465fa776614d5eb5de39bc4532a3390d4e8f71fac599982d07beab54693fe0b4

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wujaszekmc.exe
Size 91.3MB
Sample260604-pd98eadz5x
SHA256 465fa776614d5eb5de39bc4532a3390d4e8f71fac599982d07beab54693fe0b4
MD5 2a00601e3ad8640e963fa93437cf2f0f
SHA1 a07046ca04e9d4f366e23a6a78b5a0dca5159fb2
SHA512 3ce4b14350117032223df45e9192ae27eb3eb35c6ec2cc2a9a81f9d3d79ad6d632b97479acf779740eca3d211aff2c2a45b4d1b0e9ae29c3eabca8aa65cf889b
SSDEEP 1572864:KTIAC2HpuPc2BrS02I4KQJIFLXujlYEbvYChEngveKltrVDq5glHwNrB3:KI4GdSY4zIRXREzYAogGKLZeg
TLSH
T1E528339ED983605DE2458D366CACA6E74F52E4244033C055BFDE89AC76A39FC1238B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 27 IoCs

pid	Process
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
3552	wujaszekmc.exe
5664	javaw.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4596	GameBarPresenceWriter.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5416	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250490718529604"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{69FA62F6-878D-42CC-9FA3-F579F28E5E00}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{DDB34198-8C93-481E-98CA-1FF42AD7652C}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe

Runs regedit.exe 1 IoCs

pid	Process
5080	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5080	regedit.exe
4480	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	taskmgr.exe
Token: SeSystemProfilePrivilege	4480	taskmgr.exe
Token: SeCreateGlobalPrivilege	4480	taskmgr.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2936	MiniSearchHost.exe
5664	javaw.exe
5664	javaw.exe
1460	OpenWith.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 3552	5780	wujaszekmc.exe	80
PID 3552 wrote to memory of 5664	3552	wujaszekmc.exe	88
PID 2456 wrote to memory of 1692	2456	chrome.exe	94
PID 2456 wrote to memory of 3336	2456	chrome.exe	95
PID 2456 wrote to memory of 3336	2456	chrome.exe	95
PID 2456 wrote to memory of 5416	2456	chrome.exe	96
PID 2456 wrote to memory of 1504	2456	chrome.exe	98
PID 2456 wrote to memory of 1504	2456	chrome.exe	98
PID 2456 wrote to memory of 844	2456	chrome.exe	99
PID 2456 wrote to memory of 844	2456	chrome.exe	99
PID 2456 wrote to memory of 1448	2456	chrome.exe	100
PID 2456 wrote to memory of 1448	2456	chrome.exe	100
PID 2456 wrote to memory of 3384	2456	chrome.exe	101
PID 2456 wrote to memory of 3384	2456	chrome.exe	101
PID 2456 wrote to memory of 4020	2456	chrome.exe	103
PID 2456 wrote to memory of 4020	2456	chrome.exe	103
PID 2456 wrote to memory of 3224	2456	chrome.exe	104
PID 2456 wrote to memory of 3224	2456	chrome.exe	104
PID 2456 wrote to memory of 5048	2456	chrome.exe	105
PID 2456 wrote to memory of 5048	2456	chrome.exe	105
PID 2456 wrote to memory of 708	2456	chrome.exe	106
PID 2456 wrote to memory of 3272	2456	chrome.exe	109
PID 2456 wrote to memory of 3272	2456	chrome.exe	109
PID 2456 wrote to memory of 2300	2456	chrome.exe	110
PID 2456 wrote to memory of 2300	2456	chrome.exe	110
PID 2456 wrote to memory of 5152	2456	chrome.exe	111
PID 2456 wrote to memory of 5152	2456	chrome.exe	111
PID 2456 wrote to memory of 3804	2456	chrome.exe	112
PID 2456 wrote to memory of 3804	2456	chrome.exe	112
PID 2456 wrote to memory of 196	2456	chrome.exe	113
PID 2456 wrote to memory of 196	2456	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\wujaszekmc.exe
"C:\Users\Admin\AppData\Local\Temp\wujaszekmc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\wujaszekmc.exe
  "C:\Users\Admin\AppData\Local\Temp\wujaszekmc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Program Files\Java\jdk-1.8\bin\javaw.exe
    "C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -Xmx6G -Xms1G -javaagent:C:\Users\Admin\AppData\Local\Temp\_MEI57802\runtime\legacyfix.jar -Dhttp.proxyHost=betacraft.uk -Djava.util.Arrays.useLegacyMergeSort=true -Dsun.java2d.noddraw=true -Dsun.java2d.d3d=false -Dorg.lwjgl.opengl.Window.undecorated=false -Djava.library.path=C:\Users\Admin\AppData\Roaming\.WujaszekMC\versions\b1.7.3\natives -cp C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\net\minecraft\launchwrapper\1.5\launchwrapper-1.5.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\net\sf\jopt-simple\jopt-simple\4.5\jopt-simple-4.5.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\org\ow2\asm\asm-all\4.1\asm-all-4.1.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\net\java\jinput\jinput\2.0.5\jinput-2.0.5.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\net\java\jutils\jutils\1.0.0\jutils-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\org\lwjgl\lwjgl\lwjgl\2.9.0\lwjgl-2.9.0.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\org\lwjgl\lwjgl\lwjgl_util\2.9.0\lwjgl_util-2.9.0.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\org\lwjgl\lwjgl\lwjgl-platform\2.9.0\lwjgl-platform-2.9.0.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\org/lwjgl/lwjgl/lwjgl-platform/2.9.0/lwjgl-platform-2.9.0-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\net\java\jinput\jinput-platform\2.0.5\jinput-platform-2.0.5.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\net/java/jinput/jinput-platform/2.0.5/jinput-platform-2.0.5-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\net\java\jinput\jinput-platform\2.0.5\jinput-platform-2.0.5.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\net/java/jinput/jinput-platform/2.0.5/jinput-platform-2.0.5-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.WujaszekMC\versions\b1.7.3\b1.7.3.jar net.minecraft.launchwrapper.Launch WujaszekPro 0 --gameDir C:\Users\Admin\AppData\Roaming\.WujaszekMC --assetsDir C:\Users\Admin\AppData\Roaming\.WujaszekMC\assets\virtual\legacy
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5664

