9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
Size 7.1MB
Sample260813-thfltatdke
SHA256 9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6
MD5 546e138421c2ff977955212dc1bd4991
SHA1 4debbe587b2d494dce3ff328c60d640ecebbe7ca
SHA512 0998bec660749f96a6dec288cf709281659c25d69164e177d0784f94178acfa3cd7445e9c222980ec7ec971f06d8786828ea3c39defeb8807ef9e9c9f364edce
SSDEEP 98304:dVEAkjzOmH4Pko6ypeoxZ0DtZ15xbNwOjcETFP2bT1QA4Ts8ChZ1elf+:dVEAkjPikLyp1iweiQA46hZ1Uf+
TLSH
T1C276AE02B6C2C0F2D0A71630E42997399D7BB9246720CEDB93D499785DB27D05E36B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	handle64.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	handle64.exe

Executes dropped EXE 9 IoCs

pid	Process
7560	autorunsc.exe
2460	pslist.exe
2272	PsService.exe
4860	Listdlls.exe
1312	Listdlls64.exe
4900	pipelist.exe
3804	handle.exe
4924	handle64.exe
2196	tcpvcon.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Recycle.Bin\S-1-5-21-2301830172-776172150-2531349243-1000\desktop.ini	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
File created	C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Recycle.Bin\S-1-5-~1\desktop.ini	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
File created	C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
File created	C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	handle64.exe
File opened (read-only)	\??\R:	handle64.exe
File opened (read-only)	\??\T:	handle64.exe
File opened (read-only)	\??\W:	handle64.exe
File opened (read-only)	\??\Y:	handle64.exe
File opened (read-only)	\??\Z:	handle64.exe
File opened (read-only)	\??\O:	handle64.exe
File opened (read-only)	\??\F:	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
File opened (read-only)	\??\H:	handle64.exe
File opened (read-only)	\??\I:	handle64.exe
File opened (read-only)	\??\J:	handle64.exe
File opened (read-only)	\??\K:	handle64.exe
File opened (read-only)	\??\L:	handle64.exe
File opened (read-only)	\??\S:	handle64.exe
File opened (read-only)	\??\B:	handle64.exe
File opened (read-only)	\??\D:	handle64.exe
File opened (read-only)	\??\M:	handle64.exe
File opened (read-only)	\??\P:	handle64.exe
File opened (read-only)	\??\V:	handle64.exe
File opened (read-only)	\??\X:	handle64.exe
File opened (read-only)	\??\A:	handle64.exe
File opened (read-only)	\??\N:	handle64.exe
File opened (read-only)	\??\Q:	handle64.exe
File opened (read-only)	\??\U:	handle64.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
7600	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7648	powershell.exe
7624	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autorunsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pslist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Listdlls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pipelist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netstat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PsService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcpvcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	handle.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
7420	netstat.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
7672	ipconfig.exe
4504	ipconfig.exe
7420	netstat.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
7848	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
7560	autorunsc.exe
7560	autorunsc.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
7600	tasklist.exe
7600	tasklist.exe
7648	powershell.exe
7648	powershell.exe
7624	powershell.exe
7624	powershell.exe
7624	powershell.exe
7648	powershell.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe
2460	pslist.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4924	handle64.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	7560	autorunsc.exe
Token: SeImpersonatePrivilege	7560	autorunsc.exe
Token: SeSecurityPrivilege	7560	autorunsc.exe
Token: SeDebugPrivilege	7560	autorunsc.exe
Token: SeBackupPrivilege	7560	autorunsc.exe
Token: SeRestorePrivilege	7560	autorunsc.exe
Token: SeDebugPrivilege	7600	tasklist.exe
Token: SeDebugPrivilege	7624	powershell.exe
Token: SeDebugPrivilege	7648	powershell.exe
Token: SeDebugPrivilege	1312	Listdlls64.exe
Token: SeIncreaseQuotaPrivilege	7624	powershell.exe
Token: SeSecurityPrivilege	7624	powershell.exe
Token: SeTakeOwnershipPrivilege	7624	powershell.exe
Token: SeLoadDriverPrivilege	7624	powershell.exe
Token: SeSystemProfilePrivilege	7624	powershell.exe
Token: SeSystemtimePrivilege	7624	powershell.exe
Token: SeProfSingleProcessPrivilege	7624	powershell.exe
Token: SeIncBasePriorityPrivilege	7624	powershell.exe
Token: SeCreatePagefilePrivilege	7624	powershell.exe
Token: SeBackupPrivilege	7624	powershell.exe
Token: SeRestorePrivilege	7624	powershell.exe
Token: SeShutdownPrivilege	7624	powershell.exe
Token: SeDebugPrivilege	7624	powershell.exe
Token: SeSystemEnvironmentPrivilege	7624	powershell.exe
Token: SeRemoteShutdownPrivilege	7624	powershell.exe
Token: SeUndockPrivilege	7624	powershell.exe
Token: SeManageVolumePrivilege	7624	powershell.exe
Token: 33	7624	powershell.exe
Token: 34	7624	powershell.exe
Token: 35	7624	powershell.exe
Token: 36	7624	powershell.exe
Token: SeDebugPrivilege	4924	handle64.exe
Token: SeDebugPrivilege	4924	handle64.exe
Token: SeLoadDriverPrivilege	4924	handle64.exe
Token: SeDebugPrivilege	2196	tcpvcon.exe
Token: SeDebugPrivilege	7420	netstat.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 7420	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	90
PID 5164 wrote to memory of 7560	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	91
PID 5164 wrote to memory of 7600	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	92
PID 5164 wrote to memory of 7624	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	93
PID 5164 wrote to memory of 7648	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	94
PID 5164 wrote to memory of 7672	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	95
PID 5164 wrote to memory of 7848	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	96
PID 5164 wrote to memory of 7876	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	97
PID 7876 wrote to memory of 7992	7876	net.exe	98
PID 5164 wrote to memory of 4504	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	100
PID 5164 wrote to memory of 2460	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	101
PID 5164 wrote to memory of 2272	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	102
PID 5164 wrote to memory of 4860	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	103
PID 4860 wrote to memory of 1312	4860	Listdlls.exe	104
PID 5164 wrote to memory of 4900	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	105
PID 5164 wrote to memory of 3804	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	106
PID 3804 wrote to memory of 4924	3804	handle.exe	107
PID 5164 wrote to memory of 2196	5164	9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe	109

C:\Users\Admin\AppData\Local\Temp\9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe
"C:\Users\Admin\AppData\Local\Temp\9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Windows\SysWOW64\netstat.exe
  "netstat.exe" -anob
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:7420
- C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\autorunsc.exe
  "Aralez_Grhzdfjn_2026-08-13_17-03-21\autorunsc.exe" -nobanner -c /accepteula
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7560
- C:\Windows\SysWOW64\tasklist.exe
  "tasklist.exe" /v /fo csv
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command Get-ComputerInfo
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "Get-WinEvent -LogName System -FilterXPath '*[System[(EventID=7045)]]' | ForEach-Object { ([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -EQ 'ImagePath' | Select-Object -ExpandProperty '#text' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7648
- C:\Windows\SysWOW64\ipconfig.exe
  "ipconfig.exe" /displaydns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:7672
- C:\Windows\SysWOW64\systeminfo.exe
  "systeminfo.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers system information
  PID:7848
- C:\Windows\SysWOW64\net.exe
  "net.exe" share
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:7876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7992
- C:\Windows\SysWOW64\ipconfig.exe
  "ipconfig.exe" /all
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\pslist.exe
  "Aralez_Grhzdfjn_2026-08-13_17-03-21\pslist.exe" /accepteula
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\PsService.exe
  "Aralez_Grhzdfjn_2026-08-13_17-03-21\PsService.exe" /accepteula query
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2272
- C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\Listdlls.exe
  "Aralez_Grhzdfjn_2026-08-13_17-03-21\Listdlls.exe" /accepteula
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\Listdlls64.exe
    "Aralez_Grhzdfjn_2026-08-13_17-03-21\Listdlls.exe" /accepteula
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\pipelist.exe
  "Aralez_Grhzdfjn_2026-08-13_17-03-21\pipelist.exe" /accepteula
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4900
- C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\handle.exe
  "Aralez_Grhzdfjn_2026-08-13_17-03-21\handle.exe" /accepteula /a /nobanner
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Users\Admin\AppData\Local\Temp\handle64.exe
    "Aralez_Grhzdfjn_2026-08-13_17-03-21\handle.exe" /accepteula /a /nobanner
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tcpvcon.exe
  "Aralez_Grhzdfjn_2026-08-13_17-03-21\tcpvcon.exe" /accepteula -a
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 7b35336d52375b860387499cfea48fae2e3a746c63d80968cd535efb2dc934e9
MD5 0fa9f321e2ad2c94d110b6cb2e903138
SHA1 d3f68d3b85f381727152ee9553fb94344d890e31
SHA512 0a73e93a6c7a49abc86fda7601af79785f17ad695af15a6c7deccf0beb83b2d9c0169272717ed6b7a6125134ee5a38d777dd1fa51f6786b410447b24fc68a7b3
SSDEEP 384:q1TBaGMv1iduGW1UbqyRL62v+geChgfr2OnZIAXr4PWoWFq8zKwztvYbhNoeEmzQ:6TnM9SdWWGQL62v+16KIAXr8WsMubhN4
TLSH
T1A182B778212F99C7D8992272109501A7FBA4D08EDA355DF4BF2BCA2F7C50E763B60130
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aralez_Grhzdfjn_2026-08-13_17-03-21.log

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21.log
Size 4KB
SHA256 4775c40b102c68562e4b7d51c0dc62ed1fe092dc3e8c23b13d628e76bda2aa88
MD5 70705499b4c64416eee01bbb5a837c8a
SHA1 cf0b37b8f90c82dfc73ee7738cf8540a51528ef4
SHA512 4625a8f6a96c9adf2b42f265645cbbbdd7d647b4852c6932eef778de650d4ca63c46fcc7838b775f5d37a295ac21bb02f772c4089184eb7a94643b9e36a3b217
SSDEEP 96:oXjFCPD1QKyIq8HIiIi1c51HH1DJxE1EJxT1bJxH1XJxc51Q62o9ooKs4rAsh:nLnfhcZBJ+SJh9Jt1JmR2Covt
TLSH
T159A13C066AFD08A3CC9B345EF64FBA715145B1A702E36F28EF09188B54B0DDA6E3F505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$Boot

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Boot
Size 8KB
SHA256 857f409020dc3c893cbef1c7e4d64669185aaef5c6286bf24832f3885c24a88e
MD5 798b6af6059e0099ea12f3a48c203e78
SHA1 d684244827a4226503b16758cb723e7ad2753913
SHA512 9a0f80a2d2f94bce3c994b18ea7c7d54f21816e724c7b2e7839ae9095daac6d32f35fb1a97e719fa72aca1e57680372b90f6b07832774965f962ca6712bba173
SSDEEP 96:v2aNcdCmGUyH52j0V6nPt4ihC/U8remKrQUqjfyJB7y4AIwVoouEJQS:P2d/5yHEj3Pt4ihCvresUDBm4lwV
TLSH
T182F1C4F72802280DD0826779DF4DDC266CB7ACD4AA7087B4A190793A210178026BFFB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000D00000001190F30189B60

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Extend\$Deleted\000D00000001190F30189B60
Size 83KB
SHA256 518b39589702fddfa16647ebe0a75975bc3d3ee9e6add898409dc4a921d128fe
MD5 0b44f2b588e1278a46a7284d3826cbad
SHA1 d128f630ddc51ff34ead3e7742caa91611582cec
SHA512 6fc0f085ac36b31df4b45028580f19557741c18b2a9a5d8a1a268afd2a98285b97b627eb822f5ff90ad10084e91bd30156a5ff2aded182987019f4b570e0ffea
SSDEEP 768:RkdGUNjAiRjEbY1FLl2uii23UbsJm3yl8LsFMPJH+NwXtUCNVbOmgsfl:Rk96iBE814MPJH+NwXtU4V/
TLSH
T1598398243AF58225F2F39A715EF1D6999A72FC529D128B0F2181734D0931E11E8A7F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$ObjId%3A$O.idx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Extend\$ObjId%3A$O.idx
Size 4KB
SHA256 d192642eeb5a82c8dcd2990a067f3dba9b69767e19eb0ba000960929f4fe4be1
MD5 3438e0f338fb0e98ef620303f77a527f
SHA1 19f778957b60bbd635a6ce4f3e827bc76a9be590
SHA512 fdc92f658d12328def6a0f4ad70b393ce6ec42cceab62b9e002a71bb73543f28e174f26c43f743b856352cd6551fbe7d87ada70c703751d1e8015a2de5e81a1c
TLSH
T1B38130E323BC613DCB561232F1B4613493A587CF4AF58A4DA9367464CC8FA4B1539BC6
MD5 SHA1 SHA512 TLSH

Submit Download

$Reparse%3A$R.idx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Extend\$Reparse%3A$R.idx
Size 1024KB
SHA256 c6f4cbcb21933ea0e9e088dcb11dbf4c94c4e42a6c0fc80acac6c9dfdd48a220
MD5 6ded4ebf21abe222a96e8877b73bb541
SHA1 d9cac9fd85efa312e7493bf2c7ac1e4611d1af32
SHA512 37a601040e9ffb22eb28a342be0d0a620e916aeb6914554ec7efacfd26834aed71b23daff7fc0b27b3567deee9deb6496b091561468d961cba7c1e46a3f1a16c
SSDEEP 1536:gYYYYYe16k5+wjWg0fcU0LLLLLLLLLCdPnex8Uyios7fbhNWmRooGZseiQ153nQC:gYYYYYeF5+jPex8US3nZsex5Kwx
TLSH
T1862538097B82863EC970D774AAE31F69B7A6D8B686E64B5E034090127C837713375BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$TXFLO~3

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Extend\$RmMetadata\$TxfLog\$TXFLO~3
Size 10.0MB
SHA256 6ebe2f0e331a454193cc3dcc70ac98ef9991de2d91fff0f3efd50e0ff1c09821
MD5 bb93460f4af8c6220b4fe4b8a17a78be
SHA1 774d81ba84cc127c343df7ff0ecc518dae4b2ec0
SHA512 33d8042200a6bc8250e58a2f7935d0c435c8dd9a8e15835ea969b7f782534e6b977495ad08c6ce82121fd72fed4b901fb0a9639ac60e51786438fde8c4277860
SSDEEP 24576:GMr3M0pTihFmhlCLvWEXUFhVNFkbk00f+YiF6/XV:JM0pTi/XQn00f+E/XV
TLSH
T1C6B6A71467E80717F2F34F3598F257277636F88AAE418B8E004663584EA3B61D9B4F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$TXFLO~4

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Extend\$RmMetadata\$TxfLog\$TXFLO~4
Size 10.0MB
SHA256 963d4ee30fe1a112170d47252adf5f2e00180247b329a43ef172c93ea2600f6a
MD5 a2225c1e9d5a2e2e0c56f9c2abd89282
SHA1 06976f50aa72fad4ac56525585256374210ad022
SHA512 a7e9081f472499246cc07e2149d9edca9c22656851f3e026cb74d0a7c4549e4f14e2c9f9d1baa6364de4469977b649d33ba440cb0544f9ee7701c6f36dd56a63
SSDEEP 24576:sOqqqfqX5qXAY4bfZ7sFGls71rJZTVKi105aSeCTTTTTWzD2DTaLZn:dZ7sFd2Di
TLSH
T10DB6861067E80717F2F70B35A8F256167A36F88AEE51CB8E014693584E63B50DDB4F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$Tops

