2bf1b89b1047136490fc321d2fdc988b42dd86f693eea7872746ac6adf722bc3

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoHotkey_2.0.26_setup.exe
Size 2.9MB
Sample260722-vmf9kshg69
SHA256 2bf1b89b1047136490fc321d2fdc988b42dd86f693eea7872746ac6adf722bc3
MD5 aebf8ada10dfa197376eba830e6bc4aa
SHA1 3f1cac8732249b0b3c5edbd126f908ca70a47c38
SHA512 088ef2a422c274cab531de935189287354fa5d193a6f1c924d20b7cceb5d1f47c5a1e0dfa4ae8d1d01b39a1a1a9b0f3aa64777f4208cab1fab0b9ca6bea0799b
SSDEEP 49152:M9o4sQF1N/P+RzoSgVevvoWCO+LCaEzYdcGnD8ISJscm3RCa7UdI:d4sQF3+oSgwvAWCFL+YdcGD8ZnC8aId
TLSH
T184E533E165BCD150E193CE7F05751D08A728ADB6C6408BB67682802F789FAE93C4F763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4592	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
5044	AutoHotkeyUX.exe
2792	AutoHotkeyUX.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1292-0-0x0000000000400000-0x000000000095B000-memory.dmp	upx
behavioral1/memory/1292-1-0x0000000000400000-0x000000000095B000-memory.dmp	upx
behavioral1/memory/5004-184-0x0000000000400000-0x000000000095B000-memory.dmp	upx
behavioral1/memory/5004-364-0x0000000000400000-0x000000000095B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\AutoHotkey\UX\ui-editor.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\ui-setup.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\v2\AutoHotkey32_UIA.exe	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\CreateAppShortcut.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\AutoHotkey.chm	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\ui-dash.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\CreateAppShortcut.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\license.txt	AutoHotkey_2.0.26_setup.exe
File opened for modification	C:\Program Files\AutoHotkey\v2\RCX77CB.tmp	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\GetGitHubReleaseAssetURL.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\README.txt	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\EnableUIAccess.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\README.txt	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\ui-newscript.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\HashFile.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\v2\AutoHotkey.chm	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\reload-v1.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\ui-uninstall.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\WindowSpy.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\reset-assoc.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\ui-launcherconfig.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\AutoHotkey32.exe	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\AutoHotkey64.exe	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\install-ahk2exe.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\common.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\install-version.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\launcher.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\identify_regex.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\ui-base.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\CommandLineToArgs.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\ui-base.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\v2\AutoHotkey32.exe	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\GetGitHubReleaseAssetURL.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\launcher.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\ui-launcherconfig.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\ui-editor.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\identify_regex.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\Templates\Minimal for v2.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\WindowSpy.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\common.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\ShellRun.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\Templates\Minimal for v2.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\WindowSpy.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\EnableUIAccess.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\reload-v1.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\license.txt	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\ui-newscript.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\HashFile.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\v2\AutoHotkey.exe	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\installed-files.csv	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\WindowSpy.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\identify.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\launcher-common.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\install-ahk2exe.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\Install.cmd	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\bounce-v1.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\ui-setup.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\ui-uninstall.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\inc\spy.ico	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\reset-assoc.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\UX\inc\CommandLineToArgs.ahk	AutoHotkey_2.0.26_setup.exe
File created	C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\UX\install-version.ahk	AutoHotkey_2.0.26_setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C2B60D54D8C0AA1DDD4830C3EB7D9C1BEC911948\Blob = 030000000100000014000000c2b60d54d8c0aa1ddd4830c3eb7d9c1bec9119480200000001000000840000001c0000003400000001000000000000000000000000000000020000004100750074006f0048006f0074006b0065007900000000004d006900630072006f0073006f006600740020005300740072006f006e0067002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000002000000001000000e1010000308201dd30820146a003020102021029a13e8f4fc737a84839fabe5b1ab09e300d06092a864886f70d01010505003015311330110603550403130a4175746f486f746b65793020170d3236303732323137303731375a180f39393939303130313132303030305a3015311330110603550403130a4175746f486f746b657930819f300d06092a864886f70d010101050003818d0030818902818100bf8f0902ca4c3ff149449dd9d465f724703e5c4ecd5849bf079fc6d75038ccac7b6da0fa6cd9a8c095efaccf8831ff4c4afc04de881b619b0391bbb03591a9d4f16fb8679febbab19452a368b53446642599d372caba3eeae0f50d323a81bd5acd0bda0c55e1dbcfaaea6e57dfd971ac722fba457967cf0e456c500db234db190203010001a32c302a30100603551d040101ff040630040302049030160603551d250101ff040c300a06082b06010505070303300d06092a864886f70d01010505000381810022a7b4f7f8ec13c42b9669c44bf57f9bbc22f8a75d66c29586711744d7c2f94b384bb17fbfae4da822b81aa393f0a93402a9afe4500d2f3103a3fd9ace523dd5178c0ddb716654f51f08939ac1274bab4e0768421a093f102f94bd5c5bae5425eb78b840c554b801d9d768feee5e2a91e673dbbce77a208452f7dcd476f3533f	AutoHotkey_2.0.26_setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_2.0.26_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_2.0.26_setup.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\NodeSlot = "2"	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	AutoHotkeyUX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\DefaultIcon\ = "C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe,1"	AutoHotkey_2.0.26_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch\ = "Launch"	AutoHotkey_2.0.26_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\AutoHotkeyScript\shell\edit	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	AutoHotkeyUX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch\Command\ = "\"C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe\" \"C:\\Program Files\\AutoHotkey\\UX\\launcher.ahk\" /Launch \"%1\" %*"	AutoHotkey_2.0.26_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	AutoHotkeyUX.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\Launch	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5e00310000000000f65cf08810004155544f484f7e310000460009000400efbef65ce988f65cf0882e0000006b440200000007000000000000000000000000000000898324014100750074006f0048006f0074006b0065007900000018000000	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AutoHotkeyUX.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript	AutoHotkey_2.0.26_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess\ = "Run with UI access"	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\Launch\Command	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	AutoHotkeyUX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\ = "Open runas UIAccess Edit"	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\RunAs	AutoHotkey_2.0.26_setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\AutoHotkeyScript\shell	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	AutoHotkeyUX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ahk\ShellNew\Command = "\"C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe\" \"C:\\Program Files\\AutoHotkey\\UX\\ui-newscript.ahk\" \"%1\""	AutoHotkey_2.0.26_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open\FriendlyAppName = "AutoHotkey Launcher"	AutoHotkey_2.0.26_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess\Command\ = "\"C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe\" \"C:\\Program Files\\AutoHotkey\\UX\\launcher.ahk\" /runwith UIA \"%1\" %*"	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 5e00310000000000f65cf78810004155544f484f7e310000460009000400efbef65cf788f65cf7882e000000844402000000080000000000000000000000000000001bfb1a014100750074006f0048006f0074006b0065007900000018000000	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	AutoHotkeyUX.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\DefaultIcon	AutoHotkey_2.0.26_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	AutoHotkeyUX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	AutoHotkeyUX.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	AutoHotkeyUX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess	AutoHotkey_2.0.26_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit\ = "Edit script"	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\AutoHotkeyScript	AutoHotkeyUX.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	AutoHotkeyUX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch	AutoHotkey_2.0.26_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	AutoHotkeyUX.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	AutoHotkeyUX.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.ahk\ShellNew	AutoHotkey_2.0.26_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\Open\Command	AutoHotkey_2.0.26_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 4800310000000000f65cf088100055580000360009000400efbef65ce988f65cf0882e000000984402000000070000000000000000000000000000006321220155005800000012000000	AutoHotkeyUX.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C2B60D54D8C0AA1DDD4830C3EB7D9C1BEC911948	AutoHotkey_2.0.26_setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	AutoHotkey_2.0.26_setup.exe
5004	AutoHotkey_2.0.26_setup.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4448	AutoHotkeyUX.exe
5044	AutoHotkeyUX.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 35	5004	AutoHotkey_2.0.26_setup.exe
Token: SeDebugPrivilege	820	firefox.exe
Token: SeDebugPrivilege	820	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
4592	AutoHotkeyUX.exe
4592	AutoHotkeyUX.exe
2792	AutoHotkeyUX.exe
2792	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4592	AutoHotkeyUX.exe
4592	AutoHotkeyUX.exe
2792	AutoHotkeyUX.exe
2792	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
820	firefox.exe
820	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5044	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
4448	AutoHotkeyUX.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe
820	firefox.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 5004	1292	AutoHotkey_2.0.26_setup.exe	91
PID 5004 wrote to memory of 4592	5004	AutoHotkey_2.0.26_setup.exe	95
PID 4448 wrote to memory of 5044	4448	AutoHotkeyUX.exe	100
PID 5044 wrote to memory of 2792	5044	AutoHotkeyUX.exe	101
PID 2628 wrote to memory of 820	2628	firefox.exe	105
PID 2628 wrote to memory of 820	2628	firefox.exe	105
PID 820 wrote to memory of 344	820	firefox.exe	106
PID 820 wrote to memory of 344	820	firefox.exe	106
PID 820 wrote to memory of 344	820	firefox.exe	106
PID 820 wrote to memory of 808	820	firefox.exe	107
PID 820 wrote to memory of 808	820	firefox.exe	107
PID 820 wrote to memory of 808	820	firefox.exe	107
PID 820 wrote to memory of 808	820	firefox.exe	107
PID 820 wrote to memory of 4540	820	firefox.exe	108
PID 820 wrote to memory of 4540	820	firefox.exe	108
PID 820 wrote to memory of 4540	820	firefox.exe	108
PID 820 wrote to memory of 4540	820	firefox.exe	108
PID 820 wrote to memory of 4148	820	firefox.exe	109
PID 820 wrote to memory of 4148	820	firefox.exe	109
PID 820 wrote to memory of 4148	820	firefox.exe	109
PID 820 wrote to memory of 4296	820	firefox.exe	110
PID 820 wrote to memory of 4296	820	firefox.exe	110
PID 820 wrote to memory of 4296	820	firefox.exe	110
PID 820 wrote to memory of 4296	820	firefox.exe	110
PID 820 wrote to memory of 5504	820	firefox.exe	111
PID 820 wrote to memory of 5504	820	firefox.exe	111
PID 820 wrote to memory of 5504	820	firefox.exe	111
PID 820 wrote to memory of 5504	820	firefox.exe	111
PID 820 wrote to memory of 5536	820	firefox.exe	112
PID 820 wrote to memory of 5536	820	firefox.exe	112
PID 820 wrote to memory of 5536	820	firefox.exe	112
PID 820 wrote to memory of 5536	820	firefox.exe	112
PID 820 wrote to memory of 5544	820	firefox.exe	113
PID 820 wrote to memory of 5544	820	firefox.exe	113
PID 820 wrote to memory of 5544	820	firefox.exe	113
PID 820 wrote to memory of 5544	820	firefox.exe	113
PID 820 wrote to memory of 5552	820	firefox.exe	114
PID 820 wrote to memory of 5552	820	firefox.exe	114
PID 820 wrote to memory of 5552	820	firefox.exe	114
PID 820 wrote to memory of 5552	820	firefox.exe	114
PID 820 wrote to memory of 548	820	firefox.exe	115
PID 820 wrote to memory of 548	820	firefox.exe	115
PID 820 wrote to memory of 548	820	firefox.exe	115
PID 820 wrote to memory of 548	820	firefox.exe	115
PID 820 wrote to memory of 5248	820	firefox.exe	116
PID 820 wrote to memory of 5248	820	firefox.exe	116
PID 820 wrote to memory of 5248	820	firefox.exe	116
PID 820 wrote to memory of 5248	820	firefox.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.26_setup.exe
"C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.26_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.26_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.26_setup.exe" /to "C:\Program Files\AutoHotkey"
  2⤵
  - Drops file in Program Files directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
    "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\reset-assoc.ahk" /check
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4592

