C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=d3d11-warp-webgl --use-gl=angle --user-data-dir="C:\Users\Admin\AppData\Roaming\KawaiiLauncher" --field-trial-handle=2476,i,2429737538468750417,805826451529896226,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2472 /prefetch:11
  2⤵
  - Network Service Discovery
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\KawaiiLauncher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1777134408361252 --launch-time-ticks=512632168 --field-trial-handle=2476,i,2429737538468750417,805826451529896226,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get manufacturer,product
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic systemenclosure get manufacturer"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic systemenclosure get manufacturer
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe
    "C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe
      "C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe"
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:936

C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=d3d11-warp-webgl --use-gl=angle --user-data-dir="C:\Users\Admin\AppData\Roaming\KawaiiLauncher" --field-trial-handle=2444,i,15585315580089610981,16994119553681941245,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2460 /prefetch:11
  2⤵
  - Network Service Discovery
  PID:4552
- C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\KawaiiLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\KawaiiLauncher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2444,i,15585315580089610981,16994119553681941245,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2668 /prefetch:1
  2⤵
  PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get manufacturer,product
    3⤵
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic systemenclosure get manufacturer"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic systemenclosure get manufacturer
    3⤵
    PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe
    "C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe
      "C:\Users\Admin\AppData\Local\Temp\resources\lib\Extractor.exe"
      4⤵
      Loads dropped DLL
      PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

debug.log

Path C:\Users\Admin\AppData\Local\PARASITET\debug.log
Size 1KB
SHA256 34e5320f5dc94355b3e4b323c7060b37ea0e64051ef662740339b1232a02b5b7
MD5 8945e806dd7cb51d7626fb14d6ddfa30
SHA1 86a916e423f406ba4605bf445b4e31543cec8a44
SHA512 45d39565438dd9aa327bd0ae31e7378e648ea7e0689bdda8f3f2eac0bbe45ff5874843a08d50b711971dcb23d26fee59995b3f116d2de3d7e4156618035246eb
TLSH
T1C0113F2796EFDEBEC511506B836BF54CC364780A1D9BAF22BB31C42C6152F19BBC0981
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\PARASITET\debug.log
Size 1KB
SHA256 9ea1358cf9a8c134e706914065ec94dab62590cdbc20c4b386100da8e73c5f31
MD5 c79341655e8064ac01d6004b8f07d79f
SHA1 c8358cf14d8cce7787720c2e904e17c29e83d0a7
SHA512 44e4222142796d309f16d93de461b5ec01bcf3e22570ed39a18a6c3079f787a8c462dc6bf69bf2ff3011298ac1031d986a213f5883c95fb1185e4b94df9002b7
TLSH
T138212D1A95EFCFBE85109067877AF54CC3A4780A2D9BAF22B721C41C6151E19FAC0581
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\PARASITET\debug.log
Size 2KB
SHA256 3e231bba1e3365263273bf7b2c84e376b749ba55943b963b8d3ac749b7a19366
MD5 85e675f6f7492f8163bf3ac002bc11e5
SHA1 482a6234c8e8dcd66795bc8b0043e1e4fbb97d10
SHA512 c313093ddc66b044fa7eb3e6e74c6b68228c3d57b5e9decb90bd09ad24afa3de7fa26c74681ec59b8fff3a297bb17240123d2fe8ee2d3a248e8d32719f1ba9eb
TLSH
T123414D27C6FFDABE8511546B836BF50C8354780A6DCBAF22B721C51C6192F29BEC05C2
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\PARASITET\debug.log
Size 819B
SHA256 b5c18ac358af37cffc511f8c9c495d47fd491db5000ae993e6f784ea89aa1f2d
MD5 48d82f7d5a80062df3fed1888244ccca
SHA1 bb6c046879d270f3f5cc40e790d28be8280796b2
SHA512 429f3f349a76cd7b3822ff1a5bc0c1197e826fcd2f1dd62c9824d89202dc015ee2a99fd76761e88ce2f5080f3f3ba6975e4f3b76c9b08585d30f498b9b04efc2
TLSH
T1EE016B1B92EFCEBE851090678326F44CC3A47C0A5D8AAF22B731C42C2092A18BAC0582
MD5 SHA1 SHA512 TLSH

Submit Download

PARASITET_debug.log

Path C:\Users\Admin\AppData\Local\Temp\PARASITET_debug.log
Size 2KB
SHA256 140c70f1c13ea888cf85eb881bf3393dc635dadec65925585a66ca4927a0f90e
MD5 37f49acde48271ca196172224718d5ec
SHA1 d7452035ba607fd0432e0868b5b7f315f3ddfb7c
SHA512 46528f71e5726e8dcb267d23646e19f80219d4746cf269de693f9866e902b5d4106d31f50b13c13ac2f38e539da24462a83c698ed23bba144cec733c2a7003a4
TLSH
T138516027C5FFEDBA8551545BC76AF44C9354B80A2ADB9F22B721C51CA052F35BEC08C2
MD5 SHA1 SHA512 TLSH

Submit Download

PARASITET_trace.txt

Path C:\Users\Admin\AppData\Local\Temp\PARASITET_trace.txt
Size 1KB
SHA256 41f0138b8c4519f7fea4a5da44221338efb8c360c14fb1d7d74e51f74cdce14f
MD5 f5b9663e6496e34764c96106fea691cf
SHA1 6267ccbf0c0653d639a9681b1693e6dff5a628d6
SHA512 a5c30b31aea483415cf8875b50392b0e4bb71282217ac6ca7635c83fd805e884e0547d1982be18b5c475ceadb219dc0dd7b1fb26c0cd5a7946d76b58f769b9c6
TLSH
T151214B6782F7DD74A44051CDC31ECE49B32ABD1B39DFDE2AB748E60C81C266278E0985
MD5 SHA1 SHA512 TLSH

