896c5429466e3739154af5d481078f4b8a64a0981404c4f8942c09249caeeed2

Analysis

user interaction
yes
max time kernel
125s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 07:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HuMidi_v1.3.exe
Size 49.7MB
Sample260620-hxesaaez7y
SHA256 896c5429466e3739154af5d481078f4b8a64a0981404c4f8942c09249caeeed2
MD5 f4453f644991a7b8bdc61c429d0ae13f
SHA1 a79dcdc26b4b241188be7ce7925f3cfe59723924
SHA512 7521276ba444e523c5746319c53f422d1aee15bcf42a95d6cc1cc8a57e9922af97a5ae2fc3b9e59ea7d5a1939745c7089b7502dd4d5627d58e415db5befb8593
SSDEEP 786432:yz7Zw+mG3ezBJEUI/5WvqZXBBSpQIntFfKRELtpH71aXmHZU1XhHy68B1e62OW2:yzCkCBby5ZXBB92Ficl71aXmmXhlCPW
TLSH
T173B733703FA05E59FCB6127A9922C5B2A7A27C60CB50C5AB13EC7ED33BB71854D38611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 38 IoCs

pid	Process
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe
4920	HuMidi_v1.3.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3308	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264128954782438"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{E2BAF27B-EE1B-4024-9377-F086BF3385A9}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{973FCF4C-9BF5-4DC7-BF5B-D972251CC9E7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4920	HuMidi_v1.3.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5056	chrome.exe
5056	chrome.exe
612	explorer.exe
612	explorer.exe
5056	chrome.exe
5056	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4920	HuMidi_v1.3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	612	explorer.exe
Token: SeCreatePagefilePrivilege	612	explorer.exe
Token: SeShutdownPrivilege	5056	chrome.exe
Token: SeCreatePagefilePrivilege	5056	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
4348	sihost.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
5056	chrome.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe
612	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4920	HuMidi_v1.3.exe
6024	StartMenuExperienceHost.exe
5324	SearchHost.exe
612	explorer.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 4920	5368	HuMidi_v1.3.exe	88
PID 5056 wrote to memory of 3632	5056	chrome.exe	91
PID 5056 wrote to memory of 3012	5056	chrome.exe	92
PID 5056 wrote to memory of 3012	5056	chrome.exe	92
PID 5056 wrote to memory of 3308	5056	chrome.exe	93
PID 5056 wrote to memory of 5756	5056	chrome.exe	95
PID 5056 wrote to memory of 5756	5056	chrome.exe	95
PID 5056 wrote to memory of 5588	5056	chrome.exe	96
PID 5056 wrote to memory of 5588	5056	chrome.exe	96
PID 5056 wrote to memory of 1560	5056	chrome.exe	97
PID 5056 wrote to memory of 1560	5056	chrome.exe	97
PID 5056 wrote to memory of 4256	5056	chrome.exe	98
PID 5056 wrote to memory of 4256	5056	chrome.exe	98
PID 5056 wrote to memory of 5636	5056	chrome.exe	99
PID 5056 wrote to memory of 5636	5056	chrome.exe	99
PID 5056 wrote to memory of 4736	5056	chrome.exe	100
PID 5056 wrote to memory of 4736	5056	chrome.exe	100
PID 5056 wrote to memory of 2728	5056	chrome.exe	101
PID 5056 wrote to memory of 2728	5056	chrome.exe	101
PID 5056 wrote to memory of 5420	5056	chrome.exe	102
PID 5056 wrote to memory of 4108	5056	chrome.exe	103
PID 5056 wrote to memory of 4108	5056	chrome.exe	103
PID 5056 wrote to memory of 820	5056	chrome.exe	104
PID 5056 wrote to memory of 820	5056	chrome.exe	104
PID 5056 wrote to memory of 4800	5056	chrome.exe	107
PID 5056 wrote to memory of 4784	5056	chrome.exe	108
PID 5056 wrote to memory of 4800	5056	chrome.exe	107
PID 5056 wrote to memory of 4784	5056	chrome.exe	108
PID 5056 wrote to memory of 2764	5056	chrome.exe	109
PID 5056 wrote to memory of 2764	5056	chrome.exe	109
PID 5056 wrote to memory of 4512	5056	chrome.exe	110
PID 5056 wrote to memory of 4512	5056	chrome.exe	110
PID 5056 wrote to memory of 4380	5056	chrome.exe	112
PID 5056 wrote to memory of 4380	5056	chrome.exe	112
PID 5056 wrote to memory of 1200	5056	chrome.exe	111
PID 5056 wrote to memory of 1200	5056	chrome.exe	111
PID 5056 wrote to memory of 4372	5056	chrome.exe	113
PID 5056 wrote to memory of 4372	5056	chrome.exe	113
PID 5056 wrote to memory of 780	5056	chrome.exe	116
PID 5056 wrote to memory of 5036	5056	chrome.exe	114
PID 5056 wrote to memory of 780	5056	chrome.exe	116
