Overview

overview

9

Static

static

3

Ventory Cheats.exe

windows10-2004-x64

9

Ventory Cheats.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    532s
  • max time network
    536s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/07/2026, 03:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ventory Cheats.exe
  • Size 19.5MB
  • Sample260710-dkf3csdw6s
  • SHA256 11c3cedece6e2ca0c3a3d3d82449c9cc6517775373f396598c1412ad27922bf5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdefense_evasiondiscoverypersistenceprivilege_escalationpyinstallerransomwarespywarestealer

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Indicator Removal: Network Share Connection Removal 1 TTPs 3 IoCs

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 32 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Opens file in notepad (likely ransom note) 7 IoCs
    ransomware
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ventory Cheats.exe
    "C:\Users\Admin\AppData\Local\Temp\Ventory Cheats.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4112
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4488
    • C:\Users\Admin\AppData\Local\Temp\Ventory Cheats.exe
      "C:\Users\Admin\AppData\Local\Temp\Ventory Cheats.exe"
      1⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Users\Admin\AppData\Local\Temp\rx.exe
        "C:\Users\Admin\AppData\Local\Temp\rx.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2744
        • C:\Users\Admin\AppData\Local\Temp\rx.exe
          "C:\Users\Admin\AppData\Local\Temp\rx.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1680
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            4⤵
              PID:4048
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2664
              • C:\Windows\system32\tasklist.exe
                tasklist
                5⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:732
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "net user hello helloworld /add"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3484
              • C:\Windows\system32\net.exe
                net user hello helloworld /add
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:5080
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 user hello helloworld /add
                  6⤵
                    PID:1768
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "net localgroup Administrators hello /add"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4472
                • C:\Windows\system32\net.exe
                  net localgroup Administrators hello /add
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4424
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 localgroup Administrators hello /add
                    6⤵
                      PID:4492
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "net user hello /delete"
                  4⤵
                  • Indicator Removal: Network Share Connection Removal
                  • Suspicious use of WriteProcessMemory
                  PID:2776
                  • C:\Windows\system32\net.exe
                    net user hello /delete
                    5⤵
                    • Indicator Removal: Network Share Connection Removal
                    • Suspicious use of WriteProcessMemory
                    PID:3856
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 user hello /delete
                      6⤵
                      • Indicator Removal: Network Share Connection Removal
                      PID:2852
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 8ball /f 2>nul"
                  4⤵
                    PID:3516
                    • C:\Windows\system32\reg.exe
                      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 8ball /f
                      5⤵
                      • Modifies registry key
                      PID:3224
              • C:\Users\Admin\AppData\Local\Temp\Server.exe
                "C:\Users\Admin\AppData\Local\Temp\Server.exe"
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4116
                • C:\Windows\svchost.exe
                  "C:\Windows\svchost.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:956
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
              1⤵
                PID:4324
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\8ball_debug.log
                1⤵
                • Opens file in notepad (likely ransom note)
                • Suspicious use of FindShellTrayWindow
                PID:4484
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:4200
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\crautofills.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:2388
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:3328
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\crcookies.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:4332
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\crpasswords.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:2248
              • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\crpasswords.csv"
                1⤵
                • Checks processor information in registry
                • Enumerates system info in registry
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of SetWindowsHookEx
                PID:4460
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\8ball_debug.log
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:1348
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Temp1_RX_LocalFiles.zip\Documents\MoveBackup.html
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:3556
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\AppData\Local\Temp\Temp1_RX_LocalFiles.zip\Documents\MoveBackup.html
                  2⤵
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:1540
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x284,0x7ff8bba9c188,0x7ff8bba9c194,0x7ff8bba9c1a0
                    3⤵
                      PID:3520
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,7681309093885013944,12222796084107554001,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
                      3⤵
                      • System Time Discovery
                      PID:5068
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,7957581026706946858,4553330038684422162,262144 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
                      3⤵
                        PID:3416
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,12278069814219722756,521208331676534092,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
                        3⤵
                          PID:4904
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,13939696346778954894,3520750816862832672,2097152 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
                          3⤵
                            PID:1260
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,2680011457289838087,11599659228941866104,2097152 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                            3⤵
                              PID:228
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,10802019804453879915,2874726533471640373,2097152 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
                              3⤵
                                PID:2520
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11663851993887110755,9206269181064023892,2097152 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
                                3⤵
                                  PID:1892
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,16201850252947473854,14709531082086736959,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
                                  3⤵
                                    PID:1532
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,11421009316044940636,16630856657938797970,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
                                    3⤵
                                      PID:4324
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,2072848430136370797,7254502661371819625,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
                                      3⤵
                                        PID:4692
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,1380016557169447498,8497089661776424985,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
                                        3⤵
                                          PID:2356
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,8369167607158149192,11553742442137752243,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
                                          3⤵
                                            PID:3900
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,8369167607158149192,11553742442137752243,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
                                            3⤵
                                              PID:4248
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,4280110766688852040,18255725586560806808,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
                                              3⤵
                                                PID:4812
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,3982187655723970713,13168532222404001990,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
                                                3⤵
                                                  PID:1064
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,14848434230147421878,6430744788691239445,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
                                                  3⤵
                                                    PID:4772
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,164185901967385558,16150867638397292827,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
                                                    3⤵
                                                      PID:3812
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,17514543231797599349,16889972420704750261,524288 --field-trial-handle=2340,i,9444546751362798015,6616396449219807651,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
                                                      3⤵
                                                        PID:5000
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:4352
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                                      1⤵
                                                        PID:1064
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                        1⤵
                                                        • Checks SCSI registry key(s)
                                                        • Checks processor information in registry
                                                        • Enumerates system info in registry
                                                        • Modifies data under HKEY_USERS
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1876
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8bd57c728,0x7ff8bd57c734,0x7ff8bd57c740
                                                          2⤵
                                                            PID:3724
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,4700298038797201255,14962226961058514507,262144 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1928 /prefetch:2
                                                            2⤵
                                                              PID:1700
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,1379412224805934278,18232066146109981590,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:3
                                                              2⤵
                                                              • System Time Discovery
                                                              PID:4332
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,4480255317750948013,13997864058340582123,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2404 /prefetch:8
                                                              2⤵