Submit Download

PARASITET_trace.txt

Path C:\Users\Admin\AppData\Local\Temp\PARASITET_trace.txt
Size 717B
SHA256 039050b520ce6d43ecd03c87515303f72b8f3cee97f97751e953cd5cf1dec1eb
MD5 e88b6929cb3ae61396809ca4561af0ff
SHA1 5f8127c4088c73a4f7aea75274c2b14004619420
SHA512 6ee706e7c4fd101de1328c84c6d004277f8d7a618f9ebb274ecc61eb965ee832e5a1761ee0288801aa9c3f46501011c667d682df633a55cf903b14d16b3d2ac0
TLSH
T196018F6A82F7CE74700450CD821ECE4AB32ABD27699FDE6E7384FA0C45C26A278D0585
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\Parasitetealer\All\Firefox\Bookmarks.txt
Size 326B
SHA256 a89040ac04dcea095f704d7d809a4f4eb91d9039846f6b499dd6dc08e7573dbc
MD5 ccb959641ee8ebeedfcbc33d118187cf
SHA1 f204a8acb5cc9b752bef8267157d341c2d5ffe19
SHA512 0d06470b2d724349e9d2f0765f415faa2d5be97e0699af8a0424785088ab7cfe4e85323727a097d7106666e497d1544f953bdb830d28ec39d1461c53f78760a7
TLSH
T195E026B3A17241680F00EC10781D760E2887C74C8EE6118AB04A3A7080F97A004F6289
MD5 SHA1 SHA512 TLSH

