02feb55a5b1c1b7035f2b7081499eafb2bc5e3689ad393f9be757bff0a53b1cb

Analysis

user interaction
yes
max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ThaumcraftAutoResearcher_v1.2.1.exe
Size 85.3MB
Sample260803-lt9p2aff35
SHA256 02feb55a5b1c1b7035f2b7081499eafb2bc5e3689ad393f9be757bff0a53b1cb
MD5 7716909195ce585dd8fb5926e2547e9f
SHA1 dda7fb65fb259e7a25a3fa3ef8380e21e6684abc
SHA512 71d7a4159877756fa5b8d262b444e307fa39e480c4dcd0ebd34566e453fa8260c845e758136ac83007075395e096b8fdd920708fb9bb4e0786283f009e2265b2
SSDEEP 1572864:wjS6XGMK4XR3bLSCU/+6yPl3Bhw1vBlrRQ1AXmZhzi4K4C2+5oB1AtlNQSqDs:wtgYRPSC++6y9kxRQ1cA64psKOvQSP
TLSH
T198183340FAD42CE6E99D26B8E069C517E516F0CB677144AE8035108B452BEE13B3EFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 44 IoCs

pid	Process
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4568	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302243625644099"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1120	ThaumcraftAutoResearcher_v1.2.1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1120	ThaumcraftAutoResearcher_v1.2.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe
Token: SeShutdownPrivilege	1372	chrome.exe
Token: SeCreatePagefilePrivilege	1372	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe
1372	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe
1120	ThaumcraftAutoResearcher_v1.2.1.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1120	5036	ThaumcraftAutoResearcher_v1.2.1.exe	85
PID 1372 wrote to memory of 4480	1372	chrome.exe	94
PID 1372 wrote to memory of 4568	1372	chrome.exe	96
PID 1372 wrote to memory of 4428	1372	chrome.exe	95
PID 1372 wrote to memory of 4428	1372	chrome.exe	95
PID 1372 wrote to memory of 5828	1372	chrome.exe	97
PID 1372 wrote to memory of 5828	1372	chrome.exe	97
PID 1372 wrote to memory of 3184	1372	chrome.exe	99
PID 1372 wrote to memory of 3812	1372	chrome.exe	100
PID 1372 wrote to memory of 3184	1372	chrome.exe	99
PID 1372 wrote to memory of 3812	1372	chrome.exe	100
PID 1372 wrote to memory of 6040	1372	chrome.exe	101
PID 1372 wrote to memory of 6040	1372	chrome.exe	101
PID 1372 wrote to memory of 5964	1372	chrome.exe	102
PID 1372 wrote to memory of 5964	1372	chrome.exe	102
PID 1372 wrote to memory of 2216	1372	chrome.exe	106
PID 1372 wrote to memory of 5484	1372	chrome.exe	115
PID 1372 wrote to memory of 1664	1372	chrome.exe	116
PID 1372 wrote to memory of 5208	1372	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\ThaumcraftAutoResearcher_v1.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\ThaumcraftAutoResearcher_v1.2.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\ThaumcraftAutoResearcher_v1.2.1.exe
  "C:\Users\Admin\AppData\Local\Temp\ThaumcraftAutoResearcher_v1.2.1.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc6f6ac728,0x7ffc6f6ac734,0x7ffc6f6ac740
