ce4fcbab3b9ca427c7e4437cfec8de3063e4e57e9e76ccf80ccb495f79db42a8

Analysis

user interaction
yes
max time kernel
300s
max time network
308s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/05/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wockstarz Multi/start.bat
Size 448B
Sample260523-e1mqhscy8q
SHA256 ce4fcbab3b9ca427c7e4437cfec8de3063e4e57e9e76ccf80ccb495f79db42a8
MD5 621a1085edebd321cec0b44044efb718
SHA1 118150788a72ca981bed62cc76405b8682723049
SHA512 7476ceaede97d867fe88b800a080480247312a4563f19ee8d6783112959c761a349c86b95d9a93520c6f4325599e91cc66a4b0692af4935fb6ec3fd67aa3582f
TLSH
T168F05C52184390726D9828D902593F97FC1AF1066205AE10B0C660DE6CEFCD0B3ED2AD
MD5 SHA1 SHA512 TLSH

Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	main.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	main.exe

Uses browser remote debugging 2 TTPs 18 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1220	chrome.exe
652	chrome.exe
528	chrome.exe
1228	chrome.exe
4996	chrome.exe
2664	chrome.exe
2332	chrome.exe
4024	chrome.exe
1616	chrome.exe
1160	chrome.exe
3744	chrome.exe
4668	chrome.exe
2284	chrome.exe
1468	chrome.exe
5024	chrome.exe
1136	chrome.exe
648	chrome.exe
3436	chrome.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LethalGrabber.exe	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LethalGrabber.exe	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LethalGrabber.exe	main.exe

Executes dropped EXE 4 IoCs

pid	Process
2364	selenium-manager.exe
3976	chromedriver.exe
3352	selenium-manager.exe
3748	chromedriver.exe

Loads dropped DLL 64 IoCs

pid	Process
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
4340	python10.9.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
2144	PythonLib.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe
1452	main.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LethalGrabber = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Wockstarz Multi\\Helper\\Funcs\\main.exe"	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LethalGrabber = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Wockstarz Multi\\Helper\\Funcs\\main.exe"	main.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
137	discord.com
138	discord.com
161	discord.com

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
11	api.ipify.org
12	ip-api.com
14	api.ipify.org
86	api.ipify.org
87	api.ipify.org
90	ip-api.com
92	api.ipify.org

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\symbols\exe\chromedriver.exe.pdb	chromedriver.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	chromedriver.exe
File opened for modification	C:\Windows\System32\exe\chromedriver.exe.pdb	chromedriver.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	chromedriver.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	chromedriver.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	chromedriver.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	chromedriver.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	chromedriver.exe
File opened for modification	C:\Windows\System32\chromedriver.exe.pdb	chromedriver.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chromedriver.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chromedriver.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4188	powershell.exe
4760	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	selenium-manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	selenium-manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2036	chrome.exe
2456	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3104	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 38 IoCs