C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" UX\ui-dash.ahk
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
  "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\ui-editor.ahk" "C:\Users\Admin\Documents\AutoHotkey\Untitled.ahk"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
    "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Users\Admin\Documents\AutoHotkey\Untitled.ahk"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {26f4c52f-9de6-4104-b6c4-7beb16dca9e1} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {b3ee6e22-1cc5-4a76-a0af-ed973f891e3a} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27276 -prefMapHandle 2864 -prefMapSize 270279 -jsInitHandle 2868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1660 -initialChannelId {3d9c0869-a5ea-4389-a05e-0b03f6471773} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3900 -prefsLen 27276 -prefMapHandle 3904 -prefMapSize 270279 -ipcHandle 4004 -initialChannelId {c0fdee6a-c0a0-4112-a907-b1690596bb71} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 34775 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2468 -initialChannelId {7172e4de-0243-4dd0-b19e-9aae619e78fe} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4836 -prefsLen 35012 -prefMapHandle 4820 -prefMapSize 270279 -ipcHandle 4828 -initialChannelId {2598b00e-8af3-4ef3-8467-754a0315765d} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32952 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5076 -initialChannelId {27b76c09-d5a3-4faa-8117-8a204df26432} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 32952 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {f16605e3-529a-48de-a3ef-24cde19fe6fc} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {f97fa88f-8673-4a5c-b1af-147cb892efb0} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6420 -prefsLen 33071 -prefMapHandle 6424 -prefMapSize 270279 -jsInitHandle 6428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6432 -initialChannelId {3ce03444-61c7-472a-9484-259b712c4408} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6372 -prefsLen 33071 -prefMapHandle 6416 -prefMapSize 270279 -jsInitHandle 6648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6288 -initialChannelId {f741f8b6-43b4-429a-82f2-991f40ddf619} -parentPid 820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoHotkey32.exe