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4480

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4712

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:5080

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97889c728,0x7ff97889c734,0x7ff97889c740
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,5750537888080515346,8826409882167231040,262144 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,9337629590673594715,13473107106344309606,524288 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,11591207625125309801,15460589172308828950,524288 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2568 /prefetch:13
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,16613585062857981587,8329750386920139707,2097152 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3576,i,11014125898503758468,10947916907205258969,2097152 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,7444948009809120589,16860971366866680729,2097152 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4464 /prefetch:9
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4780,i,8917385831470185488,18109110549008980746,2097152 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,12248830898309345507,6583700652249031523,524288 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,14770328079489320105,13472607931097913289,524288 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,14811364994229377419,13792989245412806977,524288 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5980,i,16710714029684020170,11503256762514314267,2097152 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5840,i,17039582571633665569,3292507276364987032,2097152 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4964,i,10036431463017620921,3208264506922323745,524288 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4820 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3572,i,8522024310172386979,17100881294934129299,2097152 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,347955342491835265,7562113896291848602,524288 --field-trial-handle=1896,i,782718906482078074,15110599317116957013,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ef652388d2ecd00e3b5724aaca0657c6b6b0886029241bff2085c0d32d075059
MD5 60b1fa387aa7fbdb2ee91e6a03575487
SHA1 dd3e47a5652bb2f717ca62914591d5b1b4784869
SHA512 4da97a81059d69b08372eb9f9b61e1789fb8cb47c5e047bff59b45ab04dc41a223b47ac4d7cd8b99501b379eec8650b57a36dbf46725fb3663ad81327fbdc5ee
TLSH
T1AFF028B6DE21AC7708FD4B1970644B4AE794131B3B81895F3B3C920C8FF463B469A82C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 374KB
SHA256 ab86af68c9996e75bd4fd76238647ff5b5ab4995cdcf567ae4fa544ee090af4d
MD5 d76adab119979902b83145343485825b
SHA1 042bfc393c3aef31567d3ec3a3f5a1f2b4eb74fa
SHA512 622e3a20d8df368f515b073c7ff8cda815f812492ed5e7d9d2467deab2a8d73546a44445318245fd12ebed5267e42e23500ca8f15df52bf24898115d609233f7
SSDEEP 6144:XI3cGxSvrDVXTVsUMn3RZ4CIjt05eqLTayTV7kMrOUhAldRZUNRhK2KYspw6g0Bs:Y+pVaBZlIpmL5RKdRiHhKg+w6g2B0iz4
TLSH