PID 5056 wrote to memory of 5664	5056	chrome.exe	115
PID 5056 wrote to memory of 5036	5056	chrome.exe	114
PID 5056 wrote to memory of 5664	5056	chrome.exe	115
PID 5056 wrote to memory of 1056	5056	chrome.exe	118
PID 5056 wrote to memory of 1312	5056	chrome.exe	117
PID 5056 wrote to memory of 1056	5056	chrome.exe	118
PID 5056 wrote to memory of 1312	5056	chrome.exe	117
PID 5056 wrote to memory of 5848	5056	chrome.exe	124
PID 5056 wrote to memory of 5848	5056	chrome.exe	124
PID 5056 wrote to memory of 5156	5056	chrome.exe	125
PID 5056 wrote to memory of 5156	5056	chrome.exe	125
PID 4348 wrote to memory of 612	4348	sihost.exe	127
PID 5056 wrote to memory of 3988	5056	chrome.exe	134
PID 5056 wrote to memory of 5252	5056	chrome.exe	135
PID 5056 wrote to memory of 5220	5056	chrome.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\HuMidi_v1.3.exe
"C:\Users\Admin\AppData\Local\Temp\HuMidi_v1.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Users\Admin\AppData\Local\Temp\HuMidi_v1.3.exe
  "C:\Users\Admin\AppData\Local\Temp\HuMidi_v1.3.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa2f86c728,0x7ffa2f86c734,0x7ffa2f86c740
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,10829003518764631896,5099166811874549307,262144 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,15009152478227197314,9332907318040698986,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,5682463975786782070,11498757799350079449,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,8605777371322499438,11920620655888221099,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,4273753698774732597,18194329041545921650,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,854342249960981620,1908764693268701037,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,8898368468663805727,86313191147544385,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,15645489924056546110,3773914977648762122,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,13043633121089695739,8026304992189034383,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,8368414929307501478,15905057166291920438,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5492,i,2524258590625869784,4494517632859762423,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5520,i,225752198999875607,17834605346948213842,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5828,i,7017475830737622891,17891660486532981218,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,3264979512776292585,16908101490206332123,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5676,i,16351901153477190345,5537987368199230196,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6232,i,13109054665209404004,13842532749204010496,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,17662557961119226569,8959691810493400086,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5968,i,15590219763077733496,16552238440929323824,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6204,i,5888268049411037584,6212959454118714193,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5548,i,12189952096456573726,3998377413554383613,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,734551459864612569,5703718278466107210,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5576,i,9623311933359935052,11870307661244804582,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6640,i,1219924110057067043,17023893451557356762,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:9
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6588,i,4086430640794144143,7041931143380075714,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6300,i,13695814572389752802,14186298869346732782,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6268,i,2976675901119917978,9479224098864454541,2097152 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,797239809607056891,5232320873687054810,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,14831849969262433227,6564779422053057889,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,15894932975639615607,3599258590980114899,524288 --field-trial-handle=1736,i,10812175772304546899,13454702914328148092,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:5220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4460