Path C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.26_setup.exe\AutoHotkey32.exe
Size 960KB
SHA256 cfa4775b267c527a2ea10d51b6010c0466d0dd92dc1795732e342ff4cae8a0f2
MD5 956124b662b5e55b8f18d05eee3d2e9c
SHA1 0ac7279f9bcd90d38f9dd18bf2db2be4480342a9
SHA512 5c379224981a8f7436548cfbc87b43b1eaec390ad31e9bda39604a50ab00fb32428bbd0ae0b8a6318f0fbfdc0c9d8656713b68388e8521e26de9a494e65608cd
SSDEEP 12288:kYbnCyZaBvAzl5ljjozXzTA4hHFy9K/4MXKPNIPhbQvQBPWrlZcBUcRk:nCyQBvAzluzTJJFy9ZAC4slZxcR
TLSH
T177256C53B7C3C1B1DFE215F3D5BA6A365939B8380B3C88CBB2D4582ED9A05C05A36716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Minimal for v2.ahk

Path C:\Program Files\AutoHotkey\UX\Templates\Minimal for v2.ahk
Size 93B
SHA256 7f618d3ca343a0739a52a4a3c4f5b963ed98dc077b60c65fdc77d70fb0ec12d3
MD5 cdc8756680c459bd511d2bd2895fe2b2
SHA1 a7ea57fd628cfe2f664f2647510c6a412c520dfb
SHA512 101722eb5bba352d557e7d70704e24a54a129276857e8cc13f40da26dfa9267a67de79e52a0f552ff676d1825d0fb2eb467837b397d2e6905fa90d6891bccd45
TLSH
T14BB012009EE9D805F8FCB385F821DD641170632D0496B0D192A5044114D22194BCDA31
MD5 SHA1 SHA512 TLSH

Submit Download

WindowSpy.ahk

Path C:\Program Files\AutoHotkey\UX\WindowSpy.ahk
Size 8KB
SHA256 b29f7037876d82deaaf200e79e9f1c139a4fc9d8b883101be1f93c62d3299967
MD5 fed55040da5a78320b6a1f9369053b2a
SHA1 21ea30fab1736ee48c2c793b75485b24a9b0eee8
SHA512 95ced24314df16907497208c2085c63f8cf3837a00f63b14009a5c7a6025fc5d749ab720a7600da8096a178988c5909c555ef8aa1d500ccfbb0d4c6e36c64933
SSDEEP 192:/9RD+QOF3jN97L5joVGhwj6y2h2Vfb/xHFiyOdKZBlb0esEOSZ9o3Iu7:/D+QwTN97LFoVAwf2hEfdHFiyOqqeROf
TLSH
T154024000A56D3270D6F76766A9632604F2144137C4CF0709767CAACCAFBE3531EA9E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommandLineToArgs.ahk

Path C:\Program Files\AutoHotkey\UX\inc\CommandLineToArgs.ahk
Size 352B
SHA256 a6c51e2188e31e3510577263d7b96db147b0df3dfa24c96df8fdd9d73da859ee
MD5 e8d9a7e78d6a2a40bfb532b4812bde59
SHA1 5674b63092a69c419a42bab9e7462bde3bdb3cad
SHA512 dd7d78c7724dca4684c732b0f3f8e73af67610de8945255b48b9301672ac0b4f405c802a8cd4c343d53266f492d2d0dcd2727b5ebdb9e90cfc9173876b9ab905
TLSH
T1F6E07D451CEF2633C3BA17BD75423C01E18EDDEF0D071550380CB9401F3AD056215E08
MD5 SHA1 SHA512 TLSH

Submit Download

CreateAppShortcut.ahk

Path C:\Program Files\AutoHotkey\UX\inc\CreateAppShortcut.ahk
Size 1KB
SHA256 40a6f0cda5fd1dff324cab288bb453aa60b41b09dacbfbc64f2d871423f33935
MD5 2ffbde65b63790c5aa12996e9ef9068c
SHA1 a793986e4e72d5b5a866e927855eacc3a0399a7a
SHA512 315b2803c8e803b238e87de63a5737350e41d248f67c54662341ca889c3bd5fc6fc2f516ca20f1ff4d74fca4af247b64ec7795d4c4e8990fffce49bbf037a906
TLSH
T1DC31E052B9484280D4FB53618C2A7C00E5CF3A130CF68448B39E9BE98F79622CD57D91
MD5 SHA1 SHA512 TLSH

Submit Download

EnableUIAccess.ahk

Path C:\Program Files\AutoHotkey\UX\inc\EnableUIAccess.ahk
Size 10KB
SHA256 a9a824a763195e5810bf904854af7ed41c025527b2b8faa7532c6f24189d69b9
MD5 65d05ec61cca0547e218655e65e5ea7c
SHA1 1cf93558bb9f1ae5a055b3f9085bf4166b7f43dd
SHA512 65172fa0f9148106e44fde99e0bcad173c4eef405a19b1f54961f2a248f6e6b0a05568d728e83d6582113d0d12a5e87ce763c53271c4d52b9362b19e22ea7d23
SSDEEP 192:RA1uaqk4Ka6BYzrxPrtRdSE6hyj4rGp+HCOvFrBScc8W4:+uaqkpaPh1sFBfcU
TLSH
T1CC225453A9D25902A4FFD66CB9432C42EA084C0F957B0952BDDDD0FC2FBF8A94126DE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetGitHubReleaseAssetURL.ahk

Path C:\Program Files\AutoHotkey\UX\inc\GetGitHubReleaseAssetURL.ahk
Size 844B
SHA256 48a3f822a720b8e9b41165a1d19d56411d1f58036338ebd07ab40f2a14cf0f1b
MD5 1a8ab9bb38fd0da51d03dc48e3a0b2ea
SHA1 5c74ddd45c91a39b921139881c76c48c97e35825
SHA512 1b88603fb9eb28e717cb77623ff0159f5f45e677c34316dc0c5d5c2ed46c59f10d3afb532b1f99920f91b8098e544873f944b1e0e575efd694dd24bdca22c14e
TLSH
T113011045ACA8D008C7722B7698439990E416D20FD63AD814F03C84923FB2F52C5CACB1
MD5 SHA1 SHA512 TLSH

Submit Download

HashFile.ahk

Path C:\Program Files\AutoHotkey\UX\inc\HashFile.ahk
Size 2KB
SHA256 84032ecac8ed334cf8788a81bea721b0af5cd7ca7dca57b60cdec3556ae33914
MD5 727ae6f2ec77a5b56774df9da14636d2
SHA1 8216a2122c825127ca59b05b0bae0d57e92f1110
SHA512 f1058216b5d1b8d590eb4cafd5139f71f8df5f96a3fcc314a7635cb1b99de8623d87c57c567868ebdafb09925b8d13fdadcee49fa89f1a239725a92b948272cc
TLSH
T1BB41FB13B69C050351ED1B58B9B350D5CA99E807E2BB8BA0399FE0E11F7E910BB85CF1
MD5 SHA1 SHA512 TLSH

