c86d79a84cca59f1fccb39092ebdcdfc7560a4322dce07f8944610868a408e58

Analysis

user interaction
yes
max time kernel
76s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DedGK.exe
Size 14.4MB
Sample260701-3ht9msfy2j
SHA256 c86d79a84cca59f1fccb39092ebdcdfc7560a4322dce07f8944610868a408e58
MD5 54767f7f316f872a98e06e6d3bb385c1
SHA1 437006a230e9c4620e2370c272c25c893f55c283
SHA512 f08ed61eee18401873858bf8df4febee2dbd51c8bc8bb563c78a6369ef60ad57e74ea96e2daf7cd0000617e67cf46b51089d93fe63f00e41c8c8387e7f7df52b
SSDEEP 393216:Yr3chIW92bnEJv3fpDGrJ6Yb5LdQG44CuFw4:YLYhvFuY25L2G1Cx
TLSH
T19FE6339AB563214CCBCFE2F9F7C71DEA7905BD740771A06B064146963BA2EE0073436A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 32 IoCs

pid	Process
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe
2712	DedGK.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3000	powershell.exe
692	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	DedGK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	DedGK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	DedGK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	DedGK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	DedGK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	DedGK.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3000	powershell.exe
3000	powershell.exe
3000	powershell.exe
692	powershell.exe
692	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeIncreaseQuotaPrivilege	3000	powershell.exe
Token: SeSecurityPrivilege	3000	powershell.exe
Token: SeTakeOwnershipPrivilege	3000	powershell.exe
Token: SeLoadDriverPrivilege	3000	powershell.exe
Token: SeSystemProfilePrivilege	3000	powershell.exe
Token: SeSystemtimePrivilege	3000	powershell.exe
Token: SeProfSingleProcessPrivilege	3000	powershell.exe
Token: SeIncBasePriorityPrivilege	3000	powershell.exe
Token: SeCreatePagefilePrivilege	3000	powershell.exe
Token: SeBackupPrivilege	3000	powershell.exe
Token: SeRestorePrivilege	3000	powershell.exe
Token: SeShutdownPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeSystemEnvironmentPrivilege	3000	powershell.exe
Token: SeRemoteShutdownPrivilege	3000	powershell.exe
Token: SeUndockPrivilege	3000	powershell.exe
Token: SeManageVolumePrivilege	3000	powershell.exe
Token: 33	3000	powershell.exe
Token: 34	3000	powershell.exe
Token: 35	3000	powershell.exe
Token: 36	3000	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeIncreaseQuotaPrivilege	692	powershell.exe
Token: SeSecurityPrivilege	692	powershell.exe
Token: SeTakeOwnershipPrivilege	692	powershell.exe
Token: SeLoadDriverPrivilege	692	powershell.exe
Token: SeSystemProfilePrivilege	692	powershell.exe
Token: SeSystemtimePrivilege	692	powershell.exe
Token: SeProfSingleProcessPrivilege	692	powershell.exe
Token: SeIncBasePriorityPrivilege	692	powershell.exe
Token: SeCreatePagefilePrivilege	692	powershell.exe
Token: SeBackupPrivilege	692	powershell.exe
Token: SeRestorePrivilege	692	powershell.exe
Token: SeShutdownPrivilege	692	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeSystemEnvironmentPrivilege	692	powershell.exe
Token: SeRemoteShutdownPrivilege	692	powershell.exe
Token: SeUndockPrivilege	692	powershell.exe
Token: SeManageVolumePrivilege	692	powershell.exe
Token: 33	692	powershell.exe
Token: 34	692	powershell.exe
Token: 35	692	powershell.exe
Token: 36	692	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2712	DedGK.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 2712	5812	DedGK.exe	90
PID 2712 wrote to memory of 3000	2712	DedGK.exe	91
PID 2712 wrote to memory of 692	2712	DedGK.exe	94