                                                                PID:4564
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,6486184188838763422,15398076825478662324,2097152 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
                                                                2⤵
                                                                  PID:3192
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3448,i,6145679312528340686,13494562796821720149,2097152 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3464 /prefetch:1
                                                                  2⤵
                                                                    PID:3360
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,14687690998422662694,6408465784976641386,2097152 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
                                                                    2⤵
                                                                      PID:2788
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,16819975226402229126,2890060618349686273,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:8
                                                                      2⤵
                                                                        PID:4848
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,13723915267895721869,5377741410216435721,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4836 /prefetch:8
                                                                        2⤵
                                                                          PID:3412
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,18263624415974968003,3555333151229141906,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
                                                                          2⤵
                                                                            PID:5068
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5612,i,7471341352249578746,2472865129457856297,2097152 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:1
                                                                            2⤵
                                                                              PID:3712
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3468,i,7851855324974533477,11961397863626825201,2097152 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4220 /prefetch:1
                                                                              2⤵
                                                                                PID:2588
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,13157404025361516863,15951448239033781368,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:8
                                                                                2⤵
                                                                                  PID:4792
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3596,i,5097469280137659666,4763601647568441978,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
                                                                                  2⤵
                                                                                  • Modifies registry class
                                                                                  PID:3732
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,12138367424878021731,4904292418398456469,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6120 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4380
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,11440721338394364716,354786988143871652,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:8
                                                                                    2⤵
                                                                                      PID:3128
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,4505477723079689148,17955027845284424462,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:8
                                                                                      2⤵
                                                                                        PID:760
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6216,i,4731321322120527235,8922647868828433169,2097152 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3408
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,1574647944382202145,15624733687725765595,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6404 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4260
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6528,i,8611352792818018897,6085335906676962733,2097152 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6500 /prefetch:1
                                                                                            2⤵
                                                                                              PID:3392
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6696,i,9290615445434434681,15024838549393787971,524288 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6688 /prefetch:8
                                                                                              2⤵
                                                                                                PID:3752
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6476,i,14239667775906452455,18342461299424944237,262144 --field-trial-handle=1932,i,17498840850545863854,15404133881497036305,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:8
                                                                                                2⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:3300
                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                              1⤵
                                                                                                PID:2420
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                1⤵
                                                                                                  PID:2272
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                  1⤵
                                                                                                    PID:4904
                                                                                                  • C:\Program Files\7-Zip\7zG.exe
                                                                                                    "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap13483:58:7zEvent8995 -t7z -sae -- "C:\Users\Admin\Downloads\ff.7z"
                                                                                                    1⤵
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:4452
                                                                                                  • C:\Users\Admin\Downloads\ff\Server.exe
                                                                                                    "C:\Users\Admin\Downloads\ff\Server.exe"
                                                                                                    1⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4848
                                                                                                    • C:\Windows\svchost.exe
                                                                                                      "C:\Windows\svchost.exe"
                                                                                                      2⤵
                                                                                                      • Drops startup file
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:3676
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh firewall add allowedprogram "C:\Windows\svchost.exe" "svchost.exe" ENABLE
                                                                                                        3⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:5100
                                                                                                  • C:\Windows\svchost.exe
                                                                                                    "C:\Windows\svchost.exe" ..
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4348
                                                                                                  • C:\Users\Admin\Downloads\ff\rx.exe
                                                                                                    "C:\Users\Admin\Downloads\ff\rx.exe"
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4072
                                                                                                    • C:\Users\Admin\Downloads\ff\rx.exe
                                                                                                      "C:\Users\Admin\Downloads\ff\rx.exe"
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      PID:3760
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "ver"
                                                                                                        3⤵
                                                                                                          PID:176
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                          3⤵
                                                                                                            PID:4200
                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                              tasklist
                                                                                                              4⤵
                                                                                                              • Enumerates processes with tasklist
                                                                                                              PID:1904
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "net user hello helloworld /add"
                                                                                                            3⤵
                                                                                                              PID:4500
                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                net user hello helloworld /add
                                                                                                                4⤵
                                                                                                                  PID:1984
                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                    C:\Windows\system32\net1 user hello helloworld /add
                                                                                                                    5⤵
                                                                                                                      PID:2984
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "net localgroup Administrators hello /add"
                                                                                                                  3⤵
                                                                                                                    PID:2452
                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                      net localgroup Administrators hello /add
                                                                                                                      4⤵
                                                                                                                        PID:4992
                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                          C:\Windows\system32\net1 localgroup Administrators hello /add
                                                                                                                          5⤵
                                                                                                                            PID:1180