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\Temp\Parasitetealer\All\Firefox\History.txt
Size 297B
SHA256 18940a8ee843863c02cdd01df6df24a5aadfadd159713785e37e21a538a651d3
MD5 29a9f6da93d8fe4053abfbf955c17e78
SHA1 712c387eabf18094f7bdb3b7cdc402f0afe16f83
SHA512 8ec62fdd167b69143e4676e5093befb4b8654e0b2e924ba282c8f3e79385d3d43604e1ac679132e50222cd7672b27a57da9cfc907ff7e9bfd51cc143b4f3d6aa
TLSH
T1E8E0C2A3A27202280F01DD14742DB3DA6893CB0E8FE254C7B54A3C7182B979008E6659
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\_bz2.pyd
Size 85KB
SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
MD5 98aa4ec9b691267912bcb3336fc7cafc
SHA1 8955d7e923c4bf05d84a03666ec8cdb4fab2f616
SHA512 62084c7077ed896b92055e5a278651d6eeca65622321e389e551e8a331b51c9fe2a5eb1b903eaed41117a7a8efce514b9d62acf2b62985d1535812ab59011387
SSDEEP 1536:w1sxz74jpCk2wWdyOeR3RYZvksL8DdRbEvtwIA3V4y7NsR9KfIkWO:GsxzsIdtYOeRuZcsYZlitwIA3VU
TLSH
T162838D82E3A462B7F59F91B4D7810753F730FF560710A3AFB25482863F12B91AE58366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\_ctypes.pyd
Size 139KB
SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
MD5 409e2c98beb0554395f65fc8b55951c7
SHA1 f7e25afa8bd80fa8ed709aed8ced4374c0f1ed93
SHA512 8babb6fe295975868c1aa57c63dcab6f2cd151ba7074848dc7da27de2ea46a886496754b7c7e09b043ec5dc2813d30cbdbaa136f0f26302a1b7246a5da7962a7
SSDEEP 3072:5Dpx2Lp7KR+FrkdOJWWcovIXBzTKRFyxpMIAGPwuTkY:tpxCtKUr8WDvIXBnU8xppkY
TLSH
T1DDD38E4B736840A6DA678138C6739E47EBB1F4521A1087CF4264C99B1F633A2AF3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\_lzma.pyd
Size 157KB
SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
MD5 d5e9416137026497171e131dff6e569f
SHA1 16de80a710940e38537d1d2aea22bc33d5948591
SHA512 e7cb2a3c68e7f5129a4712b38b81fc84fc57881bd1d087c755ba16ee6d892be7ec0708a30465d2a28fe9b587226f233e02a2f512f861ad58012b5b80fe7c1927
SSDEEP 3072:QJ66gwnM5uNIJfuPdX+ENYQrHznfx9mNopUpdgwIAI1ho:QURwnNIk1XrBrTpYOQgL
TLSH
T11AF35C86B794F0E6F3628C38D6624F57E6F578190320929A01CC976D2B1FB759A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\_zstd.pyd
Size 491KB
SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
MD5 a75e9eb46c217f915fb8db1deed6dbb3
SHA1 b7e1bb9e18856a93b405c8adff3a198695b37d50
SHA512 c160a4681d9e5ecbeaa9416e294883fae9a212e28a8fdee5b86181f7e1cb35b9f1352e2af7894ae1023fb839e75d4fcaa4c5bc61024bd7cf0e261e21edb02cfb
SSDEEP 6144:dZ87M+EgY9pB2l1eUVcnmw3Vh4S+zKhThruVxzeeO07WEz9LKE+UIHHHRToSH2l4:vNcumw3vT8eeOyWEz8xHnRTrWl93R9D
TLSH
T17AB48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-console-l1-1-0.dll
Size 22KB
SHA256 5bf7ea7c2e9fbb4434723e999b5880d8163fa8f4df8331b159087aeee9dc074d
MD5 59949e0158928f91ebc7446914566509
SHA1 869a2254b1fb70fdd34d5fa822ba64d1a1e1cfc0
SHA512 22c813d3dcea75e2ca080b9808bd1749eec4a3463378e993f0c81852a324eaa1d5083097b83aa2336dec7002cf79af0bf2138cf2ed099ad5d69e784209eec54c
SSDEEP 384:hjsW3hWvcaGAf7pofXONvMscmeR9zEUsQwo:v+bdeQM7N9z2Qwo
TLSH
T1AFA25CC78BAC9102EA9A9DB042D6DE137C3CAFC71950A51631D4F1192CE77C9E71472D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-datetime-l1-1-0.dll
Size 22KB
SHA256 a800cc238cdfd30817bbf353f0643c525dea47f50ada2362c2f529059545f295
MD5 29072dd75c3b14e5c05d9b16ccca12ef
SHA1 f8291666b7297a88c75e01429bcf5abe9c47900e
SHA512 ed11e4970e12420f8b1f6087e01bd82a4eeed9f8e657bca0b73390e8566b03e37287ed93b114277e3911bc20af5ca6eba0b63fffb36565196028d4da62a7fbed
SSDEEP 384:mRKW3hW5bcaGAnEhgo0wGOrjR9zYyHiA6U:EbU1bEhOwGOrF9zYyN6U
TLSH
T1CFA219C3877C9042EEAB6F7056D8EA537C3C67C72880D56615D1F1582CA37C5AB14A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-debug-l1-1-0.dll
Size 22KB
SHA256 aa5e12704fa1fdb4cb5f569959fbe4718c91a522604867998764ef44537d6985
MD5 e709f916e136bffb71b9dd859c61fad5
SHA1 49aeb0872d507a13afd1ea4c5de47ce72472a3c4
SHA512 80759b5f4bc0d2546eccd7e04cb750db178ecd2d67b00c482c26c7cb757461cc32ab44b1fa08a262f1d74fdc5ce5a3556660f7a7f056dfa97d569bf6406feb59
SSDEEP 384:gW3hWBcaGAf7pofTezuRsyMgYR9zQx5EtN5QM:ZQbdeTezgE9zQ/w5j
TLSH
T117A24BD287B89042FE9B2E3091E9DE537C3CABC71E60D96615E4F0482CA37C5AB1463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-errorhandling-l1-1-0.dll
Size 22KB
SHA256 facad07a63c019b23acef1564b1230953237fec6751bc4887904cee7f43dcf8f
MD5 c9a8ccc3680685f5eb32acedd9d6dcbb
SHA1 4e9a686222f7f3114585e4a63e2bd78b23afc84f
SHA512 3ac88641a35860df7d5207c9da2abe579354267a3e67913bdcf08c0c499a372652e722f1158e31c57cac75a26b86c25c998b3b0962cc23ba761cb31b8307126a
SSDEEP 192:BjbmxD3vAW3hWgoca8LxydkeR+URLzgu8zlgnKug8X01k9z3AP9l4hXbf1F:BjbIAW3hWXcaGAXzgxl8BR9za9EfX
TLSH
T1F4A22982977C8043FEAB6E706298EA537C3D73CB1990D56615D4F21828A33C5EB2463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-fibers-l1-1-0.dll
Size 22KB
SHA256 52220a8c65a8f3f985c3a903a645f342f75453fc96547c1602563c6ed2c6ea36
MD5 22db18b92cb95428df4b42cd28eab00a
SHA1 b2f6df737b54b58e9971d5bea9b0e39204765a57
SHA512 6f9f822e617abf690857efb66cf4aa69369c8f8e4c8ba92e9b7c41491fa91a61c7484c6f4574d42935ca0ddc9149c3c2ba64058ceea5a302470b5c144cfab7bd
SSDEEP 192:blZPW3hWdOca8LxydkeR+ltJzSv6dlX01k9z3Az7rQz:blZPW3hWdOcaGAeHzS+R9zG7rg
TLSH
T144A24BC257789082FD9B6D708298EBA37D3CABCB1D9095661594F2681CF33C8E72053E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-fibers-l1-1-1.dll
Size 22KB
SHA256 1604d333c10e80bf390ac170b173e5d8699bcec4ade68d304f395d4c557df702
