stealc | 985a44d984f243c46472dc17929b2f80da6bbe41f88f5e84d8d103c47e00d70c

Analysis

max time kernel
29s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe
Size 46.8MB
Sample260722-baafqahb95
SHA256 985a44d984f243c46472dc17929b2f80da6bbe41f88f5e84d8d103c47e00d70c
MD5 93c5243299f263b2d431b5176761eda6
SHA1 0a527e0be4d552365c94e51977268b79d6a5b28e
SHA512 cb65b78b3b1d00061904b24647e3844540aaac17d90aab2d79a34b457f1279c917ee48a9b9ccec10b9218ea41eac601bacbf79873b4cb05cc9633933f11b2c48
SSDEEP 786432:lozIju2YZeEkloEI4D2Zse5rVBfkMLcDfR85wh57+bDhHtuCEwBDkFgbyYlrE+Ek:TwZK7be5rDZ+p8565+n5t8ebyYBENiiF
TLSH
T1EFB7335EB3E9B751D40B1CB04161F420C6BDE97AD0A2679FDBD1EB602B7A6081C3DE42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

run discovery downloader execution stealc svcstealer installer persistence stealer

Malware Config

Extracted

Family

stealc

Botnet

http://196.251.107.163

rc4.plain

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://196.251.107.163/bioxp/post.php

Attributes

build_id
Dropped
srv_delay
1
srv_retry
1

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects Reflective DLL injection artifacts 6 IoCs

resource	yara_rule
behavioral2/memory/4324-128-0x000002217F8D0000-0x000002217F8D3000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/6408-149-0x0000000003B70000-0x0000000003BB5000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/6408-195-0x0000000005110000-0x0000000005155000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/6408-623-0x0000000005560000-0x00000000055A5000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/6408-653-0x0000000003800000-0x0000000003845000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/6408-692-0x0000000003710000-0x0000000003755000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c528-9.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c52f-104.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c528-9.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c529-18.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Downloads MZ/PE file 1 IoCs

flow	pid	Process
41	2828	givvabvm.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	WinSysKdrv.exe

Executes dropped EXE 15 IoCs

pid	Process
6732	sdtp6jps.exe
2072	54quxu20.exe
524	WinSysKdrv.exe
3060	WindsurfChecker.exe
3596	EmbeddedDriverService.sys
4944	kxn3adjy.exe
2160	WindsurfChecker.exe
6688	kxn3adjy.tmp
5380	hg69t8ln.exe
2828	givvabvm.exe
6720	4zmz13b4.exe
6600	winhost.exe
6944	chmpc.exe
1356	chmpc.exe
4084	ce985mkl.exe

Loads dropped DLL 41 IoCs

pid	Process
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
6688	kxn3adjy.tmp
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe
2160	WindsurfChecker.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Component Manager = "C:\\Users\\Admin\\AppData\\Roaming\\evogv\\chmpc.exe"	hg69t8ln.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\deafdaaefccc = "\"C:\\ProgramData\\deafdaaefccc.exe\""	ce985mkl.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7112	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kxn3adjy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kxn3adjy.tmp