                                                                                                                  Network

                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                        Reconnaissance

                                                                                                                        Resource Development

                                                                                                                        Initial Access

                                                                                                                        Execution

                                                                                                                        Persistence

                                                                                                                        Account Manipulation

                                                                                                                        1
                                                                                                                        T1098

                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                        1
                                                                                                                        T1547

                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                        1
                                                                                                                        T1547.001

                                                                                                                        Create or Modify System Process

                                                                                                                        1
                                                                                                                        T1543

                                                                                                                        Windows Service

                                                                                                                        1
                                                                                                                        T1543.003

                                                                                                                        Event Triggered Execution

                                                                                                                        1
                                                                                                                        T1546

                                                                                                                        Netsh Helper DLL

                                                                                                                        1
                                                                                                                        T1546.007

                                                                                                                        Privilege Escalation

                                                                                                                        Account Manipulation

                                                                                                                        1
                                                                                                                        T1098

                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                        1
                                                                                                                        T1547

                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                        1
                                                                                                                        T1547.001

                                                                                                                        Create or Modify System Process

                                                                                                                        1
                                                                                                                        T1543

                                                                                                                        Windows Service

                                                                                                                        1
                                                                                                                        T1543.003

                                                                                                                        Event Triggered Execution

                                                                                                                        1
                                                                                                                        T1546

                                                                                                                        Netsh Helper DLL

                                                                                                                        1
                                                                                                                        T1546.007

                                                                                                                        Defense Evasion

                                                                                                                        Impair Defenses

                                                                                                                        1
                                                                                                                        T1562

                                                                                                                        Disable or Modify System Firewall

                                                                                                                        1
                                                                                                                        T1562.004

                                                                                                                        Indicator Removal

                                                                                                                        1
                                                                                                                        T1070