T1058422491A80B7607C5E813559A4CFF8F86C0372C2341DB55D76FAECBC2AAD93D9EA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7b020f5-f704-40d3-850b-8590f9eac6ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a7b020f5-f704-40d3-850b-8590f9eac6ca.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ed6aa33737575c9f436f1d0786d9a80cbae8609b1d3cc7536a9e5e131c36dbb3
MD5 31fb7b96a6877428be9ec1bf44c1d3c5
SHA1 cbe9d19c3e71e3215d2cfdfdbedfcec3ffedf6cb
SHA512 6a6262fdaddd46445c6b7ad1d58140e124411a7bee9ae0544e056936f63738b099e17965aca12cb535cf3b95bfa40ee2b705b7f1ac19e87e7bce25b953da4907
SSDEEP 192:qRFkXbWc/jv7lpuhAPRp209fHsb+WNn5+04r2D3ehKnA+VyIsnAUgtaJ:qRFkfbZg8XzRw8022DqL28
TLSH
T17942A52EFE10653B5CCBD31AF9627B47D7F6102521942E84EBF89A2C29DB6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c6568f1bac684b78de8159688fc0c3f477d5ce94b353074fc73b6fcece2ef27f
MD5 99b9728cec6ff72600a7901c0cec5a1e
SHA1 68fadc13690836b82ffc610bc19b3f4168fd1fae
SHA512 99c214f83ab8b5c26ba7a9faa2fd6472353fc9d06610b878ff0bcc717a73256bfffd663c036d7f0296134d11fc72f22bf3f86ac6e2c227b4fcd60f0fa512d209
TLSH
T1ACB0124080019141C00603FC118354C8B7149F25F60A1B0643E06923C8291938118051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a52c5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a52c5.TMP
Size 96B
SHA256 1d9ec61514ad7bbf5dae38c96fca6bc8e4af732bcf1a6ba9a4ee5cea0004bb5d
MD5 937f3bd58bf8172d8fa8d312e6a7189b
SHA1 e795b2afe542ff9d1a9ebe2b9eb81faf95cf159a
SHA512 73e7ecd393aa7a75294efacc9c06df6b81ee7b691807f4291ad3d4598ec7d8008c4c6a0dbcb215cc80e1d61d89d71d5417def0547424ab8c94a15457d4b200e5
TLSH
T1C9B02280C0022A03C00203B02880C3C8B0ECCF22C2033A02E2E00A23CC20A3083A0020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a303059bbc5bbfc6c744436d71ac201f4248c098f25ab6ee74688d40b213a900
MD5 eb880f822448a28b58ccb9d03f12f41a
SHA1 bd736551583fad1f255f453bee633d7cb0d254c9
SHA512 05f5804e9a90ef800e67367680b3c2961432f0b6dfe3e293199abe31be4d844c32b9b082ae9815fabee919f719905c447bd1be466ba5929493c828a394ac7f7f
SSDEEP 1536:nDueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:yDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T128B30212CAAACE9BE4A49C79A4C413F3BEBE5F9523F1B9424166E4423DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 f5070cc0ef90a4c9a6ceb9856dd1712cd2956af7602832840bc8ace4fe8287e3
MD5 ce0406ac3b578d0d215146314f54f811
SHA1 44b5378ac878116fd7c62c85989393aaab929438
SHA512 cd24c771af5c2042006aacddede643e421e579372f43a70f547f07f0f1ae3c4d9092beb971839a5de56866c8c7cc4f0f39522bb8860fe04029faebb17f3f38b9
SSDEEP 3072:dzgItylJKaUmTCaDWOIMc6+0MegwFs1dYvSaxZFQZDFpmzNA9J+zfAsJDREge7o+:FgIty0syOIMHt3Fs1Qb7Qf+zfAk3Wbhl
TLSH
T1DA342227C9EBDEFB948D1A7C52D877F3BE775E8162B85862C0E1B852294E7001348B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 abc8915ea21a5e6965080e1aa7d8456f3a89b435609602855066aba905dd3fe9
MD5 0bb8a1501d88c988e65fddffad72e8a4
SHA1 2656d3cb6efb0e211c535071e4783a7754a5e05c
SHA512 0ae2501c244291292bc84f98ee166e4e712b1cf3263a512ac5426cdf6b3498bc67161985a01923b149ca49c77e6168953c336ddd7b0f60dd3ce8e16b2f63ffce
SSDEEP 384:kuJWJzVca12krtuVm+SglBOVjeQ8RJo3hghFUjUXPW35PIm59+GDa50HIsYAVocU:j+zVcWrPl8RJYhgTUjUXP6t9+GDa50Ho
TLSH
T1DFA24D743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Minecraftia.ttf