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,8630253822071917474,696333781908990875,262144 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,18084528319984036780,9640133249199371627,524288 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,3248256900198124403,8535782039074018297,524288 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,7509373390843028627,4331400108990650101,2097152 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,17298685622944060296,16112852677450437426,2097152 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,4783237954760914347,7278045124119267847,2097152 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,9878649888788259156,1462404713381006262,2097152 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,9348108716560676050,8368927121389462995,524288 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,12397103616382170519,8307943045890312609,524288 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,939219956101971784,2233036371211467147,524288 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,5074979630503175428,10954842090230529752,524288 --field-trial-handle=2012,i,17909552530165243647,11326305392671807747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:5208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d92f9494cfe9c246b5839c2303fa976cf64c5c207a032240adc8a419fd05420c
MD5 0ab9f86dacc947a893af23a3a8a333f0
SHA1 97c94e61f839d2974a252b7b6109182d21f159d2
SHA512 d1c7df645cea8d51ddbdbcdaa2ca9603776a9633e5fffd70d3458b5c99b5d0884bacb69d782fb4a0d35f166aeaf483c400634ca59e2a03979dec7498466df2bf
TLSH
T1C8E02BA9D9A1DC3B0CFD176D60510749E6551307364088DF3B3C99198FB523A435AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b5ef07eee950c3764c72afde15bd83811ce58f1c982ee94f9e655736a1d64078
MD5 a3b86df173e0ea4dd56b998eda5795bb
SHA1 aa62061c72652d2ed07e83a0c316644d63cb7d8a
SHA512 79252a6444a04d6cbe19a346669f1435c512459db0f6f6b9fdd1167526fb3d08ad10dc3384419249e189cc2a764af03e072f44919c470e2b9669f09023e252a9
SSDEEP 192:MRmxn43fC704QUsUv71hpAPRp2g92Hsb+WNndg408e+2aS1aQ5VyIsnAUgtaJ:MRo43KviQBhUXDQw6408d2aS1r8
TLSH
T16042D66EA914A97B6CDBD22AFD223B53D7F5102120E11EC4E6FCC92C15E75CD222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 14d7e185f7c9b35b18b1447fb45b9e5cdb8c92843c7f93de433e97bbe10c99b3
MD5 224f156fd70e8002541631e273ba5c7b
SHA1 60a9ee00677fc736cbe311b48fbb0f63916b958d
SHA512 2b3e1e744b8cf575e9dc4da0ba5994bfc2945e5018a023745d534f375fd936718c348fe7da8cdadb3e9d62024df8eaeb7ffe12f0bc1fbd0d17a2bb8f23770d0d
TLSH
T130B0128180016642C00702F4214654C873149F14DE0B170943F4B97288255508024060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5917a5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5917a5.TMP
Size 96B
SHA256 bbd75af7df081e51a147ea3213b7fb5dad00b44a9aa5a82b7bb5037485bbb916
MD5 a4673fe23c4760e7beb06c2c8756089c
SHA1 c8f468645ffd774f62965f5ad57fc3cd1820bfce
SHA512 0173334c24b6b887f06bd8ebad108501e1ad0e7244a89f689314960dd3ae4667f3a5cfdd0c61eecc6f59afa94a03ec926545654b350a41098754b5819267c223
TLSH
T110B02220C0022202C00323B02A8882C83020EF30C203020E82F00A23CC202308032020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 f8d34659b4cd2544c29a50d04fc3adfa503bf6e7666e5f419e31b2a69bd11411
MD5 059ba266cb82dc24996a69d437831a43
SHA1 ad2de1af64b57f17c6e57598091eb95e023b0d24
SHA512 6cea75f482b92b4544393c6c13f2d2aae1e560b446df122cbb55c3e923a0707133b4005996f0b6456e8d195c6fb7165f176245b34e403e1cd759eaffc392ea7e