defense_evasion

pid	Process
3484	taskkill.exe
800	taskkill.exe
404	taskkill.exe
3816	taskkill.exe
4128	taskkill.exe
2276	taskkill.exe
1904	taskkill.exe
4552	taskkill.exe
2960	taskkill.exe
5008	taskkill.exe
544	taskkill.exe
4008	taskkill.exe
3736	taskkill.exe
1276	taskkill.exe
2212	taskkill.exe
2284	taskkill.exe
2064	taskkill.exe
552	taskkill.exe
640	taskkill.exe
968	taskkill.exe
940	taskkill.exe
1644	taskkill.exe
928	taskkill.exe
2316	taskkill.exe
1712	taskkill.exe
2432	taskkill.exe
4992	taskkill.exe
2576	taskkill.exe
5008	taskkill.exe
1884	taskkill.exe
704	taskkill.exe
3068	taskkill.exe
4604	taskkill.exe
3856	taskkill.exe
3280	taskkill.exe
4188	taskkill.exe
4472	taskkill.exe
5052	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{4BB7714C-97AE-4398-9D29-0DA58805136A}	main.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{F48916C6-B4E2-4B3E-9409-32A737CF6FCD}	main.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3004	WMIC.exe
3004	WMIC.exe
3004	WMIC.exe
3004	WMIC.exe
1160	chrome.exe
1160	chrome.exe
4832	WMIC.exe
4832	WMIC.exe
4832	WMIC.exe
4832	WMIC.exe
3436	chrome.exe
3436	chrome.exe
4188	powershell.exe
4188	powershell.exe
4188	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	552	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	704	taskkill.exe
Token: SeDebugPrivilege	1904	taskkill.exe
Token: SeDebugPrivilege	3856	taskkill.exe
Token: SeDebugPrivilege	3484	taskkill.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	1276	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	3280	taskkill.exe
Token: SeDebugPrivilege	544	taskkill.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: SeDebugPrivilege	800	taskkill.exe
Token: SeDebugPrivilege	4008	taskkill.exe
Token: SeDebugPrivilege	3068	taskkill.exe
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3004	WMIC.exe
Token: SeSecurityPrivilege	3004	WMIC.exe
Token: SeTakeOwnershipPrivilege	3004	WMIC.exe
Token: SeLoadDriverPrivilege	3004	WMIC.exe
Token: SeSystemProfilePrivilege	3004	WMIC.exe
Token: SeSystemtimePrivilege	3004	WMIC.exe
Token: SeProfSingleProcessPrivilege	3004	WMIC.exe
Token: SeIncBasePriorityPrivilege	3004	WMIC.exe
Token: SeCreatePagefilePrivilege	3004	WMIC.exe
Token: SeBackupPrivilege	3004	WMIC.exe
Token: SeRestorePrivilege	3004	WMIC.exe
Token: SeShutdownPrivilege	3004	WMIC.exe
Token: SeDebugPrivilege	3004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3004	WMIC.exe
Token: SeRemoteShutdownPrivilege	3004	WMIC.exe
Token: SeUndockPrivilege	3004	WMIC.exe
Token: SeManageVolumePrivilege	3004	WMIC.exe
Token: 33	3004	WMIC.exe
Token: 34	3004	WMIC.exe
Token: 35	3004	WMIC.exe
Token: 36	3004	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3004	WMIC.exe
Token: SeSecurityPrivilege	3004	WMIC.exe
Token: SeTakeOwnershipPrivilege	3004	WMIC.exe
Token: SeLoadDriverPrivilege	3004	WMIC.exe
Token: SeSystemProfilePrivilege	3004	WMIC.exe
Token: SeSystemtimePrivilege	3004	WMIC.exe
Token: SeProfSingleProcessPrivilege	3004	WMIC.exe
Token: SeIncBasePriorityPrivilege	3004	WMIC.exe
Token: SeCreatePagefilePrivilege	3004	WMIC.exe
Token: SeBackupPrivilege	3004	WMIC.exe
Token: SeRestorePrivilege	3004	WMIC.exe
Token: SeShutdownPrivilege	3004	WMIC.exe
Token: SeDebugPrivilege	3004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3004	WMIC.exe
Token: SeRemoteShutdownPrivilege	3004	WMIC.exe
Token: SeUndockPrivilege	3004	WMIC.exe
Token: SeManageVolumePrivilege	3004	WMIC.exe
Token: 33	3004	WMIC.exe
Token: 34	3004	WMIC.exe
Token: 35	3004	WMIC.exe
Token: 36	3004	WMIC.exe
Token: SeDebugPrivilege	3816	taskkill.exe
Token: SeDebugPrivilege	4188	taskkill.exe
Token: SeDebugPrivilege	4472	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1160	chrome.exe
1160	chrome.exe
3436	chrome.exe
3436	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2144	PythonLib.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2504	4696	cmd.exe	84
PID 4696 wrote to memory of 5016	4696	cmd.exe	85
PID 4696 wrote to memory of 2392	4696	cmd.exe	86
PID 5016 wrote to memory of 4340	5016	python10.9.exe	87
PID 4696 wrote to memory of 3104	4696	cmd.exe	88
PID 2392 wrote to memory of 2144	2392	PythonLib.exe	89
PID 2504 wrote to memory of 1452	2504	main.exe	90
PID 1452 wrote to memory of 5024	1452	main.exe	92
PID 1452 wrote to memory of 2276	1452	main.exe	94
PID 1452 wrote to memory of 552	1452	main.exe	96
PID 1452 wrote to memory of 1712	1452	main.exe	98
PID 1452 wrote to memory of 640	1452	main.exe	100
PID 1452 wrote to memory of 1884	1452	main.exe	102
PID 1452 wrote to memory of 704	1452	main.exe	104
PID 1452 wrote to memory of 1904	1452	main.exe	106
PID 1452 wrote to memory of 3856	1452	main.exe	108
PID 1452 wrote to memory of 3484	1452	main.exe	110
PID 1452 wrote to memory of 2432	1452	main.exe	112
PID 1452 wrote to memory of 1276	1452	main.exe	114
PID 1452 wrote to memory of 4992	1452	main.exe	116
PID 1452 wrote to memory of 3280	1452	main.exe	118
PID 1452 wrote to memory of 544	1452	main.exe	120
PID 1452 wrote to memory of 968	1452	main.exe	122
PID 1452 wrote to memory of 800	1452	main.exe	124
PID 1452 wrote to memory of 4008	1452	main.exe	126
PID 1452 wrote to memory of 3068	1452	main.exe	128
PID 1452 wrote to memory of 404	1452	main.exe	130
PID 1452 wrote to memory of 3964	1452	main.exe	133
PID 1452 wrote to memory of 2364	1452	main.exe	136
PID 2364 wrote to memory of 2312	2364	selenium-manager.exe	138
PID 2364 wrote to memory of 1784	2364	selenium-manager.exe	139
PID 1784 wrote to memory of 3004	1784	cmd.exe	140
PID 5096 wrote to memory of 376	5096	main.exe	141
PID 376 wrote to memory of 664	376	main.exe	142
PID 1452 wrote to memory of 3976	1452	main.exe	144
PID 376 wrote to memory of 3816	376	main.exe	146
PID 376 wrote to memory of 4188	376	main.exe	148
PID 3976 wrote to memory of 1160	3976	chromedriver.exe	150
PID 1160 wrote to memory of 4296	1160	chrome.exe	151
PID 376 wrote to memory of 4472	376	main.exe	152
PID 376 wrote to memory of 4604	376	main.exe	154
PID 1160 wrote to memory of 3964	1160	chrome.exe	156
PID 1160 wrote to memory of 2036	1160	chrome.exe	157
PID 1160 wrote to memory of 1244	1160	chrome.exe	158
PID 1160 wrote to memory of 652	1160	chrome.exe	159
PID 1160 wrote to memory of 3744	1160	chrome.exe	160
PID 376 wrote to memory of 4128	376	main.exe	161
PID 1160 wrote to memory of 528	1160	chrome.exe	163
PID 376 wrote to memory of 2576	376	main.exe	164
PID 1160 wrote to memory of 648	1160	chrome.exe	166
PID 376 wrote to memory of 3736	376	main.exe	167
PID 376 wrote to memory of 940	376	main.exe	169
PID 376 wrote to memory of 1644	376	main.exe	171
PID 376 wrote to memory of 5052	376	main.exe	173
PID 1160 wrote to memory of 4996	1160	chrome.exe	175
PID 1160 wrote to memory of 1228	1160	chrome.exe	176
PID 376 wrote to memory of 2212	376	main.exe	177
PID 376 wrote to memory of 928	376	main.exe	179
PID 1160 wrote to memory of 4668	1160	chrome.exe	181
PID 376 wrote to memory of 5008	376	main.exe	195
PID 376 wrote to memory of 4552	376	main.exe	184
PID 376 wrote to memory of 2284	376	main.exe	212
PID 1160 wrote to memory of 2664	1160	chrome.exe	188
PID 376 wrote to memory of 2064	376	main.exe	189

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\main.exe
  "main.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\main.exe
    "main.exe"
    3⤵
    - Drops file in Drivers directory
    - Drops startup file
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:5024
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2276
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:552
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1712
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:640
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im vivaldi.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1884
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im yandex.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:704
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1904
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im iexplore.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3856
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im 360browser.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3484
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im coccoc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2432
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im slimjet.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1276
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im torch.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4992
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im epic.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3280
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im amigo.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:544
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im orbitum.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:968
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im comodo.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:800
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4008
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im discordcanary.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3068
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /im discordptb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\_MEI25042\selenium\webdriver\common\windows\selenium-manager.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI25042\selenium\webdriver\common\windows\selenium-manager.exe --browser chrome --language-binding python --output json
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c "chromedriver --version"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c "wmic datafile where name='C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe' get Version /value"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1784
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic datafile where name='C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe' get Version /value
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
  - - C:\Users\Admin\.cache\selenium\chromedriver\win64\140.0.7339.207\chromedriver.exe
      C:\Users\Admin\.cache\selenium\chromedriver\win64\140.0.7339.207\chromedriver.exe --port=50206
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --allow-pre-commit-input --auto-accept-geolocation --deny-permission-prompts=false --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-gpu --disable-hang-monitor --disable-notifications --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-features=AllowAllGeolocation --enable-logging --headless=new --log-level=3 --no-first-run --no-sandbox --no-service-autorun --password-store=basic --remote-debugging-port=0 --silent --test-type=webdriver --use-fake-ui-for-media-stream --use-mock-keychain --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --window-size=1920,1080
        5⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1160
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffd5e07c728,0x7ffd5e07c734,0x7ffd5e07c740
        6⤵
        
        PID:4296
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=1940 --log-level=3 --mojo-platform-channel-handle=1932 /prefetch:2
        6⤵
        
        PID:3964
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=2052 --log-level=3 --mojo-platform-channel-handle=2044 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:2036
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=2344 --log-level=3 --mojo-platform-channel-handle=2340 /prefetch:8
        6⤵
        