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\Minecraftia.ttf
Size 14KB
SHA256 bd47314d301e50ff4d109bff28dfcf637cb7eb13945480259878b848875acc65
MD5 d7b98c450349bef0631c7229b804a5c7
SHA1 adeaf75e88666e1987255be09e7bcc452bb4722d
SHA512 b541e1231e8daf497c1c067b94e5eca6fcf1d13abf4aa76df8ed15507b45f530079b18d617bd758b66dc940a34ba410c118101ec89c4d92c5aeb276c5eb85f5a
SSDEEP 192:94XznbaOZX7UFDGkcgOE0zaIalXzVSFszkIn8gXKOrk:9UX7UFDpcgOERIaljVSFs4gXK1
TLSH
T13B528B23F3EB69C1EA1316FE815117C37FA7ADB24711D3D65AAC05325DD2C831CA1926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\PIL\_imaging.cp314-win_amd64.pyd
Size 2.5MB
SHA256 b4e06283c347910b5973bd5732159ea9eb26eda48e3eed183be2e3382db26597
MD5 78734fe23107c306715a4883e9ff75bd
SHA1 a03120f72e53eaee2cdd784a1e28eefee3d54ea6
SHA512 31564284c9875af9edbccfe27c8a3a077224788805531b3e975f0a5886bbc1bda15b2d8e0bf5088574f2daa6cf04969f09c24cd191944e59ad21b4c9898f387d
SSDEEP 49152:sUDqalNynk/D54BnHYq+1p0HFavJnRpXYnWpXM:aIrq5Fav9oE8
TLSH
T1CCC56C06E9D19599C6B28034CDAAC116E3B1B80D17F187F77684A7F93E23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_asyncio.pyd
Size 76KB
SHA256 cc27a21453b309197030b5fa8051a8a9c89aec79f9b81ee4ea2a2551ac0f912f
MD5 c2a29938ef6730c1418140a15e0cea86
SHA1 e137c778526eb34068c0d85fd37d30b81773013b
SHA512 3f5b212f005b944d872fd3e84a68d1de11809143312571d6540db9cb219c4e9f62137f90af77a81b7b342d8d1665c819b6738dce7a5be1e0d6a135564ae69043
SSDEEP 768:J3yo/J0GKLIsPwpVnU+C4qMiOU1OnzM8nV6JQIjDnSSyYTegc2Ip4YTxf1ml6Z+o:VJyyUoCgQ8nVYQIjDnSSyYiS9kfILpm
TLSH
T1B5737C87A2A44186EEB79174CA536FC3FBB1F1859901935F51A4C18F1F533A18FBA322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_decimal.pyd
Size 283KB
SHA256 1ee2247153ec6c6e5b3b49402f294b2b7325385ad489a5522e6fa9b406575e8b
MD5 bc63a4bb65d50f6de111deecd8de3457
SHA1 60ffbdc52782ddffad0c74774896159ec8eeb5d0
SHA512 60479c96b9fafb34e1c2d93970d69f53694c998cc6667fdde731e61675eb62d0a4bf875e5a3b939ebdcd7dfea8621a30d9ee30f6d7a0c7b83e058d77e36a1dd9
SSDEEP 6144:IBEAqz+G/rY2HvCnv4mrqGqqM43fIWeAxMoWl0:IuAERbvuvzVooWl0
TLSH
T14B547E96A3490CA4EF778474CA479A57F7B2B8414360D38F43A48A972F933A3673E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_elementtree.pyd
Size 135KB
SHA256 1f8259cc74aed52e4cd2de6cb1b54bec8b1725a84760c1c5b30ded49f652824a
MD5 91c8c1d04114c6d0b5fb7a42bc4fc4c9
SHA1 03e7682c4366b4dc99db5806595d0878f74b2630
SHA512 ca9b3e1b982474180ed14484ef9b6076a48ac58c466e301b53e6d965d51988369b8317e62d6d698afcd93662378332eee38ae3db1911ff164555ecbcf3c87acf
SSDEEP 3072:JQzJtOQ6oarG330lzIY15C5L+clBV417wpWKod/tIIjffZL:JQzb130l8cC5L+cw7OTozt
TLSH
T100D34B4B72A5C0ABE592403CA6979F93D7B7F8610E00838F5294F29D5F273417F6A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_hashlib.pyd
Size 67KB
SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
MD5 ff7c390260b2c94396abcc5323db052e
SHA1 adc7babe127c3586c81f321ad20ff87785945795
SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
TLSH
T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_multiprocessing.pyd
Size 37KB
SHA256 a8c15ee29f60536e00fd7c26c0315e062c4f018e2e46e7f6eb65c1fed0d886a4
MD5 547b59dc1f6caef6706ca1129b5f9618
SHA1 b990f779204ddebcc00ab926be6c17b462fb3a63
SHA512 00f49b94a31b8dca6790845e0185b7f7cecb52fa99472bac523cc8ee4efb679585e3476c727e55b43f2b434ed12af51c41364113db89f0f98113be24ab2ab2a6
SSDEEP 768:HFMV/fpXybycUlgIj7teyYTegc2Ip4u+Txf1mlIJ5pC/:HWpXybycKgIj7teyYiS9uefIk5S
TLSH
T1BD038C86A6684053E9639670C5A3EE87F935F7871F22865F3195C2CE0E373C1736A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_overlapped.pyd
Size 56KB
SHA256 0e8b684fdcc8c6de88bd4b92b6ed44a6fd917949c98b0691285e0cf6c760dc36
MD5 c96e86f3868d0323c88700f0671d9f20
SHA1 c8b9561fb80af89a67fbac11e103ef120dca4ce4
SHA512 d6953e6e566236f2bd01e40de751e545b680607ad07c8c7f7b8ac621f4c1ed3a227ac14cc45e66e15a0a1f18083ee4aebbacb24b784ced35bd227173b6b41d16
SSDEEP 1536:/sjKfS6rBgq/Wtg4urMp8IjCtDyYiS9ZfIklp:0tgxrMp8IjCtOK
TLSH
T1D6437B4A6B9401DBEE73D179D1A38E03FB74B2D34601931F61A8D28A1F23791A72F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_queue.pyd
Size 35KB
SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
MD5 8ac260b670f58c4d08ba0a7e5512133d
SHA1 3ac300d794c60ac58c68961ebd10c7fed8585fda
SHA512 a523efb322f7863033f7bb8101134a9ce6a137979665ed0daf2072eebf016a3b89bf0c386f4c3b84c3b2455814bc482581cf07a6606cdcef7df22b96e6a4fa2e
SSDEEP 768:mJe4W6rB0Bwh6EIjRUYSyYTegc2Ip4NMTxf1mlIJxp1:EhSBwcEIjRUYSyYiS9NgfIkxz
TLSH
T1A9F28DC6A65C4097E663C970C1A2DF92F975FBD39B0146DF2178C1890E237C2A73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_tkinter.pyd
Size 67KB
SHA256 14f0b750f800ed529a06052369428f75f204005be1633400c9fe0ca544d82f85
MD5 8f88a89243cd2cd254a31c2001accb3e
SHA1 bf73246b339970ccc9162719c3dc9c24746a8bd8
SHA512 dfb2230504bec8717cffb08ee4029c144addda6a87adaf2948fe1d7dc10e08a2b581489dccff60c26854e5728ed687df231bbfa42a78a3ac312b3a89601c12ca
SSDEEP 1536:MoTKqNDDa/Tf3gOrlU9oo6ptbQIjDStcyYiS95fIbH0ns2L:MoOjllPo6ptbQIjDStFTQ
TLSH
T1C0637D9AA764008ADE67D578C5B79F13E679F9520910534F00A4D38E1F333F2ABBA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_uuid.pyd
Size 27KB
SHA256 635d6c46bbf6b86dd30a802bd1c6e214dabccb44d1452c52f0b557ae5bcc6f68
MD5 ba74524f8ff1494fa556dbdaa23f2f80
SHA1 173ae2ea0790d959b89d5ced201c6656ed5df3f6
SHA512 3c4b5621c97549b9df454970199b14948b4354fb934b5a0ee85d2d475eaece03c575c13548fca052e3b1cfad7c95e4cb8d4cacbf9d7fd09c64e0a3fa6f420c19
SSDEEP 768:vfi15c4IjIwyyYTegc2Ip4dftTxf1ml6Z+7EWNg7c:ni15c4IjIwyyYiS9NHfILlj
TLSH