Submit Download

README.txt

Path C:\Program Files\AutoHotkey\UX\inc\README.txt
Size 182B
SHA256 d65c6e73417e6bba7a619f2e68933b74e6ae6141277b65542aed9b6acdfc83ff
MD5 4b095aae00456aa248024a184671e4d5
SHA1 84ae516fbc62ce0aa10ffeacd7ba865a35a0a375
SHA512 77aabe92719d8fc7a28c76f3b76fa2e42a188db14f004262d8e913620aa990cde29119b82d919511fc0d828ca0a108ea79858ba158b6a8ed6a260b72b4ee229d
TLSH
T1D0C0C01932C8734456B204F3F311A088A303D014051CD0B821C3C4CD21452EA1252771
MD5 SHA1 SHA512 TLSH

Submit Download

ShellRun.ahk

Path C:\Program Files\AutoHotkey\UX\inc\ShellRun.ahk
Size 420B
SHA256 ea67340c555fdc1abf8e324ac550ac37d2ba5f96a8edef120e72fb340f8f95c0
MD5 9e53fca8c7f6a9ee179f0fc0a7890ea3
SHA1 dc2a1bf437eea36b3f5ba9318f3b391b405d5cb2
SHA512 cad5c07f952fb93413b4a3990c522ba4b446ae41f11c8dd323bdcde1b30fbfd76515606d5dc4bcb8768bd382cdb82553801539a192b002696d253341f3c0dbc5
TLSH
T1FAE0AB9A2E0083C078EF127185B5C5A2C45B032B7C1D3949B38E8D003F3191A73C76DA
MD5 SHA1 SHA512 TLSH

Submit Download

bounce-v1.ahk

Path C:\Program Files\AutoHotkey\UX\inc\bounce-v1.ahk
Size 142B
SHA256 9b75c7f804d1d55807459e6f06db2bee8e1fb60ce9c9340d44a7b491ce53b982
MD5 165b8fc572f943e3665994f87f1772b7
SHA1 265ca3d2a66a7e1807962eb7e8a444cefb61bc0c
SHA512 e675453eef9a10560cb9ea95e993d8068c8dfca3664a140b6ba33361d0736632b8ce3a37770411583f558476173294bcc12b83bf33190d89eb009bfb9bb5f0af
TLSH
T1E9C02BC4CFEED22388D316B0270CC48AC00832CD0235533402202884F8846CC0F8F8D7
MD5 SHA1 SHA512 TLSH

Submit Download

common.ahk

Path C:\Program Files\AutoHotkey\UX\inc\common.ahk
Size 870B
SHA256 4e1e49dcb93bb8f6adcc7385029ff779259f1492a214f9bd6af0d62ea10a76e3
MD5 28ac80650af085421d678ae5f1b7def6
SHA1 600616ef61244c8747d5f9c5f3c4b9dc54b25cce
SHA512 24e57a43ddee9939517b1d351ed7ee7ee53d6c70908f0418cdc55a98f94e1de875c2a0d6f52195ac9096691cb7df23a35304df7d44aeae1c8254a13263a4d4ba
TLSH
T11F111221AE3E5F1BD4A412F56316A516D753688D35D20041F2ECBCC83F1B4F788C9AA6
MD5 SHA1 SHA512 TLSH

Submit Download

config.ahk

Path C:\Program Files\AutoHotkey\UX\inc\config.ahk
Size 429B
SHA256 4d1f241a0c973e30f1bf19e71cadb386b872a14bf0c29d32d4781a56cafd998a
MD5 248b58535f55eb55d9baec04a384b5e6
SHA1 76d067318b67da9a3da71a232a887c8935c7068f
SHA512 0186eb49da706c6cc6f48ecd94a4996c258ecea10bed26b9c79bddf0f7eca32df1449166309237859ca2508427bf79d447a2202eaeba211228da9822646cf23a
TLSH
T123E0A7273E43EC155252216B61369005CF9A566D64D13810B07AD3D48BBEC186C1352F
MD5 SHA1 SHA512 TLSH

Submit Download

identify.ahk

Path C:\Program Files\AutoHotkey\UX\inc\identify.ahk
Size 1KB
SHA256 f5b97911887c303b6859de44eff73780309e31e931dcba86a66aaafbe932af72
MD5 3e5c97e6c3a76686329c81fba864b26b
SHA1 ec111d01a5299de2ca93c5441e92bb49d9d5e710
SHA512 c70ba459abb2c35edfd62dfbe6efb9c54d5341802a72ac7d6b3b63877f28a97a974b96b6de747e29909550d6ba2c5d14da40bef6d91841c5c8c5a903697307c7
TLSH
T1CF11571C6CB403516D32E26BB8CB6691FA2E7B3341A806063ACE82872F34175C375B51
MD5 SHA1 SHA512 TLSH

Submit Download

identify_regex.ahk

Path C:\Program Files\AutoHotkey\UX\inc\identify_regex.ahk
Size 3KB
SHA256 c2563ab626df892398083404acecc5229300ba7dc6077b120844c65facfad854
MD5 f27f09d324016bd49d2da38901e79a61
SHA1 f2af4ea1ca36dc4ed53ba3a5817b83d457c9029c
SHA512 1dd5a6ddf87a3026f5b2d468197173af0c4e6c2eeab64113bcd2bbd56be46089e546f694fea2416aadc9c2669070b29ef26ec689dfbe73def8af6fd0de310d04
TLSH
T18C81211948FE9D958702C1EC67205D8E0DC5CEE9EB1871A74C10D12278F2C6D6AFE29B
MD5 SHA1 SHA512 TLSH

Submit Download

launcher-common.ahk

Path C:\Program Files\AutoHotkey\UX\inc\launcher-common.ahk
Size 2KB
SHA256 220629b006d13b24afb3367abeea424c5b4103ac0c5a137fdc9d98047cdd908f
MD5 65029d2c4fd46ea517b13d615a0584f5
SHA1 fb924c85e3e032b997aa86f85964516849baeb27
SHA512 c1346142f1b6dd5bd9a0d8cc9aac843e117f646f09a7ac40488ab513781d0162504249d7305e63080363bd273ffbb9d5f29c6dd860b9a80928aba944cfd51a0c
TLSH
T16F5145D47C4B551481F7737C2A0A5540FE699E4F45798010F9BE429A3F3E49C92F5E70
MD5 SHA1 SHA512 TLSH

Submit Download

spy.ico

Path C:\Program Files\AutoHotkey\UX\inc\spy.ico
Size 4KB
SHA256 968473df8eac7264d9e84e6ae91a4d706cda9f89f345d182617b161ef4fe1a7b
MD5 eeecd8af162d3f318496e0e60d6d8c57
SHA1 31a99c80e4f1033914ce9344e95b84571f76ad2d
SHA512 6f55968adf7f2f02e128945016ed0c4d003c9640e4cbfc7b22b82374647e6ebdb07c02e99240da369789f4107d2c130e54d4acb1324455fd26668c4d1d009884
SSDEEP 96:E+lfU3JuOE/08BQLDmMZUMxsjnzEBgTOhmvS:xkLE/B2LuzEBga3
TLSH
T13B915BE3FEB054FDC559B6EA44AB02D73D7E03334ABD6922B25E8CA45135040B39A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-base.ahk