        PID:1244
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=2892 --log-level=3 --mojo-platform-channel-handle=2880 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:652
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=2916 --log-level=3 --mojo-platform-channel-handle=2904 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3744
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4032 --log-level=3 --mojo-platform-channel-handle=4028 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:528
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4128 --log-level=3 --mojo-platform-channel-handle=4120 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:648
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4192 --log-level=3 --mojo-platform-channel-handle=3328 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4996
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4268 --log-level=3 --mojo-platform-channel-handle=4272 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:1228
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4332 --log-level=3 --mojo-platform-channel-handle=4336 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4668
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1936,i,6650366841062737219,13602006351598452193,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4420 --log-level=3 --mojo-platform-channel-handle=4416 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kill.bat" "
        5⤵
        
        PID:3856
- C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\python10.9.exe
  "python10.9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\python10.9.exe
    "python10.9.exe"
    3⤵
    - Loads dropped DLL
    PID:4340
- C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\PythonLib.exe
  "pythonlib.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\PythonLib.exe
    "pythonlib.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2144
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:3104

C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\main.exe
"C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\main.exe
  "C:\Users\Admin\AppData\Local\Temp\Wockstarz Multi\Helper\Funcs\main.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops startup file
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:664
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    PID:4604
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:4128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im yandex.exe
    3⤵
    - Kills process with taskkill
    PID:2576
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3736
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:940
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im 360browser.exe
    3⤵
    - Kills process with taskkill
    PID:1644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im coccoc.exe
    3⤵
    - Kills process with taskkill
    PID:5052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im slimjet.exe
    3⤵
    - Kills process with taskkill
    PID:2212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im torch.exe
    3⤵
    - Kills process with taskkill
    PID:928
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im epic.exe
    3⤵
    - Kills process with taskkill
    PID:5008
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im amigo.exe
    3⤵
    - Kills process with taskkill
    PID:4552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:2284
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im comodo.exe
    3⤵
    - Kills process with taskkill
    PID:2064
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Kills process with taskkill
    PID:2960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discordcanary.exe
    3⤵
    - Kills process with taskkill
    PID:2316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discordptb.exe
    3⤵
    - Kills process with taskkill
    PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\_MEI50962\selenium\webdriver\common\windows\selenium-manager.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI50962\selenium\webdriver\common\windows\selenium-manager.exe --browser chrome --language-binding python --output json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3352
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "chromedriver --version"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic datafile where name='C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe' get Version /value"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3564
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic datafile where name='C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe' get Version /value
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4832
- - C:\Users\Admin\.cache\selenium\chromedriver\win64\140.0.7339.207\chromedriver.exe
    C:\Users\Admin\.cache\selenium\chromedriver\win64\140.0.7339.207\chromedriver.exe --port=50676
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:3748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --allow-pre-commit-input --auto-accept-geolocation --deny-permission-prompts=false --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-gpu --disable-hang-monitor --disable-notifications --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-features=AllowAllGeolocation --enable-logging --headless=new --log-level=3 --no-first-run --no-sandbox --no-service-autorun --password-store=basic --remote-debugging-port=0 --silent --test-type=webdriver --use-fake-ui-for-media-stream --use-mock-keychain --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --window-size=1920,1080
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:3436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffd5e07c728,0x7ffd5e07c734,0x7ffd5e07c740
        5⤵
        
        PID:968
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=2000 --log-level=3 --mojo-platform-channel-handle=1992 /prefetch:2
        5⤵
        
        PID:3492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=2032 --log-level=3 --mojo-platform-channel-handle=1952 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2456
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=2188 --log-level=3 --mojo-platform-channel-handle=2184 /prefetch:8
        5⤵
        