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1412	chrome.exe
4532	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c525-59.dat	innosetup
behavioral2/memory/4944-60-0x0000000000CB0000-0x0000000000DB6000-memory.dmp	innosetup
behavioral2/memory/4944-201-0x0000000000CB0000-0x0000000000DB6000-memory.dmp	innosetup
behavioral2/memory/3504-612-0x00000000007C0000-0x00000000008C6000-memory.dmp	innosetup
behavioral2/memory/3504-629-0x00000000007C0000-0x00000000008C6000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sdtp6jps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sdtp6jps.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6900	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2160	WindsurfChecker.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
6732	sdtp6jps.exe
2828	givvabvm.exe
2828	givvabvm.exe
5380	hg69t8ln.exe
5380	hg69t8ln.exe
6944	chmpc.exe
6944	chmpc.exe
5292	chrome.exe
5292	chrome.exe
4084	ce985mkl.exe
4084	ce985mkl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2160	WindsurfChecker.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
524	WinSysKdrv.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
5292	chrome.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe
Token: SeDebugPrivilege	524	WinSysKdrv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5292	chrome.exe
1620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 6732	2536	2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe	90
PID 2536 wrote to memory of 2072	2536	2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe	91
PID 2536 wrote to memory of 3060	2536	2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe	95
PID 2536 wrote to memory of 4944	2536	2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe	97
PID 3060 wrote to memory of 2160	3060	WindsurfChecker.exe	98
PID 4944 wrote to memory of 6688	4944	kxn3adjy.exe	99
PID 2536 wrote to memory of 5380	2536	2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe	100
PID 5380 wrote to memory of 2408	5380	hg69t8ln.exe	101
PID 2536 wrote to memory of 2828	2536	2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe	102
PID 2536 wrote to memory of 6720	2536	2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe	104
PID 2828 wrote to memory of 4324	2828	givvabvm.exe	59
PID 2828 wrote to memory of 4388	2828	givvabvm.exe	60
PID 2828 wrote to memory of 4972	2828	givvabvm.exe	81
PID 2828 wrote to memory of 6408	2828	givvabvm.exe	82
PID 6408 wrote to memory of 3012	6408	explorer.exe
PID 5380 wrote to memory of 7108	5380	hg69t8ln.exe	106
PID 5380 wrote to memory of 6900	5380	hg69t8ln.exe	109
PID 5380 wrote to memory of 6408	5380	hg69t8ln.exe	82
PID 5380 wrote to memory of 6408	5380	hg69t8ln.exe	82
PID 6408 wrote to memory of 3240	6408	explorer.exe
PID 6944 wrote to memory of 1084	6944	chmpc.exe	113
PID 2160 wrote to memory of 7112	2160	WindsurfChecker.exe	115
PID 6944 wrote to memory of 6408	6944	chmpc.exe	82
PID 6944 wrote to memory of 6408	6944	chmpc.exe	82
PID 6732 wrote to memory of 5292	6732	sdtp6jps.exe	118
PID 5292 wrote to memory of 1068	5292	chrome.exe	119
PID 6732 wrote to memory of 5292	6732	sdtp6jps.exe	118
PID 5292 wrote to memory of 6656	5292	chrome.exe	121
PID 5292 wrote to memory of 6656	5292	chrome.exe	121
PID 5292 wrote to memory of 1412	5292	chrome.exe	122
PID 5292 wrote to memory of 2148	5292	chrome.exe	123
PID 5292 wrote to memory of 4336	5292	chrome.exe	124
PID 5292 wrote to memory of 6224	5292	chrome.exe	125
PID 5292 wrote to memory of 1064	5292	chrome.exe	126
PID 5292 wrote to memory of 2148	5292	chrome.exe	123
PID 5292 wrote to memory of 4336	5292	chrome.exe	124
PID 5292 wrote to memory of 6224	5292	chrome.exe	125
PID 5292 wrote to memory of 5060	5292	chrome.exe	127
PID 5292 wrote to memory of 1064	5292	chrome.exe	126
PID 5292 wrote to memory of 5060	5292	chrome.exe	127
PID 5292 wrote to memory of 5320	5292	chrome.exe	128
PID 5292 wrote to memory of 5320	5292	chrome.exe	128
PID 5292 wrote to memory of 1300	5292	chrome.exe	129
PID 5292 wrote to memory of 1300	5292	chrome.exe	129
PID 5292 wrote to memory of 3256	5292	chrome.exe	131
PID 5292 wrote to memory of 3256	5292	chrome.exe	131
PID 6732 wrote to memory of 1620	6732	sdtp6jps.exe	132
PID 1620 wrote to memory of 2636	1620	msedge.exe	133
PID 6732 wrote to memory of 1620	6732	sdtp6jps.exe	132
PID 1620 wrote to memory of 4532	1620	msedge.exe	135
PID 1620 wrote to memory of 4780	1620	msedge.exe	136
PID 1620 wrote to memory of 4780	1620	msedge.exe	136
PID 1620 wrote to memory of 4780	1620	msedge.exe	136
PID 1620 wrote to memory of 2332	1620	msedge.exe	137
PID 1620 wrote to memory of 2332	1620	msedge.exe	137
PID 1620 wrote to memory of 6128	1620	msedge.exe	138
PID 1620 wrote to memory of 4684	1620	msedge.exe	139
PID 1620 wrote to memory of 6128	1620	msedge.exe	138
PID 1620 wrote to memory of 6128	1620	msedge.exe	138
PID 1620 wrote to memory of 4684	1620	msedge.exe	139
PID 1620 wrote to memory of 4684	1620	msedge.exe	139
PID 1620 wrote to memory of 4720	1620	msedge.exe	140
PID 1620 wrote to memory of 4720	1620	msedge.exe	140
PID 1620 wrote to memory of 4720	1620	msedge.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4972
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6408
- - C:\Users\Admin\AppData\Local\Temp\2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-21_93c5243299f263b2d431b5176761eda6_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\sdtp6jps.exe
      C:\Users\Admin\AppData\Local\Temp\sdtp6jps.exe
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:6732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5292
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc5d24c728,0x7ffc5d24c734,0x7ffc5d24c740
        6⤵
        
        PID:1068
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1888 /prefetch:2
        6⤵
        
        PID:6656
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2524 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:1412
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3164 /prefetch:13
        6⤵
        
        PID:2148
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3696 /prefetch:1
        6⤵
        
        PID:4336
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3732 /prefetch:1
        6⤵
        
        PID:6224
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3752 /prefetch:9
        6⤵
        
        PID:1064
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3676 /prefetch:1
        6⤵
        
        PID:5060
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3868 /prefetch:9
        6⤵
        
        PID:5320
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4748 /prefetch:9
        6⤵
        
        PID:1300
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1892,i,7240146301141116567,6083885464537481340,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4340 /prefetch:1
        6⤵
        
        PID:3256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1620240742718 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1620240742718\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffc5c46c188,0x7ffc5c46c194,0x7ffc5c46c1a0
        6⤵
        
        PID:2636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2412 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4532
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2380 /prefetch:2
        6⤵
        
        PID:4780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2632 /prefetch:13
        6⤵
        
        PID:2332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3496 /prefetch:1
        6⤵
        