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:612

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5324

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6bed4db40aa78721fa7b987de87ce2219a9e78db675826a98fadfa6f83000c19
MD5 12baa5a237b838f4999a027af27648bc
SHA1 b5b97e1c2d3dc8399ceac78f570344b8424ff863
SHA512 33c695fa206bb768f776b0e4d8e9c71e2c8a0f5a92e005c840d036ad85028af00d61acebf03d71e6b19a291a681eaedf25e5b26c732c0413da177ceae72671cc
TLSH
T14D210F0422B2C043DBE29D3A49C40F15BB7569DD811F9ECE52B2E9B50E437F67EC1A94
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 544f2bda747b605128ac6f27327b1ac8076e13eed6511c63b9828af8ead7cc3f
MD5 b7736e92704503754076de546425ce6b
SHA1 2ff7afec76c5340b288c5e65a3a8149a1c680060
SHA512 adebfbcd100214384ac51b06b2f232c7a334983f87b48b6cef894aeca5db9f8cf938aff4234c2f2f0dcb97f955a98eff0b51c67226aa5e951aa65c44d64279fc
SSDEEP 192:DbcCZZ2Z5wbJQiGdJUzp2+yP0EfaPlwxNPRaPwvi9fPTGsOBdGfxGV4plt28RgqB:DbcCZYfwbJQiGdJUzp2+yP0EfaPlwxNG
TLSH
T1F432BFF7C3D88A2DC81116F8AB256E1BCE290924572C3D2AC8D5EF5FA3E1871D24564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9d001cfde4be7cb2451ca2654ca9c12a4da04b124d2ca8057219010005ece2dd
MD5 bf4b117b3534c8520bc9bdad8d1df521
SHA1 df1f5526baf69f2e9365b9bac3fd4ac6a58931d2
SHA512 753ccfacbd51c8de481bb0da1ae6953d426b7f581bb43f104d284fa6d7700d8f009de89f5f800c2542ffab736f7851512b2034752a8dc078734ea99711bf758b
SSDEEP 192:XRVcBzC6wUv7jIkAPRp2IWl9PHsb+WNnEy4Wg22ZeiaVyIsnAUge:XRVmzCTQg1X8BwTC2iae
TLSH
T13D32B52FAA60757B9CCBC21AFD657767E6F5102171D42E84E6FC8A2C11D7ACC221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3c42ac3768ab6e368ebfaf0c155bf9d9a5770c73b1f3f090113ba41479879c72
MD5 14f70ba31f69dd1f38fa510655c4becb
SHA1 a9d177150aaa917584fbbd1c3ac89645b02bf958
SHA512 cccb1ebb5ac64e2c0e4be4fd3f60328021dd99ee13e6ed980b1066ba98ac6e652129ced42e6a62ed0c8ebd427bf2a1eefb97b65f14995c079bb840febcd927ee
SSDEEP 192:XRVcBzC6wOv7jIkpPRp9IiTyC9PHsb+WN4TLEy4WgNYe28ZedaVyIsnAUgE:XRVmzCTqgGX9Bw4HC92baE
TLSH
T15B42C65BA9606A7B9CCBC21AF9657B67E3F5102171D42E84F6FC8E2C11D7ACD211380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eb375503fc055731ef9babf5bf9ba605d4e5e7be7a93062ba336197f09507caa
MD5 19347906ecea2261d05262ffd8f4e750
SHA1 b6340f8f330faf4b84c934ac62e5e74b331c59ff
SHA512 0edfe23739e65035124f353ea90b8b7be70bff5f7712b771f721397db511e650fe1c66d36cbf56924e51d8364a36e34b70aae569173253bf07be98c76f0c42e4
SSDEEP 192:XRVcBzC6wxv7jIkAPRp2IiTyC9PHsb+WN4TLEy4WgNYe2GZe5aVyIsnAUgE:XRVmzCThg1XMBw4HC92JaE
TLSH
T1CA42C75FAA60697B9CCBC21AF9657767E7F5102171D42E84E6FC8E2C11D7ACC211380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f1ead27d4009319623346f6e64281a54115de5da315bc1fd7be6149b1b88ded9
MD5 9c691c96581906eda8fdc5ec0023b78e
SHA1 fb012d0994115e4cec0ea6945e43fd794af0e2fa
SHA512 1ccbaee7145a49a0aafc40b351bfefc02001afff84f0351130c2ce476a78af00ae0d303aec93dab7c19e2b9c984b46a6fdf58ac2d1e238d69546d294920739eb
SSDEEP 192:XRVcBzCFwOv7jIkpPRp9IiTyC9PHsb+WN4TLEy4WgNYe28ZedaVyIsnAUgE:XRVmzCeqgGX9Bw4HC92baE
TLSH
T18B42C75BA9606A7B9CCBC21AF9657B67E3F5102171D42E84F6FC8E2C11D7ACD211380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 89af5c9f7ba04343fbdf22558b355769e7292b3959cedc2792befbd259d90f71