SSDEEP 3072:YH6UOuTuEesztbpAkNo+wdnsKErA1aXb9+PnLL1fk3NGm7D5Lk17ox1tIpud63U6:ULzF6qrE/vBkEm7Rkm1tYpBeh2BAoj
TLSH
T14C3423379C11FD3E5D6AA706B00D0B6F4CB12A43C470E9BD8ADD120D26D5DEB6A46E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 42dd20f66fd32001c23cbe52a3c460b66c50c44dd59b42b2b798f04b3548fffc
MD5 27e926ae042589a1181352ece6c99ddf
SHA1 9804f399aadb794510ff1bb6f6cbe27bc53c3711
SHA512 48f474e8988d5c633c8b748896b89f462e7dea91ce5675a7029f08e7c6bd9d6559e707f09b651082fdb20f4c6aa6a1795bb117a2c1397a5017ad0e6e8b696880
SSDEEP 3072:fH6UOuTuEesztbpAkNo+wdnsKErA1aXb9+PnLL1fk3NGm7D5Lk17ox1tIpud63U6:/LzF6qrE/vBkEm7Rkm1tYpBeh2BAoj
TLSH
T1DB3423379C11FD3E5D6AA706B00D0B6F4CB12A43C470E9BD4ADD120D26D5DEB6A46E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8451babf850179ead1a6a8f4bd9d2bdf610949754edab4902d188b35caf58e43
MD5 0235d0811c962cff368a10d1cde2e8b2
SHA1 222ec152dcc485b0a89efb03af0098ddd5d4d5b7
SHA512 e0477cec0c0cfe0993f5b37050b04b35515690bcbd0bc5b1da8e576eb657d413c54405ff49e86b434ce76c029823bf5e1055ec968120fc3f1537091c731223cf
SSDEEP 3072:NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Em7Rkm1tYpBeh2BAo3
TLSH
T1AAC312275D75E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85A0437EA7CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
Size 213KB
SHA256 ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979
MD5 d6b2c2d2851a63b90e7210a943d0fdf6
SHA1 642bfeae924b9d4e6ed642b5946ac8e745cfc531
SHA512 64b43766740e11a9e5cb370f9ca26f80c5a379015e1804128e0b4f206c5e481cc14bce541c9caf99482eb334599c6aba34c22006fa6992dfe1fe842efdec132c
SSDEEP 6144:sjTLQQOvUVTTPDlxkP8VXaVHaT8fyFmiGJZMzEKAqsCbb:sjTLTPGgn
TLSH
T14124193A52580061DD7352758C63A423E5F2B262073256CF09E0C7756F27BE9B7BEB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PIL\_imaging.cp313-win_amd64.pyd
Size 2.5MB
SHA256 34b9fbd040c46776f343c65b9ecd252c1cf30e84def79294d7e2675feef1a363
MD5 5ac8af8e9c61c834e079f8b2cca141c4
SHA1 7c290977f9aa0182cc71f0adff10af065f1c45f2
SHA512 89fbd288835bd27a1a7bff1e0e94a865304abb4e6a11f844bc1a586817d70c8363fb5d1419612ea2fe2a5af441fe79de95ca4bc9028e168c7b8cdcb4c7971b6f
SSDEEP 49152:oPIKflhdHqzy4Q+KncDt/W7yFav5zlm7UYsxmAZ:60acZFav5Cvba
TLSH
T126C56C06E9E19599C6B28034CDA6C216E3B1B80D17F187F77684A7F53E23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imagingft.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PIL\_imagingft.cp313-win_amd64.pyd
Size 2.1MB
SHA256 b45eeae50c452afd5fe54f475ba14b3a543cf4124752dccfad12a24b6ebec86f
MD5 9d7ca2093d0c84fd5fbda899d708bb86
SHA1 15780569320190f0c3e29c22b6b0779eb88537f1
SHA512 b59cd243eba2b1dae525de24c01de6b05e573cbf485803ef27b18f7109ca93410b178d84ce1d19fb59630fb8026ed4d35ca2056d5bd3eb062f72f32b6a600110
SSDEEP 49152:G/5V/calYLz8PYJ19FbVUFKwhgGDflVCZaxik4Fl:GsAfgl
TLSH
T1B7A5BF46E29611A8C97FC174C257961BE3B174010304ABEB65E48B99BF23FF52BBE314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\Qt5\bin\MSVCP140.dll
Size 576KB
SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
MD5 01b946a2edc5cc166de018dbb754b69c
SHA1 dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46
SHA512 65dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5