C:\Users\Admin\AppData\Local\Temp\DedGK.exe
"C:\Users\Admin\AppData\Local\Temp\DedGK.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Users\Admin\AppData\Local\Temp\DedGK.exe
  C:\Users\Admin\AppData\Local\Temp\DedGK.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Processor | Select-Object -ExpandProperty ProcessorId | Select-Object -First 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Get-CimInstance Win32_DiskDrive | Where-Object { $_.SerialNumber -and $_.SerialNumber.Trim() -ne '' } | Sort-Object -Property Index | Select-Object -First 1 -ExpandProperty SerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 16aab2fa86ffb6867296ab520375217b7c435fc055aca660b4bf31a0f660246b
MD5 a460d29016237b8779adef1fb70e6a97
SHA1 66aab34b704effec5d30181557c674a98a4ef53e
SHA512 657361de6b1985b94a1496442181fca4ce26b9f74e428f9d363ce5f6824ffb7f72b05e60c7604e7830e384fc950120dff0c4f5ff721837050285630cf80d9b60
TLSH
T17E219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F299DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes312.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes312.dll
Size 133KB
SHA256 9bd7f8c39a84d7b1ea43bfcd33c04631c60f4ff28167e82bb21987cc1c353766
MD5 9840f2fbf3a5104e53a511ee4c194338
SHA1 4e746b03ab167b077ef4a37cd79801916a21b363
SHA512 8a075dd8bd7c5d183a5920cb734e28582f1fbd8f28d2770a8f1e1b06c5faf8faf62151feb7eeefc1ce2ef778bd80cf4ae39b1dd57dd493038fee9ba0a929359c
SSDEEP 3072:m36SA+jofbJJwwdOptiNrY/rZ6YrulfF14QgR5y189I6t04/:mFA+jofbDwCOpSrY/rPuF14QgDyS9IQ
TLSH
T18AD33A47379644DAE966937DCD771A02D3A2B0000711E3CF46A1C28B6F63BE6AD3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qzl0pnqm.3lb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qzl0pnqm.3lb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\81d243bd2c585b0f4821__mypyc.pyd
Size 214KB
SHA256 52056f4b964f1bc0419064a374a32e56ef85ccb161166971d26f46a7490bd238
MD5 81565857347db31694fd9d8e2c141118
SHA1 8860b27f384f62d8d042c2403692fe1d7a52a034
SHA512 d6b1638151934766ebc73f8958da322c42131a7008ec58e7f186794f3fe3723f815334d4b77db26723ae75f9e4ae3bd1b9d0b912e4ab78c2ec70bdec045bf0c6
SSDEEP 6144:RFNBeuZ2KmJTSMMjktLxxkP8VXaVHaT8fyFmiGJZMzQdAQF039H:RFNB/IzTSdkM25
TLSH
T132242A3A52480065DD7352758C63A523E9F2F662073252CF08E0C6795F17BEAB7BEB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_asyncio.pyd
Size 69KB
SHA256 7a5c88ce496bafdf31a94ae6d70b017070703bc0a7da1dfae7c12b21bb61030d
MD5 cc0f232f2a8a359dee29a573667e6d77
SHA1 d3ffbf5606d9c77a0de0b7456f7a5314f420b1f7
SHA512 48484177bf55179607d66f5a5837a35cd586e8a9fb185de8b10865aab650b056a61d1dc96370c5efc6955ccb4e34b31810f8e1c8f5f02d268f565a73b4ff5657
SSDEEP 1536:BoxWhy9EQkTpR1Pg9qgTILN/86wW1lI1Onl7SyPxN3:BiWhy3k1Ra9qgTILN/Lw8lI1OnlB
TLSH
T12C638D83E2E0059ECD57A2B8D8632F67DBB1F1520A01578F6268C18E2F6375246FE721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_bz2.pyd
Size 83KB
SHA256 324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
MD5 dd26ed92888de9c57660a7ad631bb916
SHA1 77d479d44d9e04f0a1355569332233459b69a154
SHA512 d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897
SSDEEP 1536:+yhz79151BVo1vXfzIFnaR4bO1AsCn8Bsjk+tI1CVQ7Sy4x+R:Nhzx15evXkuxAB8BMk+tI1CVQF
TLSH
T141839E92E3956AF5F41F81BA96C10367E771B954075083EFF344C25A2F03B426EAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_cffi_backend.pyd
Size 177KB
SHA256 53de34afc3939d81bf2498b77425c52e2c3f3164f8cfe2543d3acc8f24134488
MD5 429d90ecf87f4d8df562bae6b6157718
SHA1 7907e7f8b44267f5f8c62602d77aaede49d3e4d2