MD5 2741ef2f32b748a52e92ef3d78de2a75
SHA1 0013e9d9df3581c038f67591057e394a2f310fd5
SHA512 4dd775d9bb968dd2581a8892ed5680cba795a9cabd6fc9f8683373c0c8a9070b7e7b430877f37d31ba518480d7abc84aba1583e00d1de9639612a77f85d2fd12
SSDEEP 384:xzjj+7KxkXqKf/pUZNCgVLH2HfgsluUXODj6+ErU3OJHGfV1KfkOJVzbCu:x/j+7KxkXqKf/pUZNCgVLH2HfgsoGOXw
TLSH
T11A52F967684C9A7F0FD8D68DDC167F4FACB5015666A8082852FF9C0803A5BCF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 bb5d2a0c35f3c7690bd715632b782012cde2bb06c6feb98bf3639c82d16fda38
MD5 a36fac1f3c38da61d30b2cddae36ed1a
SHA1 2f4c1d4990a2d33633103346af1c00520537e593
SHA512 aae085a9434490ba6823237f9e7fc6cc4dc3445cedee0a7d7ddd63035d861edf758929df40658434a807e7a40aee76c79b3d92ff4fa3b96ae8c79a243d0cb1d1
TLSH
T1FDA0021141C14801CC4407742BC64AC0B3208DA15315860748E48444CC5724B7646244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0ba397d883946cbbb29d01d9c937005cceb4e02ce898aaa7473ab13a27ff1d7c
MD5 99001f1729f9abf8f0b31322417dd772
SHA1 a22c6d1da1919ae9f0bae5d58aec95ac4895cb54
SHA512 c454c9b1ed6a252d44726ca47c6e7d7499cca3f3bd70312923643a6e2243bb40cc5e75ec16bb2217680cefe9cfb92830285c79a8daf0780fe8f334c2e46e772d
TLSH
T164A0026243E05552DD108670B0613FC137714C94595EC34BD5F10654889F2D26741540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f003.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59f003.TMP
Size 48B
SHA256 1cc27d3af2f4773fdde905d574685d03370293fcb0eea64252b4bc82ea08e0c9
MD5 f8c2767fbb6497113835938d592c38d4
SHA1 caba7c6475b4b6cca1bca056d4423d94749d591c
SHA512 4e0e5494ad3fe65127e209febe450cd3a54b40e3fcf8cef7ccea12e84d7299a0a30cd51976e99e955fc7565f91ede304e2c736659043a09fa10d26f242a47119
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bc0a6dd4-b059-4f03-b534-cc39590e129e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bc0a6dd4-b059-4f03-b534-cc39590e129e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 5920d78f464e800d9efff899201ce9bfba4cd6fbd34e194c7837e81b348a3f15
MD5 d577a920daeda6ef896f04cc51c51527
SHA1 29701c4742f8df2378ae875c7f52c2ba29c8084e
SHA512 754864d152eff0a1b0c0e0d8b297ebf2bd2d982d1889248898cec65600330ea9c572a132331e4271a97ee30a3370e68fad34cc79d48287639b7748c365cd892f
SSDEEP 3072:npsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBc:npsLiqC6IPHXi0X6vK+12
TLSH
T189C31273B85A8EDB15E09640715F2B0F8CEC8497A490E95FE4F27F41410BC96811FEAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 5ca02da58eb8f30b8aacdae20b4f4db1ce79aa8a4833477893a2498a00585ac9
MD5 d38b21ef1ac1cd4f1c464aa23084c511
SHA1 4f637af6c205141ae54f6738aecb576e36d0010a
SHA512 eefd60aef9ca8fc081e3d6e872c77bebc9b46fbbed54d0db5e74b7849ad9637e8984dabcb392cec3d41cc083e77ffc963f9649d1bb28d1876d8530c64e223257
SSDEEP 3072:ulpsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBc:ulpsLiqC6IPHXi0X6vK+12
TLSH
T1B9C31292B46A8EEB11D4D614716F2B0F8CFC4493A0E1D95BE4F67F41424BC92811FEAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 c9310678d071c9829131668706f758a0a3492b97130a0496a38bdfbe537dea2e
MD5 911f193ad760ba0d3fccbae511598171
SHA1 dd5b1170142b49d4fd6257b2c808767324b3d034
SHA512 0b7f06655707ddee38bc85789d552670fd3a9487941447581ec6bcbbf9fd4f26cdaec5c0407ee0c34ddac95d6a2649190b00c8991fbcfa9eb931dd0fcfa5ac6a