SSDEEP 12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
TLSH
T1DBC40923A74901A0E196E3B891C78306D7F17C468312E3C792FAD66D2F5B7D5AB3B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\Qt5\bin\MSVCP140_1.dll
Size 30KB
SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
MD5 0fe6d52eb94c848fe258dc0ec9ff4c11
SHA1 95cc74c64ab80785f3893d61a73b8a958d24da29
SHA512 c39a134210e314627b0f2072f4ffc9b2ce060d44d3365d11d8c1fe908b3b9403ebdd6f33e67d556bd052338d0ed3d5f16b54d628e8290fd3a155f55d36019a86
SSDEEP 384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
TLSH
T1F9E24C8AEB688883E963587085B9DD47FC3DF7D15B60529F1259E7680CD33C2AB3461C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\Qt5\bin\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\Qt5\bin\Qt5Gui.dll
Size 6.7MB
SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
MD5 47307a1e2e9987ab422f09771d590ff1
SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
TLSH
T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\Qt5\bin\Qt5Widgets.dll
Size 5.2MB
SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
MD5 4cd1f8fdcd617932db131c3688845ea8
SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
TLSH
T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
Size 43KB
SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
MD5 6bc084255a5e9eb8df2bcd75b4cd0777
SHA1 cf071ad4e512cd934028f005cabe06384a3954b6
SHA512 b822538494d13bda947655af791fed4daa811f20c4b63a45246c8f3befa3ec37ff1aa79246c89174fe35d76ffb636fa228afa4bda0bd6d2c41d01228b151fd89
SSDEEP 384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
TLSH
T156136C4597BC8086E46789B0C0A6DF17FE38F6926760928F0B65D25D2F537C0AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\QtCore.pyd
Size 2.4MB
SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
MD5 678fa1496ffdea3a530fa146dedcdbcc
SHA1 c80d8f1de8ae06ecf5750c83d879d2dcc2d6a4f8
SHA512 8d9e3fa49fb42f844d8df241786ea9c0f55e546d373ff07e8c89aac4f3027c62ec1bd0c9c639afeabc034cc39e424b21da55a1609c9f95397a66d5f0d834e88e
SSDEEP 49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
TLSH
T1C8B51957631965D4C4FAD638C90F860AF6F370111346A3CF24248BA92F637EA6BBDB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\QtGui.pyd
Size 2.4MB
SHA256 a9408e3b15ff3030f0e9acb3429000d253d3bb7206f750091a7130325f6d0d72
MD5 ae182c36f5839baddc9dcb71192cfa7a
SHA1 c9fa448981ba61343c7d7decacae300cad416957
SHA512 8950244d828c5ede5c3934cfe2ee229be19cc00fbf0c4a7ccebec19e8641345ef5fd028511c5428e1e21ce5491a3f74fb0175b03da17588daef918e3f66b206a
SSDEEP 24576:SUjOoTFrwI8nc6EmRAQ9RzgpP2bXYUKuXeLQp5PjYq0zb:SUqCgnZXRAQ9RzggbozJLQp5Mq
TLSH
T12FB53A1B531934D4C5EADB3C890F8606BAF37016134693DF14258F692FA37DA6ABCB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\QtWidgets.pyd
Size 4.9MB
SHA256 a1e97a2ab434c6ae5e56491c60172e59cdcce42960734e8bdf5d851b79361071
MD5 e8c3bfbc19378e541f5f569e2023b7aa
SHA1 aca007030c1cee45cbc692adcb8bcb29665792ba
SHA512 9134c2ead00c2d19dec499e60f91e978858766744965ead655d2349ff92834ab267ac8026038e576a7e207d3bbd4a87cd5f2e2846a703c7f481a406130530eb0
SSDEEP 49152:Qi+reIG7QwktsFPKoe2yicbbqgkcY9abW7KnTYK2bjMkTDGM7y:uqT7Q1kyTvoWW7EYvM9M