        PID:6128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3488 /prefetch:1
        6⤵
        
        PID:4684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3992 /prefetch:1
        6⤵
        
        PID:4720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4000 /prefetch:9
        6⤵
        
        PID:2900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4016 /prefetch:1
        6⤵
        
        PID:2744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4348 /prefetch:9
        6⤵
        
        PID:4680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4412 /prefetch:1
        6⤵
        
        PID:6560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4572 /prefetch:9
        6⤵
        
        PID:3360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4424 /prefetch:9
        6⤵
        
        PID:2700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4380 /prefetch:1
        6⤵
        
        PID:5628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3428 /prefetch:9
        6⤵
        
        PID:2676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5612 /prefetch:9
        6⤵
        
        PID:2604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5756 /prefetch:9
        6⤵
        
        PID:6664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5792 /prefetch:9
        6⤵
        
        PID:2868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5944 /prefetch:9
        6⤵
        
        PID:396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6828 /prefetch:1
        6⤵
        
        PID:6500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,2245283523677729681,6913786402953684225,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5056 /prefetch:14
        6⤵
        
        PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\54quxu20.exe
      "C:\Users\Admin\AppData\Local\Temp\54quxu20.exe"
      4⤵
      Executes dropped EXE
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\WindsurfChecker.exe
      "C:\Users\Admin\AppData\Local\Temp\WindsurfChecker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\WindsurfChecker.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindsurfChecker.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:2160
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        Executes a command shell one-liner
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\kxn3adjy.exe
      C:\Users\Admin\AppData\Local\Temp\kxn3adjy.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\is-Q35XMVAI9U.tmp\kxn3adjy.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-Q35XMVAI9U.tmp\kxn3adjy.tmp" /SL5="$400A0,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\kxn3adjy.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\hg69t8ln.exe
      "C:\Users\Admin\AppData\Local\Temp\hg69t8ln.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5380
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
        5⤵
        
        PID:2408
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security Scanner"
        5⤵
        
        PID:7108
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security Scanner" /tr "C:\Users\Admin\AppData\Roaming\evogv\chmpc.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\givvabvm.exe
      "C:\Users\Admin\AppData\Local\Temp\givvabvm.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\cnojgzob.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cnojgzob.exe"
        5⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\is-TJFKNOVOK4.tmp\cnojgzob.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TJFKNOVOK4.tmp\cnojgzob.tmp" /SL5="$C0114,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\cnojgzob.exe"
        6⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\4zmz13b4.exe
      C:\Users\Admin\AppData\Local\Temp\4zmz13b4.exe
      4⤵
      Executes dropped EXE
      PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\ce985mkl.exe
      "C:\Users\Admin\AppData\Local\Temp\ce985mkl.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      PID:4084
- - C:\Windows\system32\notepad.exe
    C:\Windows\system32\notepad.exe
    3⤵
    PID:7024
- - C:\Windows\system32\notepad.exe
    C:\Windows\system32\notepad.exe
    3⤵
    PID:6268

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
- Executes dropped EXE
PID:3596

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:6600

C:\Users\Admin\AppData\Roaming\evogv\chmpc.exe
C:\Users\Admin\AppData\Roaming\evogv\chmpc.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6944
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:1084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6952

C:\Users\Admin\AppData\Roaming\evogv\chmpc.exe
"C:\Users\Admin\AppData\Roaming\evogv\chmpc.exe"
1⤵
- Executes dropped EXE
PID:1356
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:5448

C:\ProgramData\deafdaaefccc.exe
"C:\ProgramData\deafdaaefccc.exe"
1⤵
PID:6112

C:\Users\Admin\AppData\Local\Temp\ce985mkl.exe
"C:\Users\Admin\AppData\Local\Temp\ce985mkl.exe"
1⤵
PID:2968

C:\Users\Admin\AppData\Roaming\evogv\chmpc.exe
"C:\Users\Admin\AppData\Roaming\evogv\chmpc.exe"
1⤵
PID:3728
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:4880

C:\Users\Admin\AppData\Roaming\evogv\chmpc.exe
"C:\Users\Admin\AppData\Roaming\evogv\chmpc.exe"
1⤵
PID:2524
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4zmz13b4.exe

Path C:\Users\Admin\AppData\Local\Temp\4zmz13b4.exe
Size 771KB
SHA256 2e76d6a4c45848c9a1bbe5ffdf3b6a17050789b50b27584b8b2ca850ee022987
MD5 51281be022faea9c9a00e0b324a11ecc
SHA1 28528684dc899c00f00a95541d767da2fe5bda55
SHA512 d277bf12f8b6b8a07bc874023eb50913b2b666760e81158e24b5de61943676a934df6de7a79b1102ee71eac30506463596788356cfb9c5eb392058b92d097aa1
SSDEEP 12288:fJmtSx7mW7LciwFZnlMf6r60dMIGyxBlDetAqxSvSc:RZ7n74iwFZlC6+6MIGybq
TLSH
T199F49D1AF7A502FCD07BC175CA524952EB72B8565330A78F03E14AA61F376A05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54quxu20.exe