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Extend\$RmMetadata\$TxfLog\$Tops
Size 100B
SHA256 0b0744f3e1064522e4c86ea4d8b95ff883211bad89d1ce3f4a8c28255a620975
MD5 b9ad1170ef8cc642ba8b27fbb03dd205
SHA1 91f08f2ed92a32e2f948da542640e3e7ca307a63
SHA512 4dbd3d694f0e7d7008a91c08c0c574c63fa5c2bd25f6586a65436420caeb18ed35122cceac55dc09bb918c7d19299701530c4cf98be3e26ce029db5d5372d0e4
TLSH
T167B002517044C116C51101310FE0C2F910103E45AD199417304DFB0D5C35A151969141
MD5 SHA1 SHA512 TLSH

Submit Download

$TxfLog.blf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf
Size 64KB
SHA256 59b18e7274c9cba59f56cd69a9e1bb1781e22faa574316c82d3568a8db7322e3
MD5 981dc039d9be7e9cbabd7c0d5daebf67
SHA1 2d71a1641a67b120ff1fbde84b5894eecd3357f9
SHA512 6f0408de71ef2ebfc54ced68f323c2259a1d70465d9a6a6416523508997bc7409c0a650ba79cbc33bbfb1393992522ffd02ff48b110cecd912e54dc8af68cf12
SSDEEP 96:F5tTtudC/F5w0NCaYO+PffCmlunE5t2tbdp/F50NCaYP+PfICGn:FzVFb2lbWGb
TLSH
T18753D394BAB1282DE55DD2B394FF61A37335DF2149CA460E6031DB3A6971A8F123CF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\$Recycle.Bin\S-1-5-21-2301830172-776172150-2531349243-1000\desktop.ini
Size 129B
SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
MD5 a526b9e7c716b3489d8cc062fbce4005
SHA1 2df502a944ff721241be20a9e449d2acd07e0312
SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
TLSH
T169B09B0A41476664B05ED15DAC60E147117D547A4D14A2008EF0B345D1A33550778D69
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 62ed592dc9453a002642b39a1b3dcf23c8fe2d6c9a00beb3af999635d1a8ef41
MD5 a059919c89bbe6d3f15a8950e3db7328
SHA1 20cbb473d6ab4ce9fc75e95e36dc428f83877aa2
SHA512 df2b6269627835f7a1616ac141a34d087e48f2605de427e7122270aa747de021e1f6a695bba2caa358aa4cb5ac9fa9558b87623122b74fca8b30f7e3b7a400a5
SSDEEP 96:bVfFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:bQH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T17424EE4E5F343722CDBD913668E644A35C7CF03FCB5366DA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History.FileSlack
Size 20KB
SHA256 1f55ffcddc1fce4d4ab43d09da1f8e58730a19bf3aadd78331c3eaaa8b9b4410
MD5 442acb167f97214178da962aa76cddb6
SHA1 575f212b555035a6a30fea7f49836f4ad72868d2
SHA512 833c20b9f4fc0c18334f880a942f02a14777df1fa13f663df5726118730c6fc3f9d59406a93ed1113b46a3616b9d54e23cd4de31560b59769bb0fc9f6e507aae
SSDEEP 3:RRD:LD
MD5 SHA1 SHA512 SSDEEP

Submit Download

CopyRestore.xlsx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CopyRestore.xlsx.lnk
Size 636B
SHA256 5c28350c65ef0ebbe59cfecf5be0c2ed5bdf3f28323d0149bd03dee796e5b610
MD5 b4758b2c33f80072e11569512521ec52
SHA1 f5ce7b8c234c276db6d16b834066c45a81ddcf4c
SHA512 abcb2c28c2d207541098269451de1594109fbc875857a8cd7244eb362c0d6732be800bb04ec36bd81a6d252c46d70bfdccf340cf8b6f3b9a3d0b6c06054810ee
TLSH
T1D1F0815313B65F0DC3318AB657B54168D1386954DE64D70D9891C05D189E708C570F1A
MD5 SHA1 SHA512 TLSH

Submit Download

LockDisable.docx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LockDisable.docx.lnk
Size 646B
SHA256 32758756b330ef6b2f46c004014ea0571be87cb28b0448fe65f2d1473fe0c529
MD5 14655b4d7c541d4d929c57f9b26218c1
SHA1 1915e05846b66968722a01644a4f2cb916f53a1d
SHA512 8b20450a43ccaaaad5c32875473cfe44a2be7cd752b05be222d5ea5a00e80272b20daeafe3f4e20956207cd4eca93c1fb7a583f3462942fd5da9cb1a3e6780cc
TLSH
T1A0F0468055BB2B0FC37B0B7203364299CA72BAA2FE64D70C854010A8582DF418EA1F27
MD5 SHA1 SHA512 TLSH

Submit Download

ProtectSave.docx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\ProtectSave.docx.lnk
Size 646B
SHA256 7f88b46eb0588774d9377a7e17dec081b74be59fb89b37ba6cf347a3ccc6e1e3
MD5 20bcbda7e7cab31b77d3c58b7bd1ea45
SHA1 5959afe74613a575cd142dd7fcf2adfe63b79a49
SHA512 ea4eb39f81aaeb852de843f5aa8114cde886a5b746e0c0b4bce706166f957f907a4807b36e817dd8964af6f9f0d17ab9f6df2b023d689a852706d2f47873a9ac
TLSH
T187F04C4102FA2B0EC362017602354215D97A79E2EE64D30CD545509D196EE414F64F3B
MD5 SHA1 SHA512 TLSH

Submit Download

RequestGroup.docx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RequestGroup.docx.lnk
Size 651B
SHA256 37e21acd79b2c759e0fd8554d47e21b9d8c2a873328c41a0b3ed4786ac123de2
MD5 56b1cd033cf3c5088b07043dcd522329
SHA1 ead54a3b1d3b5f9a947c22db53b951455194f408
SHA512 77802b11a176d34a632514ebf00bb7764d65fcd8e754c070c32ee57822d030cd77be7038f9e5c8059eb1ca531da420684ba7b0f427c29958aa3b64ea662c04d8
TLSH
T111F04C4156FBAB4AC3660AB203665299D737BA53ED64E70D95016099092DA008BA0F27
MD5 SHA1 SHA512 TLSH

Submit Download

ResolveBackup.xlsx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\ResolveBackup.xlsx.lnk
Size 656B
SHA256 12475bd8a2c0991b633415e956edb2372babc6968015ed4c7100ab81770995db
MD5 6099d65d1a7a72cc9f8ea841dff994a1
SHA1 fdee028aad2f0f8a2fe88070c2056c305301b13c
SHA512 93123755b56dc748858385f0bbe9c67fcc9e191a173b93f832ba00938be666f8f0ca95562b409490a0cf1bf2f58bb2a9fb790b9b7d55f05e708680620f658874
TLSH
T1C7F0AC8215E21B1EC7734CB697250325C5767E86ED74830CA81021A60E5EF01CAB0F2B
MD5 SHA1 SHA512 TLSH

Submit Download

SearchRepair.docx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SearchRepair.docx.lnk
Size 651B
SHA256 af7d7962449076b6a6e2404f86e15a154ea190f9eb60494241b9d89dca45eda8
MD5 b390e98d6cd56fe997cd5f14ffcceae2
SHA1 b2db41a0dfb0a9c13e68d071d45c498d81640e7b
SHA512 f32077d08f27590d3f8a94bfedbcec81c44af342b9d653439139b8ddb198c26a2f43b24767de8437e8d5107725d710b6c28cc3a387c7466fa80a029c6090b13d
TLSH
T1D7F08BC542FA2B2EC37B057283354256C67ABA71FD78970C890120A81A3DE04CE66E2B
MD5 SHA1 SHA512 TLSH

Submit Download

ShowUnblock.xlsx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\ShowUnblock.xlsx.lnk
Size 646B
SHA256 74d9ae2870124471f052a7aa4787ea326df74b19e34432aa77bd2883aff4d91a
MD5 c3ba5a7653a510ccc90fbd331ac9b5b2
SHA1 1d30b3f2883838f4f29f96d4a2cd5105b1856a2f
SHA512 b61b358fe3d9aaf403513ddfb8a7ee1b174262a5232ae6ec89be83e52ccf468f5b4928aa231ee5bf12f128e8e97f8141658abb41967dbed3bf2712564aa22a0c
TLSH
T13DF08BC111BA1B4AC23606B21A3A4299C5707E52FEB4838DA54095981D5EE44CFB2F3B
MD5 SHA1 SHA512 TLSH

Submit Download

StartSet.xlsx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\StartSet.xlsx.lnk
Size 631B
SHA256 e1c51c776fcbcf3f5bf9b9d8d8724c47abfb082cc4e5b6a946ed4da4c3591102
MD5 6ae4ec66531a79dab6f9f73f9f336642
SHA1 a340ffc27c22d01484e857cfd55aa7f81f691395
SHA512 d9b1343551fe59f64532a5f9398b683b5d2a18304cb83ae347e1d38ae5ca62b487a7d45241523fbd731fc79d257acb5be0758037c04e67599541764a9651eb90
TLSH
T1D0F08B9407AA1B09C7B60675523A8326D2717E81EDB4D30CD60151BC0CAEE00CEB2F29
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Size 174B
SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
MD5 7f1698bab066b764a314a589d338daae
SHA1 524abe4db03afef220a2cc96bf0428fd1b704342
SHA512 4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
TLSH
T119C08C38D2E9322141728D33BCB4A002DBB1F8212C1BCF9E06C0918B08A0A09EB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