T148D25C869A788047FA5396B0D1F2DE83F939BBD35A11875B2179C2850E533C1B32B36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_wmi.pyd
Size 39KB
SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
MD5 bca71458b37ab9784290593636006405
SHA1 4a7effcc12a283b9c65a06b6af62c1cc44820861
SHA512 fd7e5e40a9cde0253684cf0ff6f343c60c597087eda27cfa3726ec2d870b4dea1e7140c55e0de7eca0f5ee36eae32fa0092cd88be4e9969c91cdb94ac923ab7c
SSDEEP 768:y2/EEqrVmjsJuMOQMV4Ij3iYyYTegc2Ip4K4Txf1ml9dHx7Lsc:XE9BE3MOQMV4Ij3iYyYiS9JfIbHxnsc
TLSH
T14B037D85E6644052FA67C571C0A6CE93F971BB935B11878F32A582990F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adv.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\adv.png
Size 5KB
SHA256 7b0e19db6f13ebde48ca27166a9009efef67b863217de1d26c6301dc90b72e1e
MD5 7eabe04e393242d1675c4c85cf616e1a
SHA1 1d0f509a6b033a5cae1f6d88eb9f06fef7be7d40
SHA512 c78068df021ec9bb6af545d98aea79cdcdf7909691a7fb1d9069933604b63408c721bed8e6912748c823e708dabc499be8f96f6d49fd630731294dc93a1b2ed4
SSDEEP 96:2ToXAYPM8OJuM4coA1UqIEG7/9Y50jDxSfEle1vFnLfgPK:2kXJOJk0U8G7/HjDMP1dLgS
TLSH
T102C17F9BCAE677D4824C22F50DF421D52659F1EAA03660378FF17E939AE1EC33601913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\base_library.zip
Size 1.3MB
SHA256 4e75d7008a4f4705c232eb7a6250c8d682f748d82a1569f663cb1a74fd405036
MD5 c351b5e6449d2252cc806e8f3fc3ef15
SHA1 7a9f21f551d30b1c7ca227ebab013109eefbde6d
SHA512 892419ffa3a2d265c87e876e03899e2a826a2b5aa1744cbc225914161e69da5cc928d8f60ba6cd31fa533851e30513f322c7c2af39690c19c8c945f1df4f70c4
SSDEEP 24576:uuUFbdz3VHBRpHDzLQlbMQeOdP2m2dfkdo:uuUFbdz3zRd/cC
TLSH
T160552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B5A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\bg.png
Size 642KB
SHA256 7b87e1079fc2742e6827021a5e5fd7c5d550499942a8484a0575aa770081d89d
MD5 fc62ecc9a914285443cee91ba750ad79
SHA1 60a9b1904ea51f34787b6d786b593c45d0f82944
SHA512 56ae1ca3fc4ea2c35f915ca5e4921b98ed14c51e8b95732380940a437a3c163036241470946b7108baa951318180b16b1c4e68560ae2472cd29b4273886d98c6
SSDEEP 12288:In9NLkFSOpOTCsRPqXKGnPxt28VxBi28BG2e0jR1A/aZtunDqy2Y:03msRSBO83oRBhjRJqnDqO
TLSH
T10BE4233A087EFC48788B0F1EB89E996499FBB147DB8EE529F453C42C4EB5E0C11E9550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\charset_normalizer\cd.cp314-win_amd64.pyd
Size 10KB
SHA256 da3ce780d6d58ae8c6920b99f806f64d58a1b33f4a01382861b01b50549199f8
MD5 d22406cd44bf4cc0de40f2975eb9cfb7
SHA1 672fae4c492c41a11b82b71ddf6956e25bdf74d9
SHA512 cb8c9f0eb6688412394669d3f1d799e3a89aba0c6c3c3aec67f70cf636df7fa34e29ded3e830a532334f468d55754da3d2d8b7c7954f5ead6a5af2812efe64b9
SSDEEP 192:h7JGrmoX+sMl/++Ch9p85BgQ9NgeAwJz6:hJ4m446OR9DAe
TLSH
T1D122F85CFE6458AAD9158138C6374E4BB132BB22170273CF8370A06A1FA37E66534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