                                                                                                                        Network Share Connection Removal

                                                                                                                        1
                                                                                                                        T1070.005

                                                                                                                        Modify Registry

                                                                                                                        2
                                                                                                                        T1112

                                                                                                                        Credential Access

                                                                                                                        Credentials from Password Stores

                                                                                                                        1
                                                                                                                        T1555

                                                                                                                        Credentials from Web Browsers

                                                                                                                        1
                                                                                                                        T1555.003

                                                                                                                        Unsecured Credentials

                                                                                                                        3
                                                                                                                        T1552

                                                                                                                        Credentials In Files

                                                                                                                        3
                                                                                                                        T1552.001

                                                                                                                        Discovery

                                                                                                                        Browser Information Discovery

                                                                                                                        1
                                                                                                                        T1217

                                                                                                                        Peripheral Device Discovery

                                                                                                                        1
                                                                                                                        T1120

                                                                                                                        Permission Groups Discovery

                                                                                                                        1
                                                                                                                        T1069

                                                                                                                        Local Groups

                                                                                                                        1
                                                                                                                        T1069.001

                                                                                                                        Process Discovery

                                                                                                                        1
                                                                                                                        T1057

                                                                                                                        Query Registry

                                                                                                                        4
                                                                                                                        T1012

                                                                                                                        System Information Discovery

                                                                                                                        5
                                                                                                                        T1082

                                                                                                                        System Location Discovery

                                                                                                                        1
                                                                                                                        T1614

                                                                                                                        System Language Discovery

                                                                                                                        1
                                                                                                                        T1614.001

                                                                                                                        System Time Discovery

                                                                                                                        1
                                                                                                                        T1124

                                                                                                                        Lateral Movement

                                                                                                                        Collection

                                                                                                                        Data from Local System

                                                                                                                        2
                                                                                                                        T1005

                                                                                                                        Command and Control

                                                                                                                        Web Service

                                                                                                                        1
                                                                                                                        T1102