MD5 604218f60a1103e5f5b8e3092a9c4e2f
SHA1 348e53c09531303dec151cf2a071851516a15023
SHA512 e7c347a34d991c8fdfc9de3a5efb46141947ca8219eafc438b34e5a043bcb1a3424352f7995e8c449a4c6085ea3ca9c9e91585a031b245bb40ea796f86811f4b
SSDEEP 192:FDW3hW0ca8Lxyf7LRroihrS0sIs/zp9JHX01k9z3AqR6vrnYddj:NW3hW0caGAf7pof0WFbR9zpRmrns
TLSH
T169A25BC29778A043EE5B9EB042D9CA133C3D6BC71D40A66616D4F5181CE77C9EB2472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-file-l1-1-0.dll
Size 26KB
SHA256 5f44058b40804bd49b1d6b854c6b1b59b8d1668d1ee79d956bdc8c3fa493b555
MD5 afd2bf172085c7983c85ddf44bba1e57
SHA1 801fb03ec07e6c8dc76616ef119bb3e2a378f406
SHA512 467aa5cbd2692e7d95e7e4f7c5a3453c1834ef8087de9efd4c1291617b2b6073b50c892260a56bab4d4ca31bd5085f467e10db04b4b35872161495ff046c8115
SSDEEP 192:7whDPvVr8rFTsEW3hWsoca8LxydkeR+0HNiXwvY/FqX01k9z3AKU5m6v:cJPvVrmW3hWNcaGAJHwXIR9zDU5mg
TLSH
T17FC21883D674F29BF88F9E7161A2D983A83853C6041095D62BD4A75C3CE338BE39856D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-file-l1-2-0.dll
Size 22KB
SHA256 85ff02a6c8e671e164b2a3dfcad2dfd67fdd4253ca2b7dfcc7b90158dc49c974
MD5 fdb168c34702704955756f46e6fea1fd
SHA1 1a1316f05c61d425edd5f75f2218aa194e6b66a1
SHA512 476ee2d1c4b9877e501cad8453f1560baed753a28aa5b9509be23d27ac24472a412a0ede129df0d190065751051b0d0f67d528fc6339135748f17a3b3b33264a
SSDEEP 192:HNKbcW3hWQca8LxydkeR+uAR3hdxP3NGmVX01k9z3AH5rqA9T:HNQcW3hWQcaGASR3hP3U0R9zi5rqA9T
TLSH
T1EFA23A83477CD083F9EB6E7052A8EA937C3C6BC61E50D42525E4F55828E37D5AB2063D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-handle-l1-1-0.dll
Size 22KB
SHA256 702b4262403dbe601c90dccb976600f016b9a8fdf203dbe7151345864f3191c5
MD5 2b6d5d061b7c79973b96ff70f62527c2
SHA1 c0032827150bfa3892effaba9aad417436b0d9ec
SHA512 58099c98cb6995555a9c9ca29a69b3af025289601dd1d5e1a5a992d1366323511c59fdd00869d3ae7e42e06ed98498666eb154a9118b2f5de0ee20014367b927
SSDEEP 192:BCQ1W3hWmca8LxydkeR+4IFRY8u27X01k9z3AB+KOZU3:BC8W3hWmcaGA7fo7R9zc+E
TLSH
T10CA22AC29B6C9082FDAA6E705294EA433D3CB7C71950D5A606D5F1142CE37C5EB2077E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-heap-l1-1-0.dll
Size 22KB
SHA256 3e3a3bce7ff626673275d6181e95b6d66cf6ea99cade8a2d775789cd21f75c02
MD5 2c943fa6cdff64a5669fda977dc002c5
SHA1 ed42769c6359d46a063069bf9afd42787853e11d
SHA512 9db6c5bc84ed42e8f1a7fc1fb775c3d9be29a2b973280f8b95e81a7399c0e7d2f9eb90584b21ed18f7be6cc40f76c8866030b01280f55d2b35fe718cb85432ea
SSDEEP 384:ClSxlDW3hW5ocaGAJvrOwGOrjR9zYyHiAL7+fE:oU0bxOwGOrF9zYyNL7F
TLSH
T11EA24AC987BCD143FAAF9E706694EA133C3CA7CB1890896209D4F15828A37D5DB2433D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-interlocked-l1-1-0.dll
Size 22KB
SHA256 02334823ef2d09d3e8f9cc4d05f414b3a2b5955b0250ee99dbac6f597dc65c72
MD5 ec800f73f5301a56b801905af1d8ad57
SHA1 2d63fe982e970a7e139a1150cbfefbe0b12f4d66
SHA512 e0a15ce926d2035ed0293da26f60d38e02f2b1da6ec8cfa25730950be487d69a3842ddc9f90575bec91d0525fff72ab617f33f10ede8e1b5eef3d12c7939aac0
SSDEEP 192:Z5W3hWqca8Lxyf7LRroihrSjpcYFNaUHWX01k9z3APhkqr4:XW3hWqcaGAf7pofNZNajR9zOhkqM
TLSH
T1C2A24AC297ACE142FAEB6DB052A9DE537C3C67C71950951646D0E00C2CEB7C5EB2872D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-libraryloader-l1-1-0.dll
Size 22KB
SHA256 fcc460f7f03d92920f08d142c8a6e2bfb189b7abbe74267b6273c70e03b6e906
MD5 c4faa3cb0ccbccb66cff9074e11d4804
SHA1 985399a8d9631b91436c486e97ef52c056f75fdf
SHA512 7e9060b22766cdb09618f6e1f1af7e2d1e7f0f400fac46c45225fb26dc8aaf10f41a4b3c9f93f99ab65eb93aba01915690cf3c98b46e7f67ee89c3e7ab61b680
SSDEEP 384:oLTvuBL3BMW3hW58caGAe06tq/R9zVcSajoV1:fBL3BdU4b6tU9zVcEV1
TLSH
T1B3A208C2937CE142F9DE6E709290E9433C3CB7865961E8A946D9E25828E33C1E710779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-localization-l1-2-0.dll
Size 22KB
SHA256 e11d146273341e4046b2e1b79e4ad3876c77e7c450b77e5a435de818de169996
MD5 4c93363c0a6f3168d3f9f573a930e0ce
SHA1 9f16b904ccdab9602b61a3938281c70ed35991c3
SHA512 7bebca40f5aef9226b5284bda1f2dd0b6b0300013afc4ca52da28041e0e0df94b9125d04dee1a951489febc35a03fc888173f8756fc602397c3e9af110875daf
SSDEEP 384:lLnaOMw3zdp3bwjGzue9/0jCRrndbxW3hW5scaGAvkrVwGOrjR9zYyHiAWWDk1:MOMwBprwjGzue9/0jCRrndbuUob85wGr
TLSH
T188A218D6D7B8E247F84EEA717156E9432C3C67C60861D99502E1FF2828E3389E76132C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-memory-l1-1-0.dll
Size 22KB
SHA256 65d417eb8e938eed52405332905e9e2332efda5b9b706868dbf5249a78b4045b
MD5 f1cad0a0f9e3afbd84af2247ca7335c0
SHA1 cba74fb531927e1a8950d73310e4ec2fac81129c
SHA512 b4a22990be6831a647b4185d3370348411e94c5e61f5479fd8348c33b8e8b217e9b6c61397560baee76547199d63d3eed40d0ee02ce079c7e959ca94b5a97262
SSDEEP 192:RzKW3hWGNca8LxydkeR+Nt6etGndxP3NGmVX01k9z3AH5nqGu3o:RzKW3hWkcaGAMtoPP3U0R9zi5nqGp
TLSH
T19DA23986477CD042F9ABAE705294DA637D3DA7C61CD0D81916E4E6046CE33D9EB10A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-namedpipe-l1-1-0.dll
Size 22KB
SHA256 a9790e42f7516323ba0f135a6d07768fc9f11a14ee8100f8e73282ba356f6476
MD5 375456204e8cd8f6f785abf08bb5476a
SHA1 b48ac6cb1ba85967d1f340e41f3defd9cbbed3fd
SHA512 23582765c04f2b1a2b3a71ceb01b674c504b02eed0a995565160ce2cc5431f14cc760fc5891d5701f3a095fa8fab0507e880eaa2ca4358daac53c19a5d63d063
SSDEEP 192:SR/W3hW53ca8LxydkeR+h8RsS8xYqD0cSX01k9z3A5aEZPBidUzb:SR/W3hW53caGAti7vDyR9zcamidUP
TLSH