Path C:\Users\Admin\AppData\Local\Temp\54quxu20.exe
Size 265KB
SHA256 a09b8f3482137394a421f6a96eaa3664f468ddfbcdf01651dae8fc0898e9a13e
MD5 b31e9f2479f734538e6a378656f05ceb
SHA1 1a716ea4ead1f0bb4110689494fa6fef7dc3cfad
SHA512 32ea8aae9f44b49511ab02abfce662fd7eebb0c5d9ceb6f2ec652279f3185d1403e189d98f6502ec0780372b704c1a6401d6cc6f9a6ea490fc5534b75006250f
SSDEEP 6144:FJHTrrdy4gptRY/6l6Zaoxf7rxyBNdOfUHJF:FJf5c2SlI5xfMBNA
TLSH
T1F3447C4663E524F9E0B78238C9A54B46E771F8621330ABDF07A0865E1F233D1AD39B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

86b514ee-9c77-46e4-a480-28dc9b34b7e2.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656\Default\Network\86b514ee-9c77-46e4-a480-28dc9b34b7e2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5292240740656\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1620240742718\Crashpad\settings.dat
Size 280B
SHA256 b7df843c9e20aa1b4849e8f5a34389931545ae95205355860d65a1e3705da765
MD5 76b56011e52295632f92b2fcbe1b46ca
SHA1 3d083f81004cedd8f55938a4ed5bb9932ad29973
SHA512 29468a6b46ffe31ca19f9bd844c988bc60402d90bab98a139604137b7892fff723d5197390b47d23c5cb833fe5b51e905d32022a1ec3e42a756db747f27a24c2
TLSH
T155D024F0F3514401C00F11F14114071047405C1C04000340F4170F0455C4434047737F
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1620240742718\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1620240742718\Local State
Size 4KB
SHA256 2f74462082411139079d6803a5f61d9807ed5d67dbbd00948ba7a3e5eda743b5
MD5 53976724c2e28576033abdd26812ace4
SHA1 8440af93955133d9d0ca8bf9ed57f57e28fa377b
SHA512 06b7c434e4047a72e150efb0f37565639583136616f12a245a23723f340b55793621903da952b1969b5e244a8d91b35dced96f382e1c87dda11e82248fa28c43
SSDEEP 96:qIqGNkYsIMfdp1RijJQ1tcD1B8P2vp6Fv00x4UpKoEm/aq4a:AGN7HwOswLGnFv00K6f
TLSH
T1C191B5716860BCB3DBF69E81B54A3B239FB8316BD5A12E80E9D4570C04E764D5306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1620240742718\Local State
Size 5KB
SHA256 72cd266f74fa67acadebb54fdb18e577c80a57f8d15995f5644d3f39e8d1ec9a
MD5 1566f2b4a28ce511b77bcd71d0703a2b
SHA1 2f2905d5412268af856ca084dc592aaa3410f122
SHA512 0f10c617a1f7b6990d1e380a450aecd91e62cbe72ce4122e4ffdfb66b1b6089b65afc4585ee5390cc9b36d5f3f9e4bd6fd077091a623cd5cac521a68ab2b607b
SSDEEP 96:qIqGNkLQsjpfdp1RijJQ58Frh/cInURcDotov4vDmB8P2vp6Fv00x4UpKoEm/aq7:AGNn6nO5ocDUwG2GnFv00K6f
TLSH
T162B1B67164B4BC779FF6AE41B58937136FA4213BE5913F84EAE80A0C05D73881306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597296.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1620240742718\Local State~RFe597296.TMP
Size 1KB
SHA256 aadfa229aaa9bf20c448bc8f5469ab6fa2a4c3bc0af417e4b0277e1b3ce61e27
MD5 0214dd3ff76aa3eaa630aca92867b069
SHA1 7caf1f4e9be9ec887eae5a64ce992b06c22c4b22
SHA512 1df30e7a680814b144232d6851d50e1fb7a5f22081a0dfc79f5a6afd0a12d4dc179beac07ced1fc60fb68b5c9f28f26d62de63d366291b43f3bbcd429dbfba37
TLSH
T1F43185B168D06CB3ECA7958272896B731F742175C1915E8471F98A0C06F378DA71AD3A
MD5 SHA1 SHA512 TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
Size 60KB
SHA256 cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
MD5 d856a545a960bf2dca1e2d9be32e5369
SHA1 67a15ecf763cdc2c2aa458a521db8a48d816d91e
SHA512 34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4
SSDEEP 1536:aIpTlJFWaIDPZbdqzOgB1fFI75IJ7SyXPxMVt:rT36bZbdqzXfFI75IJRxMV
TLSH
T136536D05A69440B9D8674278CAD71F5BEAB1F0405351ABEF0358C1CE2F237C3EAB6796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shiboken.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\shiboken6\Shiboken.pyd
Size 32KB
SHA256 5bfd3f7dad7c9dd7aaf66c4893cf5e5f073613c03a5c35c0625721556cfc5c5c
MD5 8c6b1e46443ca1b3bbc2d440892037a0
SHA1 3d59b4d0c71e5519d9cba2e298564ff4100ef9d2
SHA512 2b86472bb6fc6259ea9209e8a84d4a4329513e584a85f7a9ce263e5281b2c0f0802c274d3f686ba8df412df958e813c048d39ebbd1f353dfd13a93f7d9691d7a
SSDEEP 384:XfFFBhadUh0+n3CwqRkjlg3/byEJaDw52tOBC0a9u6Q4HQIYiu9c315y8RbmL4nb:HBMdUl3ymJIb9oQyOBbeRP5Yiuiv5AL6
TLSH
T1BBE29E43CA14688DED21C67A80928D2AE1F1B1654790D3CF236AD0EA5F933C33D3E799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSysKdrv.exe