Path C:\Program Files\AutoHotkey\UX\inc\ui-base.ahk
Size 5KB
SHA256 5f0208e050c64b5b8c7733c2413cd5bb69cc6eb2555c67ee0716b28a351ed651
MD5 e5cc8992de0ee38e06890b369c8fbcc7
SHA1 e5880e42ed5d5be6896f51a71b3099888ef28a26
SHA512 5efff56783d5501c02e7d7267a25d80e5592b99bbcdd4d7a6ba3829215f4e160d4fcb37387a80fae072a29a4c60843f9bd6e1feefa507d23f5d2b1f63a5d45b2
SSDEEP 96:hazJ+yLSX5eZIPHGI4tLSSZMUR6l5w8OtXQyceRX35FZsFFNA3mnpJyryBeE:ha1+v5eKPHGI4J9SUtruNw35FZs1m4pX
TLSH
T1ABB152002A264515D0FBB27BF8B35C06F252453B52FB616478DD46F81FB60628AB5F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install-ahk2exe.ahk

Path C:\Program Files\AutoHotkey\UX\install-ahk2exe.ahk
Size 1KB
SHA256 c242ebb51241acab13152d95cdb05be5382ffb97f3dca2da3a4e5a084c2e3ff4
MD5 c90bed0679b789b74e4865ae6f2709a3
SHA1 b0dbee6a237ba93daec76a0553cd3254821d60a1
SHA512 f8dfe5c558b427e05905b2a3d8a09632347edf945d47ed4fc82ec38a9045f5837a798ef669f0fdae6504d9eee6762c49c8e6c32adac0f6a3e6c2eed6d48e64b2
TLSH
T148318EEF6D6C25246CB01774B75B2513DBC6E077224029243C9D04C4AF3399919AEFB3
MD5 SHA1 SHA512 TLSH

Submit Download

install-version.ahk

Path C:\Program Files\AutoHotkey\UX\install-version.ahk
Size 4KB
SHA256 d275f352ca714100249457ed39f42ce4e2b342102f51a16c59b6270d681c2907
MD5 8041d4c7e0b5da001db63485819bdf00
SHA1 eb8336c35686cac50ad506a562cabacad3f140cb
SHA512 8bf6e371f04889f09f8ff0a7b2f641a2ac23fea26e5a4e3920b202bebc7d27fec47d7a2b7065d71f4459656d2ebeb779fa73881174d668b4d7f43e88571ee919
SSDEEP 96:m4C3dyA4vkDU1tYur5Ql5rk08NpJ31rsDoxhZNlk0AVIn:Q3dyA4L/fdQl5w08LrsM/Jk02G
TLSH
T18A91882E5AC6D536ECB16309AF271455FFB2D22F20D112447AED49C89F7346C2324F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ahk

Path C:\Program Files\AutoHotkey\UX\install.ahk
Size 40KB
SHA256 eae93fc89ed952cb2323de726d54107848950f3effa55a564557e78347fe3597
MD5 684b1dd5fcb2a43debeecb8bd06c9a39
SHA1 edffde43aa1740c4629a2d984126b4ce5fa9a1d5
SHA512 588c74f8f392549dc2cadd58f06b5e3defcb28561b58c1809ce2d4b03b7363c268e2c5734da29f48bbaac648c635713a6856a1a03a8348aaac0e50a9a5dc61ff
SSDEEP 768:MUh0uh3o8L7Nl/MjTADYwFvgxatHkMrVDXxJV3w:Vj37Lpl2AwatEUVBg
TLSH
T1B513626AAF8C0575A5B37335AE5B6802EB63812F8442081C7DDE95C42F7312916FAFF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.ahk

Path C:\Program Files\AutoHotkey\UX\launcher.ahk
Size 17KB
SHA256 830db4be4c8320f23ff32316dac933d4e72d9056ea5a819cc12c38614da6e06f
MD5 596b69069bbbcc9a22ac26bba6efe546
SHA1 694cec54200ff1ec70dc56320c577b652884b53d
SHA512 1c18acf4403915c6a2562f5e26c0ed7c4fc00e9d67d19622d1db8bb9338ff6d6e8bf9abe7317f1b529ef1c24901b45c3b13dc3b734d97582c91b206bee9aa8f8
SSDEEP 192:HBHZGn4adB4K2maaPGBSE72hxuWYDlmxrCOKen2RXXtiqOeGKlLFemIpyeOYMYyT:hH2B/uWSKXn2NCQE0X40GG7QE
TLSH
T1B982EB256D854630D0B6737CAD975406FF9B842B02660024BCBC82D82FBA95D8BF5FF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reload-v1.ahk

Path C:\Program Files\AutoHotkey\UX\reload-v1.ahk
Size 556B
SHA256 e4659306a755b583e9cef5fdba3b3eb102d8939fb028afd91aad4496e758fad5
MD5 35f4753a58432446b99bf89a9e930bf5
SHA1 babc3341d9d95865a36ea9a20549a61146093006
SHA512 ac3483a17ead5173ce40a6af55c3c2361652fefd94c0bd82e004df8186ffc31eab194534a25fe995d677f2f71363095d177c01afb6ae50f2b63ba156855ef5e5
TLSH
T18CF084811E81F6660BA48B51372A82E7D242C16E4339EA90B4EC88812F7654C4CE2FFC
MD5 SHA1 SHA512 TLSH

Submit Download

reset-assoc.ahk

Path C:\Program Files\AutoHotkey\UX\reset-assoc.ahk
Size 2KB
SHA256 d26caef44190e0b612c3e4309ff6689dc2953c72cb3de1c94d002250b089f16b
MD5 0299132478b49e3eb706c214bf32e62f
SHA1 9705c410b9f515269c512c64129ced8e0b1b23d2
SHA512 2a9ce8ee71ab207dbf4c4fcc2634d49233304da858c7880813a2127c2a063dc58703d4b2129498db630d081e1d72f899d348c01dbbcc359d92ab720b89ccdc44
TLSH
T14C4164497A4E5D2699E58362B103640DF320557E12D6850A38EE08FC17AF14F8B92BEA
MD5 SHA1 SHA512 TLSH

Submit Download

ui-dash.ahk

Path C:\Program Files\AutoHotkey\UX\ui-dash.ahk
Size 9KB
SHA256 e19e68f3904e1e5d3eee1c1340a0e36a854670911e051d263a8ea4c1fb2e53c3
MD5 bdcf27851c48c8b6087dcefaa80e89ca
SHA1 8fab2c9c589bddb362a6d35d8d4980a4cf5c2735
SHA512 f30eea5773ae3ff52b163f897a868e84936d90d4daa52aac8b0a36ec325ccfaf6b1f0223afe3a937672dd1db578314665bb5e58798f218581fb286a8f7a4ca60
SSDEEP 192:AJL9eBb511HvyDOmsGIYmgxVz22oPTw5/1QVTZI+X:AJELvCsGIYzxVz245/k
TLSH
T11C22B60A8E0984A59573A3397D531505FF07006BD872480C7ACD48E8BF779AE0BB9EB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-editor.ahk