OPTIMI~1.BAT.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\OPTIMI~1.BAT.enc
Size 329KB
SHA256 5baf614e85567eb01bf89dba700ad4897e974f925762f48d6b36ba112f093f53
MD5 38d4a9a232f2f7135c3d6d32f7055958
SHA1 2a17705e1de31b032b05cb1966a86ba12c5e6c71
SHA512 b9ac4ee23f2fd28234527652b4bec8de61c4d0fab2abee91a5038d13792be3dd7ca85a5dea9269aa667c1403891dd1f5c4b4c3f901d615b35c5d69915d11f488
SSDEEP 6144:NU8Nh5suTNKavkEi9NyzcvnjLgWMgveTXRLgo2VaYfshpFUX8LRCegPhcw+qq85w:NUa5sE5/zc/vRWLRUoGaYEXFdLCPhcwe
TLSH
T1C974236A69EAF4C8647766CE7117B4B4CBEABB106CB087E3D4401163329B4B374660DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeSend.bat.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\OptimizeSend.bat.enc
Size 329KB
SHA256 c6383e9569794e8dc2687123588ef46bb83ff69778bc457ab662069ecae798f8
MD5 7f8cb96537a4fa58c80f2e02e918c1d6
SHA1 659d91b561a14786fe2a9eebc71b4dae748fc196
SHA512 351154c118e9dc372675c78827aaeb16bebe7cecaf60ba104c3d87004f85495bcfbfa55b588bdf3010c37fff8e372255360bc2b17d1ca7675c091dea3bb1894d
SSDEEP 6144:6MSurr5rPBZD/3Gh5lXdn0+LtRjdPatYYis0ZG5c5:DX5rPBp/3E5pd0+L4tYVGg
TLSH
T15C7423F7D8300FFE26D6E587B500292F9079B2EA7B3645938049FB246E12D99707998C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UNPROT~1.PS1.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\UNPROT~1.PS1.enc
Size 390KB
SHA256 3e6b9292aaf35511055eea4a43c75ce89aa647f8daebf1b8a66ed5d399d6a409
MD5 612362d7c71ab6b8549f83f912fca627
SHA1 18bc2217a36d1342e36ccb840b0c1c916acb9eb9
SHA512 ff1dfb85db3baf82fa9702397955537cbfab25d814c5165f76a590e11232097a4095ca73422cfa89aedd73678c505ba937d4bee846bfafdb7b538e7a3b49d84c
SSDEEP 12288:YDCiDWFTqzi+p12uv7Atx0XJ2/DkVATtDg:KyFTq+A12ujYxQJHAtDg
TLSH
T1CE84230A9D0F273317A839E3F9FA714C5335BA8D6B3C5642FD51EA0D849672060E9E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UNREGI~1.XLS.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\AppData\Roaming\UNREGI~1.XLS.enc
Size 309KB
SHA256 c713d6f5f8beaea9ec0625b693b55be9d9c244d05790ffbbe567a33cf4ad1373
MD5 4380c829212c99fe778cccf583170908
SHA1 0f4660a0973488bed7fa1a03d1d4877d61ea5291
SHA512 7d13a9361c7d2ec6489d82f4a447f4287979472b284083796ec8c5ea9e2f0e44e2e2d367b618f46b1c3f3a3b88cddd2bbeb580f4a582bd3152b599f72a8c3820
SSDEEP 6144:uyZi4m0v0glMjEa2tGotoixAMnHV6b5Y8OHSSyvNOV5Lc+rGP+k53K:uyZin081YzAOHV6b5gLy1OV5I+aGI3K
TLSH
T19E64239A8FC21BEC5D4DF8FE85D73627FA314A620CE96296F5D8E502647C2CF6788500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COPYRE~1.XLS.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Desktop\COPYRE~1.XLS.enc
Size 10KB
SHA256 d80e8cfe6b0d1153b188e49c3c0aaa001be9c83d682f0ef8fc388ef7a9c4ef6b
MD5 cb5072807af377bf856fa464c599412e
SHA1 a28f3059108bc26dd1ea56fafb942e1b43692f6d
SHA512 4ed8632fa453565e408983c1bd84f3dc06bb1e6295d7e66b074f3daf0d065b17cdbe4e39a3711aa93a44d4e341c31dddb27f30acaada73ff52a0e97b12a9f2b6
SSDEEP 192:O3oVdPWmwcT+OGCpTpqIFL4O5h+OouoIFnWt4W0bsdPml/hHppSLh0:xVucT+J2dlcOSUowno4OIl/ZpQLS
TLSH
T10822C1F152BFADD1A197D3072267C1608BA69F52E6F89511B1EC80B8A3983D7367A404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyRestore.xlsx.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Desktop\CopyRestore.xlsx.enc
Size 10KB
SHA256 9d3dc9d0cca8343bd95006cf51a8ec46f5f41d95606bc7507c9acc84961ae97c
MD5 ca3c9dc283fc24149e52865bde2d4a38
SHA1 279e692002212d5ac7d35fa24ebaa6928d278d2f
SHA512 ea0b96eada3e49cdf6e90d8aafc6882d28eb3aeb9f547ad8d79dde7b3be09cf22fd02343381b3fbc853cc9348506dc6e6f36e572878158f75da335dd2967c1db
SSDEEP 192:QfR1cu04syixFdwOJ87OqAYo/xzP1LBu4bSZCra2J8B5k7D6RYIT4:QfR170aO8Ooo//LBu4rrFDV7
TLSH
T1B522BFA8BE92A69B725CD26000872F08F5501D4CAD366FFC913E3C9134E1678F318775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INVOKE~1.PS1.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Desktop\INVOKE~1.PS1.enc
Size 297KB
SHA256 93176ade9660b13d159fbc3ef8317bdf0d3511e828e5e3316b11e7e9fbda66a6
MD5 d7db3128f5e4235845a5ae7b5a4fe1e4
SHA1 5b3033e5f8b8bd832465062e15f46b341891cd40
SHA512 e2064baa49aa2d9b4bb433dd574a03037e055e2466e7e8aafd95aec462941024a744d22d3fd735db30c399e61f74412ba562b251b0e0bf3f9e99e82cec2576f4
SSDEEP 6144:MS24GjtqhE1Z7h0YgjsSLWaBNo0zGwmmlBacVYK/vHqWVUz/5ed:BJGjt2E1ZhgoSqwNJZbBdZVCxS
TLSH
T14C5423132D56CBEF345AE3D5E3752885A24470FA0971B42A3651EFDC5B8E4A1C8C8DE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeConvertTo.ps1.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Desktop\InvokeConvertTo.ps1.enc
Size 297KB
SHA256 d489b002441c78372fc07aa614bb53d2968bd023c25a1154dabe7fd39a919e5b
MD5 e7ec51ef4981d282a0b3606079600ec3
SHA1 f6b769eb960bdfc2c55a0ae7d055e5420966da06
SHA512 f64f028ae1dc405cc0dccbd6a3ac58db7453a89f8b7036a93ad642cc4143a9884e7557dbcc31164e5a063b309e0bebe9be65e196347f850372529ac30c6f629b
SSDEEP 6144:qK/qWyOZW72OFSh9uynKCjt6VCk+LAH/2xKcfbimJq/gOx92AU2gxeU:jeOZa2Ozyjt6Vtf2sGd4/xx92AO/
TLSH
T119542300AB7CE5E828724C06E9A21536574B169BFBF73373E79B998788090D5DC34A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RECEIV~1.XLS.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Desktop\RECEIV~1.XLS.enc
Size 215KB
SHA256 637b4c4ade364074378dded370b602ac9b60a2d12b37866b0062b1b692a3346b
MD5 b7606faf254e90d6bce553d2da992574
SHA1 247b68967cacd20e62625b4363c2d40f7f617a37
SHA512 cfa45c7ac2da29e65bdac009d672575b87f9208365bc13d185569e281bacc531467dca406168f9d49e77a303315fb857809bc79663cccf675bfebfe434f0e8d7
SSDEEP 6144:qba4skVSHGLwsQTaDSkFnF86jkw5T3UknjN:qbASgsQWDSkHRIiTznjN
TLSH
T1782412A1E236760D2B60CF14CCA419741F4BFF819E8D1E56CF9E4197B9ECA2305B2972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveWrite.xlsm.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Desktop\ReceiveWrite.xlsm.enc
Size 215KB
SHA256 1d2576db550c1611a652d1c5db9b908f24dc6141b5fce722a7ecf15ee2277199
MD5 78b9c27f53a8831c8375923a2a7e442a
SHA1 fc75108175800365f4a05b8e44f23530bafcba8b
SHA512 53da86059183f8496756d68b536a24ba180f78cf707b9b1aaef8138547ab82eb99968625d0ac3738261d829bb3e29c9c582b1987ee370d2b395bd06cbb6f227d
SSDEEP 6144:sPZG08bpbXO88Nz6FIuqrZD11BzHaGT0ikW+Xt3lbM9Sl+:8ZipbXOoFJqrJ0a0iUdVbM9b
TLSH
T138242336E5D3DC15DC58BEF1E58478AE4BB8380DE07F3903B9A806635522428A2F34A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UNLOCK~1.EXE.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Desktop\UNLOCK~1.EXE.enc
Size 169KB
SHA256 413605098783fe41812ec2f68643635ac57f9ba2b2c1e8f1ef0879147ad5079f
MD5 8a768176851f62b9532d46fc16cdd7c7
SHA1 43da0f570f51a1f68ff417950e842b5107d55f0c
SHA512 1b691956b03272c0070c73c827c27d931978aa94c7f37432b17767fccccd0c6c1b74afd62f8b23f8c78a90a4c67fdc85bb00cb6abe3bf1c061aa4d592adb3a55
SSDEEP 3072:kvBLXY4rbOGf2zZW8DuOidvyvx2lWzg+1cdzd8Xs+OkDLcg8/:kp77OGfLvyvx2lWzg+63FkHcr
TLSH
T1CC04138A8FECD1DD49FE8D249E70B088755AF15AB7E31A51743F62858E8EDC8231740E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockRevoke.exe.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Desktop\UnlockRevoke.exe.enc
Size 169KB
SHA256 adf8b0d3fbee83907da7c9ac8a999c119ed5079db3945f4dc20ab36968635597
MD5 a847e707767818eb4b19087e45a58c18
SHA1 694ed7dd6f346ed6b63dc91d83f982e8883f6ebc
SHA512 48556d48b67873d731a26af9a84544b03e990d6c70545272cdcbd64d583b9b842b5e72aa1162ed24f289403c597a8fff43ec004dd5fc655e603bdd0adfddd4f9
SSDEEP 3072:UespTu+FT6NlEoo2CfzZMGhC5X4ZQusjCLmSOeOIUPXhsyHbZ5ap6jL2/qLA:j+FT6Nb0ZMGhC5X4ZsjCLvOpIoxsqapn
TLSH
T17C041219AB9BBF02331715190FB4889EEB4387F36E1415B1CD1CB661D8E8BDCC9261A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CONFIR~1.DOC.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Downloads\CONFIR~1.DOC.enc
Size 927KB
SHA256 46245dfd7f7ee931600a345e8e0da541a6613ca25320180df8af61bc9d4064c4
MD5 99b9da4a2ace6fc2f0291f788e5d3c7d
SHA1 c8bec9908c8274e044cae244e418a14f734de46b
SHA512 532e29e9bfd9d7300b74c34f444558a9e266d987f09c8365182e69edaf65bab0cdf409a99898b00b0af546aa9883be0e524c1835800156fd2bc7d3b3b5548790
SSDEEP 24576:059hF54I/4jPP2y8Gk63EjHA4YQ6PJX8TKVYvQYtaeGv5:Ir0tPecpEk4YNJfVYYleq5
TLSH
T17F15334AEB448BCB71AC1748D1F871884AE7F8F9E58609533E0BFB2491764FC6148B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmEnable.docx.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Downloads\ConfirmEnable.docx.enc
Size 927KB
SHA256 ea8a25dcdb8b6c16c8365710431445be0c6e409d12887135c1a22e7187cb7f95
MD5 da29e971190f546a290744aa59d2cfcb
SHA1 43a0f2babe4f4f2a046fd2b2d205cdc1d4b54609
SHA512 647332665cc63573f8ac646908cc940e8f6bcecfa9d5b3ab271e01cb31e4f71eda829faee517918a0ca0b5efa1c687772fd0ec2970241edba1c712b4ce7dce17
SSDEEP 24576:jSFkIyfoAkEq4h0znFRqDQiXbQTAudYFEfWbjFkgYBf1tCIX8rc2Tl:jSFufhqrnFRqDT0TAiW/FkgYTtr8rHTl
TLSH
T1201533613825F62B48A88C1C1DFA6FC1322F601F7D5649783A5B956F9A3F005D8AF43E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOUNTO~1.DOC.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Downloads\MOUNTO~1.DOC.enc
Size 442KB
SHA256 12e2f073be5d5030fe123e0c6c4b3c2d5dc56f63efca796ad8828b5ced0ecd90
MD5 a8f7f3b62a4d6e3dd325361846568393
SHA1 23457a7a79d1fe15c10fcabbfecb024df5a4a172
SHA512 20f515ef22e1edadedbe57dcce4da2e8465a0f922b90c1df6ee618c78a7d96b212df9c7f605eda79b4203313f82df76304a26558128ab6cbdf7c5046c673f30b
SSDEEP 12288:/RQb23HnwEQw0JzGnA6ETSqe5suWnP02Ln:/Wb2XwW0jFTSBUn86
TLSH
T1B2A4231354F3A48834D87ED5FE7F29F730A50A5F93DAA9B902E0728E9264CA5D4D00BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountOptimize.doc.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Downloads\MountOptimize.doc.enc
Size 442KB
SHA256 196d3b7683955711eca4e9e63b199ca1d5cc291755bbdf505af8a77631a71eae
MD5 2c6e55af5553ee668c7d957ca25ec71e
SHA1 76845a3f0403febcb872a02aacc2f933f947791f
SHA512 9fc251d7df4eb4ee72ce9b6c00c3315a8d418d262d10a8a0b654516c85fd720e697abb9e49a1c301af2be78789b87951574c44e6696498403392040975c861b4
SSDEEP 12288:fP36D7nXmPNl5z6OEW4fgH+/TBf1xbiAZE3V8sGSllVoHgGP:X6ePDhZFMBNxGA4VNGereg0
TLSH
T1DAA42316FC78C07437DD954D87A1011CB38E9C84BD9DAC0112AC7AF6FBA16EA71496B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OPTIMI~1.XLS.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Downloads\OPTIMI~1.XLS.enc
Size 885KB
SHA256 a6bd5504dd634fe6bd049355a63386efa2a9770416bfc6d256ae4ab33f8c04b2
MD5 6544795da9ab40c286fa1c2a8ad35086
SHA1 852d7bd96c1f1a9821e76e2fc327ef10696b4222
SHA512 a7c680524b26edaa4d19359e1e9a08cc4c86031e4c3e27bfec5090391be634182b3d12fa4ae4bc83efb35486d303303ae1a5b5b763dacf5316cd3637d3d8dc2a
SSDEEP 24576:Vk4OCJiv5Xyg6f7bd8Onc9Xm+XJgE8LQqjvLq++qK8g6g8+l:VtTivZ63hnc5g1JvG9Wg6Y
TLSH
T13F153300BC42BD9EAF8B581A9F4D30526A9263F3C7C852DBEDC8365486A8D17DD27317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SUSPEN~1.JS.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Downloads\SUSPEN~1.JS.enc
Size 590KB
SHA256 0d47bf8d0dfbf764106e66c39fc40c541518e2d02f51226f125ee75a60de6469
MD5 c15035209841bcf7c81433e54ce03826
SHA1 d3c7e0efac591f2354724376cbc8bcc2c054f22b
SHA512 d9fc2c3fb3f3d00e62d470e0f4e4f9429201d40ceb6e39740d94cf7888c02aefeded15a885537df904d9ba6c25ec7744951737a1812a0ea8416cccb984a2720d
SSDEEP 12288:OHEvOy5caiCC8LXa225WnDcTwxRZktNDUjKu/jds3VIHL9zMjKiL5x9UXcK:m+TcainEr25WnDcTwMDIjdsmtY7LGsK
TLSH
T178D433C02F098325C634AD4BE1ED3335A04A37415EF83D61AAC93656C5A99D7FCE3A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendLock.js.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\Downloads\SuspendLock.js.enc
Size 590KB
SHA256 6b2dd2b5fcc98d0e9342ae6d8308a6518f06c73b96c110de1fe481a321b4c8f2
MD5 e04ab0d4164a228db495603d9c15cc3b
SHA1 f278a334279a742a51808f3373ffc6657137516c
SHA512 38488f5ed0e73e170f93c57b318bbb793f6a3a0b8b9e45c645995b30b62ee061558c75945b92cb5c445a0a4c4724a024360bf28c9d84746f4ca2504ab80ddd28
SSDEEP 12288:u1s7AuXlMZLMLoq4XyOPueuKG9xauTs/Px51tuh2+rjNYeDNEeOmbF5RD:XAEDb4XysBtGKuOMzDHNTD
TLSH
T183D4230F44D327BD0FF322344A97297EA35D79C997DB281465C14127FC68BDA6BA082B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTUSER.DAT

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\NTUSER.DAT
Size 2.0MB
SHA256 f8427dd4cc88bd15f0a103f2c8641ea58d238505753db40115c8e529602fe171
MD5 7aadb96df4a63a863f71b0c425345acc
SHA1 5662477fb84cff111eca5216eea3b57c3d0a07b2
SHA512 faaa17a32bc424b3a5ca68da426c0de97df84cd235f9b2df7b24552e38db2fd6e829ace95e0b344cc6cf569bef37278eb6c1582ea7e2cae3e4aa9a1948e62ff1
SSDEEP 12288:mNMKa1y1nzEn6PyGG2vEp63JdYoo58aM6xJdYROJcRh62jdYsmTsB6LSdYs8Esyj:CfVO63si6xdJO62A26LBEs
TLSH
T115A58258F8A2D492E361C6764DA25B9737F37F833D08890721CD2B9E0C7F1169889E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTUSER.DAT.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Admin\NTUSER.DAT.FileSlack
Size 512KB
SHA256 1a2ea80fc7bad203dd18f2265536c7dfdb7c1f51437a89f14b3f404696eafe08
MD5 546a0fc131439df1054abf8c64e23f56
SHA1 d4da0bdabe84c543338dfced98cbeb3ecc592294
SHA512 60dd8100eda9ae828eb81eee6db2a3e6418b68ea0306edf2bdbf8862754d819bf46f7a6b6f322b015486c1ff19c42a499fd9e85d56aa69f7bc37d94b45b8a6a2
SSDEEP 6144:CT6DNgZesaT5u7cnDWfm3dwJQYt8OQnCA1o9gIC:CfZeJ7nyu3mZg
TLSH
T136B45F529AF80134F2F7AF3895B551126D3A78966F34CBDF1191029A0AB2FE0DC7472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTUSER.DAT