Path C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
Size 147KB
SHA256 be495b5cd25cba230cc88aa99d34f2f7b70201b7047ae7a605950756acce215c
MD5 e57325406173324144960bbafbad6a11
SHA1 f9fde8480bb883016207f154dd473e56d629b36f
SHA512 fd0ed85d29948c512cb072f13d2046677318dc4af588a1b7507adb538cc0227bb00634204feacb7840f0e3fc21b26074b6dda61d1737156e38ea41f918719686
SSDEEP 3072:zEM70gfA56h/elpYxyB+yLgFeOWX+LIbnZz8EN9lDt:/xf7rxyBNdOfUHJ
TLSH
T10CE35A4363E920E5F1778638C9A58646EB71B8320720ABEF07A0465A5F237D1ED3DB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindsurfChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\WindsurfChecker.exe
Size 31.8MB
SHA256 0a823d043744c21882cb8cc8279f587bd8ff83bb87e422b5fbb61aa096febf07
MD5 a1d32effb30aafdf44616490147cc436
SHA1 2eeab09090dbb0ed53ba88c1ad84844eeccb6382
SHA512 a63a34475178668ab1fd3e0041333f9aad0dc1fc1b0bd76f6077dbafc0e70fd9aad5f42fb7b54c84f84d9e4a2f2ccc4dc1df2ab3db074a32d64dff411208a161
SSDEEP 786432:t1V4E0YJArE1+gNlNC9J5W/ThqQvjxYO5KUYnWrKbPD8ucQEp6YDr:rV4E0YJqUlNC9Jc/ThBX5KUr2PD3Y6wr
TLSH
T19D77332878D699DAC4529137C1E06AA453289E9723E5C07B43B0B3E0DD26FA4513FFE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce985mkl.exe

Path C:\Users\Admin\AppData\Local\Temp\ce985mkl.exe
Size 90KB
SHA256 706409b4cfeba987355f41d23c31e047f9b1c851ccacaf49fc243a692f7a3e22
MD5 b4994740359f6302a3047feb3e6d3453
SHA1 723990132e40adab04d65fd38e15e2d3044ceeae
SHA512 e4bdd846611147115d00368b28ce8d2d100cc4934c8000913b5bde137130ba3681d411d5f2119a68c93980770e913fe2654bdedd88dcbe3ea467724d41450254
SSDEEP 1536:/Dq9NyTUi+O2IOiJ3hP51h/SeDIiG0hL47okrNTWIxUtGsNTfqroYD4c76j:/Dq99jwx51xhDJXL4DrNTWoU7rqrfD41
TLSH
T1D293CFA7279414F5D9AAD678D5A18F23F2F3B8894A15871F03B8C9852F23362723D707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

givvabvm.exe

Path C:\Users\Admin\AppData\Local\Temp\givvabvm.exe
Size 57KB
SHA256 eb4c2dc7db21d6a8a889c74c7b90eaac0e095205063ae3e348a400e253c6bdd8
MD5 51242d1f06d41c80ea8c6fa541be3d6e
SHA1 a01f91e44b2a59f24b9e9c72e46e2207b6f86526
SHA512 bc7bde4ea9431f0e7c5345ea9cd1da7ec2f6a27da9f0bcfbd86b15dcfb2df3f416603d29986b849668b5e85c73678b76ad518d98cdecc6b8ae504a284fd90ff6
SSDEEP 1536:sKWHka5dALVp1V8YJVqJMX0jl0w15GXC0rOB7CD:sKm5dAppRdX0jlP1wT0E
TLSH
T184433A58A6DE624DD836D4B5D6A5D333FBA3F8427235974F0132C91E0F22B26BD28E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hg69t8ln.exe

Path C:\Users\Admin\AppData\Local\Temp\hg69t8ln.exe
Size 350KB
SHA256 f808b3e2570a2446b1483274e9aaf0d235580dbeacb2f129d5b52adc745a91a2
MD5 535ec55dd03c574541c9f6a5266fefad
SHA1 e2b318b2e438414f775ed35251e9e72fc2e0d7ee
SHA512 ab0cbe5ef8266218290d06b4c1583223d5b6186e180add0dee5e9d80211da36265bf13a5a0d76e638a50a202fb48c21138e81ed99e9327e4c932b73c4b74cef1
SSDEEP 6144:XVzk6qoefnPoDjo4ZYOVKS2bwJz8RmQf0WIiEnm2j7ZvINkn0srBQVkhHdZ:Xu3gDjoOktsORmQf07iSvN0hs/Z
TLSH
T12D74F147FEF035E9E12A523D84644A16E736F4BD06348E1F036C426A2F2A6D15E3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-C33PTJGGMW.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kxn3adjy.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-Q35XMVAI9U.tmp\kxn3adjy.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kxn3adjy.exe