Path C:\Program Files\AutoHotkey\UX\ui-editor.ahk
Size 8KB
SHA256 7263286eb3a42eccf5edc39b43c74a8bf7c82f2671204d1ae654236c1de3f05d
MD5 82eb574294ff4e2e7461b95f5bad0a87
SHA1 a981373ef3bd61ce5a2f0ad9bedaa1cf4acfd591
SHA512 1c54e110b384d55ca0243ad343e69d1f0fa9b2a863af8da75a5c992d19f9e055182bba09be227882f82d0ebf4ec94094723e2db06cdf7ee2ed574348a8d72c74
SSDEEP 192:th4hvlbHoc4v3g/ucyCs5fyrpsp/vm1kEoQH1lY0qibz:th4h+cyCifyrp85QVldz
TLSH
T1D202B42B2A194530D177633CADD35850FB1A8ABF296B8494BDAC01CC2F73585C3B4FA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-launcherconfig.ahk

Path C:\Program Files\AutoHotkey\UX\ui-launcherconfig.ahk
Size 8KB
SHA256 179c96d787fae5dd26cdf832e5226142ab3e4f1ff53e3b1f24cecddcf3e79947
MD5 57dcc5f7853cfd0bdd49f35d1f86897b
SHA1 e7cc5a9f5f689054469c670cd4efee2889d26968
SHA512 742fcfffa94752fcdb37b28749c9fc7e43f1e467470fb3fe59aaab2a29fbecbe29ab113481fc5d009ada059975bba00d294442ec13437cef588179b7e88fb116
SSDEEP 192:1nYmhcQPheYP0oxc2r23K7D+lTt3cs8FN7bDanWPKtscP/81Tn/dUT0:1nYAcvYs325DIB3csspb2qcx/81TnlU4
TLSH
T1C60289362A491471C5F623167E2B5821E756038BC9239529BD7C42C41FFE92D8AFDEB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-newscript.ahk

Path C:\Program Files\AutoHotkey\UX\ui-newscript.ahk
Size 10KB
SHA256 e6279029591444d06adbfc718eef7436da1fb0f2b69873732aff89ca0f54a20a
MD5 9f53c1e0ea85d4d86e35e46d85a8ddff
SHA1 35eda45a024af1ba904bd26909c47e21101b12ef
SHA512 0e7368b69defdba5ac7f2ac0955a92bea937db661de93fe0169c21df5994220a44e9ad8515135b28a44d690534aeadf76caef49a1e3f632cf6c900bcaadd654d
SSDEEP 192:WWsmA5tqnaPKtGs8SCVV7f5JfzH+zoe04+v1AlLUzhAGnk0Vps61CRjqsz:WW6TKF8SCVRfEW9AyzhAGO08
TLSH
T1F02283136A45D9A182F37779EC57AD15FA27042FC9232900BCAC46C07FB5462D6ACFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-setup.ahk

Path C:\Program Files\AutoHotkey\UX\ui-setup.ahk
Size 7KB
SHA256 68b114a2ea4af9df54709a78ec5991a1f271097b29cb93757403fdb158746bc7
MD5 dd3f9c2f9115689f4350896752f15926
SHA1 fa19f1632b865b2bc098611a8be66e9f10dc692b
SHA512 12f34d5ec7a7d5452eef97e4c87093240050756c564140874d316d0b9d194c961debe139badc943b024b680b68961ef6cbe71fc1a567c6622797f90ed51fa549
SSDEEP 192:SdHQj/CKeF1DXPTYjTBS7EmK3QyOcjRn5WYHu4pCW7rvQ:SejoFpPTYjTB6EmQOcjRTHpC/
TLSH
T1A1E186442F599230F8B76374AF43AC02EB2B65AB49571069B8AF01D05FB7530826FF76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-uninstall.ahk

Path C:\Program Files\AutoHotkey\UX\ui-uninstall.ahk
Size 2KB
SHA256 1e09fc4af5dc3e673d4facfe4fa849c6bdd0b29c67b0efd7f96aaf387fcef698
MD5 0fe4932669e99a498a7bc76975919000
SHA1 e0d6a7b484d3a6c0d7427f611c575f93e4f87ba4
SHA512 dd3b99739106953608ac2eb2ecc4e3d316b5122b1b305bd7cfab82fcc7ec0d92b5944f4724d37cbc01ca5c6b5381b57fad9256586b5dfd0026453f9c11a32394
TLSH
T13A4174096A598928BDB7A3657D532C12FAC140A7C763746C79DD44C8AF73A04878BF22
MD5 SHA1 SHA512 TLSH

Submit Download

WindowSpy.ahk

Path C:\Program Files\AutoHotkey\WindowSpy.ahk
Size 159B
SHA256 c1908cfc4b224b3bc8d1a5c67cfe4acdb4e738d8acf98560905afc412981c18b
MD5 e5918a52b52ca3ce2e99788a26477984
SHA1 87c2b54b65663e1e29e866224faeed7e8bac759b
SHA512 4f320cbea5adfed4b07012e04281e8713689271932b26d3886e3519389b15e2adadb87217c5bf09b080d3db976c77accf555493b7eab5ceb45bc59131772f8e6
TLSH
T15DC080499F7C080DC6F14494F44BF5154E0DF06813408414405025D3F48745435DBED7
MD5 SHA1 SHA512 TLSH

Submit Download

license.txt

Path C:\Program Files\AutoHotkey\license.txt
Size 17KB
SHA256 b27c1a7c92686e47f8740850ad24877a50be23fd3dbd44edee50ac1223135e38
MD5 e3f2ad7733f3166fe770e4dc00af6c45
SHA1 3d436ffdd69f7187b85e0cf8f075bd6154123623
SHA512 ed97318d7c5beb425cb70b3557a16729b316180492f6f2177b68f512ba029d5c762ad1085dd56fabe022b5008f33e9ba564d72f8381d05b2e7f0fa5ec1aecdf3
SSDEEP 384:gq2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPyBrsS/S9B:gzuh1iYWrTXoPAs9B
TLSH
T18182A32E7B0503F20AD242916A4B68CEE31EC079763A1155345DC1AD237FE39C3BFA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoHotkey.chm

Path C:\Program Files\AutoHotkey\v2\AutoHotkey.chm
Size 2.0MB
SHA256 c867ea63fb647e09266b87ea063cf3f4ba6faac10f77fb78a71b22ad6b715429
MD5 9e430b34982e2e0da564be48db28d07d
SHA1 5021aa3c80606fbf60897097988abf74e1a772ca
SHA512 cc33246b3495240d627d7b8a42a97370d774e79e53b1dbcd7c6b13f423ec29b60c66e0b45536af9230c35b940ad033912293ec0414d2483f6b3b86648bb9a66c
SSDEEP 49152:wh5fDhJDcCsI+D1q/twi/zciNovnCaAHIa1/PGDjQuxx1/x2U7bLI:wh5lJofD1wSnbAHIa1/Ps3t/xY
TLSH
T143A53343CA6FA608F828AE7235D3A15B21F83D3D1863F146D0DFA95AEBD577A3519003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoHotkey64.exe