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Users\Default\NTUSER.DAT
Size 256KB
SHA256 f6921a89bdf7ca680d595351ee7bf8ab522ea191d0bceb7683770a8162c41a96
MD5 b63fd4a9647b978495c3b79b3afa13b5
SHA1 6b903dca4c06398ab92058cddf9e35f8e74cee70
SHA512 85c0ae47deae2410db546559211b692a6194df3bd656343de32613f241df1bf17f5a2475c48a93bc267fa1044dea6f53b72209299202082da8c4d1dbb817c83a
SSDEEP 1536:3XzlGc6PeLtHPnf/DzLLgKy9CZJ9/3Ks8ue1KHG:BGc6P2tPfLbLJ9/u
TLSH
T1B4440E41BB90D6D1D1B749329CE6DF966B37FC41AE1283473380372F8DFAA469E12681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPLICATIONFRAMEHOST.EXE-CCEEF759.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\APPLICATIONFRAMEHOST.EXE-CCEEF759.pf
Size 17KB
SHA256 accf8b8504c71db731909f1c8ed6926273b5a242660880ceef5649adcd70809f
MD5 fe136b0c3d2aca3ab76baba6922831f7
SHA1 2bc889e2693a7a71739c88be9cc9e07d1a1bd384
SHA512 58f8ff1b65165a54e60890cd516b0088d523ddc4fd5864d7c1610b1bec8eb7911f534dca0cc9fd30831f06a132e604272a96375d1c0844058365ae7be77da386
SSDEEP 384:bkUXsyZcTWv2/Dib4yHVyMqlU7zWcnv37hq8LcsCVIEI7SiV8mpNUY:tHcUb7Jnhtq8LuWEIzN9
TLSH
T14C828D9D4425CB4FA1080873F694493C10E807DFB5B4D082BEF788ECDE92DD5BAA65E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BACKGROUNDTASKHOST.EXE-104C7847.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-104C7847.pf
Size 11KB
SHA256 5f4efe1590094e7e5afbeda8faba12d0666b9ff8efde24ff14a0378f58de7c94
MD5 f0d697170e38b9d263a3934db4185c81
SHA1 d3d0ca38989e43a6a300184965fd8ac548dcfc5a
SHA512 9e9d8e01fbb12dad2606cf5a501b00a247fe0952d183be23cc9ed789f33b54923c0dea45e25ff9de8da2c6cb69f589c3009dbecac00f4eaff1cbe4892026ce1c
SSDEEP 192:ifH6I6c9yF/jph05dtKK0T+olQoChGRixzYoOLQ/3BYKCnJgI4+b2:iyd4yF/jw5dtKK0agT64k/RY5++a
TLSH
T1CA326D60A4BB2C4D1CC1C05BD05619A6F126D66770BBF7E3360566CB6BC80B522E8B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CONHOST.EXE-1F3E9D7E.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf
Size 6KB
SHA256 28e9350e46a0658b3b0e7e64bb50219211835ccbeb6953890abbfffd86cd4660
MD5 862630ae9835db947d72d12c871a29e4
SHA1 022f392618989251a1f1c6f498e8360c2d1190db
SHA512 7f3400b4de20a7086daaa8757febb08f75be43e4c7ccf8853f989fae45c4e3a895374a65d8da55ae2aeb246de6ca5246d9f14bcbb892bd42bedc39ca7a378c9d
SSDEEP 96:u3Br/VF2MyjcFHHAft/cRc3cJaYaXoGibj++D7aYFmGNPbw5kufw4MVwl8IbzGh6:EVAfEc3qaKGibjL7LZEiVwRss4inw1bG
TLSH
T100E18DA924F4A108C6C57F79E7690D55063C86154AB0A6A2DBC36CAFB32F5F8923436C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CONTROL.EXE-817F8F1D.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf
Size 10KB
SHA256 2819aef0b6b32a93eddbff46e287bef05e5ef43ccfe4c105e7811796985fe07d
MD5 d920a854469d9a8d90494ed0e5f8ac7e
SHA1 d585924170ec2fe429ce1c914d2af328c7b690fa
SHA512 7a972c3f1f18a463359e610cfcf15db7a9fe9adf8a1e653add564ebe04826e54e4acb38855b70834402a4857f9126c0cba98dab45648484425150c7ccc5bcff0
SSDEEP 192:ZtSC8NuVoHOAcl5EWvu/bLdJ+O/e5vWnN2/IO6ZhR7m823GkYGxTGywtJ:ZtAkpAc/tgE55enN8Iy823GRG1stJ
TLSH
T144228E70FAB86E8D8745E46CE04A52B14200C521D928B663A70A3BC777CD1F7BB7855F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCRIPT.EXE-D1EF4768.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\CSCRIPT.EXE-D1EF4768.pf
Size 9KB
SHA256 0d58e2c2412da30c5e4913597a80ed361a5fb0bf222ca05f5e7a1077c39c7da7
MD5 1247846056710bc6bd2df10e6e19c6c9
SHA1 95eb1b442dea3689ea79a3a861c4ddf62f4a9110
SHA512 6a5313e3e0123cf541109a841d840febeb9fdf566fecee9c31cf798469e4758633313a071c6300e02ba131f591e62d907b9fbb12cef2113025ba654a031337d4
SSDEEP 192:8IKb3BxxhsnhauSMBLzDO3AV3vkZNNKbq0rY+dvvpGC8os2ZUxAIKaMJApK8CCr:8ImR9snhauS6zi3AV38ZNNMqwY+hpj8R
TLSH
T1C2129EA4B5A02D899B41902ED053CE77603ECB5F8199F117823A0A5313DD3EB90F49E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DLLHOST.EXE-28A8211F.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\DLLHOST.EXE-28A8211F.pf
Size 7KB
SHA256 92f6b0d604b70aa0f9615d64af71545ef4fe329f83c8b97480f20fb9d7dab459
MD5 38456a4ff0b642e41b89ae14917e3fa0
SHA1 8e9e320d45d9fc5d1fdfe46edec38c0fcbd6d47c
SHA512 12269d4f52e4e990efd8fa396c98ee6c70e8f2b90028df26e020e364f4cd7070466db36878f180aa62d5c58f2be66f6db79eb6b9274c3523e6e9b7cbd25bb9bb
SSDEEP 192:tErH08lTqzJdwp2HjDIh0nQI61NZgt2UlElZvryr:St+dwpjhVI61NZgrloZzy
TLSH
T17FF17E11847F0D8E4683C06ED49803B6A026C56FF9ABF2B23F05716A73C84D179B5B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DLLHOST.EXE-5E46FA0D.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf
Size 5KB
SHA256 45083097f75727d767a76528ca6bf5e1641c37b7de221c486ba846c9b6f60019
MD5 96fb9a3c170065abe812644cf72e5753
SHA1 d687ffc28fe812300acc4eb6e5db898acfd90692
SHA512 c7f9fae5bb8984e30726b455abbce6b2f4c5317fd8d376269c9c25bed065eb5a5d2d613a1511a2144d9d8014fb75a574828ba6efdb57bdc8d5331664ccd4efe6
SSDEEP 96:09/HccdcBRmxZO2lDwDix17Fzd43EoNpqyU5KZ3azGxMzo1Ja5FAax3x6xI0TLdk:0lHccdciO2lDwOxBFS3Pnqy+KZHWoAdZ
TLSH
T1FAC14CF6F87C2D465ED7E8DDE0889CF14422D072A021B2E34343A7D2B75457251B46BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DLLHOST.EXE-ECB71776.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\DLLHOST.EXE-ECB71776.pf
Size 5KB
SHA256 0b31c7f4a0fc57fb626174f9c1927c02c35c38e5fb8b6258298820f94656029a
MD5 acd400f26e45f119f09ef650a9090506
SHA1 3591ddae606f23be5986b6aebaed9b7e66957d88
SHA512 9997a670008e2a9f2ce1fa27c4ef611658ea4a7669f173f55cf5c75959edf3ee06a638fa1450a1598bed78ebcc90dd2555b3053d81f122513304cb972d13552e
SSDEEP 96:VKzNRvQBDVMTxT1gUVDfN6MToLETS8hOYsogp48dbTruNlAcPeoqk/mTkCgA:Ez9xLN6KnzYa8FTruNlApoqk/ikLA
TLSH
T1F4B17D20A0D02573CB32B8BB96CB0FD9970BC15BE55323024671E00C96ECEECCE459AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPLORER.EXE-A80E4F97.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf
Size 32KB
SHA256 a79a9fefd215eac674f5438107745323886f623c7ba8356895c8e57fdbd193ff
MD5 a4e51dcbca9009b7da358d5b6d0833c3
SHA1 8a3828957ba255db66b9d7b1479e732ac0695651
SHA512 b831bffb3aea6b3985fc1c1ec68b8c8f4138e068324efa9c1d6be940bb36691c82028452ec324f2855490e895f7fd3c9e6380411c928a32762dec3ebf287ce38
SSDEEP 768:hijINc/dazPwon+CArwxbLleJzp4ybiPBwgqLJJBuwar:hijhUzPwonU+Wd4aiPSlMRr
TLSH
T160E2BF9FA838113295C3D5E7794113B02606CA2571F8EB63372AE1975F580E05DF3EEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FSQUIRT.EXE-BBD9646E.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\FSQUIRT.EXE-BBD9646E.pf
Size 7KB
SHA256 cf74694c4c0f7404734d5038bda169f78c30c7dd69e4c387be1bdf6ad0d85c7d
MD5 45bc83e41fa60ca8eb1d9bf13c624362
SHA1 8eedaf71cd90eb22a742ee69444d2643e41f2f98
SHA512 9322c3ae8c12f50709c4e8004109899054e9b39c7b28f112ceb1ec5e221cff447ec3d2e6b0c1931086564ccd8fc211ed6551ab01b609145b4b8f3dceedee7125
SSDEEP 192:yLh/7oOMYAtl3hLE27oEtRireOjxvpIfwL6fZ0y/ytvAuJitN:ytjoMAv3hI27oc9GWfytvXSN
TLSH
T1E6E19E14E81A2E17E85DE1BCECAE4C4A940FC485917140A2B60CB7269FE37F7677490F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MICROSOFTEDGEUPDATE.EXE-C4317749.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\MICROSOFTEDGEUPDATE.EXE-C4317749.pf
Size 9KB
SHA256 02164220debabd82731d16793a42bc5a06204f5179c0180d5d82b699bd201391
MD5 d809e07eaba7be3ae22d0d8857249916
SHA1 92cf86195935f4337d5ae99a4ef4c0ab3e12550c
SHA512 de5bab57ac0ce6018390217053dacc37f747f2b9e48b6a0444796fa10c8064e907487fc5c2b578893cf4068e140129fdde70ab36f31e44efddb6e75748e9b121
SSDEEP 96:2zSqbAsu0iuZ+FXnugk2MgZI2+dB01SPpME9nChTzy3SiXhX6sPvvVZ1fWxYr0vJ:2z4DNnRJIVO1IEVz3iXwOfPrySD12t2m
TLSH
T14D129D4A1572AE69CCBC5F16BC2ECB8B066956EE83DA4F461BCBB8F4545185E3420D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOBSYNC.EXE-C5E2284F.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf
Size 7KB
SHA256 9d6fa32bb69005926ec427acbf6a4d38cc12bf15878cf785f1aa176f8ebd03c9
MD5 5a44fffd11560193696fad29853810d3
SHA1 22d192ce5f06c7c1a9599380461f8807076d2a94
SHA512 b5227b20620d4337b9527f5c0178597459a0c0a4952441c908669cad8df332ca9796cac2da3310b73d1493967c43b88ac4b4ebd87fe725a3582dc3f92b319805
SSDEEP 192:QAP7tH4GwP94jIptoM2Rmc0OTa2x15JbeCIcX4:3Ph4BPejIpL2Rmc0O31pIN
TLSH
T1BCE13B75E92D0E8D02C3CC5E9186AAB87424C83766A675312B0AB5CB224E3F517F85DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NETSH.EXE-F1B6DA12.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\NETSH.EXE-F1B6DA12.pf
Size 8KB
SHA256 4ab8b6bcb3a4560d0306dd64bdc2b195ccfa2740a5cb25b7c88ce871f7aaa363
MD5 fa66383adcccbae28a8319d99f69f989
SHA1 5d162cfb31ecb941b6c3226cee2e880a666c1c96
SHA512 6ba214df10a248b695dfd688657e33e63d028d9c22f4b821a239a2e4f0e893e6d8e92124b43ccbfeedfbc9fc961a50b3afec2219427dedb2ca6f72bff86e958a
SSDEEP 192:6o+gIDHQ/e4HE8KMHPe0egIYwPLklpvneQIHuWOmEIw1bByk:l3UqekEbMHPe0vIYyAlp9OmrLf
TLSH
T1D702A021256D71519F43DBB9EC50958AE50C1737C5DBBF5C8CF11C32A3059A920A92FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OPENWITH.EXE-5C93E816.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\OPENWITH.EXE-5C93E816.pf
Size 28KB
SHA256 b83436829cfbe9a2fd912a1b635833c165cc9188fa584039c176acb18752088f
MD5 62b9123f80b39d2be7f3fb3139903a9d
SHA1 b3caaed4e480f79b65aa794b298aff2dfb51a6c4
SHA512 260dd3d11ae531e6e9b29bba3001b2ce1a8e08cfab9eb3507107179a43018fc7a2cf59660f0506a7f272e819361e50860d83b2a2b48f06acc48f4676a4d6cca4
SSDEEP 768:4uvDac8MzeQL0s9puxx5JxX1u2oUowxzh/e2JGV:4u240saX0dwxzh/VI
TLSH
T1A8D2BF1D4F7A6A4AFA81457F70F0A1782555916F8294ED323702F233A106A32D7B8DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PICKERHOST.EXE-B8A68B3C.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\PICKERHOST.EXE-B8A68B3C.pf
Size 19KB
SHA256 85ffc2ef51cdfcfe9f08325f399d2430f194dcf2939ed0a468ad0f979ddd4a59
MD5 44834f21c9c59c24067aecf11bdb0c24
SHA1 0003902776fa32564c82770038b59185b75b52db
SHA512 44b70891d84f55f52d434a94b82b38185077c9367351c2161f01efae1ff229ad71eb7ef0f35bc98b7d9eb42bb129f2b445f1cd3f84162a28ee1a7b427ccfc3c9
SSDEEP 384:0hABpNRLTO+LrDdtmg0UXcGdpz/raHbYFO4x7+J9xZ0NwktMLl8AE:0afxOivj5s4x749x7keLl8AE
TLSH
T1F0926D9B59710EB7CE262C76A8D279E717A1D03919CCCD0B32BA6438E70707479D1EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

POWERSHELL.EXE-920BBA2A.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf
Size 45KB
SHA256 4c1674f146c200581c026d147ee3ea0a04dfd9aa1f14b2dbcbc6de606698c034
MD5 0644c5c7c2f199995434855df3060459
SHA1 6eb0baaac09ca021bd06357ad6f91dfcab487e51
SHA512 a57a8e888040fa86b0ebb5193f52b7b731ecf5c80f5ee645bfe3f70469d6d192a2c177d7e107ca87e405c88c2ea3480d64463679450d725a542d25f99fb06eec
SSDEEP 768:C/OncTZIcfst7otOwBXYQr8dAlRbWYoz0ebGKuDa3UPSBonyzkIo3Eg1eDM/c2a8:C2nkIMWctOwBXnHlRiY+0dxO+SGnygIS
TLSH
T10523F1168BF055EAC19AC3FC45A0BF278D96262B408F2248C1DFACF56254E3E70557EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSEXEC.EXE-80F89DAE.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\PSEXEC.EXE-80F89DAE.pf
Size 6KB
SHA256 b284caf72e54c891dc4db2946a19747c9d5cc59730449bf5636cae7bf3e9f671
MD5 36adb37945d970eefb461121cb894410
SHA1 95b90bede464d936ebbe2d0f50aea6cf7083971c
SHA512 378de1431f7e67d7cbef1c48ad9808ae3972f564045823a939da8c8e48939615c711273216ee5983b3fefa13acd51e3fb3f5b0695725cbaab11408137fd60fd0
SSDEEP 96:/zpzkgtofQV2gU5WnmNGvdCQowz/2x2iW+sTlBLeBeqOCijD35NQUcT3xBKLfJVf:/1M4V2R5Wn718wqxElH/QUy3OfJFq63/
TLSH
T1C5E1AF54F5A10E464DC90AFC5B6800F7876FCCCB928835723357ACF6E8D6874ED1A081
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSEXESVC.EXE-7F956DAF.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\PSEXESVC.EXE-7F956DAF.pf
Size 4KB
SHA256 35dcc8d35395fff1feb33d624020f8accf8fe15fff9ffe53f89ec75873d6a74d
MD5 4168f9b8fbfd56149a72c23fa49762ac
SHA1 dea8e13c439b85c5fc0d56b0c28792619bbf322f
SHA512 bf48b827a63149e41a40b243735d94ebcff32beb405352b09c0cb6ff95c77d5d54c6466873613b210292fb890f50288ee64814aea75c9b9eafe5e263a50cb3c4
SSDEEP 96:LHs7sfeiZh4OiQfInMkNCvFyLlVOXgogKocZvx2TsBs7UsPZzYHY:LH4iZxqrEyLlAXMyOhzL
TLSH
T1EB917C95A8624ED5CAB0847379E112A165F70CE43D0CE1D06841CFE9293D72375B4457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REG.EXE-E7E8BD26.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\REG.EXE-E7E8BD26.pf
Size 1KB
SHA256 3b6464d45ae687aefa527097eac2cd608cb448835fd4fb3798249c0cf747555b
MD5 fc13cc3b02515448f7f12b824b424efe
SHA1 3a7270c407033f674b55ba73cd551717147c2acd
SHA512 379e05cb90d06a821ed77923dbdcaeb7cfd731c8522972e50da786e87ed4e26eca1b74a7cb730e571cc22e1657cffb1c1c5451f4765c0b221706f7cda90e8bd1
TLSH
T129310968E08213A1FEFC65FA239792D686B5335AC05006034AD9953018E557E29EB433
MD5 SHA1 SHA512 TLSH

Submit Download

RUNTIMEBROKER.EXE-4C0446C5.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\RUNTIMEBROKER.EXE-4C0446C5.pf
Size 6KB
SHA256 f6be49709b5132b3271f8cf6dd1278c065aab5ba1f9e731ee25dd1a3b6001cad
MD5 bed86f28265cbf797e52757ed9171c7e
SHA1 812069fb1b6e3d39b0789402a8bbff48ff9f322f
SHA512 6415f778d6a06e7c5023abb74302e4c49af4bc35b19808788834505f84d62df1830851c36a24db5cc4dd2408eb86d2ca84cd3559edd31a81559a36ad85b9eb92
SSDEEP 192:vmKsG674ycHKBWr/97ehRJmR9R8zN1m18fLwT:vmKN67UTTpeLJmRv8JUSfUT
TLSH
T1D0D12930C1ED0D1E19C3C897E14952A2A216DC27E92676F20E0636E77BCD2B116F65DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUNTIMEBROKER.EXE-FC4F7215.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\RUNTIMEBROKER.EXE-FC4F7215.pf
Size 3KB
SHA256 96f24705d4b495c1160559f0808f324adb036a9b0698f458dd71a2a62aa0d2c8
MD5 7ee6527d4e8261da4239348b98bbb3f8
SHA1 f85f132376f36c6a71ef416f79a18e0b7abc0108
SHA512 b0ea0f0d8d7b42ebf1f0430a385f763952a00f9d9454a2f78687101c618e5c09e6090d673667d22517d20f9bd3538e91d20844dfe93c3011eba2520ca345c6d7
TLSH
T164816E0378DC7F14D8FF95749FF15A2564486E350D0071B392C1786A394AA7785F90AD
MD5 SHA1 SHA512 TLSH