                                                                                                                        Exfiltration

                                                                                                                        Impact

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        459441a5-1a5b-4a53-9224-39d8c1d75ba6.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\459441a5-1a5b-4a53-9224-39d8c1d75ba6.tmp
                                                                                                                        • Size 6B
                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        BrowsingTopicsState
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                        • Size 414B
                                                                                                                        • SHA256 68078ec22e9323b621426aa15530d338b64ef261078f888680c5040bb2dc36e0
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        the-real-index
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                        • Size 1KB
                                                                                                                        • SHA256 0f5e629e5abae9cbd11830571bc9f7fddb3d761c1361442625ec06533703b24a
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        the-real-index
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                        • Size 1KB
                                                                                                                        • SHA256 f7ea528b34d72dd447fff70cbd8c966a78d0fdf7fea1ceee3c89548604eb7e6f
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        MANIFEST-000001
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_app.mediafire.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                        • Size 23B
                                                                                                                        • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        Network Persistent State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                        • Size 12KB
                                                                                                                        • SHA256 9185e15f61db56bbf2d706db5f1541ea24583c31f8ba43f183d51ae82f34f4c1
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Network Persistent State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                        • Size 11KB
                                                                                                                        • SHA256 a04ece9a8b22cacd3afef1f54165adbb223edeca3855d12378b2bfa36ba8d6fc
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        • Size 13KB
                                                                                                                        • SHA256 78b098014eb5c3bf28116b6465a059b8697e8bbc2cb74ec0cd35120dd1e20e71
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        • Size 13KB
                                                                                                                        • SHA256 e2949cdc65e42a78b523db4ee5ec10674be9b6a88bb5a8ac15ec6241501e4b7c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        • Size 11KB
                                                                                                                        • SHA256 b365301415181d720f0f7c66e5c1662ce2a333233ba94f237fe422f0f38786f9
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        • Size 12KB
                                                                                                                        • SHA256 c48aafb28e6021a6f38f310bf6f7711935648ced1e81508da344a4bc02b2ed78
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        • Size 13KB
                                                                                                                        • SHA256 d486620db489cf38b4dfa9d95e7226bc03c0f280594b67d69e1484d54f2d1d39
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        • Size 13KB
                                                                                                                        • SHA256 f0e10d42e8b50946e287bfc3a4dc01220479e7a92bcc6b1312f1bcdf6e3cde16
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        • Size 13KB
                                                                                                                        • SHA256 898418ef69d3af255457d21707480f3a415673de01055026646b631879cf333e
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Secure Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                        • Size 13KB
                                                                                                                        • SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        the-real-index
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                        • Size 72B
                                                                                                                        • SHA256 fdd1dc48cf5043f3bf94aa5036609f9892a3e7a28b6336c06cb166d99a8cc0cd
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        Local State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        • Size 233KB
                                                                                                                        • SHA256 42127f5e7ac7a544de0a555c8d302a47fb3a61fa46c365bd8e3169b9601d3987
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Local State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        • Size 115KB
                                                                                                                        • SHA256 2980456b56911da815ee8f314e32f05d632cf4fdf2e0d5c9ca7f436f34146ce0
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Local State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        • Size 232KB
                                                                                                                        • SHA256 038e4a50b5ef4a500e3223ae4a1962e53bac78cb43f64c047ddf4265d3e3704a
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Local State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        • Size 233KB
                                                                                                                        • SHA256 173f4d12aa95ff9f46ba45c26e95f3b4323ce14c3c8345194b846a704843b105
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Local State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        • Size 232KB
                                                                                                                        • SHA256 43224a432830e0f38e82ddba0bd13c23e7a2e0566baddb365e78799d086d9459
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        2b089c9a-80da-4148-80dd-3a75b243b7d6.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b089c9a-80da-4148-80dd-3a75b243b7d6.tmp
                                                                                                                        • Size 8KB
                                                                                                                        • SHA256 4ed210def6083d9212fb39465e10e1c93d74cf789c717de6d25943d20d98b19c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        CrashpadMetrics-active.pma
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
                                                                                                                        • Size 16KB
                                                                                                                        • SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        settings.dat
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                        • Size 280B
                                                                                                                        • SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        settings.dat
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                        • Size 280B
                                                                                                                        • SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        settings.dat
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                        • Size 280B
                                                                                                                        • SHA256 d74a70b1aa9f701b866531cf627b0340a0fcdda29420f3ad31d57737cd1617dc
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        MANIFEST-000001
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                                        • Size 41B
                                                                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        the-real-index
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                        • Size 3KB
                                                                                                                        • SHA256 0a3e42e3d40814708b98323f1e8c98c0a8853d37ac0003330b3a5e98ec1e73e6
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        the-real-index~RFe5d6881.TMP
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5d6881.TMP
                                                                                                                        • Size 3KB
                                                                                                                        • SHA256 d658c47e1081a16eb8ea61e8474f5da8c9a757a3635026510f7cdba65ec5363b
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        Edge Profile.ico
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                        • Size 70KB
                                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        CURRENT
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
                                                                                                                        • Size 16B
                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        Network Persistent State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                        • Size 1KB
                                                                                                                        • SHA256 93c465b42e31a685ddec0976f0749b2577e3b33f24b9f9ad41ff0e9ec0abdb9c
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        SCT Auditing Pending Reports
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                        • Size 2B
                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                        • Size 13KB
                                                                                                                        • SHA256 fe5bb16b057bfd0bbc842bf78f4468639a1e45a58669a06ad12467d04e47f8c1
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Secure Preferences
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                        • Size 35KB
                                                                                                                        • SHA256 6bb46c06125dc71d150de05168c8024dd355ea3760a7eb37b5eee603f7d73f6d
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Local State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                        • Size 8KB
                                                                                                                        • SHA256 f8ae6a80a6187de5f7bc51a6f214e2dfe1421a0d089c80334248be1040649c2b
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Local State
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                        • Size 25KB
                                                                                                                        • SHA256 27792821c5cea1df65a59691064bfacbf8b9fa9c0d25326edc0b8edb746d3572
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        data_1
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                                                        • Size 264KB
                                                                                                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                        Submit Download