T105A25B8697389142FD8FAEB042D8DA533C7CA7CB1D91C92562D4E96428933D5EB30B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-processenvironment-l1-1-0.dll
Size 22KB
SHA256 5c8e539604f15dd88a62ff7cbdc7d59c302397cb353dc759c0f1d16b54db0c89
MD5 6f3c0a524f24402742d99bf4d74a1d6b
SHA1 1ff7488008a9d7a58cfafc2221aeca0f5a1391e4
SHA512 b6a143b9654ae72780a8bbb2fc70536c2af5ead91579372d104d96783602e164c1c19e83dce5a7e196fe426b3f56fa468242dc9e73593767dd2d22cea5e596e6
SSDEEP 192:4tIFCUW3hWWca8LxydkeR+pfPDeX7Vo+DF9X01k9z3AX6Bef5:4iFNW3hWWcaGAmHDeXNp9R9zi6Bex
TLSH
T1A4A24CC29678A042F5DB6E700298EA777C3CA3E71C40C46912A8E72828E7791A71477E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-processthreads-l1-1-0.dll
Size 22KB
SHA256 d35f6d321693900a75c784766c87780849bf1bbe176d3892e2693859be57f4a5
MD5 56f4dd5e8f3a8c4b353ab24e0824f177
SHA1 2209c3ba9bd03412268d218253a634492bb4f631
SHA512 6b9685acfa20f91ef01f6cf725e96aead8c53398e17a5445e5722214914c3c658fb7fe69d3c98302ba133e3048924228ed492173e1d3acbce3eda6347961ae36
SSDEEP 384:LAck1JzNcKSISW3hWkcaGAYucR9zDU5IYZq:ScKSqTbDw9zD6Zq
TLSH
T111A219C2967CE2C3F89E9D707285E9637C3A93C60965853106D4E6942DFB3C6C62863D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-processthreads-l1-1-1.dll
Size 22KB
SHA256 45c3ecefa2ca9b2372a043a269e3959cbcacf6c9a658fad430c753bc5176d396
MD5 645edbe9da4f81d2da12c5af1aa46e57
SHA1 24760e0aad9a40d83ebed6bf9c09a2b5e224c139
SHA512 0d898708bc0aff553e210bc9db680932b2b8ed89b024bb1cf3102de8fc541e5c13f65d7091b1dd64f035020d87b10cda7e4cf48a9b15254bde33763e62a06027
SSDEEP 384:RvDfIeMW3hWdcaGAf7pofPZpcUthXBnR9zQt/:WedYbdeMCf9zQh
TLSH
T1E5A26BC283BC9142F9DB5EB0A295EA233C3EABC71D60953111E4E25C1CD73C5E71462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-profile-l1-1-0.dll
Size 22KB
SHA256 b1e967f7520a5de9e4af1e2b338bf97b566a674de123cdec676b742305966f38
MD5 23058af2cc9fc20131181f46d5801c3e
SHA1 0841f90996c9d2654d896cc304229158ffbf11a2
SHA512 7c9e80aa22209b4e01c1da5cea3d5d6d05346b0f56d1dd81bede6760991668d0f723f621e7981650b114882cb79bef5ef85ea9425fc5258fa04df0afbbabbc66
SSDEEP 192:fW3hWcKca8Lxyf7LRroihrSAglltIjz5j4HsX01k9z3AK7Rj340:fW3hWrcaGAf7pofAg4R9zR7J
TLSH
T137A26CD2833C6042F99BAE7082D9DA533C3C67C72DA0965956E0F0582CD7BC9EB1467D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 22KB
SHA256 61b4e3d9b5a8cb3090413771f2a5e6996d0284b3d1db7d8f1446fbb067cc8278
MD5 f5cc841a993e3f2dd2487555f3bcf22f
SHA1 2b257c0500e9759d0bc104d832635de93dfd7f3e
SHA512 568fcd8bbf47188aa75d93e4da4789953b02c96dc271648475ac2a882350891fe1fe3dec4e90ccad36bbc42b56b1f9a199c76808d41b79440ba7d89c26962ceb
SSDEEP 384:iPGeVYW3hWHcaGAOeH1A9bFs0R9z/Zimvs:OGeVh6bH1QZs49z/8mvs
TLSH
T1FDA239829778A042F9ABAE705299DEA33C3D6BC718D0C4361194F2581CE33D4EB2073E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\api-ms-win-core-string-l1-1-0.dll
Size 22KB
SHA256 c8abebb85cee4bb344bfe4a3ab7d3ebf1c97b3d2c9174cca561ae4fe0ef94aa0
MD5 337658b616e8b3b7a793e1020f4d24ac
SHA1 2641df08ee878a44bf9e158754861d4a7e0e0847
SHA512 322843a26a286e56978a8e484d1247b4268839a4d9790076fdc0c605f8d44d422b324a60b1765cda105d4be6e7e2a133f9a3ed51d21554557bf55ea831112c0e
SSDEEP 384:FYyMvwW3hWbcaGAf7pofAP8r91FR9zROygz:FYyMvJ2bdeAP4nX9zRh+
TLSH
T10BA24A9697B8A006FE5B6E7041EADA533C3CA7C32D50926651D4F1081CE37D9EB1473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\base_library.zip
Size 1.3MB
SHA256 a1e913fd6277ede6ff52e1863e818fc7194695154873fa3e37d92081a7714bae
MD5 1047f8de9ff4b8743a7cd170b93db7e5
SHA1 6da846e962645e2e4c36c5b685e7d3db48fe822b
SHA512 930564eaaafa62442c2da2e484107c8454fa2237ec52f075f6f7357fb801d92d287c347e1c4d317453854c649546170461c2b31f5ac1be283d2cdabc1ebebcc3
SSDEEP 24576:juUFIL5bUelbeRpzQeOdP2m2df5idwJ3XK:juUFpPRV/Ydg3a
TLSH
T1B3552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\python3.DLL
Size 72KB
SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
MD5 33282f049faffb54e4b5604f18bcb4f7
SHA1 3406bdbd09a8968816f303f5c6e8e220a9336807
SHA512 6a8754ed4a24748d60002f2a02c0cc193a4d2185edba7c834572a6815b1aa1bea4733708460dbd2780cc3a6c856ce8aba0d2f55cd1a65c164599267784e0d2a6
SSDEEP 768:PQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKI1:ebTrnXngXMjMIAG0Yy7NsR9/fIbHgv
TLSH
T110734B5E6B54F8A2D6F629FC78D199CE242B12FC4F2984DFA47DD3920D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\python314.dll
Size 6.5MB
SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
MD5 e823b990ba85afa143b799c291058dce
SHA1 3e53a71a5c72c3011bee19a792a6552a0d702671
SHA512 fc9b0a6795993e1c4519622726647c33c415a9aa9983daa52d1f9f371c58fb74067599052f5b9c25f5acc08ed15021221dc524543a4de87b5705bba145a1b622
SSDEEP 98304:6PEfNNEwwP1Fyh4NIyDB7Qfo7wavAHDMiEuGC:tfXEwM1Eh4ayDpji1
TLSH
T180669E26737401A5D9BB8035CA074647DBB1BC00AB30D34B59A47ADA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20002\ucrtbase.dll
Size 1.3MB
SHA256 db6bc090827c93a24ed59bd73a6889f99b284c59e9abc9ad8bf1985d0b6ad14d
MD5 40ddc069a568ecb3f9db9e8a439278be
SHA1 8e4c5187915e3c224e6e9e2e33ff1de1ba8b947b
SHA512 451ac7db53dfbcfc31ed9bccb754eb7066c114de88b752af72c0aae4a0430eaf6eadb2fb66e54cd7564d151cea4af413fa3d5e996a1ab311608b9190832cafdd
SSDEEP 24576:HM6VUOfZDUVOb+uifkfEee3siuEWBlwmN1v2PI/BoEzJszZ7ymxvSZX0ypOpT+R:HM622DUVOb+uiMfE+nzTv2Apvz4VpQ
TLSH
T17055BE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalState_1777134927678.tmp