Submit Download

SECURITYHEALTHSYSTRAY.EXE-41AD6DE1.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\SECURITYHEALTHSYSTRAY.EXE-41AD6DE1.pf
Size 5KB
SHA256 c76f6349698d774bc1c29240e288f47efaa365aa9ac74fa21bfba1d57bdaae34
MD5 988547c5602ab6b5d4c8eb33b15ab8ad
SHA1 2e616aa8289fdb2a0f8e16cfd1ef6f6aa086f2fb
SHA512 5baea22361330ceb6ce2a201e1afed2c08da5b3669b80a4199f49db5027a0d1584b9a57e864d245275e35a683dd5d0f9ea5aacab8ee707cbc7393f33e63eb569
SSDEEP 96:O+BCrFdF4k6cqYIcOFkbup+ma6xVZVSNq71Ct32ZYHOWqgsrVN7ohEdfPvj48q:OiCrFo5Tf9p66Hqq7QMgsZmhEdHvxq
TLSH
T1FEC16D84AC297C4E1875E0BF7AC30EF1893908D7473305412FA9325BABDE5F11835A89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SHUTDOWN.EXE-E7D5C9CC.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf
Size 2KB
SHA256 479c8576dfb3b121e341307e6c2f076ef1bb0e0663694dfdd94fa6238a853759
MD5 d02965103a3fa22fcc83e5a4e473cf1b
SHA1 2eea6b657e4d5797d1250f692feb546356f9dd9a
SHA512 3b0620c4904811178722abfa168760e4be63394179c059259391676184f21bb6460e8b44d04b84ea063424391c967a802e8b93e240fbcbef29e2504dbb757f31
TLSH
T1B1516D05740918DDC280BCF93B611A437DBAE0E3AF1A11B5B0DA5ACC5DC66E8B42302C
MD5 SHA1 SHA512 TLSH

Submit Download

SVCHOST.EXE-07A3B3AB.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\SVCHOST.EXE-07A3B3AB.pf
Size 4KB
SHA256 57d1582aae067f330dde3569bfdf4b868c701a940db0ff30c15cab33b2b188b6
MD5 2862386c529f4c990333d6d548376678
SHA1 acb8c89cae77a103613fac4cc13cbb0a4e921994
SHA512 3edc81d117a1c83c20349ef70799be24631f4dda0cc1270e0274c662370ef576a3c19f70c1d8f9fad6952337aa8b1c7124bf3215f616e8759d8f2b5a0cddfdfb
SSDEEP 96:fnJxxatBYw19eOLdDaao/XVRPJWasarNF53XBuKMipqvXcWiGtqoBGRVKumjFJr1:fJxc5eiavTPcarJ3XBu2oiNT3E1wU
TLSH
T1BEA15C01B8DF7B00B6CA573593E48F2661E2D022862D9E4724F3750391CACE6E1C8ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-2F0E0AF4.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\SVCHOST.EXE-2F0E0AF4.pf
Size 11KB
SHA256 26c87e5a2c14d1ac0f4ac97b6ec66647858bfd170c8177bb0b74d8b05c09c44f
MD5 d40551c5ddb8e9f8470c60ae8b09cb89
SHA1 7cd815f9608374252dca223e45848a62fd77055a
SHA512 36a19b7bbc7cbe0693cc3bb35d619fdf0f17ecef3e40f8892af2faa1e117621fc14631133f4e00b497ad538d87ec78e58fe688721a278f9af16978f0a6bd200f
SSDEEP 192:Px0kOTqSuAPGL4e+YRRUnYmVD85VAWxzNOe8rBSPnYpsYyCD6JmmamgZZ70Pr:Px0pqSs+YRRUbD8XxzNN8rcP2z6J4mY8
TLSH
T104328E7AC4725D056383D939E89767B1C028E032581AFA522B09591377C92F33BF9A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-893DEE50.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\SVCHOST.EXE-893DEE50.pf
Size 6KB
SHA256 c992ec20dc137e51fa70a5afaf308ae836b3dde26f08009bfbebb1efaaf8764c
MD5 6fa72ef1ec4c262904a3a49360d51a12
SHA1 ee5ccbd2b7c18dc921ac95f6c780b1327026d215
SHA512 2657e277ad3131ac4d55b7df70eb3e9c52e88a4385ff656a9ad37b2e7ead63092295118b307a296a702efa6dfe8e1c123661c27eded0d8a4e78a8847924cc635
SSDEEP 96:IU8uv2k1TXaRY2OLp+vfp+xNvoyybfCsFBIa2HyywNDDxTva+PyxIwm9C:+wpORj0xNRybfCsF25Syw5DE+ajUC
TLSH
T1A9D13AE1717C1248D583C025E0E888778031D93AE1B2B7663B267247778D2E32AB4B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-96A7E1CF.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\SVCHOST.EXE-96A7E1CF.pf
Size 4KB
SHA256 bfb5097baa4abffd08329752571c236f925042976b2e19b5283d138e357a98fd
MD5 ff479ae4f12eadc9a7d7817aca91210b
SHA1 bdc32b3279679515bf7e4fa03f53ea5720321e57
SHA512 0cbf4a7f3215c584faff7e5eb522140d59d9979ca0bd2582619bdcc7e4d2939b447000577c2597fd93b636fc545ca36d149d582cf782b33c80d1c351d1276cbd
SSDEEP 96:acIJ8z7fcO1IiKVRWQwWR8qpNsCIrxuUtO0K2KuwbbZsAwWj+d4L:iOz7flIi2W7WR8+CrLRwbtqWid4L
TLSH
T135917EC4A42C7707FCD2C4FF5B098FB1D5214E736B71E43C66025109786F599848E2E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-C49E779A.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\SVCHOST.EXE-C49E779A.pf
Size 10KB
SHA256 b1b02b6e1c821d992d485b905fd632308b53161ca456a9bccbd9f7bb7dfaad89
MD5 2226becb71fe1183d40f3b54a526fc79
SHA1 25a5952f681d37e9689b6030b2b6f8105158336e
SHA512 34bc1072a4dd6926eb7ceb360f9f75bd45987329e08682154adee7517e0365e5849e7b2af3d17122b2f25fa86bf4c5d4d1b013dcfd918ad5c7f7f5b84e73a0f7
SSDEEP 192:gojnwJYOH5We3jxusEguomVRfP3690VygVILOCpJ6JAv7zM5aSp73JdFf:gokJYOZWQVuuKa90VygVYOMJu595Hf
TLSH
T1A8224C37713E1C0C26C3D43BE82499D5741AC927C976FA52370262DA77CC1E256B4BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SYSTEMSETTINGS.EXE-F13C32B6.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\SYSTEMSETTINGS.EXE-F13C32B6.pf
Size 54KB
SHA256 24bac5505bc0f1193f24236987f3b26c2f716b2d41848ceb8d60020b85075cf3
MD5 92568fb8963aadd32ab67e7c743adbdb
SHA1 89cfeaf86fe547e9f8b0c5bc4c0d71b21b52b40d
SHA512 1c5d75bc2db11850274b578b8be406d31665685f65ac755f6abda9bd34c8a6e0359af2136b6a3d1fac69ea0d4e5b93697d90e545a9ab7b6c4996e93e1bbd52f8
SSDEEP 768:r8iUqrRWfZVxHpqyE2k2ZELUyZjswSo3947oChaSasF8M8TvQrtOPMi7Mm69bL2U:wiUqrMfxHWjxSo3OULE8z8xmPrvQR
TLSH
T13343D036E97A070098CB98F3D1BB50B357BE95394906B743737A7990F2811369B3234B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAKEOWN.EXE-A80759AD.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\TAKEOWN.EXE-A80759AD.pf
Size 2KB
SHA256 f0584472c1e0fd422ce3cff6424cbfdc3dbed2411ceb3501709818869f5888e6
MD5 00232571b6b2540ff337c7d4ab980d53
SHA1 15555b4d8a40d7be96882d4ff5c66af0c3e081a9
SHA512 4cc6c2b3061603e98ac9be6c9d2f0cfa6964d82c7c70340d73a01151f56d8cfa1267ce9568249ea46465aa861bfc5810b92f6dbdf09faecf9fb4d4b0458859a6
TLSH
T188411B1C10F1BC03EDFD19F8068646259BFB04A0FB4A2682A5B8B2569DA1976A5C786C
MD5 SHA1 SHA512 TLSH

Submit Download

TASKHOSTW.EXE-3E0B74C8.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf
Size 5KB
SHA256 9fff8b366dde6bf8456bbbba0f32eb50585949a5d0de3eea4ed498225f6b3c62
MD5 92dab088f507745ed355bde0c1216463
SHA1 35f9eada4072ae39802bd51edc9bcf6249e74a3b
SHA512 bbb118d02c7b277c3a432764e4416df342306f1a56ad64461327fc49322978dad145083444a8dc22956f146edc7535c6ca1986253938428beeaf2019c0058a4e
SSDEEP 96:VCnwf9IMqqWVx0I2WXxcjkewYHf62tjaF4YrNxig1z4fQTCYR3n/muCM7U734p4Q:eOz5WVGI2Ie36H/rNxflXrL7g34p4nQ
TLSH
T1F2C1AF3485AFB7024DDEF13CDD6A042136E1CDE77A08A184D6C6AA047E382E490F69D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TASKKILL.EXE-8F5B2253.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\TASKKILL.EXE-8F5B2253.pf
Size 4KB
SHA256 2bd1531b991644ee7f88311a3c8544b224894052540f9542610cea49e110a85b
MD5 eb885952b6aff539f49c2e28142539e4
SHA1 d56d3632a1cc3446d0c08a0b845db6901a2f81dd
SHA512 e503a5e5797640dd145248fe7da4955a16bb21c34144a567870888bae2cc80750dfdae2242c2a8d23288590ab8d35d1743166418fb7c6cfe6f86a42cf828057c
SSDEEP 96:VLQLql5ZdSy3rMm3jhiefmvot1L8h+I2GJEpKdVM3wJ8AyLvfw0w2Ol:N3brSy3rt3jhhfL8gI2DKd+3wJY+
TLSH
T156A18DC4096B2F12E0C9D3F9DB9E1821DA6454616F2301144F08689E825BAE3C0DE625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USEROOBEBROKER.EXE-D2992F42.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\USEROOBEBROKER.EXE-D2992F42.pf
Size 4KB
SHA256 afce78ef5d78a68a37cdbc67aba5405fda989ba96594e81bb98e39bbeb6ba918
MD5 6e44247c449fc59a453bcd24176ca729
SHA1 11da5e04372f3f57cfe87293f87b15158d31e0ed
SHA512 dd0803fb8c59f1ebca8ba1af0949fc64661b9ef1cfb61cb36b609c69fd6d8819e83d22d3668b4dbfc6a5fd9e8bc8b35625348653017179610d754b57977920e3
SSDEEP 96:akJeT/JdMZkS8kaZlmo42Pv9le8vXuKv6NS6XK+ox:bJUdMNwDmo9xvl
TLSH
T1BFA19E814BDC211EF5B3A1FC229D4D701041C3FFD5DAA7258620B9246FCF6593C660E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WLRMDR.EXE-C2B47318.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf
Size 6KB
SHA256 b4c98491afa3610f04bead0a5275cbfb4116e7574a13992cb4b9b702b2d0a14c
MD5 937e37fceb733c53965996a2915b4ae1
SHA1 52dedc7c81a8456ba7c391d5575f110753eb91d5
SHA512 1ad2040e6c7b9c9425e0a329fd531efb2b9f4c41fc4f50e69474fc9b9415721e489f9ffdf036f99be083885496339e7e59c45e69891f84407c39be797592f737
SSDEEP 192:C0/R6eUIFBw7sPltKyIozabPx4yCVcCokdoSY6:C0/EMFBZzKyk4ylod7Y6
TLSH
T182E15C62F0154E0EE85BDDB25894CAF26414D5BC4125E075AB0863D3B38E2D036F0FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CimFSUnionFS-Filter.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\LogFiles\WMI\CimFSUnionFS-Filter.etl
Size 16KB
SHA256 eee1544f42ad9f0bd718c2f1b422dd49e3c28398ef9d916052357d7e17c3b0fa
MD5 335cacbcf19e3938aa4f5468c7c70e5e
SHA1 b40a43a52f5df8f1e6b55848ac0ca55f0cc9e66f
SHA512 eefd5bd49f4d4d4bfc19f3a0ba0ee1c3d13bb046cfdacd8ccb70ba280aeddc3200459110bca3fffeafd92989ca3b76a131b893ba32d9ac947e89bcb9bddd3476
SSDEEP 192:+a5IMxsTTcfDtaOgaA9CRd6eGpPjbVO4a:/N
TLSH
T154728A79F7562888C5F94072B98FFA242971CDAF0D559F01054C31CD6A3328E9AE1BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaceTelManually.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\LogFiles\WMI\FaceTelManually.etl
Size 16KB
SHA256 4eb124232609d21e3145ce7ae4af2a48381aef9d23f46ca81ee1bd89e0b14a2d
MD5 c07835af624e0df138cb2d616748ac4d
SHA1 232c733821554697553ef33b7825bc0b936d9fd3
SHA512 6f23f613be839d2bd4e145e433ec5f3eda400385b71eccebcd521a393f24dc179529d89152ebff1e873ab54e39162bd32caa30fcd324a167fe2bf07a8773e903
SSDEEP 384:euSAuVuAukouYPIuYd1Nj5DRBJkzs7uY9uY+uYs+nut:cEj2sMUPC3
TLSH
T1D972CD93E648025EC92566356C5E17A058979D47094BAA3802CF7B34FC7FCE9DB233B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaceUnlockManually.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\LogFiles\WMI\FaceUnlockManually.etl
Size 296KB
SHA256 88135e1ee2d30b0a1495aa39d9f32252a9cc478c588fc01290d6c1d7edd3f8c8
MD5 7ac80bdac12d5bd59087bab4daaeea4c
SHA1 7ba7a7a6d341e77ea7a4377c90b8db5205404c41
SHA512 5d2de6141319fe829ea6e537eb97baf5a8aed4a17e9eebee38978558954ba9317141cb93876f13b579c030cff019dd7ad0c548c75e665baee389a3d43349cb9c
SSDEEP 1536:0VFX7g12oGUqf8Nc0u5pG8dXA9q5cOQYE:0VFg8lC
TLSH
T1E05412F540AC185DDC6D28B4FC2B1FA169932D8709814E354BC2BB3AECFFCDA9A50594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LwtNetLog.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\LogFiles\WMI\LwtNetLog.etl
Size 192KB
SHA256 780d5abeba6b3784de6cb26b314e4dbf6b4fcb7949daf0d9a136835fd1d39748
MD5 693cd4db8a0fd884cb42b0fb492df113
SHA1 2c28fa9709fa83577a888a2b2e61f373a236b489
SHA512 60ecc2fabb371f532b42c90606cc6517224f69f347e7a15d3dab792bb277c185714c47f83e7adfb919f92d134a97fd6a54285baf52a03909e31b6660be46c947
SSDEEP 1536:O+LokL/JP2qkeYB+3+G+Z+EiseMrGuADI/e7:O+LowP2qkeYB+3+G+Z+HseMrdADIm7
TLSH
T1321427613A5EC362C92BB171815E4F8B2671FD0912C08527F360BB7EEFF63A15923919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetCore.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\LogFiles\WMI\NetCore.etl
Size 22.0MB
SHA256 8aa2e91c6a7b41e920bc01c4255e7dc95955b9e082a72b39e703ede7820baa94
MD5 6c1917f15b92e6c5aa8e5d57cfac7879
SHA1 9469a1fd21d0d32c4ab12ac5f35929ce9c70be28
SHA512 265cef416833d326fc803df384b76411e64644bc03d630837904b1dd5be1d228660840ee548c3ca6ee0ea450b7beed424d7b1c96e78985190d6ecea86a1f2bd0
SSDEEP 12288:MYnFjQpr90ob1aTam5epAK9I/VtwzADtrBf8r6P4X95G7YEd7Ez+L:MiFjQpuob1i/K9IDwzADhF
TLSH
T1B337862D7668723AF7BD00321CAB273219352D6F4261896F035DF339AC37FA19D46686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetCore.etl.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\LogFiles\WMI\NetCore.etl.FileSlack
Size 19.8MB
SHA256 9d47e4548a0314645b22b0808e633d264c7e659efba657fa1f65319aa6e0aea6
MD5 933d7b3300c342ac4e4a740eb1eef2ba
SHA1 6601a97efe38273bad0a113c2a8f27a3b786b09e
SHA512 36e841a1018a47ad017a481102ff3496c7f2f1f16961b0d02ad8254af6542923133ce56401c2b718290e3c740617152349a30ea2264e4b3add1601e930de6dbe
SSDEEP 49152:gDZ6XO2IpCVBBllz9ETQIigfLoQeiGpW6MY6zY1RBxKJh9UZ/rE/VtT5PF176dHj:gDZvCVsicei0OX2PHZ/lKJDu
TLSH
T14927A53067E94209F2F36B302E79F5846E37FD676A78D45D214C816E1A76E608A31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RadioMgr.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\LogFiles\WMI\RadioMgr.etl
Size 6.0MB
SHA256 d9e28b71e0e259106a0bc31a9dc8ec5e54898fb65e30356823f7ba09b4935f33
MD5 a03c17217b2a32d202fe17c7052468b2
SHA1 c50926fa676962633c75208d7282eab853f6abc8
SHA512 ca0a169cd216a45d094648d318ccb5702a458af7c44f50c28263e88ce3edbb15ebba705bb877d45b2aedd64ab8f92c02daeaefdaba063098c98d32ad64279654
SSDEEP 6:cfkK0B/QIosMcln8MclCKmJglluqcyI9m3n+SkyGkRkJ+lr8KlvyITzKr5X:cfkKaQIDncCKlcvyI92+Uc+prlyIfKV
TLSH
T1CB56CD119FF5479BF1B2C735FC77820423367C14E7124B5E1A4432B90D75B844512B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFSLog.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\LogFiles\WMI\ReFSLog.etl
Size 4KB
SHA256 8381304f04036242d3e8eae180d6c0c5263a3b2d72bb976e49ad7f22cd474030
MD5 734472effa3617ab816c52807ab4c3b2
SHA1 cd4c55f163575f962948566b62a1ed4102d83e00
SHA512 c4874895be7fef0f3045149b9fbce8f433d2fd267221373ae5b764b9a5a0b54ca6c9cc174702e76a4601e0ca9d5f4a6c34a2a97cd76bda90f1104062092f47de
TLSH
T1F68186117FF64696F1A9CB35E87652042376AC28DB168B4D0A0831980D797549661721
MD5 SHA1 SHA512 TLSH