SHA512 f561658624c72efa89fec6dc84a490b876d030a2fd98570a40ab2750694702e45716267e1e9c66c149fcab097728bd1821d9519bb9b46593fe28171b5c854ac3
SSDEEP 3072:4r50eONP/8gtmDqd/6XIrcqwnQ3j6lMU2TS9Jss7kaN0S7JxSTL7K6X58YHo:4y8gGbAcqwnQ3elMU2sb0wxSTLOuuYH
TLSH
T196045C5A339C11B2D5A251788A679B53E3B3B431170197CF01A0C7B62F1BBE67A7EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_ctypes.pyd
Size 122KB
SHA256 8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
MD5 c8afa1ebb28828e1115c110313d2a810
SHA1 1d0d28799a5dbe313b6f4ddfdb7986d2902fa97a
SHA512 4d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56
SSDEEP 3072:cXw32spTVYgFoj6N2xE9sb7VRf/EiZBq5syCtYPU9BI1LP885:cgGEOgFoj68ksrf/Ejsa5
TLSH
T149C36C0B339400A9EBA34179C8B36E07D7F1B41B175193CF1294C69A2F637A76E6E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_dedgk_main.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_dedgk_main.dll
Size 17.2MB
SHA256 a3080a59accc14b45d75a6ae048ab9c3dbe167841f9529849430f508143df03e
MD5 fbabcda6b345134fb2094b3536e6f8db
SHA1 d2f3c8c794d6332510e9457f6b9cc982602ec638
SHA512 9c40d100056bad677dd91cad36a75a2a021bcf50258f3167ca2f74a17c89f98e3033e581dbd398d8a28aa1e4488bdb1f4c59eacf7e6efcb946aafd151ec408d7
SSDEEP 98304:ECAikqa4cQyiKWrebJJAYatyedEEPOed4+/7iUgDdmFKxInJn5jRejsL6uucufsY:RiUgQy6k4zxZACZgDVR5jPC925EK3
TLSH
T195075B43B17120B7EE66F0B44A165567A774F83A62307AB330DE84362F17D71AE2C69C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_hashlib.pyd
Size 64KB
SHA256 f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa
MD5 d19cb5ca144ae1fd29b6395b0225cf40
SHA1 5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4
SHA512 9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519
SSDEEP 1536:/9gLpgE4Z27ARZWZnEmoAlI1OIH7SyT0xq:26RZeEmoAlI1OIHth
TLSH
T198537D09A69544E8C96781B8C8A35F57FAF2F1511B10A7DF0368C18D2F237C3A6BB356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_lzma.pyd
Size 156KB
SHA256 6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
MD5 8cfbafe65d6e38dde8e2e8006b66bb3e
SHA1 cb63addd102e47c777d55753c00c29c547e2243c
SHA512 fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4
SSDEEP 3072:lsvkxujgo7e2uONOG+hi+C8znfF9mNooXnmbutI1Z1mb:lnu0o7JUrNYOo2Kz
TLSH
T111F32992A394F0D5F6728C78D6624F17E7F678490320929A02CCD37D2B1FB759A2A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_overlapped.pyd
Size 54KB
SHA256 46dec978ec8cb2146854739bfeddea93335dcc92a25d719352b94f9517855032
MD5 df92ea698a3d0729b70a4306bbe3029f
SHA1 b82f3a43568148c64a46e2774aec39bf1f2d3c1e
SHA512 bdebafe1b40244a0cb6c97e75424f79cfe395774a9d03cdb02f82083110c1f4bdcac2819ba1845ad1c56e2d2e6506dcc1833e4eb269bb0f620f0eb73b4d47817
SSDEEP 1536:Minr44gaZPXxCJ/+yZdDDr5I1Xtw7Sy+xmS2:M3J/+yZdDDr5I1Xtwf
TLSH
T10F437B06679404D9ED77C57EE4630E1AEBB0B1965710931F62A8C24A2F737837BAE3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_queue.pyd
Size 31KB
SHA256 76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d
MD5 7d91dd8e5f1dbc3058ea399f5f31c1e6
SHA1 b983653b9f2df66e721ece95f086c2f933d303fc
SHA512 b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf
SSDEEP 768:1lzRmezd6rGjMoW4BI1QUGL5YiSyv8+WAMxkEW7:LRm0MGooW4BI1QUG17SyIxC7
TLSH
T192E2AED3BA541C56C963C871D8E25F25E932B786470183DF2229C24D2F327837BB9765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_socket.pyd
Size 81KB
SHA256 2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
MD5 e43aed7d6a8bcd9ddfc59c2d1a2c4b02
SHA1 36f367f68fb9868412246725b604b27b5019d747
SHA512 d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e