Path C:\Users\Admin\AppData\Local\Temp\browser_temp\LocalState_1777134927678.tmp
Size 90KB
SHA256 70e42492ba7760520a0ff40bfb4a52e2614cbd7fc18a2ed6189cc23a62694f52
MD5 c1e9334306229ee892745c69a3d4cc74
SHA1 0fbe5864d3d8249e1d76ea343bf6ea1c724a3f30
SHA512 ba43e6d054853b368f3dcd9f4c7ddad2a398af7a490a3afa6292aeff8a848abcfe939c0918428064147e1e5a144302d03e2fc68b6f0bf61dd0d942b34a7b6a85
SSDEEP 1536:lIP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNn:c++J3qUQm08KMWF0bFTcVHr6zg
TLSH
T1D09302BD991E7C79536BC696A0079DAC8CD3DCCD111851BC30C76F0E14BA3A3A31B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalState_1777134944645.tmp

Path C:\Users\Admin\AppData\Local\Temp\browser_temp\LocalState_1777134944645.tmp
Size 8KB
SHA256 1990a79d25edba9b77cb47b72d4759e24186be8769c6302234fd361ced1b34a4
MD5 f819cfe1c7df5abdc7332e8276ffec84
SHA1 7f27c458bf08230d9c0595bb0faa3d72cc87d685
SHA512 0d11f8b89418a4b4bba9c692645058f0261e3a290c45ecd63f5baa006baa2d3ca10589216e0d6c5b570bab8955fd74f576eb61390ac336b386509dc31baba716
SSDEEP 192:VGNU6EajeQmiUyrLw/snRvAwxCS9ERr6ieYe:VGNU6ENELwknRvAwxCGEkIe
TLSH
T15402D835B87C7CBB8EB3AD05B0477B276FE5112BE5942B48DAE81B0D40DB35C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_1777134930499_f19xx4