        PID:2700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=3036 --log-level=3 --mojo-platform-channel-handle=3032 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=3056 --log-level=3 --mojo-platform-channel-handle=3048 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=3972 --log-level=3 --mojo-platform-channel-handle=3804 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4132 --log-level=3 --mojo-platform-channel-handle=4128 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=2984 --log-level=3 --mojo-platform-channel-handle=3024 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4252 --log-level=3 --mojo-platform-channel-handle=4248 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4156 --log-level=3 --mojo-platform-channel-handle=4296 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-notifications --enable-automation --remote-debugging-port=0 --test-type=webdriver --use-fake-ui-for-media-stream --allow-pre-commit-input --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1996,i,18048546417021027191,17704903119795085650,262144 --enable-features=AllowAllGeolocation --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=4364 --log-level=3 --mojo-platform-channel-handle=4360 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kill.bat" "
      4⤵
      PID:3920
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_asyncio.pyd
Size 76KB
SHA256 13b374175108c266f4a5bdf907f990d0ccd5b486d0313856e08a60ba9bf856cf
MD5 7c068accfe6b0c30d60c1873889a755f
SHA1 6e4aafbe3bb0622ba08fb210d1fb5d9d9dd9fdcd
SHA512 c86e038d8a6ee0379b9048c51bb30e1159c4f61f35a3cf3311a072894ee9dca69988522af85b0ad9f1a7b7defb3331fb9c6f967cb36df649233dabefeffcc653
SSDEEP 1536:ePrgCA7vEAQ8mCo30GoIADnx0y7NsR9CfIbHMvM:eNcEAQ8Zo31oIADn8T5
TLSH
T17D736C8792A44086EEF79174CE536FC3FBB1F1915904539F51A4C18E2F533A08BBA726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_brotli.cp314-win_amd64.pyd
Size 836KB
SHA256 44f02bcf2b15519a487cf653e16b5f9c65f26d0be559592878988ad47148fc5e
MD5 9aecb372d2475e80654316a36405628d
SHA1 8e8136db459db0a9ff308db3f5256afbbae57573
SHA512 16ae1aca4556243a2c9a955b180931640039d8be1a8d8266290f8d2181d51e9da824e8c9ff010c5ac8b0cc6253b999dc1a84a9db3db0cba0390bcc0575024bf5
SSDEEP 12288:/GLA+oU9j/L2muMNivAHhlyq8hnnb3xKWulsONv:/GLZtXWtAilgWulsON
TLSH
T12F058D0BD8B35739CC27C4798DAB1336EB357568531089A7B258E5313B43A141BBB3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_bz2.pyd
Size 85KB
SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
MD5 98aa4ec9b691267912bcb3336fc7cafc
SHA1 8955d7e923c4bf05d84a03666ec8cdb4fab2f616
SHA512 62084c7077ed896b92055e5a278651d6eeca65622321e389e551e8a331b51c9fe2a5eb1b903eaed41117a7a8efce514b9d62acf2b62985d1535812ab59011387
SSDEEP 1536:w1sxz74jpCk2wWdyOeR3RYZvksL8DdRbEvtwIA3V4y7NsR9KfIkWO:GsxzsIdtYOeRuZcsYZlitwIA3VU
TLSH
T162838D82E3A462B7F59F91B4D7810753F730FF560710A3AFB25482863F12B91AE58366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_cffi_backend.cp314-win_amd64.pyd
Size 177KB
SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
TLSH
T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_ctypes.pyd
Size 139KB
SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
MD5 409e2c98beb0554395f65fc8b55951c7
SHA1 f7e25afa8bd80fa8ed709aed8ced4374c0f1ed93
SHA512 8babb6fe295975868c1aa57c63dcab6f2cd151ba7074848dc7da27de2ea46a886496754b7c7e09b043ec5dc2813d30cbdbaa136f0f26302a1b7246a5da7962a7
SSDEEP 3072:5Dpx2Lp7KR+FrkdOJWWcovIXBzTKRFyxpMIAGPwuTkY:tpxCtKUr8WDvIXBnU8xppkY
TLSH
T1DDD38E4B736840A6DA678138C6739E47EBB1F4521A1087CF4264C99B1F633A2AF3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_decimal.pyd
Size 284KB
SHA256 1f4a8ca9814508d3597992173fdf4db312f3b970f6baeb053b9d8c3087f907e7
MD5 d0cc4eb1597b0d0e851761ad781002bb
SHA1 606a80e9417cca5699fe48e1eb2e6d22f67bd82f
SHA512 4ae19bd6e2bb22697727bec6369725a7a1bc718b28c5a74c1f4bffd1508091714dfe5db644a1b8bfa34d30235ba36111449df72741d61b80415a42442a35bd45
SSDEEP 6144:R/wuhmr5uFGZvFvvpYXqOYv3wGqqM43fIWeAHmMVuq6:lmVuFGZvtmXMntVW
TLSH
T1CE546D96A3490CA4EF738434CA879A57F7B278414360D78F43A48A972F933A3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_hashlib.pyd
Size 67KB
SHA256 58c5c9ff93f989e2a233b8c5e06420ea73dd6c013e1f08d996fb0f2828eba0aa
MD5 c435a8d2988b2b248664a45ac26b8b14
SHA1 224adc85a39374e72de0383810aa747a7bc89705
SHA512 480a76ad73ce1942751af83fca8913e3a36961876b15341035162a121b71aa0a86e992d3b6ca54a8a7ae7d43efc24fe8a824819f833c539a2abd30c41257d62c
SSDEEP 1536:2qCcJ6CJ2GEioPMc5Wv52ztK4oIADIJy7NsR9BfIkH:xCcEyG1X5Wv52zBoIADI4
TLSH
T1F3636C46A6984092D62382B5C9E34E43FA74F6512B1197CFA239C1CD2F233C3677B75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_lzma.pyd
Size 157KB
SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
MD5 d5e9416137026497171e131dff6e569f
SHA1 16de80a710940e38537d1d2aea22bc33d5948591
SHA512 e7cb2a3c68e7f5129a4712b38b81fc84fc57881bd1d087c755ba16ee6d892be7ec0708a30465d2a28fe9b587226f233e02a2f512f861ad58012b5b80fe7c1927
SSDEEP 3072:QJ66gwnM5uNIJfuPdX+ENYQrHznfx9mNopUpdgwIAI1ho:QURwnNIk1XrBrTpYOQgL
TLSH
T11AF35C86B794F0E6F3628C38D6624F57E6F578190320929A01CC976D2B1FB759A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_multiprocessing.pyd
Size 37KB
SHA256 a88475c4cba47977eef5756c217c79441c53cf57d0b05441de87744313e2898b
MD5 f320012244fffc160183d3354e1f1032
SHA1 9ce890d318e65e10b00bb972d5de26074190df86
SHA512 2c3fba6f7469daaf04e7ee38c7dc31c3d1d3179af1e795689db6b3a1d2fac05196653c88e54b29f7fc654dab3830967ebe408de0c90e75a8d1592944ed70e59e
SSDEEP 768:MFMV/wXXybycUlYIA7tThy5RNLaRYT2Ip4oTxf1ml6Z+7UVFg:MtXXybycKYIA7tty7NsR9UfIL+
TLSH
T10A037C85A6680043E9679A30C5A3EF87F535F7871B25869F3165D2CE0E373C1B36A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_overlapped.pyd
Size 56KB
SHA256 43b9e0bdc41646fc363f144bf050600dab647ce9e7c251a2b6d0e75358cb10cf
MD5 ab8858a46a7be17fac60533920888a44
SHA1 b01429e86b7e994d1952c5c3f8012b44731706fe
SHA512 c439c30a700e3b0b7f199b8bd3adffd1371839215fea569cee31b1de0d7aea71855052bcc60ef6fd77c957fdb1e1e8bee6b31380ebb30102242a8c8d8606d6fb
SSDEEP 1536:4CyjKf/t3jM2POqg4uGsLkIACtTy7NsR9U5MfIks:41qgxGGkIACtu
TLSH
T19C437C496B9401DAED73D579C2A79E03FB74B2D30601931F60A8D28A1F73792A72F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_queue.pyd
Size 35KB
SHA256 2a7bb0a53e86ae4982a6f64e2570137829a0be66537bb1c166913af273edbf0c
MD5 ca3c81d27c1baf30131d62f290d69057
SHA1 d8c637b974f7c6d5a8761b02e145f8a1c3b5538c
SHA512 684111ef143ef891701e209857486e3172e6f1d02fd50236e591e231748ba7acee31cffb840a5cb56ba57e92c57654e461cf479cace7bfc3fabcd42442911b7e
SSDEEP 768:ZlBxk6rOVBBmMIARUb6hy5RNLaRYT2Ip4DaTxf1ml9dH3jL:ZjSBBmMIARUbmy7NsR9GfIbH3v
TLSH
T128F28DC66A689097E6A3C970C2E2DE53F575F793170086DF2169828E1F273C2A33635D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_socket.pyd
Size 85KB
SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
MD5 8a8a372bee9f3b313e44bf441fd5dd61
SHA1 802cc8454b2c5ca4c8a7754821b756d3ca248058
SHA512 bbf0362e306e0679937158647f402bd93a23f7f4270f90eff524b44b0f0af114456f8681b933424a50e3fa764b2ea5aabc67e385a02da2427c340163bf6ed739
SSDEEP 1536:ecVuncT0XH3XAJtZypxQ7XP+66wSz2/jAjI/Lb6NsQ3cs8PgMrMIAGwsy7NsR9dB:nEny2+jypxQ7XPz6wSz2/jAjQOsQssVG
TLSH
T1C5835B01AA6040F6EB72C172C2639E63FB74B5C012D4A75F5466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_ssl.pyd
Size 180KB
SHA256 06f51fbe150c831af619890eea2d9fca9ce8b49758bfe3f382883551c592e6b3
MD5 372d2752bed978ad699a22fe125fe285
SHA1 9600c5fc4f904f65b29fb523cf9aadc9f109716e
SHA512 87c0a1385e624acfdeec9194a20d02475aac5cc965f558b40a932d955b49e70517f4691c142e8718bec283b3ab5d7671b886084792f47a236759000308716414
SSDEEP 3072:2Lj0a+17gAx5pW3kfh6CM6qMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/Uo:4+17gAA3Qh6CM33bLOUBD
TLSH
T147048C47B1946EF7D913E8B9C2234443EBB4F145332287DE48D6D6860F03746AE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_wmi.pyd
Size 39KB
SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
MD5 495460dff020ae1b0ed769ca066d2635
SHA1 04dff00adde1f80ed9a367a0d7221af1968afa17
SHA512 d3171934fad631f51edd02526e6f05e43986c1bf8bc16d02877077d39bd7aa27f83efb2f27ada23e792c2a1bad8ce17bc2f0801e308f425c21d3bbae99ace5c8
SSDEEP 768:D2/EEqrVmjsyu2OQMVwIA3ilhy5RNLaRYT2Ip4ETxf1ml9dHMjL:OE9BEe2OQMVwIA3iTy7NsR9YfIbHMv
TLSH
T1A0038E89E6680092FB67DA70C5A6CE53F575B7931712838F326582990F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_zstd.pyd
Size 491KB
SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
MD5 a75e9eb46c217f915fb8db1deed6dbb3
SHA1 b7e1bb9e18856a93b405c8adff3a198695b37d50
SHA512 c160a4681d9e5ecbeaa9416e294883fae9a212e28a8fdee5b86181f7e1cb35b9f1352e2af7894ae1023fb839e75d4fcaa4c5bc61024bd7cf0e261e21edb02cfb
SSDEEP 6144:dZ87M+EgY9pB2l1eUVcnmw3Vh4S+zKhThruVxzeeO07WEz9LKE+UIHHHRToSH2l4:vNcumw3vT8eeOyWEz8xHnRTrWl93R9D
TLSH
T17AB48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\base_library.zip
Size 1.3MB
SHA256 920828e8f673ef03e6e673df296f6bc3373b1a3bde6167c03ca67c3baccebb22
MD5 a79883abfb936275e53d43b2749cd83e
SHA1 224e3de94874cca10b76e73510b56fc6be1732db
SHA512 7894234662e5711296e34b0fe981a66c26f1f8e98c36f5133dd447d25aa0e2463c6e3635cccd188c336ff794a8084f38bbde7deae13152c062cfa73e2dc237c6
SSDEEP 24576:7dwOMilbyQeOdP2m2dfARp8uUFSw3VLpO9:7d4/oR+uUFn3fy
TLSH
T144552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\libcrypto-3.dll
Size 5.0MB
SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
MD5 7e8a8461fcd43c82841a99a2054711f1
SHA1 a931808c56e3a117795491965cb3f679cdc05886
SHA512 023c34e26b7dc7240d4571f8f808bdd0b749bd6e924948c3db9c5bb4f7acf24557d3a94bfe6ff82697f9747b35c13a73b94482dff3568e1dadb8fe08b598bc61
SSDEEP 98304:on+c+4Vp8XhjqO58Pw1CPwDvt3uFlDCQ9p:mPTVpghjqO5841CPwDvt3uFlDCQ/
TLSH
T147367B6AA7A80189E4BAC13CC9534617D2B1F81A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\libssl-3.dll
Size 776KB
SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
