Overview

overview

10

Static

static

3

_336c35fa5...74.exe

windows10-2004-x64

8

_336c35fa5...74.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 11:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _336c35fa5189d4ad981d7d4c284f1cee64ccf0758b685ac682cbf3a91a4ae374.exe
  • Size 8.3MB
  • Sample260709-n4faaaaw6y
  • SHA256 336c35fa5189d4ad981d7d4c284f1cee64ccf0758b685ac682cbf3a91a4ae374
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecredential_accessdiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://85.11.167.193:5173/api/file-share/481c0582-8d0d-4c4f-82c7-098cdc433d16/download
  • exe.dropper

    https://85.11.167.193:5173/api/file-share/bda3066f-4f4b-4d45-9029-a0b43058e047/download

Extracted

Language

  • ps1

Source
URLs
  • ps1.dropper

    https://85.11.167.193:5173/api/file-share/bda3066f-4f4b-4d45-9029-a0b43058e047/download

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Loads dropped DLL 14 IoCs
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\_336c35fa5189d4ad981d7d4c284f1cee64ccf0758b685ac682cbf3a91a4ae374.exe
    "C:\Users\Admin\AppData\Local\Temp\_336c35fa5189d4ad981d7d4c284f1cee64ccf0758b685ac682cbf3a91a4ae374.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5664
    • C:\Users\Admin\AppData\Local\Temp\_336c35fa5189d4ad981d7d4c284f1cee64ccf0758b685ac682cbf3a91a4ae374.exe
      "C:\Users\Admin\AppData\Local\Temp\_336c35fa5189d4ad981d7d4c284f1cee64ccf0758b685ac682cbf3a91a4ae374.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoP -WindowStyle Hidden -ep Bypass -File C:\Users\Admin\AppData\Local\Temp\update.ps1
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3840
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sysloader.ps1"
          4⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2536
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu --no-sandbox --disable-dev-shm-usage
            5⤵
            • Drops file in Windows directory
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3016
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1bc,0x1c0,0x1c4,0x198,0x1c8,0x7ffc9bfbc728,0x7ffc9bfbc734,0x7ffc9bfbc740
              6⤵
                PID:2408
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
                6⤵
                  PID:4744
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --force-high-res-timeticks=disabled --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
                  6⤵
                  • System Time Discovery
                  PID:5712
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --force-high-res-timeticks=disabled --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:13
                  6⤵
                    PID:4820
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:1
                    6⤵
                      PID:2360
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:1
                      6⤵
                        PID:3604
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
                        6⤵
                          PID:3884
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:9
                          6⤵
                            PID:4372
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:9
                            6⤵
                              PID:3536
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:9
                              6⤵
                                PID:1396
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
                                6⤵
                                  PID:5140
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453" --force-high-res-timeticks=disabled --field-trial-handle=1876,i,12921903310438110693,731105966156799066,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
                                  6⤵
                                    PID:3424
                                • C:\Windows\system32\netsh.exe
                                  netsh wlan show profiles
                                  5⤵
                                  • Event Triggered Execution: Netsh Helper DLL
                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                  PID:2124
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:2244
                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                            1⤵
                              PID:3272
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              1⤵
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of WriteProcessMemory
                              PID:2032
                              • C:\Windows\explorer.exe
                                explorer.exe /LOADSAVEDWINDOWS
                                2⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Enumerates connected drives
                                • Checks SCSI registry key(s)
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                PID:3484
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                              1⤵
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:4180
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:4676

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  1
                                  T1059

                                  PowerShell

                                  1
                                  T1059.001

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  2
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  2
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Defense Evasion