SSDEEP 3072:rlpsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBc:rlpsLiqC6IPHXi0X6vK+12
TLSH
T180C31292B46A8EEB11D0D614716F2B0F8CFC4493A0E1D95BE4F67F41424BC92811FEAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d3fef9fd75add61ddf3da8d543c69f82f17296b9a19cae42c138969184441b1a
MD5 866e346a5af90b4823774a4a9974cc74
SHA1 3eca278bc46778f101bc3af8c3b7ae4a100e7bc3
SHA512 9b761f69f7029d929f823ef6662d04c56d09417ec2151348ce1a7745d5ad0f895f6b9c718abff50a3bf15b25e7a3f09531a8b874b4327cbdb28b7a69e8cdc7f1
SSDEEP 96:zC6kd+q/o6Oe4rRfPd6NdjRDotok5WpwDjB6EGyvsaKicT10b7v4a:zC7x/oj1QJDUDEG9oycT10bf
TLSH
T108A11A3360685C778CB6D9C575473F43CEB8A1ABE552AF54F8DD9E0C50A78E81302A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\Qt6\bin\MSVCP140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\Qt6\bin\MSVCP140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\Qt6\bin\MSVCP140_2.dll
Size 273KB
SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
MD5 3151333808c2c2339d5f5466df70b7dc
SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
TLSH
T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\Qt6\bin\Qt6Core.dll
Size 9.6MB
SHA256 9fbea00b87ceae5f9e319c23010eacb903ed460c661b9b1b17bcabd02bf1eec2
MD5 6dd8a0805ef99c97af6273582aed1611
SHA1 d7679af06c805c8a4230b01887f946bcb1694dc2
SHA512 3f633218cff977fead550447a6e3d0389a6566a4bc8ea7f78e4ccee232d36b2d8fdab8d8fd71e858e67fcd8eaf2d223d57231bd4eb746d952cdf45dff0ff6522
SSDEEP 98304:HmesKMUytgJH1KFdu9CwJsv6tCUDo1cs5Ami7fFbW9/3PO:Hm2f1KFdu9CwJsv6tC3OC/3
TLSH
T181A6290766FA0111FAFBDA34DAB71242DBB27C466B3496DF025861185D337F09E3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\Qt6\bin\Qt6Gui.dll
Size 9.1MB
SHA256 63c31e9f79faee8e6ac3919f13be59d293c4fa5f091d200cb683c9f1ea4e6ae7
MD5 33fab1e02f2f9152f565d0e37e078f6f
SHA1 4d47ff143e4259480a7b4b381e52e686514911d6
SHA512 2af964620e4d1a6f26858482c701bd737b30f7f731d61b802e2658f4ef28f4e25a923fb33100281a7f78f54a86f3156afd2a119bbefcc6affe82f97ab70b8145
SSDEEP 98304:0v0fimOnRKCT7G93vbkmHUJkz2YHH9RTSrYfTuLRN:nYKC303vbEJkz2YHH9d9E
TLSH
T16EA69D57B2A901D8D57BD13C8B5B9507EBB2700503629BDB02A4CA562F33BF12ABF711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\Qt6\bin\Qt6Widgets.dll
Size 6.3MB
SHA256 6c139cf501fd4a4cf2b690520df79dd02687df061d51eb6b3c91757d503ef909
MD5 f8fe94ce6e3b33f68a02b2168f0d329f
SHA1 1fce468419f3b83b5640f492d3593023979b618d
SHA512 730fe9e801f3d9705cb9f7285ad7fa379b9475b85220498a7ada7d7d6caa1c056a3d943923f5dae60c0bf6e6cab0d39513c0fbc62307cf15bba746f6ef2eb2dc
SSDEEP 98304:s5XLmsLgex105PXU0fr/NDTdxu1hnHTKiRk:s5XLmsLgeD05PXU0fr/NDTdxuLnzVRk
TLSH
T1F4667B57A3EA0185C5AFD13DCB1B8A17EAB2700443229BCB0169CE552F737E16E7E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\QtCore.pyd
Size 2.5MB
SHA256 9306ceffdc3b663f90fc446800be4ab870887c0bf3c38dc16b00e070e519d895
MD5 2518da139b7d8deab42d1202c3237982
SHA1 c49c8ce328746b9c4cea2b76e64125fbc39afd5c
SHA512 898023fb0031e6e9acabc5a266a9ee82687b9f81b95ecdc1e08c3485e7da0011fc0b6cba9cef512898d609f427a75e2f3f8f49b6052ff7b574aa61d6f14e497a
SSDEEP 49152:fVcRFswuHiy73NZUGwOz5vQL3xRVopq05cAJtrHFE4zEAZp92CmZqyarhho+eJi2:fiy73NZUGwOz5vQL3xRVopq05cAJtrHQ
TLSH