matkadybala.class

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\matkadybala.class
Size 62B
SHA256 39abb6263212fe8c86f19a4e3f89d2265645d015890c70f7ebf06aa65028b2d4
MD5 b8cdc3be2a514ea1f500296dd2b18b06
SHA1 e054e79dba50476dec621a2de6f1c2e38600984b
SHA512 89e2c84d842081caf8bad0307bd4a2b16b3baba1f51c19fd67990c766c6f793ab431ab1ebccf271f5515ddd3025f8a1e3deb1148400f976ba2967c91694f8181
TLSH
T1A3A0021C662794971E4442B1339658178B1380754656401B6A85191766A11852862D87
MD5 SHA1 SHA512 TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\pyexpat.pyd
Size 214KB
SHA256 9349be352300fef4b16da0574c670b174d75094574ab51f3d385767d1e3dfc0d
MD5 d6e692eacc35a0195bda97cef2345c18
SHA1 f010bc356b81149c390dea898eef59e6600de198
SHA512 ef2c9a33a0cb15f7673af716099b0735550a111d056422102ba6102618f1e9aa8c2d91a6cf0fd9eca03c3b6d0f0855a7807144585fc58ef08d13a6b27f6ace42
SSDEEP 3072:O3qcWGiB96M+1+XyXu1w2wiMuUL4blSA+gq9qUSGAoP4lSTmyBt3cBFN2X1JcGGz:lGiBK1+XyXu1GL4blSA+gqLt6yz3GnWs
TLSH
T17B247D9BB261C1E7D853803CE5968B17DAB1F86603909ACF12C4E77C9F2B7513B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\select.pyd
Size 32KB
SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
MD5 9e31eff5c36a868a6010be873e0f58b5
SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
TLSH
T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\tcl86t.dll
Size 1.8MB
SHA256 77c41c2d5850224b21d1f35d29cff87ac4d5d847e3694c52f5f63f5eaac7d1f2
MD5 b99a3b97e090cf78a5063ad64af0411a
SHA1 62bbd39f6305497b98fae0795c1d35d908483c14
SHA512 889986f553d934d0b99ffa18d74f8ca9e035a3018a58ea409065ef584008f3ec879f09ebc4d0a7bdc4a69ffef4cc7250296cd2b6a2ed4c18f60f55dbd2d2f2b2
SSDEEP 49152:C0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGB:LBUqMR7i6x9T+B
TLSH
T1E7859E1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\tk86t.dll
Size 1.5MB
SHA256 c85f46920f82c05ac7eb6ea27dcf85d716377edaede778bcd2c40d991e341f22
MD5 c3c9096242b05677a0d1064badcb8c7b
SHA1 31b602aa7f9508d7ffc928814929bce5e263b86a
SHA512 152a49dae30eff7827bd3ed7016f9b021350c05462ead8c3846b8bc6834ff1586c53d2a004c6268eff1523f18acfbd82e85f89fd8b3259c0663041059967171c
SSDEEP 49152:076DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezfzt:ZQchLNqaJvARxr9DrTwylL1y5BEq8JT+
TLSH
T1AF754A06B261C198C66FA134C91796BAE7F17C05931057DB72A0BE697F33BE2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\unicodedata.pyd
Size 740KB
SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
MD5 624ffa84aa15efced4c1fd8e5ccf0b95
SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
TLSH
T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wujaszektxt.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\wujaszektxt.zip
Size 51KB
SHA256 d57158310dbda00af010e5b80ef9b9d1ab10a23b4d3916cf94b6afcb627d8786
MD5 278780dc59041d8834e6752059f6c97a
SHA1 aebc7b25787c6774c0a03f030bcdaeb12a7b5ffb
SHA512 224ff06f746cfdf0d221a5889c13d750c677579d510e594b37467bc8279d5933795c70a9a74e5efcfc5a5ca5c71443e8d7b9b964d90ac2225b94a66c62578ad0
SSDEEP 768:+5bYwTd/cDgBKX3RjcFipCKirdfabzqoF/zSlNKCRY+7bqsoRZP:AbYi/5g3RQ4pCbN9lICO+PqskZP
TLSH
T1B333E135D4735FC4E1D7F73080A60BC3D563461DEC02B0AE49E81668FBEA0E36A4996A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\zlib1.dll
Size 144KB
SHA256 4f4168a375d3628f96846f5a9319f55521a501e30d9b7e91c384e64fb3245d4c
MD5 71700382fc3394b7adf0e570b19d1a2d
SHA1 ecee1af12c57270269949e6fed4b33551ac1a2c4
SHA512 c10a6ddf4869d5de91c22a8c824801d3dcebbbbfd534b9752e29bb0c4f15a64185801f87861ca78fe58125da0b6e99598cb37b6438f09df45b3babbda7e8f23f
SSDEEP 3072:EvEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCGJa:EsVD+RrFgvi7JM
TLSH
T12CE37D9BB6A255BDC677817042E6C7B2F932B8214B309DEF5088D7741A12F806B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinput-platform-2.0.5-natives-windows.jar