MD5 299335af4f92df8a446d5f98d6e9cfc4
SHA1 75ddcd4863ffde24d22914946ce4e085722dcdbe
SHA512 2da67c01775d71122e6bb951b7e5e7462e8725f79b513551478cd262dae2d97e108427241d13f4fd6ef1d35b739d34fb9c999ca4a6d50271ceda8e0c3dab313c
SSDEEP 12288:8VJ6zW/kDXMeI0niRBRKZk60STGaFc4rldFe9XbC:JDXMeI0iRBRKZN08GaFFe9XbC
TLSH
T1D3F44CADB37C05DDD8B6C17986934623E3B6F4162330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\pyexpat.pyd
Size 213KB
SHA256 05530afc9cbfe68c28c052eec159b852e731316007e1f52e0a31412e4eda07f9
MD5 85913240677e6a75f3dbd5b548e824ec
SHA1 21904e9603cbb4eaea1af1d32a9efae984a5344e
SHA512 aa3429a87d6928fdb27dd0a607ad1f2a901ffde7e2b744079e03b82889bfe6305dd260d617143281c636203aca469b8cb62e8ba4ad76f6383496ac06b9ac7558
SSDEEP 6144:+H/PKxsukBnL1G1QA/3t1sYJsaoYC5mx:+KxsukB41QwOwx
TLSH
T1A1247D9BB265C1E6D853C13CE6968B13DAB1B86203909BCF52C4DA7C9F2B3513B29315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\python3.dll
Size 72KB
SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
MD5 33282f049faffb54e4b5604f18bcb4f7
SHA1 3406bdbd09a8968816f303f5c6e8e220a9336807
SHA512 6a8754ed4a24748d60002f2a02c0cc193a4d2185edba7c834572a6815b1aa1bea4733708460dbd2780cc3a6c856ce8aba0d2f55cd1a65c164599267784e0d2a6
SSDEEP 768:PQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKI1:ebTrnXngXMjMIAG0Yy7NsR9/fIbHgv
TLSH
T110734B5E6B54F8A2D6F629FC78D199CE242B12FC4F2984DFA47DD3920D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\python314.dll
Size 6.5MB
SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
MD5 e823b990ba85afa143b799c291058dce
SHA1 3e53a71a5c72c3011bee19a792a6552a0d702671
SHA512 fc9b0a6795993e1c4519622726647c33c415a9aa9983daa52d1f9f371c58fb74067599052f5b9c25f5acc08ed15021221dc524543a4de87b5705bba145a1b622
SSDEEP 98304:6PEfNNEwwP1Fyh4NIyDB7Qfo7wavAHDMiEuGC:tfXEwM1Eh4ayDpji1
TLSH
T180669E26737401A5D9BB8035CA074647DBB1BC00AB30D34B59A47ADA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\select.pyd
Size 32KB
SHA256 56441c3148743a0890986ccdf93fea8174155b0ee84db2493151f075d8e7c51a
MD5 220234862600483073f18e48a7860bc5
SHA1 fd000174506afa55ffe67f72b45f8bb9e572ad6c
SHA512 c4b7f64f8934c9892763487fcd0eaf4c8087679082d0bb250cc264bdabaf88fb7245ec5b54abbe412a05c397abe56729f297bff98a956f9d4d8f98310ecbfcde
SSDEEP 768:oB7YoHf8aqFMIARGLhy5RNLaRYT2Ip4zTxf1ml9dH7DjLkB:oB71/8aqFMIARG1y7NsR9RfIbHHv
TLSH
T126E27DCAAB745047E6A3CA7186A2CE43F939B7A35651829F31B991C90E173C1F337319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\unicodedata.pyd
Size 740KB
SHA256 58013696b4f08717aee2885aefa24031f4b18b3e62faa8125248cc3e0a86af2a
MD5 89acf0e666a540a8e22cac1a09f15ff7
SHA1 e11e74df8f7b7448c79f31fafd6a9ef5f1a393d3
SHA512 26c9958de86384a1bfab493f2f733e087de887f3f0c7532bf30fb3de2dd32b5942ac806b8bee1370e2f9ae67b5df7fba65fc43aa88dab78f8408c09d1c769a28
SSDEEP 12288:PPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNi:PPY05ZmDPqO54lDJPTMNi
TLSH
T1CDF4E5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI25042\numpy-2.2.6.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
TLSH
T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\_bz2.pyd
Size 81KB
SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
MD5 bbe89cf70b64f38c67b7bf23c0ea8a48
SHA1 44577016e9c7b463a79b966b67c3ecc868957470
SHA512 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1
SSDEEP 1536:V/Uez7qlsjcaNXZIzNYM4B0NDX8rjE2tI7tVj7SyxPx9:eezGiXMjdMrjPtI7tVjLx9
TLSH
T10B839D93F76095B5F41BA2759AA14393E331FE49039093EFB244831B2F13B913C6536A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\_ctypes.pyd
Size 119KB
SHA256 e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
MD5 ca4cef051737b0e4e56b7d597238df94
SHA1 583df3f7ecade0252fdff608eb969439956f5c4a
SHA512 17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3
SSDEEP 3072:YjjHoXs01LUZJNUoNZf4adhfrI70s3nRI7QPY2xB:Y3HUJ6f5dhfrIHX1
TLSH
T178C36C5B2354109AEA678078C5B35F47DB71F859172083CF02A4CA9E2F637A36E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\_decimal.pyd
Size 242KB
SHA256 4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96
MD5 6339fa92584252c3b24e4cce9d73ef50
SHA1 dccda9b641125b16e56c5b1530f3d04e302325cd
SHA512 428b62591d4eba3a4e12f7088c990c48e30b6423019bebf8ede3636f6708e1f4151f46d442516d2f96453694ebeef78618c0c8a72e234f679c6e4d52bebc1b84
SSDEEP 6144:LbdyrWOay+msmOE8qQRiJpCWi9qWMa3pLW1AUg42G:6zsmsmGNRm1omZ2G
TLSH
T150345C16A3490CA4DE778074989B9B57FBB278854360D3CF43A4CAA63F576A323BD344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\_hashlib.pyd
Size 60KB
SHA256 cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
MD5 d856a545a960bf2dca1e2d9be32e5369
SHA1 67a15ecf763cdc2c2aa458a521db8a48d816d91e
SHA512 34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4
SSDEEP 1536:aIpTlJFWaIDPZbdqzOgB1fFI75IJ7SyXPxMVt:rT36bZbdqzXfFI75IJRxMV
TLSH
T136536D05A69440B9D8674278CAD71F5BEAB1F0405351ABEF0358C1CE2F237C3EAB6796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\_lzma.pyd
Size 153KB
SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
MD5 0a94c9f3d7728cf96326db3ab3646d40
SHA1 8081df1dca4a8520604e134672c4be79eb202d14
SHA512 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087
SSDEEP 3072:PBKvRNVdG9LqSS2IAiznfI9mNoBkD9ZRqtI7e1Pvxs:PBKvRts82awYOBkvRqM
TLSH
T1F8F33992B394F4E6F6228C78D6664F13D7F678490320829A12CCC37D2B1FB755A2A717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\_socket.pyd
Size 75KB
SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
MD5 0f5e64e33f4d328ef11357635707d154
SHA1 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA512 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643
SSDEEP 1536:c67eU/Bgujs9/s+S+py8k/DDjaRI7Qw27Syj/Px:c673/aujs9/sT+pPk/XmRI7Qw2xx
TLSH
T1B0735B12A69050B9D2738175C6635F23FB70F480139593CF1264DAAE2F23792EF7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\_ssl.pyd
Size 155KB
SHA256 e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab
MD5 9ddb64354ef0b91c6999a4b244a0a011
SHA1 86a9dc5ea931638699eb6d8d03355ad7992d2fee
SHA512 4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca
SSDEEP 3072:xOoLGtbSpE3z/J/PUE1ueW5J2oEPwu3rE923+nuI5Piev9mutI7t7L+xu:xOoitbSpE3zhH7ueAE8nuaF9muy
TLSH
T15CF37C47F24419A7E817E4BDC2230A53EBB5F045231147CE49D6D68A0F13B46AFBAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\base_library.zip
Size 859KB
SHA256 b23b8106a3b169e7a6fa4e15a268838e15ce745960e898417b27a1708a410c5d
MD5 8d2a0fa9d93151624dba781324e5491e
SHA1 ef3ecbe6b92d446fdb1a548a5e6b8e4c043bf964
SHA512 0fd1561926c3479f156be4dc9cf4ca8ff833165aa15ff921294aa2a9f17982db3f77b2be886efa4d60d757dda190805ba9a32b67eabf765d3c094d9353717920
SSDEEP 12288:1A4a2YHP+CMNSWfpE4gYJuCd/SN7QT6uBqkbcyuVwxGi:1La24+CMNrfpE4gYJjF7uVwxGi
TLSH
T103153A8069911ED7FD05F278815F8E3C069AB33ADB89D543BA4FC2D8BF472E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\libcrypto-1_1.dll
Size 3.3MB
SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
MD5 6f4b8eb45a965372156086201207c81f
SHA1 8278f9539463f0a45009287f0516098cb7a15406
SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
TLSH
T1B5F58D5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF08A681780F17BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\libssl-1_1.dll
Size 686KB
SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
MD5 8769adafca3a6fc6ef26f01fd31afa84
SHA1 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA512 fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
SSDEEP 12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
TLSH
T1ADE44B95ABB51498D9E6C17C86534A33E37AF4141330AFCF06A5853E0F17BD82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\python310.dll
Size 4.3MB
SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
MD5 deaf0c0cc3369363b800d2e8e756a402
SHA1 3085778735dd8badad4e39df688139f4eed5f954
SHA512 5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989
SSDEEP 49152:m/4rIQeEKdN4uxzx1njuYWxKLx5NFnb7d1G2F58rkx7qzMJYlf1GCJLvNyoInO3V:mS7q35VNFnlRqT84NAnYHAMDlPK0r
TLSH
T1DC267B22A26401A4D9B79477C5238647CBF1FC552F20E34B41A4BAD92F73BA316EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\select.pyd
Size 28KB
SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
MD5 c119811a40667dca93dfe6faa418f47a
SHA1 113e792b7dcec4366fc273e80b1fc404c309074c
SHA512 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3
SSDEEP 768:zeS+FwhCWHqhmIRI77GwYiSyv87PxWEgC:zeS+ahVKhmIRI77Gw7SyGPxL
TLSH
T111D2AF8B9B9058C9E863C57258E64F02FA34B661875082DF3319C26D2F237C277B6769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50162\unicodedata.pyd
Size 1.1MB
SHA256 4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
MD5 4c8af8a30813e9380f5f54309325d6b8
SHA1 169a80d8923fb28f89bc26ebf89ffe37f8545c88
SHA512 ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a
SSDEEP 12288:6DYYMmuZ63NIQCb5Pfhnzr0ql8L8kXM7IRG5eeme6VZyrIBHdQLhfFE+uAM:gYYuLZV0m8vMMREtV6Vo4uYAM
TLSH
T18A355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_st14r3tj.jmk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_st14r3tj.jmk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Crashpad\settings.dat
Size 40B
SHA256 769f6efe0d269c0d9499411ebd6504c5e2bc9b584121557612f93a9f2b349eaa
MD5 5f2c3b60c0cd3bd6847b28f5583e50f5
SHA1 d780675f1ca165882f9aa206cb3877c164c9d394
SHA512 29f24b3cca7e02d35fb7185a6976d7b0e85984a75cabaa9753c00cbc7c343853af307eda00d572980f45bebf21f9db1238f28ee7916aa31e6d0a531fa3b088dc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 09d11a62e3426d70548a082c0fdf522eb2047cdfd8e71c41622d2193b7af10b2
MD5 a5cb7207cf6c8367653be1dce123cc15
SHA1 cedeaf54c5c36b54e6f2eb4ac2f4ca320ecbf6da
SHA512 dd1dcbb3bfe8914ea5dbaa2ad49de9af0cdc33dd600edbee10636ec712bf5618273e5d7adf46f7f0d1cbbf9166087c1e8afa9834ad4b32669b2ed529bc180586
TLSH
T1C7E08C9755910A70C721C0B174CECA052D3C633785101D2787A0A26054A7A4CB21E7E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e375.TMP