Path C:\Users\Admin\AppData\Local\Temp\db_1777134930499_f19xx4
Size 138KB
SHA256 149c1a433e3a72d2b816d4136fc02404b2288ccfa8521cd6b156321489cb8e67
MD5 8ebb107c3e7835976940935223cbba9b
SHA1 ae1475637457ff9e697820bdd7d1ba7fd2acfb13
SHA512 c93794e1776f43d0ce451dac51873e835f2da8866d8c8c23a8024393f9d296c21845bb53b52492ee4196c3e612790e4c5d8089c2104075b89bd9ec7e91636b22
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2ODQGNHLVumbnEbXyuR:FnbZeMrv/hGtDQGNHDnEzyuR
TLSH
T1E8D3A84B3A747002EDE59A721CE051BB4E3C716D8F55A5D528B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_1777134932538_fauz6q

Path C:\Users\Admin\AppData\Local\Temp\db_1777134932538_fauz6q
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_1777134934551_osrwu

Path C:\Users\Admin\AppData\Local\Temp\db_1777134934551_osrwu
Size 20KB
SHA256 e5934d7bc7276bfcf686e9d5cb1672b10ecc1a79e5fb8de0872223d3e9d94fd8
MD5 6563843ae72e6c6ab418ed901a078e08
SHA1 5e4ca4180f2be77929cb582dc30372ee4ba38ed8
SHA512 74b7e5c677f1a5bd8fb5a7f6b8f8797f062426b25b5abc09278b8cbaf86fb8c341d6e835f944317d7ab7e99b4bd5099dc8f088050f07c7515f665b54ac58bd1f
SSDEEP 48:TeW9aw/aHLopFMavU1iBwHm/iaDc0Xd9NH:nPareMaZz/iaoulH
TLSH
T15292004F2F303610C4F84B32E9D2546B2E7D112D83637A9AEE1468B39DC25ABF1055E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_1777134935786_ekf3ee

Path C:\Users\Admin\AppData\Local\Temp\db_1777134935786_ekf3ee
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_1777134944645_e562ea

Path C:\Users\Admin\AppData\Local\Temp\db_1777134944645_e562ea
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_1777134946675_vy7bxp

Path C:\Users\Admin\AppData\Local\Temp\db_1777134946675_vy7bxp
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_1777134948708_jzu8ey

Path C:\Users\Admin\AppData\Local\Temp\db_1777134948708_jzu8ey
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_1777134949911_qhymhe

Path C:\Users\Admin\AppData\Local\Temp\db_1777134949911_qhymhe
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_bxe1ej.sqlite

Path C:\Users\Admin\AppData\Local\Temp\temp_bxe1ej.sqlite
Size 5.0MB
SHA256 f7263fbc1cf7dc51635915ada8c5e748662c9be2766851eecd8e51af954f84ec
MD5 fd77542176d8065a3079b639ea2d4af7
SHA1 8727317bcee4ba06b42070500414728c3548fda0
SHA512 2a9f9d955433af766a479a69da363296d369e15e527ed837a20c46bae3d9e3776cd1e0dcf599f6a042686d62f6c187d3a842219f6e51bdae060ef707d738eecb
SSDEEP 192:M8rJQaXoMXp0VW9FxWHNasfVPV3jK4ZE:M8r54w0VW3xWt7VW
TLSH
T1C636100F6A212150D4DAA232BCE36F161C3F70169A3336933DA4656D4DE0767B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_gvmluk.sqlite

Path C:\Users\Admin\AppData\Local\Temp\temp_gvmluk.sqlite
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45af77c9-3fdd-4460-97e0-200bd3060b18.tmp

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\45af77c9-3fdd-4460-97e0-200bd3060b18.tmp
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2bfba6294729cdb4adadd8f75f9ffdea9e6e604deba43c9ef986b49519e95d1e
MD5 849cc58e825625b1bbcedc0cac820022
SHA1 406f7f8bd2100ac7709f262a6475ed85c7104b7f
SHA512 47e8ca08059535019205ebceaa8952eb159273ccf8c177703dbe281c8af1e84ffe89ad37f1df03de50ecbfbae496021304f56177d18a533c8750dfcebf34eb14
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 33acb6330895bac6e9942824747fcc592cdacb73fdb873bf5c6eb5a989ff85cf
MD5 518dd866d96bd857c913dd53457d4a30
SHA1 2504aba2ecaccc7551d8274df9f98e66233b0db9
SHA512 dbaf89c36c18b5bd720366c3b887c185169cba3a3cabf76b32a008b1738f1b30db88dfa25f2b76d3321a8b2b5024a84ed701898aab9c7de786add91b06d936a6
MD5 SHA1 SHA512