                                                                                                                        d0f90ff6-c4de-4496-9651-f5d822daac23.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d0f90ff6-c4de-4496-9651-f5d822daac23.tmp
                                                                                                                        • Size 13B
                                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                        • Size 2KB
                                                                                                                        • SHA256 9e9530f4d082d4cedb6c2f9f23abb06325e47472590f05cf587618a821d75536
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        Server.exe
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                        • Size 29KB
                                                                                                                        • SHA256 87ec5cdddd906be81994736e2347c17d88850165c8231dd28045e3ad2a8658fc
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        VCRUNTIME140.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\VCRUNTIME140.dll
                                                                                                                        • Size 116KB
                                                                                                                        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        _bz2.pyd
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_bz2.pyd
                                                                                                                        • Size 82KB
                                                                                                                        • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        _ctypes.pyd
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_ctypes.pyd
                                                                                                                        • Size 121KB
                                                                                                                        • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        _lzma.pyd
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_lzma.pyd
                                                                                                                        • Size 155KB
                                                                                                                        • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
                                                                                                                        • Size 216KB
                                                                                                                        • SHA256 fc17eb621ecf2325e3c2d7501d3ee2c3848e3c7fec7027fda7c7fa1782874743
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-console-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-console-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 869ec6bc79d1da594b0db2cfa510472ca781ffd826acbe7716198415ea3a3605
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 60675dfc2cb2af87456032d28d454baa4821d6b1921cb03f12a2891def445fd6
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-debug-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-debug-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 3182765b6cae55cf4c67b9cb5b6f0b037f323585950ff9b6301b59e5e5acf780
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 3746169e2226c52c7b930bbffc8f3e263283d559d3237c4e193cbb07abaced1c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-fibers-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-fibers-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 7ad9720c4999b88c8b8db1dcb1ee765f374900b489b2f09bb40e4951b68b0aab
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-fibers-l1-1-1.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-fibers-l1-1-1.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 6599741ffe12d3e90ef2b456b64cee90425ff995bc0d1c3cd9c754ddba6697ae
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-file-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-file-l1-1-0.dll
                                                                                                                        • Size 25KB
                                                                                                                        • SHA256 3a7bdd492a945a962eb18f486ae7bcddc2bbd5b43a12eb461057a6cdc5657f5f
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-file-l1-2-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-file-l1-2-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 1b384401b534ca9a61dce7f51c8d54b9eabb625f86569bf09e449be5724c6ca0
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-file-l2-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-file-l2-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 1d2f1efefd0a802190f0257aac7e1589d08ffbaea550c561c69c1827e57b55e7
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-handle-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-handle-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 819976a22a6648536ba0c184d80d093d867d513849baa8f7011fade104a7f8c0
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-heap-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-heap-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 83ca55315263d7a42d16cf032e67b79359052321c43c5df97d687c2f4d84a79c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 7e32a4463c99e54dd1366658b4284020e1a3384c4c366761116309dae49ee831
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-kernel32-legacy-l1-1-1.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-kernel32-legacy-l1-1-1.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 82bb3c053e3c8f4ed9127d3a4d0d5bea73d13b98a023073ea0f039ca96405c09
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 c29c1592af0578c58f2f37e77a044573e8c9fda4daba184c3ac5032b061693a5
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-localization-l1-2-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-localization-l1-2-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 2fb638be18863ef6077fef2b7f4ebda92527b8e19d2e5b39eba27b3bf96a7fed
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-memory-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-memory-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 7aacd77d48b5a7595c59ef95c09d65bd9ee6644206b0878a8108398563b09515
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 c184419f20f5ea131239e627dcad237da804a5fd21b446846f5c0d60b06a7b49
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 9ab3de163dd167a9423946c308a6f225e22172e8547ccf154e0269d258588df7
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 f5b2cd5c8fbe89ac55a09b6939cfacdd0861ff47e1fc3df300412603fa96e00b
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 5a3d41a750d1d6714232448193e57ab7d8fd718ba9cec24c7afc71f69886dae3
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-profile-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-profile-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 23a1324112574ad2f7d903a881592354e8fe915ba3086e830b9dc49cfbf7154c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 17423b1dfc0d5c9246a1b4c50bce5af931b186ad66268761b2611e611d9adbb3
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-string-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-string-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 ac5a66b65ead96dfbc63afd947601bd276c1c5ede2a7acc0d580b02ef104892a
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-synch-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-synch-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 2d577cdae281cd49141a87340d21ee3b372a297ef9ce35e82cf449dd352f380d
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-synch-l1-2-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-synch-l1-2-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 220a7cee500b92a005b58d45006b1b98545fcd2040dda5d3d750fe2e6de5c62b
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 371442d516a47a8949945f85c6bb0fe3c3b88731de07a4ff457c2b041c928cfd
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-sysinfo-l1-2-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-sysinfo-l1-2-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 da65cf54767305c74eaf35e39ac8b7ff472c2df5e22a84e4fc465e2448d2fea3
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 9dae313de05c31ab6583545323e422dd1bdaec4aa26e81cbea0d5b69b632fd0c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-core-util-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-core-util-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 d627df017ddcf7472c761f9796cb55fc7a2347f05cc897bf6c7c29aee8e4dd0c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 4324863a74391b29229e5376020de3e1a04f436abbd4604e305307fde4601fa7
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                        • Size 25KB
                                                                                                                        • SHA256 6f997e4a9837f42295fa25f45cb564f5efa93c99768e2a2e2643008ecffe97b0
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 3c0893659c504d16984d6b87c61c98fa050d60473ff77e294f69fdb7fae155bb
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 924099811552d0e9623d220fd9f9348a14d44ef08694a15d442010193574b1fe
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 2cfc2c7c376630b595e3582ccd2dda019f82ae5dc1665d34d3621e2c62e1a868
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 3c2bc1ebdcb4c6fedefc5b82419a1a4b5ba035c3f5453e9d083dccdbfe2d9e95
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-math-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-math-l1-1-0.dll
                                                                                                                        • Size 29KB
                                                                                                                        • SHA256 930fbbcfd3fbd97bfc2c0174f059ff48f33fa54274e409ed6d629a7230e45aa0
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-process-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-process-l1-1-0.dll
                                                                                                                        • Size 21KB
                                                                                                                        • SHA256 4efdca4ac7819401a586e2abebc3b858ba8ba0b13ad296c6afacd583500f2575
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                        • Size 25KB
                                                                                                                        • SHA256 5e9837abf4517eb8f74edcf7ea08a3d32916e253d9c24663869dda40cf7b0280
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                        • Size 25KB
                                                                                                                        • SHA256 f2a7e41ededd62b2c192fe6381c8cc33f9bd223164ffc8b38623c9220c009ccb
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        api-ms-win-crt-string-l1-1-0.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\api-ms-win-crt-string-l1-1-0.dll
                                                                                                                        • Size 25KB
                                                                                                                        • SHA256 0b337649b564a760abb57e21fb2a755cff080a604034b71c3e8a3cc48c7da71d
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        base_library.zip
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\base_library.zip
                                                                                                                        • Size 1.4MB
                                                                                                                        • SHA256 a1547257bdcfcfd9a17d36d12d37e2b57ddc778fabd043c7b3e0490057d33dc3
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        libffi-8.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\libffi-8.dll
                                                                                                                        • Size 38KB
                                                                                                                        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        python3.DLL
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\python3.DLL
                                                                                                                        • Size 65KB
                                                                                                                        • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        python311.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\python311.dll
                                                                                                                        • Size 5.5MB
                                                                                                                        • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        ucrtbase.dll
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\ucrtbase.dll
                                                                                                                        • Size 1.3MB
                                                                                                                        • SHA256 d404dc9aa843d53d7e276dd078b2cac8d7aa905e2838a1fe8385278e19ba3810
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        crpasswords.csv
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\crpasswords.csv
                                                                                                                        • Size 23B
                                                                                                                        • SHA256 0301dcea0b7420ce981cc8379ba365e251c06f2e26cda7a69e4173785caba3fc
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        e28602c4-51c5-4e5a-b37f-6105c073763c.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\e28602c4-51c5-4e5a-b37f-6105c073763c.tmp
                                                                                                                        • Size 1B
                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                        Submit Download