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Default\Code Cache\js\index-dir\the-real-index~RFe58e375.TMP
Size 48B
SHA256 a1f73d7b575da89f3fd1839788a62462cfde0eac8b48d2dd9c388fc25dcc3d9d
MD5 78c86b51699f730422f7eadff6aa33f4
SHA1 16261606d7db4178c029d5e50e46b0a9a410916d
SHA512 fd639f12ed6e966dc1c0d6e2a8eee73085e3da36c32e5c6c6d524e8b6dbf700deb1a14541acdf3ddf9c40d3a5583e5c6ced1a152a4a50cffb65c28f5d311d9a8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Default\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Default\Preferences
Size 7KB
SHA256 2a4e8eadb1e01511a741d16b835736c74754f01327bf05dbe1bee1f5e54be212
MD5 800673aad0bc921f54a626e4c3b33b12
SHA1 23a83f70657d62a3b9d403999514ded31f44c7b5
SHA512 5db20c129701d0af6a78557be5751cd6a3308ebf2cd366107e53637019e091e70ea581a90df4607753e77149865193838aac166c019351e9b6f3c7467527a543
SSDEEP 192:bRJwcnqzAv7AybQvAPRp2mdXsb+WNWLLPzKcS2+5mmk:bRbq4g6XVXwef82+EF
TLSH
T1D7F19517B82499374DC7D51AB9347B66E2FA543226D41D486BFC8A2C05EB7DD2203D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Local State
Size 1KB
SHA256 43cb6bf2dc6e54b0472dbcdfd2c1399fb2c9617a2c22b7e766cc1a7d474ec26f
MD5 2dec67d4c8096a132422e3a3ca8c5800
SHA1 ea8987eba5b92230efbedeca3a88c5d48c860a03
SHA512 de7dc4c2c14a5ef785e9f8eb5de474376902273d072ec6b34fc470ab43f1924ccc7c79dc359c5788f383c4a304433abc2ed460e391c0d9c45f686525d9f1075b
TLSH
T100219671B8A5357158668D06B341ABDB0E3D8437C6535D8C72DD0E2C50BFB9C1306C35
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\Local State
Size 3KB
SHA256 73d33eef712a326a26628cb699479c511b07dac3f8317ebc37ee309d826990b7
MD5 922514dda6b26769d5050f0416467f6f
SHA1 0419bb90a431c5f89088d97e65aa2de3e2520f3a
SHA512 a4268970035daaa613b3cb2400c5cff1bdbf167045a274d28140f46e93a20dcd0d30c36fb568d952718630aeee79d550fb6979350dca657603c96b1f9020543b
TLSH
T11681D672B06858338876D802B1423F878B79687BF6127ED4D6E90F1C10EB6D80343A27
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_debug.log