T17FC5195393651088C0EBD639C61B460EFBF270550762A7EF05758BD82F2BBD55A3CB88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\QtGui.pyd
Size 2.2MB
SHA256 78f1acd16154a241101ead83c845388394526b9e4ddc7bdc914d22d96710f7bd
MD5 f142b986d10d33b3451bf57a00e8e327
SHA1 5f384c4daa0e36918046b9de3a1e91d751092964
SHA512 6d1bff7962876ef1ad5cd8f3ee772a3c0750bea6b519362f59eca01380eae5f147d769c32d9753c36e42157933e134afe1cadb0275215dac56cf587ab1fd9e69
SSDEEP 49152:2Zg3TkT/gfMx9yLUFA0067aIBXkKS+w8ulbCpbB1Y9zqE:9MxgLUF71eq
TLSH
T125B5F85393692088C1EBD73D846B460EFBF270A103A256DF04695BE87F27BC5693DB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\QtWidgets.pyd
Size 4.9MB
SHA256 a5e78921d92d4b4975edbd441369ef7ab689e336d1b40d8555728880f0503fd4
MD5 b9f3fef02dd10351f026bc6bf1183b79
SHA1 13cc25bfd6ef3cd6104ba407313e95eecdcd2d08
SHA512 4709f91def7973a9a213b4d2696f0d965425449728a25739813f801ef6ec2a4beb7d26582019979fa3ace5c4aaaad73b691796983d6cdec083671e49f8fd06b6
SSDEEP 49152:GCtl8hsSNhGwo+81a6yznhtVqOy5gieFVxKEVkgRMpu4aGdJzD0z7G0J7oEQEtXd:UxKEUjH
TLSH
T16A36D703935A60D8C5FBC23DC99B521DF9E23490076A97DF082A6B996F33BD0963D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\PyQt6\sip.cp314-win_amd64.pyd
Size 109KB
SHA256 42baece39b566cd4fc16088bb0e830b2423a1becb5752ef529b72192092ceda6
MD5 f32a732ccc39964f0551901d1b4075da
SHA1 31fd4292ea5b946c58b03443a1157bc57f068fb5
SHA512 4870e5a83a507fce073a583be16d4957e4a5ec42a507d682a7a640dfb80f3c2acfa5db68a119d575eef7d73cea3d57ce6a61e5de79ef545535f4cd60b7711f1c
SSDEEP 3072:VXqJKZflCgFmFGLGNr64t9Ndj3PKqETxbSv:ViuCRUar6v9TxbY
TLSH
T1A7B33A5A72E900C9EAA6417CCA339947D773F0601B2097CF42A0C25A2F57FE63DBA751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_bz2.pyd
Size 85KB
SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
MD5 94fd94a3194ef83be4437755a14cb810
SHA1 7cef55c1ff01f359963cceebcbf6baa6cc8c7a5d
SHA512 2cac920cb3b101dade078fb96b8438db7bf0ab17f009c9df64b443e1e0aa13a155d695270679cc35cfcc57adef4bb2a81e4446d0f04804b127ca8668c02110be
SSDEEP 1536:4GNqB8z7qyEXkmNf0/ixk+x5dxNjP8AloDb8zMDIGwIM3V38y+kR9LfIgHL1:FNqB8zFEJUoZlTjUJ38zJGwIM3VUYB
TLSH
T18F838DC6F3A552B6F59F91B846840793F734BB960750A3AFF14882893F13BE06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_ctypes.pyd
Size 138KB
SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
MD5 5860d45269a360d830807497fda7dd50
SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
TLSH
T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_hashlib.pyd
Size 67KB
SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
MD5 d60cc3d94442491b3f8657d54225198f
SHA1 c5b75c895f593081308e82038ea0d23e8da9ee7a
SHA512 ae60189fdc30500952fd52f64d593c51444e7706e9ea44e15ee5fdf362792d80deeafe5a0d319caa31d0f75287bedc89d0ae4d90c248bc56310897d3cac4e804
SSDEEP 1536:WMRoOWZsPkJWvCGt6RUoIMDIf8y+kR9WfIU6H:7mYcJWvCGt6ioIMDIn/
TLSH
T1ED635B86A6984062DA1382B4C9E34F43FA75F652271197DF6339C18D2F233C3973A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_lzma.pyd
Size 157KB
SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
MD5 47bfbdcb4b88b6d9e6fb7ca72f7929ca
SHA1 f4ac4210b1f5a290956e55d7ddf665dca95157ba
SHA512 a3e3c1edbbea4b2335dcd5adb79460fc8a2108e323b2c8ca84eb070cb0e8f54df2e82f17a3ba23c5b080ee108d595587b1237025cb41229758af0733f384fb59