TLSH
T1C436F803665A71E8C4FAD13D8A4F4602F9E37099035B93CF1C264B5A6F637E1AA3D748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\PyQt5\sip.cp313-win_amd64.pyd
Size 117KB
SHA256 7a54c971af695af612a1cda68924a2170d4a2afe48dd32770b60fde5b2dd7dab
MD5 2d6576a84b75174a95410762971fca3c
SHA1 11b7a1b56fd4ca01bae27692b57fefcaa9f11ab3
SHA512 b8aeb89f03a7f5079381693695d622386b2ed1ff93b6f7eb80c509624a8568ba56ea573b3f9882f4af205b4a4ff8abf5a624d6e4c68c342e1c2e62608ed0cb0b
SSDEEP 3072:lePO8Y+E74YgjAlluOQxD1Y6QqE9Icnbdrc:lePOV+YgclkVl1WbIcnbVc
TLSH
T1B0C32A5B73D8008AEAA6917C8833A503D7F3B461271157CF12A0C65A2F67EE67DBE740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_asyncio.pyd
Size 71KB
SHA256 423007b8c7d63b4cb5f23665a761dd5de1c7e15a65c8013391de0d18c89ce417
MD5 47520f35aa9c07fcc1215afb68215a2c
SHA1 866155b8d608881996abfa0347f6f6c7252bd213
SHA512 0b05db220ab6a20da49b22a337a77b9dcf9006087d3e8335dfeb8dd2d272c262dbb19ef1a0dba68f0124588d1cf4b347837cad05512c3ad02396df2f20fa2af6
SSDEEP 1536:Fi9HPOnui7hkc5MC7UCkUoRIIvnvy7NsR91fIkq9:Fi9HPOnuiqoMC7UbTRIIvnql
TLSH
T1FC638E86A294418BCE97B274D5736F53FAB0F6920901575FA0A8C28E2F533D193FE712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_bz2.pyd
Size 84KB
SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
MD5 0a18953eb45266704171cbe54c6dd261
SHA1 15f7edd8d0ac559d912d64503fd68f1a8d4c58f7
SHA512 e5f1bef48695b4fae556113a2ccc6ed1e1cf49fa319b94f052705e809eba2543db16fcf955ac9c01de4d81746c90abc85d717004b6b3b1071b27696c6838068b
SSDEEP 1536:QVF5z780RCmmgKRF2OXvLJnmEmdBv8ZEs8iEEx0ZIILVfy7NsR9QfIbHbvTcE:yF5zIjmNAAOfLKdB0ZXjxx0ZIILVdTl
TLSH
T194838E47B76461F6F9AF81B496910353F730BE960710A3AFB24482953F13B91EE6831A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_ctypes.pyd
Size 131KB
SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
MD5 b865b6717d0bb9c909c21997e5e43878
SHA1 6b7bc1d2d8a5fa1816b8c83806c8bda0d766c4f6
SHA512 a1cd8e5e1bc5b5ee78226eb9a3dbc2054ae7ca2cddb592eb287606aae3ade7e76f821b036837aff15675a177938418d8030841b3fab667c0288235b2595abb75
SSDEEP 3072:iuZHKSoKYuYz5sdf/FVzy4PKzblEUS1IIyP7Tv:doR8f/FVzyIKzKUS0v
TLSH
T1F5D38E0B776800AADAA78178C533AF47EFB1B453161057CF02A4C59A2F63B966E7F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_decimal.pyd
Size 280KB
SHA256 398117a6af493e34f56ec0d78ced9901b20b8e895686ce5966edeadb23507056
MD5 0ba233f4afd6a256463b252e00bf4cb5
SHA1 4a585ca379e1157c0124067a0f2c3bad87bf6688
SHA512 24afacaf1db65f89eb62ad2fa17fb91c96354656e45ad595a1c84427c1ee31ab8bb87c509b9c119c4872b0a18792295600d8d1cab7664da2eef0aae2b001f6e0
SSDEEP 6144:rL107gegKHJ/lvdr0bCGqqM33fIWeAssREsMbbd3:318gegKJlvSbSYN3
TLSH
T14F546C57A3890CA8EA7780749A579F47F7B278860360D38F43B48A973F93792236D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_elementtree.pyd
Size 133KB
SHA256 fbce9a1190a228c59767bde785c27cc4d18ee3a1f6b46e9da042fc86f8d0def7
MD5 fb1961a466afae0f555b2f63b992233a
SHA1 0101a3a05d70898bc1208018656eaf57ebbc3fb1
SHA512 4f1f5e5d812e18f470bebf6b8a8996b00689ce50cb3cde0f658d2b7a4a4378a6df16eac2eeeb6bae23ed8cd1a13be430df021d73b07a31f187bd8c9de495d402