Path C:\Users\Admin\AppData\Local\Temp\browser_4222dc53ed9d42899f88384b9c1db28e\chrome_debug.log
Size 1KB
SHA256 29b7aae7ec624e9b885c7cd562642826ca8b8b863fce6148c5057b98c5a2da7c
MD5 3327445392f49eac8d29937be60057b7
SHA1 c267871913101506e91292bf4be12eed7032c9ac
SHA512 db82ded1fe7727edfd9f4edd223ec45f3cbe91295410db7dd5737aabe5b95c2b676a8d99e3c59f2736b791121f300e61bdc077aed278ec14c649a289c34d45c2
TLSH
T1CA31BD72CEDC2D3364566B8A3CA39CE3322CC559E62024379169AF6573CCC7A8147758
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c\Crashpad\settings.dat
Size 40B
SHA256 9be2de23016886ff2f9fa567a4c8c3647351f922ba198e7b3adf9a2ecf86104b
MD5 755c952af922e527db79466065ecbcd8
SHA1 6399fca756368c386d26c8a638bcc8b4630415a2
SHA512 912040c69412e278ab721d5ec1009d78791c0a283dbfe6dc0b092051fddc2b3c3a0b355bbda26dc5dddb0e733686e277d8b7ebfa3a85e81db46931a5e002c3a7
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 436adc94334afca65cfd434c5b3ea110c3878a72c2b5802f2b646e0f49977166
MD5 6d29cb651a5a0f127d805dbd86a76931
SHA1 412288e64e839654e9bcbfd738899716ca9a8056
SHA512 708f65a4fb5dabe039dd7937c0f86e894975a577d3fb1c4a4978fb990d7128ddf688d737a2b3de6b28da780c361e684c463231a499657984df7c91715c8272ab
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 d298fd15e29766159143166aa4db9aa0d0a443e38e747852a55891ee0044c73b
MD5 d811d66ce2c348a1fafd8ba62a35cfec
SHA1 f1dcc276619a536013f425914d0c8c5f8647511b
SHA512 354049f769bfc880930fc8d9382816027a4e89ae60ee85c2481614938ef8c510d57a534033555334a9be41ec6c7d4e44d021ac9a9007bf2206333c2baa6f1134
TLSH
T123E0C21784B21074CB319475B08F344A29748F7D8D504D7B9BF0B452B8E33DB020DE51
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c\Default\Preferences
Size 7KB
SHA256 52ca432989cabb71d5f026ea268f87e6ed2f4f9e88f071747eb386ba6f5e8e38
MD5 524629a94e37a8dbc8afdde1052f8b71
SHA1 30883814ff981e28690aa1e7ce5b40bf5825bb0e
SHA512 8428a235b42020f4ce80abea4ff85d0cd8e82233802f9a7e86217e94967a275d1f9a08600370cc36d11476cc7127a176599f37add093c801211ef6125d82c1fa
SSDEEP 192:uRswcn9Xv7evAPRp2BhXsb+WNuXekKeU2+vbk:uRo9/y6XAXwCM2+A
TLSH
T17CF1952BB81459774DCBD51ABD307B62E6F6547267D01E486BFC8A1C05EB6CD6203C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c\Local State
Size 1KB
SHA256 5e499638438eabb5da5723d8a3dd11ef8e7cf4d0341aeb15ba1a105c4a34858d
MD5 5e38c69c724ff93f1ca63b55e04a01ee
SHA1 d44e2e37c6720590408f9e8c0692673aa2c6ce6e
SHA512 8e0b234d968c5b8bda7ede96a33d795476803a55289f8dda474b1fee82ab8913c3ae1ec100f2f95f50348447be7bd549e8607c34bbc2f5312ed7a6c5163e10fa
TLSH
T1AA2160B0A594213179969D0AA24097CB1E798633D1B7AD8C7BEC1A0808FBE9C731AC31
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c\Local State
Size 3KB
SHA256 fa5fc5bf72e1538c4a3a63cbe49a23050bb917cf5ba3e4814a0b54391b9c90f5
MD5 c0c9c81e7fdb355b85ae4a3aaad4288b
SHA1 8319b18b3ae2eece5e30366e7b3275178d379e2d
SHA512 5d9fc847f240281a006c0a8d310c0f443f7429862891c14e2e56b67ec78040c8c8fdbed1b5278dec3a40052252127babb7eecbd791f80c9bcb4d8aa01b5bcd8b
TLSH
T13E81C871B1A858336966EC02B5823B435BB56577F5617ED4EAED0E0C04EB5D81342A23
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_debug.log