Path C:\Users\Admin\AppData\Local\Temp\kxn3adjy.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
TLSH
T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_asyncio.pyd
Size 62KB
SHA256 45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5
MD5 4543813a21958d0764975032b09ded7b
SHA1 c571dea89ab89b6aab6da9b88afe78ace90dd882
SHA512 3b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f
SSDEEP 1536:aW3/DZG0409EevNR4aimAWAs+FI75nED7SynRPx:aW39GlANR4aim6hFI75nUJVx
TLSH
T185537D86D29041A9D96791B8C8B30F56E771F5804B00079F6268C29E3F733529BFFB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_brotli.pyd
Size 801KB
SHA256 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
MD5 ee3d454883556a68920caaedefbc1f83
SHA1 45b4d62a6e7db022e52c6159eef17e9d58bec858
SHA512 e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6
SSDEEP 12288:tY0Uu7wLsglBv4i5DGAqXMAHhlyL82XTw05nmZfRFo:tp0NA1tAmZfR
TLSH
T1DD058D07D8A3173ACC27C0798DA71236EB357168A71059A7B25CE5313B43A2417FB7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_bz2.pyd
Size 81KB
SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
MD5 bbe89cf70b64f38c67b7bf23c0ea8a48
SHA1 44577016e9c7b463a79b966b67c3ecc868957470
SHA512 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1
SSDEEP 1536:V/Uez7qlsjcaNXZIzNYM4B0NDX8rjE2tI7tVj7SyxPx9:eezGiXMjdMrjPtI7tVjLx9
TLSH
T10B839D93F76095B5F41BA2759AA14393E331FE49039093EFB244831B2F13B913C6536A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_cffi_backend.pyd
Size 175KB
SHA256 c379126647af2cbfb592d6a921f6218da59b886e2a56e9b82f8159aced6f1100
MD5 04fd1a452e91605545a267cb04cdd78f
SHA1 482d3bc8b0059d7c755cff695c0366be402c86ba
SHA512 12549b3a03e869998cc808079da1ca13e00949efa7c15ba97aa510feca2e481bdc74eefa12ab1f6a08d9cca06957a6d4769aa67e9973b59ad4fb9ef04a95b37b
SSDEEP 3072:1X9Iup1Rz9vapoU+EX+QRhbUvpzLcmIXPpSfJ0KN3kS7ORSTL7K3gqFb2HF:1jL0poIFRhbUvpncmIUGDRSTLOwU2H
TLSH
T140046C5A329C10B6D6A6513886579B53E3B3B430174197CF0160C7B52F1BBEABA7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_ctypes.pyd
Size 119KB
SHA256 e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
MD5 ca4cef051737b0e4e56b7d597238df94
SHA1 583df3f7ecade0252fdff608eb969439956f5c4a
SHA512 17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3
SSDEEP 3072:YjjHoXs01LUZJNUoNZf4adhfrI70s3nRI7QPY2xB:Y3HUJ6f5dhfrIHX1
TLSH
T178C36C5B2354109AEA678078C5B35F47DB71F859172083CF02A4CA9E2F637A36E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_decimal.pyd
Size 242KB
SHA256 4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96
MD5 6339fa92584252c3b24e4cce9d73ef50
SHA1 dccda9b641125b16e56c5b1530f3d04e302325cd
SHA512 428b62591d4eba3a4e12f7088c990c48e30b6423019bebf8ede3636f6708e1f4151f46d442516d2f96453694ebeef78618c0c8a72e234f679c6e4d52bebc1b84
SSDEEP 6144:LbdyrWOay+msmOE8qQRiJpCWi9qWMa3pLW1AUg42G:6zsmsmGNRm1omZ2G
TLSH
T150345C16A3490CA4DE778074989B9B57FBB278854360D3CF43A4CAA63F576A323BD344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_lzma.pyd
Size 153KB
SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
MD5 0a94c9f3d7728cf96326db3ab3646d40
SHA1 8081df1dca4a8520604e134672c4be79eb202d14
SHA512 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087
SSDEEP 3072:PBKvRNVdG9LqSS2IAiznfI9mNoBkD9ZRqtI7e1Pvxs:PBKvRts82awYOBkvRqM
TLSH
T1F8F33992B394F4E6F6228C78D6664F13D7F678490320829A12CCC37D2B1FB755A2A717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_overlapped.pyd
Size 47KB
SHA256 f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973
MD5 02c0f2eff280b9a92003786fded7c440
SHA1 5a7fe7ed605ff1c49036d001ae60305e309c5509
SHA512 2b05ddf7bc57e8472e5795e68660d52e843271fd08f2e8002376b056a8c20200d31ffd5e194ce486f8a0928a8486951fdb5670246f1c909f82cf4b0929efedac
SSDEEP 768:zy4KxRzXINGAQSKant/QKhl6XoTZfWJhSVAWiUOJI7stsYiSyvxPxWEa:XKxqztLTQSVAkOJI7sts7SypPx
TLSH
T135237B45679404DADE7B827DE4A35F12E67174A14311C39F622CC64E0F723C1ABBA3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_queue.pyd
Size 29KB
SHA256 007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75
MD5 52d0a6009d3de40f4fa6ec61db98c45c
SHA1 5083a2aff5bcce07c80409646347c63d2a87bd25
SHA512 cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824
SSDEEP 768:yez/DF36r3CkrAIeRI77UNYiSyvlfUvPxWEl:yeDM3CkrAIeRI77UN7SyOvPx