SSDEEP 3072:O0m6DHDbBwiZfxA/VcNdznfx9mNooN4fnbOwIMI1dsZGK:OTCHDjfDNlpYOJfbOLaR
TLSH
T10EF34C86B794F0E6F7228C38D6614F57E7F5781A0320939A01CC976D2B1FB659A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_queue.pyd
Size 35KB
SHA256 4fd91087253a1507a5e5068eb366e77826efc27a568707ed4796d638df1fcf1a
MD5 d2fb94ad66cdc01078d9150ef50c614b
SHA1 7a4cbc8262e8abbabae26ac26937906c89246604
SHA512 04aa9a0309b8253e402e1f8be90b00625dff8526d6a83b2a8e0c1c51e56012c0b670faeeda089fff4b96edfd93a3a99ccc3ebdbb703da0201de551212e88b922
SSDEEP 768:UG5x+6r81mVRTYsIMRUnbo8y++RYT2Ip4oTxf1mlDeI6WSU:5YmVRksIMRUnk8y+kR9UfIUWH
TLSH
T15AF27ECA6AA84093DA67C970C2A1DE93F535FBD3570186DF2139C18A1F273C2A736359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_socket.pyd
Size 85KB
SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
MD5 b042a4ce17bb4174ee2a927746f13f97
SHA1 24c32e42af77a808921f0d6e87a8b88c279c39fa
SHA512 33ce7df647c57529b365bc8633b4c168fe4d194e66e666dc2e545ccc43d1a08570bfcd91aaadb109a6174a90477db6951d279dbc7c145ce08770f77522de406d
SSDEEP 1536:HCzH6HTMXx87Rfypx97XP+N6wSzPeVFSeJScNsIMGwR8y+kR94NfIW44DFr6pr:KH6HTOoypx97XPs6wSzPeFSWScNsIMGI
TLSH
T161836B01A66040FAEB62C076C2679E63FB74B5C113D4975F1466C69A1F333C2BF3AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_ssl.pyd
Size 179KB
SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
MD5 0e79667c70090d09216d6a84f9c81273
SHA1 cfb45075d214a28dba7fa42ce421307975a92ee9
SHA512 df7a003ecba4e141ed2a23cf4fd4d604bb10ed7cfaf152a52dbbf67e3d647730ad07b19ae88ea642d3a47a6a9e2b2d1277578875e0d2b6d9a0a0a1ac41d0985f
SSDEEP 3072:HHqb8RUZrARopfh6CwdqMUUuGyU1y9MK9og5MFe82Iu5tyFjUdNcwPHIgqADwIMx:qkU5Xph6CwcRGyEYlI
TLSH
T1FE048C47B14429F7D913E8B9C6234543EBB4F145732297DE48C6DA860F0334AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_wmi.pyd
Size 39KB
SHA256 2aec82cd41bfc201fd04143023c7493f117436041f66120ddcd4a24b131ca9db
MD5 d1eca38c5e1e76abe6a5eb862767e009
SHA1 021b3fd3b5f7bf3c236832283c95f6fa979e565d
SHA512 08945a1c25f7271e5793fb4706b896471e51cb2723a816e78115db3eee1d3b820cd7817fd7e524ecae9e0e72a8973469c127cda26c87ba3441abfa00cd7d932b
SSDEEP 768:n2/EEqrVmjsGuN6S9VVwIM3i7Vo8y++RYT2Ip48Txf1mlDeI6JSU:yE9BE2N6S9VVwIM3ie8y+kR9wfIUJH
TLSH
T1DA037EC9E6680052EA57CA70C5A5CE53F635BB932711938F326982991F333D1E73A339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_zstd.pyd
Size 491KB
SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
MD5 11e408a51564f9626db73bb282aeeefb
SHA1 890db1462cde82ab16ff6c0e6bb3b70d35cc5869
SHA512 65a5302758daebb2a59ed982d1a62cb1fabcfd0203f45baf900369bca11e3d70263db77dfb305e597e9846a9aa9cd92d3749e7a7f2f699d86a4b5ce8dc7c7af5
SSDEEP 12288:/Pm5BlLPg/FcxTbwWo2iD4xjnBTrWl93S9Ct:/Pm5BNg/FcxTUWo2i0x7e
TLSH
T135B49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\base_library.zip
Size 1.3MB
SHA256 f22701ec40999ad1b84fbd9ee4743a4940319edcf04d87d1a843010ec959f266
MD5 6db5938d2f4b3f356bce0eae25d55e2d
SHA1 13bc98bab6d582357485fa316c2e61d4b190dee4
SHA512 3cb53d174bab4db84f704fb496b7ded5cee5d22a8cd5f3535c95ef9d48d5ae7de339cc027baf62b89ebab30d2d044f2b7228835d5590f82e90f4d11d96dc3ef4
SSDEEP 24576:RLmlb9ugK+kkQeOdP2m2dfHuUFLIYRaFdS0:UugT/vuUFnRIdX
TLSH
T1F1552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