                                                                                                                        e3238468-2036-477f-b8fa-c8ac5ec9b85e.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\e3238468-2036-477f-b8fa-c8ac5ec9b85e.tmp
                                                                                                                        • Size 10KB
                                                                                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        rx.exe
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\rx.exe
                                                                                                                        • Size 19.6MB
                                                                                                                        • SHA256 39c0f411e84820bdec8bdb966b7613c4cc4d506b4525780e72092f550fdae499
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        content_new.js
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1540_197692209\CRX_INSTALL\content_new.js
                                                                                                                        • Size 10KB
                                                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        1d2f0758-9ee2-47bb-b2d5-770c55e7f0fd.tmp
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1540_833176004\1d2f0758-9ee2-47bb-b2d5-770c55e7f0fd.tmp
                                                                                                                        • Size 152KB
                                                                                                                        • SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        tmp069hynyj.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp069hynyj.db
                                                                                                                        • Size 160KB
                                                                                                                        • SHA256 f847694de9ce17d5e20a4a05058766e675f8db1ecd6bc4a3181dbf519c51ffca
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        tmp3yij_ab2.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp3yij_ab2.db
                                                                                                                        • Size 204KB
                                                                                                                        • SHA256 2a169c44505968dd1f6dcc58c0821dbba6451eac5481ebbb3399eb407390eb7f
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        tmpabzpj9i2.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpabzpj9i2.db
                                                                                                                        • Size 204KB
                                                                                                                        • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        tmpffecg2c5.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpffecg2c5.db
                                                                                                                        • Size 160KB
                                                                                                                        • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        tmpq8aktyoh.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpq8aktyoh.db
                                                                                                                        • Size 56KB
                                                                                                                        • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        tmprakfpv5y.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmprakfpv5y.db
                                                                                                                        • Size 40KB
                                                                                                                        • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Tempcrcecvbvko.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Tempcrcecvbvko.db
                                                                                                                        • Size 138KB
                                                                                                                        • SHA256 8557f90c38f7d05792217c45dae6269a0f753e652f283c29ad5a574de99ef36b
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Tempcrkoymiish.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Tempcrkoymiish.db
                                                                                                                        • Size 138KB
                                                                                                                        • SHA256 bd82e0aca787d95e320c98c1e8faa344e2022cac6683c678c6f2c9b6eacdb36f
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Tempcrxszmjopy.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Tempcrxszmjopy.db
                                                                                                                        • Size 224KB
                                                                                                                        • SHA256 58042d6e80351bbb46a34189b9202cfa1b3a3df5b0d01da5e851a504f7e1e863
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        Tempcrylpclzle.db
                                                                                                                        • Path C:\Users\Admin\AppData\Local\Tempcrylpclzle.db
                                                                                                                        • Size 224KB
                                                                                                                        • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                        Submit Download