Path C:\Users\Admin\AppData\Local\Temp\browser_8808163149094fa7a83e68b1e6a97e7c\chrome_debug.log
Size 1KB
SHA256 e40f658b85b37d2051ce164fc2784757b7d9ef250cdd0bb8a34ba9201601783d
MD5 6c54610c4dabc60f8f7929cad18d437b
SHA1 d5b97ef8e65506b930610d1b5f352835ad2f3ba5
SHA512 fa48e07d47dba390c3b71183811b2b795d1ba2f115f19c8274fba4b59ff197bff79823394d31114b49116a2e6436371bb47b1c1dd9a11e646e70df87f9e478d3
TLSH
T10931E322EDCC2D3B0016EB993C63DCE77628C58DA61474A3D2256B51A38DCF98111B4D
MD5 SHA1 SHA512 TLSH

Submit Download

kill.bat

Path C:\Users\Admin\AppData\Local\Temp\kill.bat
Size 77B
SHA256 9f92b8786662200d52ca1661ee05a2bddc9bb278643caff0ae4f3741478342f3
MD5 1e3461e33f9fc64308209b7611497489
SHA1 49a5d793560bbdfe5c572065f1e2757b1e02d1c0
SHA512 f9e64b9510b07af1cf5833d3471f1c9467e3638b2bf5cfbc22f28a218563214be2594ef28f4a235833ace24050019bd989193ccd2cf9e077d9dcc54aee6f7d3d
TLSH
T1CFA0223882002CC020002EBC220F08A2B2CF80C30020ECEF322300FB8CC202A082CF8B
MD5 SHA1 SHA512 TLSH

Submit Download

kill.bat

Path C:\Users\Admin\AppData\Local\Temp\kill.bat
Size 203B
SHA256 0dc1733d1a3107524adc7f4c994afe103265928c9c15986463c66d03b63ab9fc
MD5 859bc5dfebcf57cec30802152e862218
SHA1 632a52a6a1833e81a031c36d15020df572605a34
SHA512 56003bd1a6b9f74bb24826608355fc2bb1c44c354c09c8c470301fe0031d3d5aac08a941689b290e9e23e5c4244ef32fcbda01e7474b9f32948b08ee7787009e
TLSH
T182D02304A262C6D71841345B127A556CF1FC0CC5B7047E131D13816F57C200C59D5748
MD5 SHA1 SHA512 TLSH

Submit Download

lg_b481fadfee6b4e5f88735d8dbfb5ea4e.db

Path C:\Users\Admin\AppData\Local\Temp\lg_b481fadfee6b4e5f88735d8dbfb5ea4e.db
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rbx_1299c702bf61499fb0debfe6246ca327.db

Path C:\Users\Admin\AppData\Local\Temp\rbx_1299c702bf61499fb0debfe6246ca327.db
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stager_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\stager_debug.txt
Size 4KB
SHA256 5c2cc5f97df37caa2a7c8805ba365eb66f968d9e58a430f9e7cafaf5cce86ae1
MD5 e25f7b048723f78a3b6771de3d6be556
SHA1 f5674d35c5286aa4de815641a11cb6b1dcd03721
SHA512 d57333f39af4000d9fa2a99ab82353485c3983351cbc9ae61ebe78a6831c74628aa87a0e2cb1c505f3fa06907e105c28c997be1e2dda2cb48828f4dfd7e22cfa
SSDEEP 96:KhDkUsPkoWrZHjNHjKEoeAexOxEaeAeHOF1Qe1e0Okf1eSe2OA/y2eLeZOj5TVeb:awVP1+5DVxNVHkw0Iz2qHyZPRIA
TLSH
T11D914A1A4AF5E1928E065121E77384ECED6B30433ADD34C5F326444C99885A6FAECFDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stager_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\stager_debug.txt
Size 272B
SHA256 38f99adf06db446b7066a6024725a112e5bec12d6bfd25d7cf64fca3a02e57da
MD5 51d5921f3eb4bd2bb17bf1d24fa84876
SHA1 430a37138e6af2c1b1177b0512a4caf27b56024d
SHA512 c9ee01bd79dfe510f389f6489a0cd1b52a1a5fa223d09afd881dfc4310729e55dec93ba452247dc8851f698a4967bf0cae4b452917ac6bf53bf1ceef675a93d6
TLSH
T1DDD0EC25C8F4E032EF4D0871F662096C1DAA3C03E41C38C87315A24A8F0D073D684ADC
MD5 SHA1 SHA512 TLSH

Submit Download

stager_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\stager_debug.txt
Size 690B
SHA256 169208f4d35e6b2212e0ba285fdd11915de2cb001075e514bff79da2b8f68596
MD5 407246167046da052e1cf7edfe39c042
SHA1 f4eeb7964def46cfd1a5ec2e0cdc5d48b5607b1c
SHA512 994f6cfa4d79929e4d85968581832e46a6c03ad03e938793602e3039e4bf6aab27ee751717d8599f81a24e370154a436a49b130260fb49cc069ae5fe196b3956
TLSH
T1E2015E148CF4B1669E490922AA3289BC5EB63C07BA1C39D87721D0589A4E473EFC5BDD
MD5 SHA1 SHA512 TLSH

Submit Download

wb_f7703cd6d1b040e487d325f5935231c3.db

Path C:\Users\Admin\AppData\Local\Temp\wb_f7703cd6d1b040e487d325f5935231c3.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-960-0x000001C0D8120000-0x000001C0D8579000-memory.dmp

Download

memory/376-1289-0x000001C0D8120000-0x000001C0D8579000-memory.dmp

Download

memory/4188-1045-0x0000026865FF0000-0x0000026866034000-memory.dmp

Download

memory/4188-1043-0x0000026865BC0000-0x0000026865BE2000-memory.dmp

Download

memory/4188-1046-0x00000268660C0000-0x0000026866136000-memory.dmp

Download