SSDEEP 3072:01Y7oarG330QHQER5C5P69dBVwjb0qf/5e1aBpIIzfaTdy:01r30Qw0C5P69MFn01aBMdy
TLSH
T19ED35C8B7265C06BE0924038E2678F56EBF6F8A20D0087DF1284F29D9F733957E69715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_hashlib.pyd
Size 67KB
SHA256 50f3ce7a2281fd32f378f3ba5067bdd13e18ee95877db5199c6a0babdc9c516a
MD5 7715e3df55b6783704fdda2a3850919e
SHA1 553bf2e027251497c2b40cbec2fade2c5952b5ab
SHA512 f9b4774a34185425b630aabc6be70e5c974d2aa87690044695e9ae33368363321abd2505ace723f7ee1cf04041ff98dba0fb918b3d020419d9db7a66d3af3396
SSDEEP 1536:9qXn1yAu1lEAXfXVfcV5TaSZ6CARIIvIcy7NsR9tfIksk:O1w1uAdfcySZ6CARIIvIVy
TLSH
T1FC637C95AA894092D96382B6C4A34F83F971F35217119BDFA2A8C0CD2F233C39777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_lzma.pyd
Size 155KB
SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
MD5 8aab96a90295cac7b047fc706a118823
SHA1 e9ce0ae765d65ba9c4d7d3f9cbf61622f5633ca2
SHA512 2a10aeb5783bd1d99dea0200f577bdeb95f36dc328063fb8d3a54fb70e7ac74251f03d424f2ba4fcdd5359f92d6b9106a124403bde6dd154bebfc5c7b7fbf6f7
SSDEEP 3072:mK1fxbqH1ZTffdFj+JnTqznfB9mNohPRHdZII01dkTB:m6Jbq7vsnTc5YOXHdwIB
TLSH
T1DCF34B86B794F0E5F3728C38D6624F57E6F5791A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_multiprocessing.pyd
Size 37KB
SHA256 4df0d8f9da454831e96389c145ac9ea0093e09749627a3717ff60d21218670c8
MD5 3f48b72a614af5bfa2d39f0e1902f066
SHA1 12441f50f1329e637fff2dd3df1b602efc8da77d
SHA512 7b728d9c688ebb44e24a2a994ca5f1f65bbe5f06421b9991cfd67d2dab4244afb3cd872d0fd14ad8412389dccac658b47b5e5a6e58bc2de94c78fc4f05de19c0
SSDEEP 768:mrf5SZTRMQ6Dp2sMIIntUhy5RNLaRYT2Ip40Txf1ml9dHEbgjLTct:OfCH6Dp2sMIIntEy7NsR9ofIbHEbgvTI
TLSH
T107038D86A6684047E563DA71C6A3EF87F535F7930A11865F31A5C2CE0E373C1B36A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_overlapped.pyd
Size 56KB
SHA256 53fe68819f23fea7f6deb0054623e936cc2500241061f29bd5288cf4a511278f
MD5 b48c98beee1d19164be31ffb78a8082b
SHA1 fc042b9b8b15a95f04bafd67e129aeed68f14299
SHA512 9f7a5fd7827f9705baf9b7c92932edbd1d621ccf1c7fb05bfe8ea2698122a3dac29fce333fa045244ac10bfd291a9ae603b4b11f6423dea19c216db691499988
SSDEEP 1536:4+yaLbOIfPsM62PZMp3tF4tIIWtQy7NsR9XmfILOB:4RyhPapv4tIIWtkHk
TLSH
T199437C4A679401DAEC67C179C6A38E03FB74B2D35601972F61A8D2492F73392A32F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_queue.pyd
Size 34KB
SHA256 b5b5368026c33ade7651fb4cf4c6c1ca7eecc9c8cdad0af007da8a3ac0e067f7
MD5 46e2bc8ea5bd7b4ab0348065865faa8d
SHA1 66c4c72e835c268d1501ba593dc4d01806845b96
SHA512 7d8f131d88115cce87c46f8f73752143bf7b27e313f2a04d5095698a973ae4cbf0f8a231a8a35e44ea9b8b2116e6bbb4319365a927763f732725364fb6af1461
SSDEEP 768:3+Z+6ri+fX1II9Ujlhy5RNLaRYT2Ip44Txf1mlIJClM:uLi+fX1II9UXy7NsR9EfIkCi
TLSH
T1D6F26ECA9E6C4487D663D630C1A3DE92F935F7935611879F306982CE1F233C2A366359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_socket.pyd
Size 84KB
SHA256 8676f3cebd9d01c7ad51a29b3f7ff429c0a8f6bc564cab21eb6cdaa2e26fd259
MD5 62b775fc816033e9df749b5fe77cc921
SHA1 9966268c186c99db7dab32749fd7acb5f0d4c6d0
SHA512 daa1cc564a67c431f3091b1658426cc019088f52d9dec8951c9620b442d6e3f401d37e9778133b63360f8e310e5e7635d676747761d6b5e202538b6a0fd9c0e7