Path C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe
Size 1.2MB
SHA256 a2a54b8abc476d7671d4de0771bb54bf5f2373d79ff6871d0ba6a62c3b88ae00
MD5 52086b801555ef17e4b51e0acffc70b3
SHA1 cfd57e014de125db717d1381506ab857fcb7ebd1
SHA512 ff154875bb6deff3e17d0efd9e814eda8208ed6dfbb424ab3ad349ba84086cd8023df96cc689d90823a0a48fe96d8e75958f4dd990af7399e521a9eab0b446d3
SSDEEP 24576:A2ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBs:lToMKvPQvOi8AmQNsrlLa
TLSH
T12D459E0773E7C1E9DE7BC1F9C9614226EB31B8640B389ADB2590452EDF63AD04E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoHotkey Dash.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Dash.lnk
Size 1KB
SHA256 0665c3c43400cc2e486ad211b3109fdf1cd305997d50a46276293bdade5288e9
MD5 c3d348851e1a556ccab36c8f0ed7d910
SHA1 4a22fc68274cca399d1ee9593010a1727e07cb6f
SHA512 b5b434e8fe0e86b97215c8e7972b27961d05948cdf0fb292e49785df4af69dfb248926e9a15139c7b23e7d8b029304b2556f255534f8b1325f17d511c5dfd040
TLSH
T1E321F32053F72795E7F3D0712BBAA6716D33B506DA74C71E804C8E8C89E10419E2AF57
MD5 SHA1 SHA512 TLSH

Submit Download

AutoHotkey Window Spy.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Window Spy.lnk
Size 2KB
SHA256 cd7f95195184451541bb1d5d5ed13624a18f7efa59fed71dd85a4424681d48fd
MD5 fdc7aee2151c8f3b07a18f33e479a9e1
SHA1 cce0af3a4d232a9fa5c39c7a775ab7bfbd01abb0
SHA512 0ecbf062d6aa47ae8c5daec9d890741dd6cc0c74749fec9c7b145a5f71cc50ee26c7feaa8a6b45c75069fe7cb6f05de12e78d0a4f020df705960df097e27ba00
TLSH
T10B41F22023F71799F3F391715BBAA6301D37B946DB74C31E814C8E8C89A20519E2AF67
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 10KB
SHA256 54c9b05ae51d6eb69b828dafc4d8e82b5103d04f8cac9be05e38c4df44eca7f2
MD5 b0191bab1798c7103c83314f8b39aeb6
SHA1 5d302395e7cb649edcadfce6ca8b88da7320152e
SHA512 f2d4ed0cb91154e239b670b00fc81d0f8285f3aa6fde6105ce2b06ea580492d540b63c6eedaad006a9ce7196e9eee71e1fb8ac1c42dc82c97814565965ed3070
SSDEEP 24:ruhMZK391jU9xtNwU9BBNwE9F7Nw4N9VvvNwq85q9F55A5MNwH9ln:gx262mmc4HBiq+I56ddx
TLSH
T1A02276FB6B75E463F0A28FB45459B18C9C33072915BC95C4DB4490FB02D1A99913EBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 99d52edfb8447241667e299f52029330095df796c490d6cd114dd195de9bb49a
MD5 47e1c7ebc5e786ad73648c32583af0f5
SHA1 c059355aa322e50c20eafc222e835f7f51497855
SHA512 56c4d8eadcd1113755392d46cd8b4ba24ce869dda16d5957f16e9bba6d697a0d3d1a7baeace8d6a16c2300c7daba8ca81e8a94a5c8ce5409ce0164fc37be54d5
TLSH
T10E61E958F229863FE449413ACD931B416F347456A8AF3F2A35AC604D1E1B2CE76CE43E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 62970f7cb87f7d0c85b521ee31c406e6a1f4d5fa16f0a59635ce208524bf3b6e
MD5 d009c358797831ee2f9da0837471d2ef
SHA1 4c47a91e74adee9559f244095f3cdafcaa9e8d8a
SHA512 93510b8503531a1cf85266d1f66d6216b4427fbcc0c1d5251629b273295f0d31894ac0d80c797460b718bc0a0fa873530c65ba2b9673452a783702902fbbc71d
SSDEEP 192:nQcOv5zboP+ZxLpyjO1iU1d66JozGzgCl6mc0d:mbomZNpyjUd66JozGzgC1j
TLSH
T1CEE12F64E629863FC409027BDCA61B414F3A388A9C4E3F2935ED741D2D872DE768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 fb33d4eee596367f9899e5eadffeddbdd50384f44cbc3862383b7828e9b807e4
MD5 94be1a21d736bd10e877bfed0edb4b89
SHA1 607c7e468e086a40d018cb9be46f74a58c23a23c
SHA512 78282012148076035cc3a1e0d87a41885967e2531e7200613feb7563b323faa46e921e983a002c4c5d097ec4b950ed073b55543d8484d58583d472e8e1a33aae
TLSH
T12621379C39B88D6B5CCBF69C785112CE53658E0705D72D830D22FE8CCEA1ED9316A839
MD5 SHA1 SHA512 TLSH

Submit Download

2f40dc9b-4174-437d-b192-c3f83c5f03c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\2f40dc9b-4174-437d-b192-c3f83c5f03c9
Size 886B
SHA256 057eb4ccc59d0d9e7bd7e9eb3d8c925eaf9788da1d870a6ce4a8135b116b8026
MD5 6774ad98f6bd35451d5c1307f4c7ef6d
SHA1 2843ddf787d6a0bc876fb55dabdabfb986b4316a
SHA512 8c5b4524bfa1e28928731f4f4aa2b2e2f920e67bd861f27c2f8f3106fe96585b6ce3541290663887088676ce916a81ede3d2b1774f49b290c579be027a7fed7c
TLSH
T1F01140805A35B5B28D7C824F94A17743C6E4721380CA29247EA59A180DEF41F93A760B
MD5 SHA1 SHA512 TLSH

Submit Download

9cdf4008-1bb7-4058-9a55-b70c27d90262

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\9cdf4008-1bb7-4058-9a55-b70c27d90262
Size 235B
SHA256 024e46b1880d4dadde5e28e2e7992bb82d65158d9ffd1ac3790a5f7efad97796
MD5 3320ddf22751ea3498a73617f58dfb1b
SHA1 67493269651b67dc7c56a40bcd70595fe405fa07
SHA512 c43f5c3ce544a82ce05a621fa5abc7c68df15dc874c702390259c6cc36643e54e3243e4402821fcb4350dabfbcfee5badb409ac0f6c2bb523403f3defd06f77e
TLSH
T1E9D0A79124DC77AD0C145F07F0B57AD631898C3714649824A99145789DB9DC95362937
MD5 SHA1 SHA512 TLSH