SSDEEP 1536:COYhekrkJqlerLSyypHi9/s+S+pzjii/n1IsJqKNBI1Lw9PD7Sy9duxJ:jwkJqHyypHi9/sT+pzjiE1IwdNBI1LwU
TLSH
T176835A11A69050F9DB63C0BAC2635E23FBB5B4C013D5939F1166C66A1F33783BE79A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_ssl.pyd
Size 174KB
SHA256 68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a
MD5 6a2b0f8f50b47d05f96deff7883c1270
SHA1 2b1aeb6fe9a12e0d527b042512fc8890eedb10d8
SHA512 a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37
SSDEEP 3072:ZmkiCZfBmvD1ZLnM2Yfp6XSVJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JtI1C7lD:xiC5QD1dwp6XSxMfjTwJxd
TLSH
T1AD046C03B5902EBBD813E4B9C1231913DBF1F015331257DE49D6D64A0F17B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_tkinter.pyd
Size 64KB
SHA256 f0ebdf2ca7b33c26b8938efa59678068d3840957ee79d2b3c576437f8f913f20
MD5 e38a6b96f5cc200f21da22d49e321da3
SHA1 4ea69d2b021277ab0b473cfd44e4bfd17e3bac3b
SHA512 3df55cdd44ea4789fb2de9672f421b7ff9ad798917417dcb5b1d8575804306fb7636d436965598085d2e87256ecb476ed69df7af05986f05b9f4a18eed9629e2
SSDEEP 1536:dGpS27sIvGJdk7YeY7S81CpnHcKWlI1OSs7Sy+xe:gpVp7xKSppnHcFlI1OSsz
TLSH
T1C1537D9BA7A0008ACEA7C179C4B36F23D675B5124B10934F0294D35A2F337A3A7FA755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_win32sysloader.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\_win32sysloader.pyd
Size 15KB
SHA256 db277aae2b8417dbd01435a8691cc74707f6699ae3199e1b205f609cefa5ad24
MD5 b5e8c2715e155fa9faf3414c9e86a7e9
SHA1 69583ba52e9019380da8bc98a5f6b6a6cbeaae06
SHA512 144bbc20c922198e3c8e57b3b683597a7e60af83a191d20cb63d9665037d510c053b53a85b65bf2506da8beae6c1ebee36bfe655d14692da62327f9dc2bd2b59
SSDEEP 192:PE322v+8dKH3x8HOrx0PqX9Be+RyUnCplDePxe3sedmXQYgeun7ytI4SWIk0/I:Pqm8dKXx8Hkwly5e3sS0uUVL0/
TLSH
T117620681B79585DAE077C27CC8731F55A2BAB9256731434F07B212180DB62C97F29B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\charset_normalizer\cd.pyd
Size 10KB
SHA256 aec205186ce86077a5f8fb469e924cd5f7e183daed53f9de9362e77f3bf3637f
MD5 15ee9441b9b1901c82309c49a9989bb4
SHA1 c8d7f23de5888d3e6b93cc3b02d257c7072af35b
SHA512 7e07ae95528bc6cb965c5fdee755dab00283b09bec9a101cc106d5d1f40178cf01aa14f55b782b68d6de45498c8ed3720a77d19dcd1ee4cc68e1e7232becf668
SSDEEP 192:qxGrmoX+sMl/++Ch9p8PBdVpcjgeA0JH6:qx4m4468D3clAe
TLSH
T1C32208ACFE7458EAD9664534C5274E4AB035FB22170233CF8370916E2FA37E26534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\cryptography\hazmat\bindings\_rust.pyd
Size 9.4MB
SHA256 051e355666d8d242827c7969b70f6da6b7f27aa23fcd5c36fcb0c81bc25a6856
MD5 9713c93a97e4693a9180d642aac5be37
SHA1 c997712c2a604f10d5f2f4c842f1e486e2436a37
SHA512 412e01f6f4619dddf0a8c3bfba84b95087dafded51eea96d08a857fd8f902f8c35d690b19227e7e03144e2cc92280d23981bb8a5eb77150a407868036b74616c
SSDEEP 98304:Pmtj1GYnIWWGrRmuNB4rh8hSN3PHlFbWaK/HOni+f2lxp5Y:PMfNOrh8hSN3/l5WaKfOika5Y
TLSH
T1A8A66C25BAA950A8D86AC4B8C34762339B7174DA07747AFF49D486B52F36FE01B3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\python3.dll
Size 66KB
SHA256 29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
MD5 8dbe9bbf7118f4862e02cd2aaf43f1ab
SHA1 935bc8c5cea4502d0facf0c49c5f2b9c138608ed
SHA512 938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/D:BDmF61JFn+/O/BI1L057Sy+xF
TLSH
T166637052BB54F8A3DBFA69FC39D199CD542B12CC832584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\python312.dll
Size 6.6MB
SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
MD5 cae8fa4e7cb32da83acf655c2c39d9e1
SHA1 7a0055588a2d232be8c56791642cb0f5abbc71f8