                                  Modify Registry

                                  3
                                  T1112

                                  Credential Access

                                  Unsecured Credentials

                                  1
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Discovery

                                  Browser Information Discovery

                                  1
                                  T1217

                                  Peripheral Device Discovery

                                  2
                                  T1120

                                  Query Registry

                                  5
                                  T1012

                                  System Information Discovery

                                  4
                                  T1082

                                  System Network Configuration Discovery

                                  1
                                  T1016

                                  Wi-Fi Discovery

                                  1
                                  T1016.002

                                  System Time Discovery

                                  1
                                  T1124

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  prep_Activatable Class_Hermes_perf.cache
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                  • Size 599B
                                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Cache\Cache_Data\data_0
                                  • Size 44KB
                                  • SHA256 228194361b77f804cbc54223a99f99055262ff8d27c962c59c5f8870d538533c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Cache\Cache_Data\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Cache\Cache_Data\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  the-real-index
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Code Cache\js\index-dir\the-real-index
                                  • Size 72B
                                  • SHA256 5318c8ce131d0a33fbe6b6e847f5c5cdd9afe1bc0f2752c1974f8c3342a3f658
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  the-real-index~RFe5a0b1d.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Code Cache\js\index-dir\the-real-index~RFe5a0b1d.TMP
                                  • Size 48B
                                  • SHA256 cabe263d84bfd28aa55c6647899d4ab0ea36fad588b591e23a54423862983311
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Extension Rules\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  SCT Auditing Pending Reports
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  the-real-index
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                  • Size 72B
                                  • SHA256 b501329fa9bec3bca5cee3ba98b3ed0ae2555551ec725d0158abfbe74da83397
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  the-real-index~RFe5a0b1d.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0b1d.TMP
                                  • Size 72B
                                  • SHA256 e6b3e85836ca2e239f50c46d6ed845790366ea81d1dd2fa41d6915d8a1bfb66d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  CURRENT
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Default\Sync Data\LevelDB\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\GraphiteDawnCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Local State
                                  • Size 3KB
                                  • SHA256 f375a749b5b647dce8187d1b16fe91e6063d9bccc90a1cf1f8f6fa8ed2c72a43
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Local State~RFe5a0b0d.TMP
                                  • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3016240759453\Local State~RFe5a0b0d.TMP
                                  • Size 1KB
                                  • SHA256 ceaa6718d9ec9945b12d14a0243445387dc98603a92b2c25a6b1259a007af402
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  VCRUNTIME140.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\VCRUNTIME140.dll
                                  • Size 117KB
                                  • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _bz2.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\_bz2.pyd
                                  • Size 84KB
                                  • SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _ctypes.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\_ctypes.pyd
                                  • Size 131KB
                                  • SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _hashlib.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\_hashlib.pyd
                                  • Size 63KB
                                  • SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _lzma.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\_lzma.pyd
                                  • Size 155KB
                                  • SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _socket.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\_socket.pyd
                                  • Size 82KB
                                  • SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _ssl.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\_ssl.pyd
                                  • Size 178KB
                                  • SHA256 21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  base_library.zip
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\base_library.zip
                                  • Size 1.3MB
                                  • SHA256 bb4d32121e22099635c68790ae8c89d465bb2b50bdf7cf773cbb0fe8cf4af522
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  libcrypto-3.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\libcrypto-3.dll
                                  • Size 5.0MB
                                  • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  libffi-8.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\libffi-8.dll
                                  • Size 38KB
                                  • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  libssl-3.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\libssl-3.dll
                                  • Size 774KB
                                  • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  python313.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\python313.dll
                                  • Size 5.8MB
                                  • SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  select.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\select.pyd
                                  • Size 31KB
                                  • SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ucrtbase.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\ucrtbase.dll
                                  • Size 1.1MB
                                  • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  unicodedata.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56642\unicodedata.pyd
                                  • Size 694KB
                                  • SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  __PSScriptPolicyTest_afosy2dp.2aw.ps1
                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_afosy2dp.2aw.ps1
                                  • Size 60B
                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  sysloader.ps1
                                  • Path C:\Users\Admin\AppData\Local\Temp\sysloader.ps1
                                  • Size 1KB
                                  • SHA256 99cf6a8c174ca3db7a108d482def525745939aa6c02303a148f35258868bf9df
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  update.ps1
                                  • Path C:\Users\Admin\AppData\Local\Temp\update.ps1
                                  • Size 5KB
                                  • SHA256 a24ff6fa8ea27f365878b58e444d1130e90e54d94615934c7fb771bfadc151e5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/2536-150-0x0000000244E40000-0x0000000248270000-memory.dmp
                                  Download

                                  memory/2536-305-0x0000000244E40000-0x0000000248270000-memory.dmp
                                  Download

                                  memory/2536-155-0x0000000244E40000-0x0000000248270000-memory.dmp
                                  Download

                                  memory/2536-151-0x0000000244E40000-0x0000000248270000-memory.dmp
                                  Download

                                  memory/2536-306-0x0000000244E40000-0x0000000248270000-memory.dmp
                                  Download

                                  memory/2536-147-0x0000000244E40000-0x0000000248270000-memory.dmp
                                  Download

                                  memory/2536-149-0x0000000244E40000-0x0000000248270000-memory.dmp
                                  Download

                                  memory/2536-148-0x0000000244E40000-0x0000000248270000-memory.dmp
                                  Download

                                  memory/2536-122-0x0000026573A40000-0x0000026573FE9000-memory.dmp
                                  Download

                                  memory/2536-123-0x0000026575470000-0x0000026578391000-memory.dmp
                                  Download

                                  memory/2536-125-0x0000000244E40000-0x0000000248270000-memory.dmp
                                  Download

                                  memory/3840-91-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-97-0x000001FB73EF0000-0x000001FB73FA2000-memory.dmp
                                  Download

                                  memory/3840-119-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-115-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-114-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-113-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-112-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-111-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-110-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-107-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-106-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-105-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-104-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-100-0x000001FB74120000-0x000001FB7413E000-memory.dmp
                                  Download

                                  memory/3840-99-0x000001FB73CB0000-0x000001FB73CBA000-memory.dmp
                                  Download

                                  memory/3840-121-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-98-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-96-0x000001FB73ED0000-0x000001FB73EEE000-memory.dmp
                                  Download

                                  memory/3840-92-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-88-0x000001FB5BBE0000-0x000001FB5BC02000-memory.dmp
                                  Download

                                  memory/3840-90-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-89-0x00007FFCA4520000-0x00007FFCA4EC4000-memory.dmp
                                  Download

                                  memory/3840-85-0x00007FFCA46AF000-0x00007FFCA46B0000-memory.dmp
                                  Download

                                  memory/4180-336-0x000001BDD5E20000-0x000001BDD5F20000-memory.dmp
                                  Download

                                  memory/4180-347-0x000001BD93BC0000-0x000001BD93CC0000-memory.dmp
                                  Download

                                  memory/4180-381-0x000001BD93F30000-0x000001BD93F50000-memory.dmp
                                  Download

                                  memory/4180-367-0x000001BD83A30000-0x000001BD83A50000-memory.dmp
                                  Download

                                  memory/4180-346-0x000001BD83950000-0x000001BD83970000-memory.dmp
                                  Download

                                  memory/4676-525-0x000001C56A000000-0x000001C56A434000-memory.dmp
                                  Download