Submit Download

Wifi.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\LogFiles\WMI\Wifi.etl
Size 240KB
SHA256 ace5700119c14cedac71fc256dd0d8451f47817d2df376fa807c2554806064de
MD5 55a8abf6fabeaf200ae7c61af1c1b942
SHA1 a7fa8aeff404ae655df35c1680bb1a5cf35e018b
SHA512 9c14e13659330278fd98a62924c9f1994fcd7767a2e0acda5cd1c68ae479e666aecdf9909a5baac85f6e759b605331d8b4a91d78dc2608f012d60d328e9a56d6
SSDEEP 3072:CiE0OTEMZF0JyTvaVSdzN+ORpN+a9tGbbVfXWXkZS0SAyVEmN+o1gtliZU5N+yZl:+Y8Lav
TLSH
T15E34B0BDDF685468C43900331C6E7B1255633D8B0F297EEB22457A78EDB7BE19C009A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootPerfDiagLogger.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\WDI\LogFiles\BootPerfDiagLogger.etl
Size 16.3MB
SHA256 2663baed820295e757f64b95b2eb725e5a69944d997ebe708f71fba974574d9e
MD5 51666e4d0f3539d1dea5b1f264b33760
SHA1 456ba46ad318927540ab5dfe70fd82eb8bafc51f
SHA512 28f3ff39b114996f6bdbfe3e4b079ed228090c19354fef6df648c71e96ec958687f00a9ebfba83a20f406d6189803106022e41cd50fd2946476fa815574a846c
SSDEEP 393216:/KstdR0sYSILxpD5xvkncFEFj1yK6Tb9UG:PCS+f5icql62G
TLSH
T1E1071224ED059FBBD5E98F7000EB5234BAF14D97AEE33045A5BAB2360E71760AC53D09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEFAULT

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\config\DEFAULT
Size 2.2MB
SHA256 a1adba69394d57d102ef662c03405dc3e448379651469e78d030d8d1ecb1a5fe
MD5 cb81ad584d25266442538ff4d122d5b1
SHA1 083891acae0c57abd2596a44c87179884d85bee2
SHA512 1fd443ffe8a6d3cf27c631ccffa458c9103df89ff44ad2e43f941b458ac27d301f785913a5c5a15f92b6d0e567b442848b054c61590d09f3ebe72f58382c8303
SSDEEP 6144:X8Kr7XtEjG1nEWgFvWEkIkyAIpQa4aecJwNxJjFxzaJVAmQJdYlKn76mRsnyKAqh:37XqjGMlMawNFdkVyJdYu6H
TLSH
T1E5B5AD257AD9E644F2B786305C74C3A0A62EFC92EDF0834F7640F78DAC3651285A2E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEFAULT.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\config\DEFAULT.FileSlack
Size 144KB
SHA256 582a9228131b62afe830d22e93b439c1c5e2c8252abaa4e06ab300398c27d8de
MD5 ec3e32c4f0aa40efeae9855cec654c56
SHA1 e416577694efc49aecd7996d3f98171aea990bd6
SHA512 cb52c3f798de45d9909b7497fc64cfacb4a3ab9a0783dac693ddca9a8230fe909a07887c63992948549af6b022895db0fd9b32a33d7221507c13234afdaaeb74
SSDEEP 3072:r6eaZGArhiiQpMLzmkht9k6VJ/Ek8wGzqzZteETaTjNr/b+hmW1x:koIdznm+k6YPJ29teE4jF/b+E8x
TLSH
T12FE312AF386232A4E12798ADFD08B1D7959B401DEC564F555C0216FC0BF933AFE9862C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SAM

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\config\SAM
Size 64KB
SHA256 d076c770efb1c78708ea3bf8abebb42b37cb2fcc930a22b398e5135e47be6295
MD5 8d11292ab3fb3a96b625bb256c1f2a5c
SHA1 00568cbb1f602f67f342522d350f446a8f2e2307
SHA512 877819408e37df64eb2d388fa30b8abc9b12c1507b049b0e90a39827c35743ba245ad1de4af2e0a710570e1aa05e8b2c03b589a929fb01defb35278ca3da871f
SSDEEP 768:BqMtL/cSRAr42rqFEelIfdfElZeI93w8afw/CnI:BH+quw6
TLSH
T185538D41B684C686D4B60731CC778BA47776FD929F76830B3305232E1DB6B819E92317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECURITY

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\config\SECURITY
Size 32KB
SHA256 ae43a68d5ea957a58e549b7c5a6c5431d25901a52139bc5601e14de9c2c00f69
MD5 8a109a8820e20f5bb5842dfdb554da96
SHA1 2be14ccb734e8fb913298bd7607f87aae54787d7
SHA512 1f41cc8c89ae1d6043b9b837da5f1e66c09a02d761bace66b414a384cfeb731c5d9d63e5f7de1d5c18c3b668285ea494fe198bbaccfcf86e7a2ada0209d0680a
SSDEEP 192:DB8RPDErRQ0GfGMyVDRBbuR9isHn26N6a+WON7LV3ilguwIpKpd:aRPRmhRBbuR9isH26N6a67Lwl7
TLSH
T1BFE22002BA40C6CAC06956738C57CBE93767BE529E6642073B85331F6DFF782AE53019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECURITY.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\config\SECURITY.FileSlack
Size 4KB
SHA256 31aed817aa251599f71d9079cf90831dcc949bfd5cd44831a53797b2a9498874
MD5 09f3bbb1f62828c6c6d081fa0d715e34
SHA1 d481b8db835cc4014a3f234f24b85753c0486831
SHA512 9a2d532a21f6241d67b4ae1109ccf2068bd99df1226e044627848aa50980d2610af04fc5c74e0edababb99523dba9819780f97525decb727fd9b5685af57e0e6
TLSH
T12381FB8320BCAF7BE9180BB15FC9A0D0A37A845A87F1CE1F50C042252857B77A56CF5E
MD5 SHA1 SHA512 TLSH

Submit Download

SOFTWARE.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\config\SOFTWARE.FileSlack
Size 112KB
SHA256 2a36edb9a74140d86b5d643f0e15dddc8131cabdd82cd700fda4e913c1f3c7a1
MD5 37eb1748bcb630eca867e763ba52ca67
SHA1 fcebcb61c0f57594cf9ec159ac62c9dd4e214cad
SHA512 a86776929201303e688f888f7e6f5ab1d1baf52949fac74b8956d77d153315e645ac13a808b135ed0c73e0cf64232d0309f0fb393a3c6cdb92a798ae4f080acd
SSDEEP 768:Za44pOiGKFnCuLGt+v9RdLt5HZFxmt6SQSY5e9z7jOiXs3FRlF1:8fFnCuLNv9RdLt5HZFxmt6SQSYF1
TLSH
T1DDB3C24997E40B23F5F24B31A0F2985BB83A7487BC459F9D506307894EB6B619CB0F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SYSTEM