SHA512 db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c
SSDEEP 49152:Jc7/HNCHh0IWiUDFsx3hghs7g6kIPuch+Xe16/02yWYqiVx7qb4f4wmC36nhIVcF:JcBZhxsje2kUvid5E+vbHDMiEr/l9o
TLSH
T1B4667D667268C0A9C96BA0B0CC13C28BE7727C11BF50530B70EBB75E2F737A2565A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\select.pyd
Size 30KB
SHA256 678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
MD5 79ce1ae3a23dff6ed5fc66e6416600cd
SHA1 6204374d99144b0a26fd1d61940ff4f0d17c2212
SHA512 a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa
SSDEEP 384:I8RVBC9t6Lhz64SHfZslDT90YBI1QGjHQIYiSy1pCQQRaAM+o/8E9VF0NytuSS:1GyqHfK1HBI1QGT5YiSyvXAMxkEm
TLSH
T10AD28E47AF646849D923C972A8A28F26DD36B752871182CF3358C15D1F217C27F7B3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\tcl86t.dll
Size 1.7MB
SHA256 fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760
MD5 3ae729942d15f4f48b1ea8c91880f1f4
SHA1 d27596d14af5adeb02edab74859b763bf6ac2853
SHA512 355800e9152daad675428421b867b6d48e2c8f8be9ca0284f221f27fae198c8f07d90980e04d807b50a88f92ffb946dc53b7564e080e2e0684f7f6ccc84ff245
SSDEEP 24576:CAZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDR:CA0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDD
TLSH
T16A858F1BE76410A8D8ABD1B8C527BB0BEBF178151350A7DB51B08B912F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\tcl\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\tk86t.dll
Size 1.5MB
SHA256 afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2
MD5 966580716c0d6b7eec217071a6df6796
SHA1 e3d2d4a7ec61d920130d7a745586ceb7aad4184d
SHA512 cf0675ea888a6d1547842bcfb27d45815b164337b4a285253716917eb157c6df3cc97cba8ad2ab7096e8f5131889957e0555bae9b5a8b64745ac3d2f174e3224
SSDEEP 24576:gJ3uXVFKflt2zwvzPYHURwgVdF9EWyCzfdmHQnveD4CGan9nViFoHb15K3cmwdbo:yeFSpvzg0RwgVdF9EWyCzfdmHQnveD4Z
TLSH
T19D754C06A261C198C66EA134C91796FADBF17C14931057DB76A0BE6D3F33BE2273A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\unicodedata.pyd
Size 1.1MB
SHA256 c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
MD5 b848e259fabaf32b4b3c980a0a12488d
SHA1 da2e864e18521c86c7d8968db74bb2b28e4c23e2
SHA512 4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27
SSDEEP 12288:FrEHdcM6hb/CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAa1:FrEXaCjfk7bPNfv42BN6yzUAa1
TLSH
T1AA355AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\win32crypt.pyd
Size 123KB
SHA256 30cf71545212bbfb7362618f41a40cefcea39327306fdd7926c95374ce9294bf
MD5 a1f0fb2b55795d041ea073cf2071d9bd
SHA1 9864492cf891992fa3392ff0cbf3c464070a0410
SHA512 2c8ca6a690d8de83fa360b5cd2aa41b888d78e9842d6605a054e8c0fd0be011f3364c6bf38d955e6d62d7a2882502494f66cd8fa4fd18ed70e7007773d2b364a
SSDEEP 1536:t52JbGMvjXV7otG69ozHwAmuzq1OvL/ZAPPAEyASLIobnVVkwgCBxbAVbB7MNHrp:tsYQ7nAgpAgEYJboCB6B7MNH4aj
TLSH
T138C34B07729509CAE9AAD3BDC823A907E7A5B0151311A7CF0950C6DA0F67BE17D3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5812_735815_qHrqiu2nrHM\zlib1.dll
Size 143KB
SHA256 28484bcea1e387c4a41564af8f62c040fe203fe2491e415ce90f3d7f5c7ab013
MD5 4fadeda3c1da95337b67d15c282d49d8
SHA1 f49ee3256f8f5746515194114f7ef73d6b6141c0
SHA512 45634caf9d9214f0e45e11a1539d8663b45527e1ae9282558b5fdb8465d90b0fabcf4c0e508504427a597ba390c029bc12068ac17d842fd0fcbb1886d252c6b1
SSDEEP 3072:7qLKjJj3yg1shVjm4OvfqnKAh2mrohmR5JHDbuNy:7qGEgSefI3roCDbV
TLSH
T113E38D9AB6A224BDC6B7857056E78B76F931B81107309DEF6188C7B41F11E806B193FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-1056-0x0000015B673D0000-0x0000015B67482000-memory.dmp