TLSH
T1DFD28E479AA45CD6D433C07094E75E25FA31FB52870183EF3218C25E1F327826BE676A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_socket.pyd
Size 75KB
SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
MD5 0f5e64e33f4d328ef11357635707d154
SHA1 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA512 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643
SSDEEP 1536:c67eU/Bgujs9/s+S+py8k/DDjaRI7Qw27Syj/Px:c673/aujs9/sT+pPk/XmRI7Qw2xx
TLSH
T1B0735B12A69050B9D2738175C6635F23FB70F480139593CF1264DAAE2F23792EF7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\_ssl.pyd
Size 155KB
SHA256 e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab
MD5 9ddb64354ef0b91c6999a4b244a0a011
SHA1 86a9dc5ea931638699eb6d8d03355ad7992d2fee
SHA512 4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca
SSDEEP 3072:xOoLGtbSpE3z/J/PUE1ueW5J2oEPwu3rE923+nuI5Piev9mutI7t7L+xu:xOoitbSpE3zhH7ueAE8nuaF9muy
TLSH
T15CF37C47F24419A7E817E4BDC2230A53EBB5F045231147CE49D6D68A0F13B46AFBAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\libcrypto-1_1.dll
Size 3.3MB
SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
MD5 6f4b8eb45a965372156086201207c81f
SHA1 8278f9539463f0a45009287f0516098cb7a15406
SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
TLSH
T1B5F58D5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF08A681780F17BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\libssl-1_1.dll
Size 686KB
SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
MD5 8769adafca3a6fc6ef26f01fd31afa84
SHA1 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA512 fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
SSDEEP 12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
TLSH
T1ADE44B95ABB51498D9E6C17C86534A33E37AF4141330AFCF06A5853E0F17BD82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\main.pyd
Size 209KB
SHA256 8188a9ff19175fabf8f7d6c46f6ddbebb9b4432f491d52291c22088d94cc9183
MD5 5c915402cb041d864afb87f7744b0b63
SHA1 7ad31439813720e370369f28892eb747a473a2f7
SHA512 086a9a2fbc410ff41c5ffeae686177f4f0d92a7196c5b3c9fdc29f1c8c803293842e204a486fb3fef285dfe6e5ed8f518b376fdb6fd7f57bf85a9ea87da7585a
SSDEEP 3072:RIQRHeADb7Mdi/C/EZvBLiJf0gZPRR5AJjsAUFNmo8uVe6Vy6vb8VsJPw:RIEnDL/lEn2JjjULmRuc6Vy6vbqsBw
TLSH
T1B124081652D40465FCA791388C7BD527FBB3744A2324AB4F2668C5C26F43BAA77BC702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\python310.dll
Size 4.3MB
SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
MD5 deaf0c0cc3369363b800d2e8e756a402
SHA1 3085778735dd8badad4e39df688139f4eed5f954
SHA512 5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989
SSDEEP 49152:m/4rIQeEKdN4uxzx1njuYWxKLx5NFnb7d1G2F58rkx7qzMJYlf1GCJLvNyoInO3V:mS7q35VNFnlRqT84NAnYHAMDlPK0r
TLSH
T1DC267B22A26401A4D9B79477C5238647CBF1FC552F20E34B41A4BAD92F73BA316EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\run.dll
Size 40.3MB
SHA256 737d846310603c8f1906a3b05a23005810fd422b5afa197d9d5ef4dbd9714f32
MD5 ae9e6e8daaff23703a71b49a9f18c817
SHA1 c205073556d374d30b4322286a4b89e57ba2eb0d
SHA512 59e29f4c6266c60569a2058b1bfdce15228116b6cdfae02705a9f3c20092a4f8f83b6d5f27222351d771836891a605fed953010750a49dd7b580523e67556956
SSDEEP 196608:q/slE/AujcD2YD0cXOGAsrfQyEaE3m3AW0uDy1ccUnyS2PKsWAtAET:q/ZcyYD0pgQxaE23bcUn72PjtAET
TLSH
T11C975C5223B40187FBB7E075CD799A13EEB2B49D1734299328A4CBD43346EE15BED284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\select.pyd
Size 28KB
SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
MD5 c119811a40667dca93dfe6faa418f47a
SHA1 113e792b7dcec4366fc273e80b1fc404c309074c
SHA512 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3
SSDEEP 768:zeS+FwhCWHqhmIRI77GwYiSyv87PxWEgC:zeS+ahVKhmIRI77Gw7SyGPxL
TLSH
T111D2AF8B9B9058C9E863C57258E64F02FA34B661875082DF3319C26D2F237C277B6769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3060_134291553978404965\unicodedata.pyd
Size 1.1MB
SHA256 4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
MD5 4c8af8a30813e9380f5f54309325d6b8
SHA1 169a80d8923fb28f89bc26ebf89ffe37f8545c88
SHA512 ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a
SSDEEP 12288:6DYYMmuZ63NIQCb5Pfhnzr0ql8L8kXM7IRG5eeme6VZyrIBHdQLhfFE+uAM:gYYuLZV0m8vMMREtV6Vo4uYAM
TLSH
T18A355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sdtp6jps.exe