SSDEEP 1536:iFl/fFBFu9aBvtgYKyNEyJwRQlyJ+i+nzFQwLvxtq388Z1IIywDy7NsR9UfIbH7S:iFR1u9mvPEyJwRQlyJL+nzFQSvxSx1I1
TLSH
T10C835B01A66040F6EB73D175C2679E63FB74B1C01395A75F0066C65A2F33382BF7AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_ssl.pyd
Size 177KB
SHA256 b8118580b461801df12ec12d3d666aa0ebc2b3750bcf92b90b92789b152bf856
MD5 9a4ef2f2b5d0e273eb96c8f4f83fa4db
SHA1 5e03564da19a815b75dd667cdf889d6ac3952ec0
SHA512 bf391ce160ba50cd1fcce3e51c071957d3ab7b1c2d2bc9189ef5331293e8d2fbf66772a5541f78d1bbb7ecfc9e552f48fc3d4066cbfb83a165003533a0ea9d3f
SSDEEP 3072:c3fN4Ub9zRO5RlfU6CAA1UOmI7IM/cbPuC/JZZIIL7Gh:c31/b9zRcTU6CAhOs7O
TLSH
T1C8047C47B6945AF7D813E4F9C2234903EBB0F155331247DE48D6D6490F03B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\_wmi.pyd
Size 38KB
SHA256 9a7255064ea143895b28efea6d78e9e518bac290900aec52a6a0435c36a172fb
MD5 5642ebdad727e582e20e429852885f0b
SHA1 1b686faff069886e3d9b7ddd1d7d3299eb424501
SHA512 2c8502137e4a6871b0ce545984e70e5b21e9a31c2d3b43d43d155304ca1c701fe7ac0f4ca20ac009b03aee2d91626a0831919d13f03f7997af63a48a36d1fcbc
SSDEEP 768:u2/EEqrVmjs+uY2cruZIILiYhy5RNLaRYT2Ip4XTxf1ml9dH3jLTcQfg:TE9BEGY2cruZIILioy7NsR9dfIbH3vTS
TLSH
T1F7037DCAE6684082E667CA71C5A6CE43F575B7D31712978F326582990F333D0E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\base_library.zip
Size 1.3MB
SHA256 882722b8a569944856530b131a99dee159dd2e18c90b1ef87da3a11782bd67e2
MD5 32c9763ddd351999ffe041162bccadb9
SHA1 be4a06fcf2aa3f0abccb8ae3da8d07370fef42e1
SHA512 08922c9e2bfba1ef5cd2a4c22134fad4049e0fd6e14dda9721b1ea45f526034e76a8579e4d318485bbe95c441aaa4b678914357ac3e9a7b6c1b3d3ce1a114eb8
SSDEEP 12288:wW7WpXuIva80201jwCVRDVoioSYBYwtYzGN8TxFwtb5GUjEA31i2cPPdxhYPL+D5:Z7WpXlsSuTxFPUjX15cPPdxhY1dZc
TLSH
T1AC551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unknownAspect.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\images\unknownAspect.png
Size 1KB
SHA256 80981a521983b80966c920c4878f9ec74ac0d6c038a0e744068cf9a0981cf4ae
MD5 fb5d535842fd50132bbd555496ee33b3
SHA1 eee087ad383972ab7714e3e465d467e1b472fe03
SHA512 d8eb303c202a64fe45b2969942601022e2596b5f67620f5676e1d979fa90919180d3b877d44eb162278de4c20c7308a7cf2c75a6eccd0913fa56f54f41d1419e
TLSH
T1A8219682E9B479A6960DDC5A747820C14C6199BB61127AF0E3350FB3441C76553B9AC9
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\libcrypto-3.dll
Size 5.0MB
SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
MD5 7e8a8461fcd43c82841a99a2054711f1
SHA1 a931808c56e3a117795491965cb3f679cdc05886
SHA512 023c34e26b7dc7240d4571f8f808bdd0b749bd6e924948c3db9c5bb4f7acf24557d3a94bfe6ff82697f9747b35c13a73b94482dff3568e1dadb8fe08b598bc61
SSDEEP 98304:on+c+4Vp8XhjqO58Pw1CPwDvt3uFlDCQ9p:mPTVpghjqO5841CPwDvt3uFlDCQ/
TLSH
T147367B6AA7A80189E4BAC13CC9534617D2B1F81A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\libssl-3.dll
Size 776KB
SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
MD5 299335af4f92df8a446d5f98d6e9cfc4
SHA1 75ddcd4863ffde24d22914946ce4e085722dcdbe
SHA512 2da67c01775d71122e6bb951b7e5e7462e8725f79b513551478cd262dae2d97e108427241d13f4fd6ef1d35b739d34fb9c999ca4a6d50271ceda8e0c3dab313c
SSDEEP 12288:8VJ6zW/kDXMeI0niRBRKZk60STGaFc4rldFe9XbC:JDXMeI0iRBRKZN08GaFFe9XbC