Submit Download

ab93e36d-a142-45da-b6f2-ca1813a29120

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\ab93e36d-a142-45da-b6f2-ca1813a29120
Size 2KB
SHA256 29b35a941a43a217f20bea02540ae48703808385baee1d0d3dc0cfe1756b6d81
MD5 f1e80a560cb296d893cdb1abb1b2275f
SHA1 ef21e97c4ada6a1b0500ab108c8bfa5f5e7fc617
SHA512 d1d6c75ec2133661809fe857c9a9d18b4b1ea3ebf009b3b16123020812028abf69b973f42645e3a288282a2f54d0e0d109a1f42987888f832eb6573e36b4c30d
TLSH
T1B041135C37784CB78CEAE19DD081279E57A8460310C62C532EA2EE0D8D9B65E736A53F
MD5 SHA1 SHA512 TLSH

Submit Download

c0a7ecf9-0e30-49c9-a09d-2f7a3f7b3d9f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\c0a7ecf9-0e30-49c9-a09d-2f7a3f7b3d9f
Size 883B
SHA256 babb06b48f4386dcc97f681a961e8f5e07014bd4e4f13245827390eec978118e
MD5 4b90ae0353aa1061ac27345c741cb5df
SHA1 ac97cd36c0aa992f8f598a47a78012e6142a1c42
SHA512 1c33fe3f94d26eb79fabd1287626ab73b813e01439ba3003c52f83b063d0e4a651cf4b575f8e7004c1a76fdf070ecb5f370a0e2e7ebae735c4a6b14a02080b3d
TLSH
T11B110040A636B5B28D68D24BC55137068BF4761380CA64243DF1AA254DBF82E97AB60B
MD5 SHA1 SHA512 TLSH

Submit Download

d1e85eb9-2da9-42bd-a484-48cac61d09c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\d1e85eb9-2da9-42bd-a484-48cac61d09c4
Size 16KB
SHA256 ee7f164a0e0f42d5a8f5d6fd744f84b69affa22a296c5f3cad14a019acefbbf3
MD5 71c4f31a00c4afdc30b9f3fa251b44cf
SHA1 1dbfbd1911754f18fe4e6f9f7d353b79f28936a0
SHA512 1b19c9036fe15d7440a0b85881357840c15ed2639cb1ad0683fa7e969d1242c5569339848b4a2425ac8e82f49e6d24d225422c88d17ccb7fb6cac31bb78a103d
SSDEEP 192:vC3Ng6V1Zfd1pNV7uBaRveD8hTaT0Y7rKzpQSpn6ENQLD/UzGQOoiaeBaif4/HZ9:adg6Pz3S4eD8hu7rKFQSpn/w7elYDO
TLSH
T18772D856243045BAC651E3A8D4F8BFC3E5F528CF8C419FCA9BE4BD0869DE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f69568c0-216f-4af7-bc0b-ddb3b7a9c038

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\f69568c0-216f-4af7-bc0b-ddb3b7a9c038
Size 235B
SHA256 39057b97113359833cd0c6c1b7ba949ce8df71a1924c4e00eef7192aaac58f5b
MD5 72018ba7e4b454d1e6dc7e1971c00b07
SHA1 a860994fdf771c67760b01ec1ce14a41ada6729a
SHA512 7a6e430744a0ed980d497f5b7c8de2da8cd84246be7269cec49a30d26a2baa3e32ca2ea82f5f133558a1a74c7cf7fee3c5930aeed01deee83c75a79db9e2b626
TLSH
T19ED0238828A8675C48010F07F0F02CC6318A4C33ECB09824D6604075DDFDFC9812180B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 2ea03c8a61f5965f342c5447d298a23b27bb9f8266aa78328bfd7aa48a2e4feb
MD5 9587fd498634d6eda0173d9a6191af99
SHA1 2de6012dbd4be4f9726bab8c8176a1ceaa8bcc46
SHA512 74e3a237e0b207196d659a3501e895feb8a25f71109c8086260ee0c122c2ab2fd7150fbd5015355ac80ff912f86a6dcb6093ed94687990a693cc99ec6ef40428
SSDEEP 96:xHi+UTUHqGqgaf0AC1zSXSSlmdv9jzsnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0ACiSSqz5lfWTBw88qV
TLSH
T1B8E12E7894088F7F64B67BACAC688C716AB2013BB7BF28D750B55485054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 fe77db3144c672a4508575648c86116acac344e9d71b5971823a2b98c2ab1646
MD5 19cc9afe9b2a532e9599ca25d5f9d7b0
SHA1 8a4d188151ea309564cf744e0d90a211e9ae0f03
SHA512 ddc639de13ca311e2a4b9fb27c41cedd9c771eaa9f54d5441dd7b2439a3fe8540865048c6d23dbdefda4fd48eb7a706f73dca233e488f164e2638a1539cd0f42
SSDEEP 96:xHi+UTUHqGqgaf0io1zSlSSlmdv9jCnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0iosSSG5lfWTBw88qV
TLSH
T1D5E12F7890088F7F64B677ACAC688871AAB2013B77BF68D750B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 c9b3a8cf7df1d6db0b4f1f313a27ab8927c9864d8157ac65a81245c48edbea32
MD5 16dba0a1d4186eca8e1e49fedaf35481
SHA1 30a78d193a30253bb906b9711cf5c4000258781c
SHA512 0016aef4b9c56f73af25adb5f81dbf78dddb201e3c4f62aa41dc6faeb3e29f48391ff80f9e9e78d6a861b55688cff0ab5306ef1db26cc5c76c4c3242f2c0c73b
SSDEEP 96:xHi+UTUHqGqgaf0ACkzSXSSlmdv9jzsnuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0ACxSSqz5lfWTBw88qO
TLSH
T1F6E12F7890088F7F64B67BACAC688C716AB2013BB7BF68D750B55484055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 3f6fc9290ef86498a98656ca613dd7d31b98e0d3795f56ebb3ee2c506478250c
MD5 5fde77e3c03ed8ac01ff86b5bc836277
SHA1 230ca1b10598f480c67c130e98863cbfb35e9368
SHA512 8fa3c48c6529fdc3754757795ba5031d525240e9c28a9cd5f872eae550294c5fad677153aa5d7f8b2e94a203b4f2d5583425fd591278942b8e860c62a8b25aa8
SSDEEP 96:xHi+UTUHqGqgaf0io1zShSSlmdv9jCnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0io8SSG5lfWTBw88qV
TLSH
T126E12F7891088F7F64B677ACAC688871AAB2013B77BF68D750B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Untitled.ahk

Path C:\Users\Admin\Documents\AutoHotkey\Untitled.ahk
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/1292-1-0x0000000000400000-0x000000000095B000-memory.dmp

Download

memory/1292-0-0x0000000000400000-0x000000000095B000-memory.dmp

Download

memory/5004-364-0x0000000000400000-0x000000000095B000-memory.dmp

Download

memory/5004-184-0x0000000000400000-0x000000000095B000-memory.dmp

Download