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\config\SYSTEM
Size 10.2MB
SHA256 334e32960e32401239190d3f8f8ab20dd6e666f73862b79601b253996dc947aa
MD5 8eda158b376c7cd2df74da8b639af703
SHA1 526bf6c25afe88b565fc140985deb765fcf467bc
SHA512 ee503339e517c9eac71996754e9ce8818e4cfabf2dc7cc765c1ec6c98ea96cd16d466a432379a89e6767e76eb18fb8898f9e92d5bc3389493c21f1a93529ae69
SSDEEP 98304:hToWSWMvRPsUlQ6Kqhf8eoMP+QFpI8eaAMfhUPQ:hTLQ
TLSH
T133B60D01BFD4D9C1F1A64A329CB6CF855A36BD51AD215A0F3394330F4DFABC1A923626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SYSTEM.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\config\SYSTEM.FileSlack
Size 208KB
SHA256 2308947b33b2d6fa6a9df6112aee7e40a2f80c07ab0adcb61ce1adcc1d251538
MD5 db2a020175b34b1d377aa7cc8852342c
SHA1 a2e66d53f0831e7b2b1de7d66e957823fd7223ff
SHA512 f988cc6a7519e1958b43066227b53637e3848cdd13cbc04c79687dd7d5e66df447184f339b3cf34a521f96a94d89cd3d9e61c2971e7eee1b2c239f1859b6a1a2
SSDEEP 6144:sPwbI4cuu7ivKOL0wvJUn12iDPOdOvRqhqzgyvaG:sPGAwhU1hJuut
TLSH
T128244C62589060B4C5FA33B67D1DEA2C9D3083C69F274AD78AB4ACC03FB45E3297525D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Application.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Application.evtx
Size 1.1MB
SHA256 07aa81710a1566c515bbd1f09a338c23c6eb7a444816e720fa005223ed32b0b7
MD5 4c4b0755b82536fd6a22592108dc8bd2
SHA1 bac18171fd4b266d54e42dd2b9dcd55ae4e9d901
SHA512 34d7ce8d136d187e26de8f032a17d31a8a7e22c0a46ba9c3070d523ecd06d72ad0556516ca195328dac4486b306873097a3eb88ca17d45a44ae0f9d86062f003
SSDEEP 3072:pGcucpCPfVtKnj/czR2ctGrcLBYOAQjrNoC+MWcD4pcWcnc1cQ3cnc:3CPfV48tGb
TLSH
T11435ED19AAF41166E0B3CB38E4F342176B36BB111E35CE0F629053895812E4D6F99FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Application.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Application.evtx.FileSlack
Size 640KB
SHA256 396254b77302db098e5b285a55c1ecf4bf333149c96cbafc3d56dda99b8240d6
MD5 54e3a677c993bc1fb7bf44f83e43281c
SHA1 d0ccf422183f37229442bf1ae46bead07756a768
SHA512 58d13972746b7fc13f557e8d2d7440fa7971f5eb25643e544dcd3e71331c8b4a5b9fcafa7e0af1b08a6a8baaef6a34460265e556825120c0a3261bc8904000ba
SSDEEP 3072:S4PJJF5dNjWxSMNrdvwcmtEKBCPcfkmsjUfpoqWaib0VzF0mI4dDImUcTpvOqLyH:29F4ydxL4Q52/6yn5oFoGMU
TLSH
T1FCD4523DA618633AE7FD013218FB677609393D1F4521485F171CF22ABC33AB0A955B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Client-Licensing-Platform%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx
Size 68KB
SHA256 fa0776ec0726512a65eadb42359148fe5972b30f124cc2fa357e678dc56fc09c
MD5 c69c4aecbe6c56b7e273a9538a813394
SHA1 d2bfb5121b33d4202a7a79a6ad1f73c89d40cdb9
SHA512 cc691c33bb3cb747b035baab603d17e06f1aa447953aaefe6b10e3256edcd41713a0eff6cf30a6b33cf5cc2f3946af7cf9247644a4419c27c580fca89f0e1f82
SSDEEP 192:3JWV7EQGjcv6qIEvCsZKbYtIve3iKer7Li97LzdAm9RgKpQ22+OKT6fEUWney7u1:3JWhRiq/69GUrkHpQGTwW1zAa
TLSH
T1E263040607FD596CE1F64B39A8B787282F32FC106A51EB0F5164629C5C52E628E70FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppLocker%4MSI and Script.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx
Size 68KB
SHA256 c9f9ce581bc0025ab0dc84daba96c5cdde598efea322979be94493e81c5be49b
MD5 cdfd22a4f0dc4c96eb4a2612624c1d0e
SHA1 3eb43e46a93e47ac77388705cd05c30e946e1396
SHA512 8135d2aec32a0f8f226a8e15a2b7bd7ad3f968dc70b1f8bf8f83b9684fbd150cffd05e359a8dfa74419ed9ae42d593e58748b653a560053cb2d1802a3124ee5c
SSDEEP 384:JNhpYutGSYYO6YUNIYPYOTmY9YNPYcYxntsYzYoqYCYcWuYQYWyYwY5+/YZYdjpD:3TGOTtJ3p/togtbcpzFp+0fn6i+
TLSH
T16863CE00ABF84628F5F24B7DC5F30B25AE7AFD659B626A4E0004F2551C12E51CF61FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx
Size 1.0MB
SHA256 15e36824d5a6aaddd73b28dc65e2323be2bcb099544d0354b4703bb64680f160
MD5 fc41149b7149e85011cfdbc53ae1b65c
SHA1 173c3fe13c60c89371db65831f37a21cf32cb787
SHA512 1f70ba8f0a7697594a77381ffe4cde34d66ee950f8323d106d40ae9c913fe99aa6d02e06fc6e86ae8e797eb80236c4b414e820bf503412c1ecd06ff456ca52b4
SSDEEP 768:6MZXRDXfzp/vdmWI+qCaLVIat3YSIHKls5:bXRzZv1mLlt3YP
TLSH
T16F259E013AF80624E2F28B3989F35B25597FF8644E559A9F0120A19D4C1BF799E30FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppModel-Runtime%4Admin.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.FileSlack
Size 896KB
SHA256 05bc36e464718171d4b123a7fb5f878f505622b74c5f96a0073b1f5c1c8f7a7e
MD5 9ef6a83f900bdbbd242ed7f4d74f0f47
SHA1 abeca659b1a1321227686a2d8d1448cebadca860
SHA512 5e7f3de0e038a35d2aa17a7c0f8bc2c570ab8ad57da49ae3aa5e976442dd4ee79061c1a0d00e96e6e3b05381bb246c632a233b465a6ffb764b390e06b5282e04
SSDEEP 6144:5XYM8oWeEh+U0rovXzUQdfWgKaxVKm0mePL7Qs:SMbEEgKaxVWm07t
TLSH
T12515B70495F0AF58D1B245336F92AB0AEA3842F36356DBD4B4EE5017AFE73928633171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppReadiness%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx
Size 1.1MB
SHA256 5f49bd6bd17e6464c392319bf2b89ed0d1a042d91cb9819046cba4dbd5fd7de4
MD5 5f3dd74a11ae521034f8e6de2a2d3b1c
SHA1 608674af2820a18f396d8939c8ef229c8ef39328
SHA512 9cae66946de19b601c63cac8fb204c74b0b08f4bb952367524b874c2d869195eac9a39a51283a3271167653838191a28fea0cef68f8e75006da146505d15d15a
SSDEEP 768:QTmvDAEifs3Wt3hSfO3oHzB51dQiG8yvDRqcPMlag2a/t5vb2yvDRqc:TNWt3hK88yvDRqcKKyvDRqc
TLSH
T1F8355B142AF42430E1F38F3DC1F31B29997AB8251E415E8F10D566A49E46663EE70FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppReadiness%4Admin.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.FileSlack
Size 896KB
SHA256 5827f08cf40e2b89349a9075284e5e8284853be1eba8b2eafd6afdc5b2acb8f9
MD5 f8bf67f97fd81631064947b7b0324f27
SHA1 41c24532dac7ba6c59de7b8bd2419a1b0c0ed00f
SHA512 ad1732ee48095d9140a4f51d66c186778f49e85d2f7e8339ac37364993952793946c50c02942f7ce262de89a62c32b16d614424f17cc49339416240e06f54fe7
SSDEEP 6144:HxjhKU5qbOrmG1dgqmIZyKUKKZDPlzifcL0o9zC5pcKnXUCuoCQH0i6xxdjATpqu:HxjhKU5qbgmGngqgG
TLSH
T1A015DA1143E94B19F7F32B346AB41251AA32BC9BB939E94D718C622D0F75B10C972B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppXDeployment%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx
Size 68KB
SHA256 48b9b4dc256d6d7e1f5713f8a373da429795dcf63e6360c5e7250ed6e580bf57
MD5 35770e50232170f998b1ebfcbdb3240a
SHA1 b95fbb9740d64ebc0b7f7fb33b8a2a51887f4f62
SHA512 97ad762ac0b9b8127c5563750b05ec667b4d7a6b014910c8a38aa4c64d09ec055f038f942e8e9d43e784778611141e62e8acc2008cf987142693f47f8ba395d0
SSDEEP 384:Xwh00VAVjv8BD1cpfVIlVocVBAD1cpOVoMVFVoEVJVoLVPUVo1V5VoNV7PVo+Vqh:AK0BzYJ4hdrUunFKhZ
TLSH
T11C6347296BF40715F1F2CB3485F22A676A7B78D68D41E7CD109A930D0822E569C64F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx
Size 2.1MB
SHA256 e39f95eaa0db87bc0cdf1e143f39e47f37f6b5f116b1eafb069d40e69741d3f2
MD5 ada3b43a8c465aae3d0a954dfb8c7feb
SHA1 65fbd7b38c92cbe6565a05158191f7063e87caf5
SHA512 edd58a14e778ae78568660809a41e0a5f9ea630d2ecf88056df01dd3f75b1a0c1744efa5e59efe71ea11db7b673a6ac2062549ce9a1c59b770777aa5e3bb3bcc
SSDEEP 6144:fis7VikT/55ssceCEW2MnqMTuiNJG/Pt:
TLSH
T12CA5AA0667F81628F1F28F3488F35B271A7F789509559ACE1065B24C0C67E629EB0F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.FileSlack
Size 896KB
SHA256 1a4c18895b88a1ebb2a8f656bb5e716ce18e43141f798f7d85c622cd3eee2a9d
MD5 3cffc3dcfd36c7402b03bf2b9e5aabdd
SHA1 54a4346ce85763bbb022a896814936f7cc920119
SHA512 c43d6022dd89eed84004054631b452b3a8cf69aafe107b831e8f087462af447aaa7790cbae1c43a137ea8edc5ceaa445f4bdfe2be39aadf4e1efcd10647ee5c6
SSDEEP 12288:I+bJUm620k3rJ/glZEOD3DGmn2VUY24T8Cb8zNJ86Af1f5NDvJech35e84dD0E:I+A20kbJolDzJn2g4PbONJtODv7d5e3l
TLSH
T18A1533805AE2EBEB057FDCE42FDD5A7EC9286305A4D7C75A26F108078EE94701B4D4A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx
Size 68KB
SHA256 5a3bd069eb19e5746baed131d78d02e604d34006f4723e8ce6ab2aa4ce2f31cd
MD5 06ea9c2e3af8ab68441e75f45e248465
SHA1 b7c6d7938608c0a01669c8f0bb947d39ae596fd6
SHA512 630529125f2af9b0b3565f938db41c426f886e366601276b7e18d128e953fc5192dce2e4b13fce9fe75f4bb8c36e5564f733cb94cd8c5b3d0723af3d77fd6f2c
SSDEEP 384:wYhOm8b58lmT8HJmT8HmT8ZmT8CmT8emT8emT8:dG9hpDZyOO
TLSH
T1C463A926BAF82718F2724F3999F357274D2EB9565D14C98E0129634A0C23F10DE72F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx
Size 68KB
SHA256 f5f9e97a6b1ec8d46a9bd5b9d4ccae96521b85517b0337b248814d2e974a968b
MD5 1f83dae35478669aef357fe90594264a
SHA1 c70bfff0a559af8cb76ad80a504dd55bd6cc484d
SHA512 94cee3ba110b815812fbb1339e54cf4b7b2942b0145315019d2a5acee75a90326a6bb0e74388ff5545afe23f85856c1404bf35698b5bdd6fdfe2be6645ce84d5
SSDEEP 3:MgAWl1l0c5MfaltpRTtPl2tVRl/l:Mk8IMijRM
TLSH
T16563020476099812D1080A3944878B81BF70FD501F7A9753A960363CCD753421952F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx
Size 68KB
SHA256 4a7ecc04be4e4d08d516b93d51b8711844f6b15cb796621f513cc3558c1682d3
MD5 0f3272a51a98078411225a64c53df2e5
SHA1 b87d7a7cf7bee185bc494d1aeab92f43ccd046c5
SHA512 c098b43d274d7ccc302fe205d80f4edb19c020c4c1c08415842a6b9fec472cfdbbff94e6f0cc68b6eceaeac1046d9cadb825e8e6842d42c86ddab704615cab20
SSDEEP 96:aT14KNVaO8eqz9B38tA++xHx9Bbx2gF9BZxv9ByFpD9BXa9B:aTa8V7I9B3KA+s9B1F9BZd9BC9Bq9B
TLSH
T199638A06ABFD5139F5E34B3849BB5B156DBBB8640A01E64F2028616C0C73E54CEB0FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppxPackaging%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx
Size 68KB
SHA256 3f1413056e03535f9c0923a0e740b1a76c9781416bc411eda4918ffd3f624398
MD5 dcb6e39b6914cb7399363d55e7a73f1f
SHA1 e56b90af4f06b3b1f4011f5f5761d88959164c65
SHA512 50d3d07b916199226dd93f19cdb32ee29e5c9ea7aa5085c709357163c1352296f9b5602ad602e71995b67f1bc20d401fb421b91ea99e76f04ab97036057a1089
SSDEEP 768:nqiF+qMVz+xErjR/Hootbm3aMDHeGi/91EHPL:qiF+qME2rjaoSWGi7EHPL
TLSH
T18963980236FE5950E3BB1A740FB14711623DB5A25F51E39FA220A3BD3D31A936E90772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Audio%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx
Size 1.0MB
SHA256 d2f80fd2670abb7c42ab020d04193726024374e07400cb913ad4a299e3b7fd40
MD5 aef1840be745b7e0a5216a3f8fd8b471
SHA1 c6363a18fead09f2820e26b6d908eb2ecc600d22
SHA512 5767efd953d16a88eb2e71aef84f88c35bd9a8442209b8d16b10fcb8964ee8c605258bc9b6a7b0ac5a28203120f2d961d6ae81855e6936f71b5f5ea8a1748c6d
SSDEEP 768:NjHaktWFs6vFG5rxLtq8Dw7RXDYORO/h6krKdzqcbBrF7eFLixuYsYHhHwEMT9B1:GEnWp
TLSH
T135259D241AF55B38E1F2CF3DC0E7073B1D7BB9458D864A6B1094D3D49C12A629FA0FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Audio%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx.FileSlack
Size 896KB
SHA256 52a1c35e705c77d8a7f4719dc2a28d5294cb404b726eddce824a7f6ee9ef965f
MD5 cece5650d250970ce217d4b530424c33
SHA1 8ccb6df3b9ac9eaa5384bf194bc0ca5c2232601c
SHA512 9a13f34a3bbc2fd820fe4484686169730a56da2b5a0083bdea3279e4d2362a3d5989fcdad0f37ab1fa143cd6be13216b4f11c8f35d4e235d40b46d5cf0760309
SSDEEP 6144:hgDO7KRcqBWGNIdKdNWWhKmRg2ijLBybqNv/ez:t20Fu
TLSH
T15315DD6167FD6548F5F37BA87FB8A2944F7BBDA2B939D80D1210214D0936B448D20B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Bits-Client%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx
Size 68KB
SHA256 72b2afd1d0e771864a34fffefd6809da0e39166a79d189c7417f7ec8a1caadc9
MD5 a573776a049d893b0fd5a2334cee66c4
SHA1 6ccac1b87b99df068453ebd5daa55414b5b5cc62
SHA512 5d5a55a5be0075996cbacebd00f2b7988c5f3bc6a1ce8998b6bf20e8ab7c9960f3bd75503200ae6f40a7b716920798d802922ce9f9e3ae5c2ef0106a9cd321d3
SSDEEP 384:cyh4LGGG1P780GvyGPus7nm8GdGEGDG0G/cG5G8vFGN:/R
TLSH
T1B863EB019FFD8838F1F34BBB94729B252936FD241E52C56F3198625C0D62914CFB1BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-CloudRestoreLauncher%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-CloudRestoreLauncher%4Operational.evtx
Size 68KB
SHA256 446048c26809928689dcc09d37819b1aa0c1b55286445c83c34d86ca52e4fcbc
MD5 9b317a0a4ea478ca06e92957f5d942c0
SHA1 0cad8065f5408faf0a638513062ebe91d5c35f99
SHA512 c4703f89efceb3d0b68daa813681284e0cd44997b67dedf718ee8d88fa4a00a6968bd8df47aee83ea6346a6d6db759d46f93b461469a92941fae813d70293c3b
SSDEEP 384:8LhSDnDDDODaDTDYD1DPDuDMD5DnDmDeDfDXDV8DSDTD/DaDqDXD3DODQDBDRDEH:m/B
TLSH
T10463881117F9F53CF6F28F7990B70B28AA7BF6090BA6A14F061092450C66B159FB0B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-CloudStore%4Initialization.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Initialization.evtx
Size 68KB
SHA256 c8a2d5e5d3f9e2f6e6a720406cc6924427b97c2e24a23437c0f25e9433aebf7c
MD5 783901abced1da95012e1795ed92ffd0
SHA1 be7db9079a30382e9b2f015aaf17bf92d6afab1b
SHA512 b3b4548b7d3d36e244a8cda9d90a1723b4aad8eaaae0f8fc9795cc4e24af47ccec1fc1c8151173cca243ed7b35404965714f3b9310e96ae3a6d41c42a0e01b69
SSDEEP 192:E48V73ecY8AdjdjY8nRsYKY8Vwm9hY89:EDhucY8A7jY8nRJKY8VFhY89
TLSH
T17363BC02AAFC852DF1F34BBA89BB4B34A97679655F12D04F2004626C0C62F108FF1B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-CloudStore%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx
Size 68KB
SHA256 9d3ec0bff28e13cdd359c345812bae37c87cfcb58e15cdba451fdb986c811a3b
MD5 c71b5946c7001b9c39c4cef57fb22811
SHA1 b5f8afc753fd6b3fe64b90fb20bdccc865062529
SHA512 47dfd053c505592b81a5fd7a93ab95d9c4c355a8cd1d8300b66c84d62c821d6124d678c08fb4658ed73a3c6acbc1a4c1dadb69798b881394e075cd10ca9f01bb
SSDEEP 768:4FB5z3I1xiSGkTFxi0EC7xNUZZizCVRWPxBCAqw:y5z3CxiSGkTF80P7xqpVIBCA
TLSH