Path C:\Users\Admin\AppData\Local\Temp\sdtp6jps.exe
Size 175KB
SHA256 af6479e3b2a695104671b8b58ad505e47f735fa84ac724028e3b42e0620b0ed9
MD5 36a47bf18b29128aab0039036270b04d
SHA1 45d1a7a237c17c1a2c22829ffe14359a5e947b6f
SHA512 4f0e597debf6ea5e35d2506c9000954ab83432d7c0e13b32ee5336908103bc1aa71ada50c2db25cb5fd966db5eb8bdf4f4e34eb9cabfb4d4986291b788463bfb
SSDEEP 3072:P2PYNMZKq+nFIiAxXnPra8seTpCxIpylMbmFXR2Q7SkugstR:PNysOxXPra8seNCGyXFXMccgst
TLSH
T16A043A5BD5D541EDEC19CA38899AE237A4B3FC461925BA4F2BA0DF111B90B30B71EF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2160-191-0x00007FFC5FC10000-0x00007FFC5FF42000-memory.dmp

Download

memory/2160-198-0x00007FFC5DA00000-0x00007FFC5DDB9000-memory.dmp

Download

memory/2968-608-0x00007FF7DBB10000-0x00007FF7DBB2E000-memory.dmp

Download

memory/3504-612-0x00000000007C0000-0x00000000008C6000-memory.dmp

Download

memory/3504-629-0x00000000007C0000-0x00000000008C6000-memory.dmp

Download

memory/4084-539-0x00007FF7DBB10000-0x00007FF7DBB2E000-memory.dmp

Download

memory/4084-534-0x00007FF7DBB10000-0x00007FF7DBB2E000-memory.dmp

Download

memory/4324-135-0x000002217FB40000-0x000002217FB47000-memory.dmp

Download

memory/4324-128-0x000002217F8D0000-0x000002217F8D3000-memory.dmp

Download

memory/4388-137-0x0000019A79BE0000-0x0000019A79BE7000-memory.dmp

Download

memory/4944-60-0x0000000000CB0000-0x0000000000DB6000-memory.dmp

Download

memory/4944-201-0x0000000000CB0000-0x0000000000DB6000-memory.dmp

Download

memory/4972-139-0x0000022742A70000-0x0000022742A77000-memory.dmp

Download

memory/6112-600-0x00007FF780DA0000-0x00007FF780DBE000-memory.dmp

Download

memory/6112-599-0x00007FF780DA0000-0x00007FF780DBE000-memory.dmp

Download

memory/6176-676-0x0000000000770000-0x0000000000BD0000-memory.dmp

Download

memory/6176-635-0x0000000000770000-0x0000000000BD0000-memory.dmp

Download

memory/6176-630-0x0000000000770000-0x0000000000BD0000-memory.dmp

Download

memory/6268-698-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/6408-544-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-653-0x0000000003800000-0x0000000003845000-memory.dmp

Download

memory/6408-546-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-545-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-548-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-543-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-542-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/6408-536-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-535-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-602-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-607-0x0000000000D60000-0x0000000000D61000-memory.dmp

Download

memory/6408-134-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/6408-692-0x0000000003710000-0x0000000003755000-memory.dmp

Download

memory/6408-132-0x0000000000DA0000-0x0000000000DA7000-memory.dmp

Download

memory/6408-195-0x0000000005110000-0x0000000005155000-memory.dmp

Download

memory/6408-666-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-623-0x0000000005560000-0x00000000055A5000-memory.dmp

Download

memory/6408-547-0x0000000003A00000-0x0000000003A25000-memory.dmp

Download

memory/6408-153-0x0000000000E60000-0x0000000000E61000-memory.dmp

Download

memory/6408-148-0x0000000003AB0000-0x0000000003AF0000-memory.dmp

Download

memory/6408-149-0x0000000003B70000-0x0000000003BB5000-memory.dmp

Download

memory/6688-621-0x0000000000550000-0x00000000009B0000-memory.dmp

Download

memory/6688-674-0x0000000000550000-0x00000000009B0000-memory.dmp

Download

memory/6688-202-0x0000000000550000-0x00000000009B0000-memory.dmp

Download

memory/6732-638-0x0000000000F60000-0x0000000000FDC000-memory.dmp

Download

memory/6732-628-0x0000000000F60000-0x0000000000FDC000-memory.dmp

Download

memory/6732-616-0x0000000000F60000-0x0000000000FDC000-memory.dmp

Download

memory/6732-200-0x0000000000F60000-0x0000000000FDC000-memory.dmp

Download

memory/7024-661-0x0000000140000000-0x00000001400D5000-memory.dmp

Download