METADATA

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\mido-1.3.3.dist-info\METADATA
Size 6KB
SHA256 20696eee0a795cc01ae11b6fc1d0499efa8292cb54e31c1001d9ab77797467c8
MD5 50d2df3282960d72b813d51d083230ed
SHA1 f5f6aa268e89ac9a28680a9eed1257fa0d316b50
SHA512 fc4974a83b12f97b014445d513698098acdb915d7b3778e35a900e39e17d26ad072ba1f964b1c010d61b379169b97028252468892eba322bac7430cc5317dbd4
SSDEEP 96:D6XyMPktjaVBQ139XbWH+a5Yy3qugkgHkgqV2/46B7rBQIu+lLobp5kTH3gylxbw:DtLJa5R3qfkgHkgzhV++lobp2TH3Hq/
TLSH
T1FAD1B9522FD46DFDF7C6C2C672AD2397C21B8269968E5448FEBD41A92B01775007E034
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiarray_umath.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
Size 3.5MB
SHA256 1197f2fe41606451fac1a2e3fdb3344bb837a9e235138cc135f16bbfdc2d1e3b
MD5 f474170cd6ea27c29c28a06f20644994
SHA1 66dc44951a66186432f8f0af09f302bceb4f0c86
SHA512 14eba0ff7354168a1582b78d1cb2f6c02657473f10cd95df278f6ecb3c38b4d47deaea2654833c0bf13b256a285515e48ff991c54d254f2dfbc4ddeb8b463e6c
SSDEEP 49152:S4FCDg4pQ3aXKxYjBiu1nYsTFd3BVfz+tbjZPgpkFHwiUcGXOu4EDX6q:j0iy3wgp8YOu4k
TLSH
T110068D9B92E511D8D16BC078CA2BE04BEF5274270B505AFB2194CA652F23FE91B7F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\python3.dll
Size 72KB
SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
MD5 79d62d130655743c0edbfe60adb57836
SHA1 fdb7b138dbef34e7536cf8226043f318bdfa6ef6
SHA512 5f06e2d8456980ee389e983c8f60971702560b18f24598eef343cddf47515d45495b4bfc2f86a271bb5f5b24a585d814dae552b543dad776b844442eb4bbd87f
SSDEEP 768:6QlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIE:vbTrnXngXMMsIMG0G8y+kR9efIUdHo
TLSH
T199734C4E6B54F8A2D6B629FC78D199CE242B12FC4F2984DFA47DD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\python314.dll
Size 6.4MB
SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
MD5 6c86b5a9512f313fc0ff2ebad8f6d47c
SHA1 4e4f7ee84898d274b399670aa5368ad65dda6e9c
SHA512 0d34c93842872992a4b15dae1837dcf2d428634f95875da8a112673365d1ec439f82caa10b0145a09e3de2cce8e1d15a7c385c0af6162ce8d7e56fba6d711a1e
SSDEEP 98304:UIuAsiTMRBKQ19BtjDm5lERFQYtNX2jivPHDMiE2GZ:FuAsYMRBKQ9Bdi5lERFLkiK
TLSH
T1E0669D26737501A4D8BB8035C9074687DBB1BC00AB30D34B49A47ADA3F773635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\select.pyd
Size 32KB
SHA256 5c4103eef14aebd195425d42196895ffb87bf6a25ab4651242bebf0a6b25cf1d
MD5 b6021321b7fd33c8c8a4079131625fab
SHA1 b8a812e37647eff1f0dc0689ab0fc7c6dfdb70f1
SHA512 4f31fe858655e82575216e55bf940cff6606b2869db1e567e7966e96f1b09391fe4beea0d6c00225093ad8b7248ae63ba8652365e0b9f396c00f703b73ab8e20
SSDEEP 768:yB7Y4HfJeHrFsIMRGno8y++RYT2Ip46htTxf1mltPRVgg9:yB7R/JeHrFsIMRGo8y+kR96ZfIZR+c
TLSH
T1AEE26DCAAF645043EAA3C63186E2DE83F539B7E35611829F31B981990E173C1A337359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\unicodedata.pyd
Size 740KB
SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
MD5 62a8f384eff5516c5941261b8b8c9fd5
SHA1 a497464bcac193b07216ae9c87b8a1c6db83560b
SHA512 00827618788c4cc77b32622c9fd97ae6297c82ab34a686dc4c0898759bffa1bf78a50a467e42d9aa8f1077ef1e02cace55f772b2bdeb729ccb098a40229c91b6
SSDEEP 12288:GYJAPtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtWQNm:GYq5ZmDPqO5ElDJPTMW8m
TLSH
T13DF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2582355D8EB3B44DD182E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5056_1854309688\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4920-305-0x00007FFA324B0000-0x00007FFA32990000-memory.dmp

Download

memory/4920-316-0x0000020CB6210000-0x0000020CB6220000-memory.dmp

Download

memory/4920-349-0x0000020CA3BE0000-0x0000020CA3BE1000-memory.dmp

Download

memory/4920-311-0x00007FFA312F0000-0x00007FFA31524000-memory.dmp

Download

memory/4920-308-0x00007FFA31E60000-0x00007FFA324A6000-memory.dmp

Download

memory/4920-291-0x00007FFA33490000-0x00007FFA3371D000-memory.dmp

Download

memory/5324-915-0x0000017981E60000-0x0000017981F60000-memory.dmp

Download

memory/5324-949-0x0000017994200000-0x0000017994220000-memory.dmp

Download

memory/5324-904-0x00000179801E0000-0x00000179802E0000-memory.dmp

Download

memory/5324-914-0x0000017981A60000-0x0000017981A80000-memory.dmp

Download

memory/5324-935-0x0000017981C80000-0x0000017981CA0000-memory.dmp

Download