                                                                                                                        b8ab77100df80ab2.customDestinations-ms
                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                                                                                                                        • Size 1KB
                                                                                                                        • SHA256 6f4d0ce32bd4a7cc665b2cc3fc08d2ed889fdb2384212eb3a12b4cf19a8fb112
                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                        Submit Download

                                                                                                                        memory/1680-366-0x00007FF695FD0000-0x00007FF696037000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/1680-294-0x00007FF695FD0000-0x00007FF696037000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2200-2-0x0000000003FB0000-0x0000000003FC0000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2200-3-0x0000000003FB0000-0x0000000003FC0000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2744-295-0x00007FF695FD0000-0x00007FF696037000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/2744-367-0x00007FF695FD0000-0x00007FF696037000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4112-0-0x0000000000220000-0x0000000001598000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4112-1-0x0000000004230000-0x0000000004240000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-307-0x00007FF899C10000-0x00007FF899C20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-358-0x00007FF899C10000-0x00007FF899C20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-313-0x00007FF897A10000-0x00007FF897A20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-312-0x00007FF897A10000-0x00007FF897A20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-311-0x00007FF899C10000-0x00007FF899C20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-310-0x00007FF899C10000-0x00007FF899C20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-308-0x00007FF899C10000-0x00007FF899C20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-309-0x00007FF899C10000-0x00007FF899C20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-361-0x00007FF899C10000-0x00007FF899C20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-359-0x00007FF899C10000-0x00007FF899C20000-memory.dmp
                                                                                                                        Download

                                                                                                                        memory/4460-360-0x00007FF899C10000-0x00007FF899C20000-memory.dmp
                                                                                                                        Download