Submit Download

DIPS

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\DIPS
Size 4KB
SHA256 5c9dec1886cc01f5f2307ee1ea87f9b32a4cef0f8f9a2c68beebc558013bedab
MD5 22ebdd36e102f2af2f5766b7297dcad3
SHA1 ba29f798da42295195aab0af09c1c1e067c6913b
SHA512 f1911640f9fb21fa51628f5eb2feb945a00e2a65d7b5ae55639c0bc42b97c8f36788008693314da891d65cf37b969340293d940f018b3d9a151e91bdf2ee8d8d
TLSH
T18A81044053C000F1D07507F354D5530C4F07D1F4D5510F5717011145CC415450C70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Local State
Size 434B
SHA256 d957bd179a56410377cb1af42d08336a702be230c518abddd6e3cd209ecc5722
MD5 e9c82ba982d1f6d90b2932be8e869c23
SHA1 6e6a9232924a501e2abbb9a7693c06503a04825b
SHA512 97a8b73506809209b760ba0430846baad3bc3c6bcf8c5dfa06c10975a8720664ceb257e6d7fe716601de11279df838b3ba94dd358c0f518b807cc66a2a645e38
TLSH
T112E0A33110B3EEDDFE700D711414B5134C3549F7A65DA519D91D410E52A7CB85151D36
MD5 SHA1 SHA512 TLSH

Submit Download

97bb3a8c-1ace-4b7e-9b48-30523bd40de8.tmp

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Network\97bb3a8c-1ace-4b7e-9b48-30523bd40de8.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Network\Network Persistent State
Size 665B
SHA256 06fd9d8f89c00c3c52a53e8b4bcf90b0a7c6fbf4e1df59f112fb72cabe3e0cd4
MD5 8a0e7f16e707ba3e41413e1367cea599
SHA1 c9f512a0d4bd5b9c4327c3f219be79252f110805
SHA512 43ee5c897a78e87151bf069a5e2c82fe257a1ffbd4f1f700250ae9463c2b57902e77c4c043e4a33f4070155844b5b16b3c9a9d84009b80acd848d0dff089efd0
TLSH
T15B0199ABC3D885BE495203F13A347923C9BF092983683C12C8D8DF8E83F447A160064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Network\Network Persistent State
Size 665B
SHA256 f6be6640e52ceb757952f29c052dab71f0f3ea805b3a567998b721339aeaaa03
MD5 d8ea2b4b703b4f36170b372bae2bf606
SHA1 dda32bf6ca11b450c2e46d3b1547183e51092d7e
SHA512 19fae410c18fe03b68e3444763c7a232fb902f65af115c36882a2d33631d078383231026aab2a349a40aaf1ffae157ff617c6eda10bb32fca57b02d1c584b0d6
TLSH
T15E0149A6C3D845BE895213F13A347923C9BE096953287D46D8D8DF8E87F1439460054E
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Network\Trust Tokens
Size 36KB
SHA256 fe03fb82cfe74a64c7094c810f9e8167c3b61c254c27569cc6b7db5ed84b0b18
MD5 c3e47f014a4bb58a64a57890314786ae
SHA1 ff572da2509f042cfd7ee8245f90c76105e27c89
SHA512 fc5c8206b6ff078fed3c2481360d0f638e828669f972710b1b0fdec071c0fdcaa481cf3a48b95df014943b9aed3b97da808c5567765ad6a226488aad4ab2e16b
SSDEEP 24:TL03lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tw31DtX5nDOvyKDhU1cSB
TLSH
T115F2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 06d56e277d7113b1a08612b6eef65ca3b044c780ea0f030e82274a69aa9a74fa
MD5 3b71d9a44d13a5639819946d111869ab
SHA1 c8ca65e48ee8de607c1b1fb89602044937f4dacb
SHA512 d333e2093ce9ffe2bf66315a4c5a0c34bf98c1a7f3c52f03928a71525905cf436cf21d3857d9c11e2abf135217c0bfe09d41d86f082343795743c4938cd2f014
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\KawaiiLauncher\Shared Dictionary\db
Size 44KB
SHA256 9dfba1d139c9933668e58e9c7777804c8ae01b2942dcc2dfaaa65ac139853a59
MD5 726d6140f181f7300ea50c13070a5903
SHA1 5a78b8a7db3078a7ca5a81e4fb78ed35ca476515
SHA512 6d48e90d26205be87925543a1645036971b9419785e0e8ba5987cc27c7926a53c71338dc2336878c649d186142239ed8be93309a7f2e695409119a624c2b3e9c
SSDEEP 24:TL6lgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:TBOIy4m1b3fbUdeqSB
TLSH
T11013AA0F1E187551D1BD0235E9E64E6B2E7E205C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/936-334-0x00000265B5050000-0x00000265B50F3000-memory.dmp

Download

memory/1508-459-0x0000022FE9120000-0x0000022FE91C3000-memory.dmp

Download

memory/1736-461-0x0000024BB5A80000-0x0000024BB5B23000-memory.dmp

Download

memory/2000-335-0x000001C625F60000-0x000001C626003000-memory.dmp

Download

memory/2456-475-0x0000019A256D0000-0x0000019A256D9000-memory.dmp

Download

memory/3384-49-0x000002034E290000-0x000002034E30B000-memory.dmp

Download

memory/3940-138-0x0000024630AE0000-0x0000024630B5B000-memory.dmp

Download

memory/4132-460-0x000002A668550000-0x000002A668559000-memory.dmp

Download

memory/4552-494-0x000001F826610000-0x000001F826619000-memory.dmp

Download

memory/4736-466-0x00000247E0E80000-0x00000247E0E89000-memory.dmp

Download

memory/4924-137-0x0000024914AA0000-0x0000024914B1B000-memory.dmp

Download

memory/5056-50-0x000002194F9A0000-0x000002194FA1B000-memory.dmp

Download