TLSH
T1D3F44CADB37C05DDD8B6C17986934623E3B6F4162330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\pyexpat.pyd
Size 212KB
SHA256 b5f57327418750229656c30a809308669797cf30d7da3705f8cd584c2b8a038b
MD5 5700e570d6820f163085ba80046eeb9b
SHA1 d74c3aca36f0e645584272faa37b60a45b702fd9
SHA512 60b8e33b4d7eafca39d277f7b377386c95eca93335729b1412b97743e317e7968d5d739f41f74174b833719b460247d656cdfba5e739f41508e9c50866daaf5e
SSDEEP 3072:WXE3MsjPU9n+gGoJGZArDu06nHoSifAlApl0sIpsrzA7Xof/DtM3Bl4ykmbDGRuR:EsjsJ+gGoJGZAmloSifAlAMsjkIAo7s
TLSH
T157247D8BB265C1DBD843813CE5968B13DAB1B86603909BCF12D4E77C9F2B7513B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\python3.DLL
Size 70KB
SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
MD5 2862d7a3de70a60be154aa7590cfeef5
SHA1 74cee0f36417a8f2ec213c8f0c755a40bbb8a051
SHA512 3fe520a0928b2af4a20e73a7943059573f965eff3ac59f6f03f5a2c4761301dc0ff42c7f87baccb2eaca2ea3bb83d84d81a1e0f0e04a5a2d2a4745b4b30ab7cd
SSDEEP 1536:FotssyKcunV8Po1IIy0Sy7NsR9QWfILQB:+tssyKf1IIy0jXi
TLSH
T1AE634CC25B5BF8A2D6F665FC78DDD9CE242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\python313.dll
Size 5.8MB
SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
MD5 5a7cbaa796ee41e35b5e6bdf4e024e48
SHA1 868b787184e90a277f065d7d0b830772bdd6e52f
SHA512 69dded87aee32562f57c50c5b1a3f99c7f64089226d911751cae314bc451bbd2d3e4a9c9410a532f4fefffcc4687d7c26e609d5aea13b077aefd1070151d5f6f
SSDEEP 98304:aE6YlbgK3Lv6PVN1Wgz52Wv3HDMiE9o1w:aE6M3j6PV/Git1w
TLSH
T1FB568C16729E51ACC97B8078CA13864BFBB27C053F60434B61E6BB5E2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\select.pyd
Size 32KB
SHA256 ddf1221851814943a82ed8a986d228463404da2ada969661bdd69223f14fc050
MD5 aa8843971de4ca77a14a895da3fa579b
SHA1 95812c71a6dcdbbb1d2fdf8fb0032d00e90f1d44
SHA512 2411886cec792df496846c0119aa9330edf7229eebe73b97145afc722961d41a6433c03420c4d23728bdc047e4efafc332a341b82eba1337e0b4bd2fbc1ae32a
SSDEEP 768:rpX5WHfPLTaP1II9GQhy5RNLaRYT2Ip4MfTxf1ml6Z+7UbFgGHl:dX5W/P/aP1II9Gwy7NsR9GfILEzl
TLSH
T1FEE26CCA5F685047E6A3CA31C6E2DE43F939B3A35611869F30B992991E177C0E337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50362\unicodedata.pyd
Size 695KB
SHA256 b965a80346ee95dbec0b147faab329f3276ba24fceb8df5df171367649f116f3
MD5 d5ca99b1befd647ee910150bf751967d
SHA1 331fc08a5f29f5f9ff726db4eaa1a0e9b0b44ba2
SHA512 384c2456febd975399ff66b4ef80531190bcdc9ed5c785158551cc273f9ba002fac1e8a2f5af282ed475d03af27e75f352cd4f0fbe61f19b2ee64f602e013815
SSDEEP 12288:GSYUdLI/X77mvfldCK1ihH32W3cnPSqrUgGgIS:GSYUW7qNxq3cnPXGgJ
TLSH
T1EFE4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-442-0x00007FFC71690000-0x00007FFC72A11000-memory.dmp

Download

memory/1120-427-0x00007FFC74770000-0x00007FFC749D5000-memory.dmp

Download

memory/1120-441-0x0000026E851F0000-0x0000026E85200000-memory.dmp

Download

memory/1120-412-0x00007FFC74FB0000-0x00007FFC75213000-memory.dmp

Download

memory/1120-434-0x00007FFC72FF0000-0x00007FFC73531000-memory.dmp

Download

memory/1120-433-0x00007FFC73540000-0x00007FFC73A2C000-memory.dmp

Download

memory/1120-555-0x0000026E863B0000-0x0000026E863B1000-memory.dmp

Download