Path C:\Users\Admin\AppData\Roaming\.WujaszekMC\libraries\net\java\jinput\jinput-platform\2.0.5\jinput-platform-2.0.5-natives-windows.jar
Size 151KB
SHA256 24afbd5e1fab17da57d16a4d3f19d53f36155ef46a9976484201a4bb9722287f
MD5 b168b014be0186d9e95bf3d263e3a129
SHA1 385ee093e01f587f30ee1c8a2ee7d408fd732e16
SHA512 e8dd2c73c97cb0ec065acb3973a89cacf742005d60eca5f68edfd5306a23c4a6be8dd8deb4f7ff870075f75d79fff9a87c2aaee980ef7b4da764bcb822257dfe
SSDEEP 3072:gZZFp7OhuJ1SqaixK65/tUOuCZq+/qPrB/rlSTgaCi+97lRxp9JJKjMVfHYdM:gZfBOhL4K6ttUOu8p/KWTgDi+Fxp9JJx
TLSH
T1A0E323A294CB366CD491C293078439877253EDA32FFC91A75EF9D055F4AAD39F02B04A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Roaming\.WujaszekMC\runtime\jre-legacy\windows-x64\jre-legacy\bin\msvcr100.dll
Size 809KB
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
TLSH
T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages_zh_HK.properties

Path C:\Users\Admin\AppData\Roaming\.WujaszekMC\runtime\jre-legacy\windows-x64\jre-legacy\lib\deploy\messages_zh_HK.properties
Size 3KB
SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
MD5 880baacb176553deab39edbe4b74380d
SHA1 37a57aad121c14c25e149206179728fa62203bf0
SHA512 3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
TLSH
T1217154FE0A1622472ECA80E1D985A58FD7A2FE01B122C52BF5FD6D01775731BC913A38
MD5 SHA1 SHA512 TLSH

Submit Download

win32_LinkNoDrop32x32.gif

Path C:\Users\Admin\AppData\Roaming\.WujaszekMC\runtime\jre-legacy\windows-x64\jre-legacy\lib\images\cursors\win32_LinkNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
TLSH
T100C08C88F34888828A4AD2384874138C68A4C4BB8A224B88144A2A94A2935A2C1D0302
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3552-1066-0x00007FF98C8A0000-0x00007FF98C8C9000-memory.dmp

Download

memory/4480-1053-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/4480-1061-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/4480-1051-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/4480-1052-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/4480-1057-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/4480-1063-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/4480-1062-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/4480-1058-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/4480-1059-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/4480-1060-0x0000016F93A20000-0x0000016F93A21000-memory.dmp

Download

memory/5664-2883-0x000002A6FC7D0000-0x000002A6FC7D1000-memory.dmp

Download

memory/5664-2845-0x000002A6FC7D0000-0x000002A6FC7D1000-memory.dmp

Download

memory/5664-2956-0x000002A6FC7D0000-0x000002A6FC7D1000-memory.dmp

Download

memory/5664-2857-0x000002A6FC7D0000-0x000002A6FC7D1000-memory.dmp

Download

memory/5664-2911-0x000002A6FC7D0000-0x000002A6FC7D1000-memory.dmp

Download

memory/5664-2908-0x000002A6FC7D0000-0x000002A6FC7D1000-memory.dmp

Download