Download

memory/2712-1061-0x00007FFF5BAC0000-0x00007FFF5BAEA000-memory.dmp

Download

memory/2712-1063-0x00007FFF44A40000-0x00007FFF45BAF000-memory.dmp

Download

memory/2712-1062-0x00007FF6D73A0000-0x00007FF6D8239000-memory.dmp

Download

memory/2712-1064-0x00007FFF5BAC0000-0x00007FFF5BAEA000-memory.dmp

Download

memory/2712-1060-0x00007FFF44A40000-0x00007FFF45BAF000-memory.dmp

Download

memory/2712-1059-0x00007FF6D73A0000-0x00007FF6D8239000-memory.dmp

Download

memory/3000-1041-0x0000022A6EDF0000-0x0000022A6EE14000-memory.dmp

Download

memory/3000-1029-0x0000022A6EA20000-0x0000022A6EA42000-memory.dmp

Download

memory/3000-1037-0x0000022A6ECD0000-0x0000022A6ECEE000-memory.dmp

Download

memory/3000-1038-0x0000022A6ECF0000-0x0000022A6EDA2000-memory.dmp

Download

memory/3000-1040-0x0000022A6EDF0000-0x0000022A6EE1A000-memory.dmp

Download

memory/3000-1039-0x0000022A6EDB0000-0x0000022A6EDBA000-memory.dmp

Download

memory/5812-1058-0x00007FF6D73A0000-0x00007FF6D8239000-memory.dmp

Download

memory/5812-1952-0x00007FF6D73A0000-0x00007FF6D8239000-memory.dmp

Download