T17D637943D9DD841DD1FECA31A66E0BBC3B73646FCAB5931B936C812C6D12B816E10786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-CodeIntegrity%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx
Size 1.0MB
SHA256 c37cd460f447cd981e6e685c0d7cdc8fb4ede2bc52e09a56652cae70a7c39eb5
MD5 90664ad6cf738053a8ee31736ada4b70
SHA1 e6d45c89fd6335cb70c02352c1094c43d2bbe2ee
SHA512 fb431cc9058329b042651723bf10688d4663d5e183444da6ef2d079fa320ea69fda7e26197b6447011692f68ee5372fcbcb2d797db2b36b6a32aab410413f433
SSDEEP 3072:pJXNdHYHv/AeE3CLvnbpPE/0x3CLvnbpPE/:9W
TLSH
T16825BD012BFC0938F1E34F3884B30B295A7BB9684F59D58E1221615C5D5AEA0DFB4BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-CodeIntegrity%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.FileSlack
Size 832KB
SHA256 2bf1133a2a62b4fcc6ac86a1efa923d41e01951172b01dfdebb7d6d45522f94a
MD5 829f352643b56fed9867a00543e4e3df
SHA1 eae78aa7de5d3f5c33b1750f03fcf50c7cbb4da8
SHA512 6f97cba54114bd087716b199f6a72f4b451dfc33828ca1bf34bea33daeda9d715828399c63adfd4f0943d3ea32cc9bb3feb4a667574f3df8ae40b89891caac8d
SSDEEP 24576:1f00q8ivsut/V+89PghkVRwYd4cN3k17u6jKYuWX:etvpX9P2kVRw6UvBX
TLSH
T17405330821F0ED1CA422CDE09B99BA2CC955965DF1CBC418C5CDBA73364A6FFCD892B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx
Size 68KB
SHA256 11a234e70e7bef73cbc8df7e43fed35c819dfdc2e44bd8c3700e913728cd27fe
MD5 5c9e0e848abed7e340f8691521cdf143
SHA1 54cf44cab738e688443461130b46d005630918dd
SHA512 a89ba7142f0eccb848d1aa9f36d07f5803a57312ae68dd9d9deb4c6413fac5412f25192a37932088212a7ae9bb703e5279336ebef5801ce8e7b8b017eca50a6d
SSDEEP 384:Azhjh5GShPyzhEhwhshmh4thLhTh+yh3hzhrhlhth7hbhN/hkohURhVChmhmhFhf:qYFQi7tWm0W
TLSH
T10363890367FD4934E4E2CB7582771B2819BFE9248B13895B1144A15C1C69C72AEB4FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Crypto-NCrypt%4KeyMgmt.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4KeyMgmt.evtx
Size 68KB
SHA256 68a7bfe7bca1452f5ea9369cb2935923efdc2626d1b194eb6ee00116c142a223
MD5 27f68278ce5c34c250010871f0e6b5e1
SHA1 e8084dd5207c1127664415f7b00712be77225913
SHA512 06078fd1a36e5a95110725344d0eeba5135728152a1bd9dae7945a3eb47ec4941763b95ba51e863d9eca66f511d25b2ff13750c5518987ce5016add6c0de592b
SSDEEP 192:l38V7arYFT/lGKyYG9YRYE9Y4Yp8UYpL:lMharYJlGKyYG2RYE24Yp8UYp
TLSH
T1B863FE296FF88939F2F3CBBA847207259976B4615A11DD4F2151238C0C67F118EB1BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx
Size 68KB
SHA256 ee89fcd51f11ee2b04f2e802a96666eb998fc0bb1a08d160d5488d31655284e0
MD5 851be94500650c9b310f40f9b7eb3e08
SHA1 fc94e2c0f9c8ef9b3ad6e391b04ab03f3b34a116
SHA512 38342d914d283b8ccb2e9aa94768552eec136ad856956f8597ebad0226ae0d12c2607f9f5181a784320f0ca8b3cf0d2fbf8b7b017309cec7cda505a495a7a372
SSDEEP 384:xnh3CpCGICXCgCACs/CD4CFCtCFb2CFmYCDVUCDeKCtX7CFuwCD2YCDtGCtwVCX5:pKR9
TLSH
T17A63342857FE1A68F4F78F7985B20B411DBABD552E44AC4F01B062980923E56EC70F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx
Size 68KB
SHA256 e2c80022bf540f88bf54837c2e5947af3b911a341c9e0ec68b39e430a44bdc0a
MD5 850b09ce53c148ccd230e080de96019a
SHA1 9f5b7a817b0f0da11e38524bbe63cb804f74669f
SHA512 1d5cbb17fcdabc5316709ea3dfb7245b5b43ba97c74c5dc3f568341e6776e784ef3a18349dae328f81995bddeef5871eae997f02fa88bb3f638063d384f1d24e
SSDEEP 384:/OjhMC7CJC3CoC+DC+CHC+oC+/C6OC+yC+VCi6CinC4NC4UCgQiCiGCirCg:oKr
TLSH
T1AC63511957FE1A68F1F38B3989B60A1019BBBD552F40D98F11B062A80833E55ED71F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-DeviceSetupManager%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx
Size 1.0MB
SHA256 ba060425b1abdd5de3fb7b22c2178b7e14bef2181b6d2e41cdccdc26c5c47bca
MD5 2d4b988f3b4626e9594e5929873ef1c6
SHA1 ce96c7fa3c379b939ad2cb7b6c195fee8420d08b
SHA512 a426be4890dfe71bd569bf43ab0d46c0bd642fa9de1b623ecb269698941f4c9483218e4bff9a9794ffe9641da8d8dbfe2c081a17fca5679ced8960e826deeeea
SSDEEP 3072:kXg1zyh3GoEq0uomQqJpsZhA/KgLIjxU:kV3GpgLIjxU
TLSH
T16025270066F85A3CF6F3DBBA87B317392A3BF8540956964F1030A1589C179654E70BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-DeviceSetupManager%4Admin.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.FileSlack
Size 704KB
SHA256 d09f172dcd24744dc7e136bcb6908c861948747c7314e04a53633c1b0cec6170
MD5 bd293598f9b82a4fc95a53e98a2ef7b3
SHA1 778c08f97e072e559a3e9220f1b088acc3162a86
SHA512 c13010a8e576be3e05d77a051efe4702d7548238b46c59b262adf1d2fa77eb5f9c5af49f94554bd970865999f62e73dbb2ac68b3a03782b5121b3374ab2b9e24
SSDEEP 3072:jTke1WwhzQoWyLV8IYiZpq0xuD2X4Zw79qiZGVkMtcpliHkfb:hLlv
TLSH
T13CE49C295DF91233B1B2CBA5DBF88467F955B8E7B9045E6C50C307490793B02A8D3A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Dhcpv6-Client%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx
Size 68KB
SHA256 8a2b87fd494d129b5baeba4e8d2fe9397176f9b9f0a9f6b566ace85cbe3f3df5
MD5 7214f9f078c26f57381ac1cfb3c8b128
SHA1 6ab36c9aeae5bdd606f80763f82f38e556ffa48b
SHA512 54e05cc5b0c6e964d0a87bb8832fe43756ec86a0207f724f51f977979cbb82ef3b1e6cd27bac3f2a6a8f8e773ffc2f8e09ce0521ddb7cf6a8987523fc5535e5b
SSDEEP 48:Mdo/dWyhrP+MZQNRBEZWTENO4bpBOoaSMmtamLmncpQUSD7H0NtG:uoKNVaO8eoOmtamLmncpQUSDmt
TLSH
T19763DD02AADC5819F5E2CB7A4677A7386935F9604A10C1AF7220B36C1C66F40DFF0BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Diagnosis-PCW%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PCW%4Operational.evtx
Size 68KB
SHA256 fc2b542563b2e9f59795ef7ec0f9cac3a888059ab3dd1eb97a06ba8a19ddd9ed
MD5 b2c6ca63391406c345af79cc2baab535
SHA1 fe057e5f504c364c5e71ce26676382831a1dca43
SHA512 5bba5761209d7a911ce1d6f286b6d95182c71d8e5d8e80650b80b082dc9f6e3ae79947be804cae04cd8d6825a94f22df8633711c0f52ab13846bf7b27708b192
SSDEEP 384:Fhhz5x59W50535P5h57585Yj5Z5m5I5W5J555b545Z5x5H585p5X5V5W5v5J535d:3Z
TLSH
T16063760256FD463CF4F39F3845A71B25097FFA640EDA594B1220616489299A8DFB0FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-GroupPolicy%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx
Size 1.1MB
SHA256 5ed522079a4a0a4c84b9650c9ef3e4545a16c9c3b9ff5778c60f859b3c18e7ca
MD5 99d3bc45b2f8c075f125b264ef98050f
SHA1 a02e875c86c7abb27870eab2017eb09023d318c5
SHA512 c90f464d515caa8063dbb2c3453837849a366d274429b3905c59e1a462254ca9bc291fd8fd9af800cff0210d4cf627a07af2e57034b5c777a135fdc365c186f0
SSDEEP 1536:KR2nhp+zfYP6jhbDV2r3N/yl1p3YgLS6ZuN9O6/TxX65RL1UQB48pLlxC0CSxy:S2p+zfYP61dgjJLm1Wv
TLSH
T1D7356D427BF81A28F2F34B3D54A70F782F7FAE481B4659972040A1985C658299FB07F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Kernel-Boot%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx
Size 68KB
SHA256 5371f8430a311d6a276480e371fe5cb56aa8d508ebd3f65913385d168bf21477
MD5 871776f71b7548853145c1b8bd747799
SHA1 49ee5908c65297b6d5a865574cc4ed895404d5a4
SHA512 213c99a2bc6b7489704ff2fb9de65bd239dba44efcdecf097ec6e5696d1696a0818ff7a86ecc42bab0964bd9d6015d44d3acaf8f466bce347061c8188db37907
SSDEEP 384:MdhEDhmdDmBDnDpaCDnRD4oDXnDWDQD4DMDfDJDBPDx/D8DWDCDGDcuD1tDU0Dnp:EapP7lGYiYVCEmTXq
TLSH
T1F463270667F52938F1E28B3A88F3177C2A7EF9041D815E6F2150629C8D759225FB0BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Kernel-Cache%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Cache%4Operational.evtx
Size 68KB
SHA256 8a4055f6857feedb8ac11470ab2d4b98052c6dfd62ba4b8d1bcaba50476dcc52
MD5 5e6f980050eed3f771d3388f45c6626e
SHA1 c31b0119cbc20d1af82dfc24a9dcfbe74c05cfff
SHA512 cd341133d79f0e3037fffd99452b2e08361f5b780a4aa142ba0024eac86ed6295b62b23f72be74c9cc0be5412182043bd58c3642528866180f11f087afca391f
SSDEEP 384:1fhLOpOYUO/YOA3OYhT2O4/OYbkO/Lq+OYvOxjOYlRO/lwOY6OxaOYtO/8OYaOxM:lnM2E4/04A4n4zhti/AcNd
TLSH
T14263B40127F84438F1F38B7E64B74F281ABFF9648A814F5F212051999CA99658F70FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Kernel-PnP%4Device Management.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Device Management.evtx
Size 68KB
SHA256 e682878b9f5b60972ea2372a23d6f8dee8e2b6243e16f23383b04cbeea87e112
MD5 1a57c112676953d0b6b8bae97239415b
SHA1 277fa8833ba96669dea0d2cb8eb1338f1c6807ae
SHA512 016c8a5f2ea98f4b73ab193c4b057505d644719035ff8fa552bb074d262da3cebc2b4963c4da1bff19b2a801472570b177ec7f8d533faa7203245a9cca4a6c77
SSDEEP 96:P9PARNVaO8soY63gOhOpKxJjIrjjbY6IOhOpOS6IOhOpO:P9PyV716Qwjx+vM6IwM6Iw
TLSH
T16563EB029BE8891DF6A39BBA41F607165A3ABC504A11CA0F7520536C0D6BF51CEB0BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx
Size 1.1MB
SHA256 76bcc4638c0806381d83e39fe4bf9e1126840c8531fd721d3d961dbb7331d2a0
MD5 2702fe2f2ee1c2004abf91332f6265e9
SHA1 964af560df39395a9aa6cde8c53c78cf160bef3e
SHA512 f2f860f427baba03acd9496d0d74a65b6c44cfe922901a4a20d9fd140f5c7e576faaeeddcc206c827eeabf07e6a801bda71a408896de4d8b18029255e016a9b2
SSDEEP 384:IehmIlI+IVIRucwdI0TRIQoI+IzIuIsIrIbIaIgImIbIbuITXIbgIQIwIZIYI8hI:zatN9YBAU+h/od67K9YITCL
TLSH
T1C735EC0177D04C21E061477588A3DBA4257EBE488E02920B3A9C736D7D7BD7CDF6B6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Kernel-WHEA%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.FileSlack
Size 754KB
SHA256 370489805f3321228570ac7c50362b7d60092bef7db1a7ed53b86f773c43d360
MD5 f29671d8d2ba6000ba9066f5b820cefa
SHA1 2d0fbc8281453d998d83c919048eb41e389a217f
SHA512 b51587b71e06bf4e42e6a76446e315a23359c5a40a0b2ab6814e19d0c0252e5f919b5703eaae162f7ca123d2dbf7cac81be1cce6dde839094bae3bd870c4118d
SSDEEP 3072:e362OqpC3sRUQo3USEG2Jb77F9stVJb77V9v6DghXaEENa6tnBW/E2XR7sr0Gvsf:h2pFc9tyIGCyvA0ZYr
TLSH
T1A1F43D257EDA0C3FF3A29AF06FEC64CAB86EF7FF26525499007503854B02951DED1628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Known Folders API Service.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx
Size 68KB
SHA256 ebeac62302e6d18a558264eab2fe4242498079628b5c829eef25fd7f2d9f5730
MD5 567505836d672b118c7f417f76a7a17b
SHA1 6dda9a068c50918b2229e67db314cd5b71da20a9
SHA512 f49815844120d802c8df4e6b1c667915adf7d61e7d8e604dfaf6aed899dacdbb4720e73ae11f5df17e36d3f889eeed9a924fe37aec77566fd132eb2bde154ca4
SSDEEP 768:Riio4YwvOvMXkp81ZjxDVFPu5A1ydBLVIF9pFLV4hJNNR9VM1F11/VUh:ND
TLSH
T17E636B1113FA4978F6F38F3A44B31B286D7BB4640F51A24F529062881E25EB5DE31BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-LiveId%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx
Size 1.0MB
SHA256 c8b23a1676db233803b31f574251d6e1c43106f6f4660e025fc8843601fc38af
MD5 5d6ee10fc08829c3038d8889d39ef9be
SHA1 c6900d8b89b04346903b5c7c022138de61616c82
SHA512 0c1b926475dcad0d5883649533c6791048c40e1356736f4a17be1a60cc732d359d4b3a97ecc4e6f634a00960f34f2ec58c7ff435d12792f6845fb723d0da863f
SSDEEP 768:zKL47FNplwBLkhzxbtCgJO9jSH3b2KjbF9P7FmFXtCgJO9jSH:ecjwtkhzxbaQHr2KjqaQH
TLSH
T1C725970D9CDC4841F3A3CF389AF3AF8824F5B76A84E9655E27A0505DFD40CE88165BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-NCSI%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx
Size 68KB
SHA256 bb224e6e37706736a63bcfdd394eee3584489efe0775be3b3025a29b102b6c3c
MD5 475795a6637114fd4f85702063531e7a
SHA1 f3ff69ae2ad60965d48403fcca5472062b0796e0
SHA512 4598c53661adb2426b6e10615c80235f7785a7853657046c763b3550d174b86af4696b7680683fb98738b3f95ee74b5f3f7717c7dc9ef367633cabfda28f8d14
SSDEEP 1536:y1wGDgEGA5hnBrJG5nwXxUDtd7/8PGDhB:pGDgEGA5hnBrJG5nwXxUDtd7/8PGDhB
TLSH
T17C638C425AFD053CD1F28B7984B30F38263EF6380A967E1B2110B1699C19A5D6F71FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-NetworkProfile%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx
Size 1.0MB
SHA256 beb28e65d66bbd51a2182c26662391c183fbf2cb1c87bc05be4465868b0d8d41
MD5 fd8aa69b3df4e7ec9eebffa804c9c7d4
SHA1 874792736e31592c4f320e2bcc956d877da158d3
SHA512 b39a48ebbd4ff9e180bf14242e0029a70bd266bc82f8ba66dbe031011d21cb2985b4eba25e8c65feea2240e7ae09ab5223e0d4d7cb1edd10417611932ccd82c4
SSDEEP 3072:Z4VUMHh+84VHHacOgo/Wq2fuLmMOhAdzU1pmaczx6gEQO7Li4Y7s2RvWDqGf8qo:xoaAO
TLSH
T1CD25290217F90A38F1F28B7598F71F38357FBA241A856B9F1414709C4C659698FA0BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-NetworkProfile%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.FileSlack
Size 947KB
SHA256 7c3b866115922d2525980142899bd13e972c73642ee73b31f51a319534290b49
MD5 450a4a1efa92af9e606b5e49627043a3
SHA1 4e1e4808feb48809cd0dd424d115b0e8c98bb182
SHA512 a199b0213efa1dedbd6cda6c9da81e4514a73cf4809545555aff4a8b23c7891ea496ec3843e012384519cc843d5a44fcc29e63104b278810576f4cb9d2fafa30
SSDEEP 6144:SPVvppp3tay1lrFVbTxaRKxYa4xRP4wgenLvMvi0lEtPPN:OLtay1lrFVbTcRFa4yN/l2PN
TLSH
T1E925323257FD0244F2F37B3159B956A00E7B7DA3AA79C24D2149651E2EF2A208E30777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Ntfs%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx
Size 1.1MB
SHA256 0ebed3062acc5f8dba0be9ebe8ee451af01e908899c6732cdbbce15637bc5d56
MD5 b20c43c2d2cc3eb9771c1119cde531f3
SHA1 0e9a6be686c3ec78a863fab46537acb028ce49ce
SHA512 1766a1980574a7a4ccc57285fcdb44b929856df7357d237543880083210078429558b02a65203eeaa51731aca8728f6bba431125eb2eb268b01804b94936a5cd
SSDEEP 1536:u3iIn20HYnaNjQWh+IJK8ri2NSnq5JsNnSjPNCDhWoYm2nYD7nxwuu4pnCjEpD:yonaNjQWlJK8ri2NSnq5J
TLSH
T13435DC051EFD1529D2F68B79C0F3073B173BBA101E969A8F10D063894D96A15DFB0BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Ntfs%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.FileSlack
Size 704KB
SHA256 388ee314c6a736e18331a2c0e88b65baa420f0a3b38d5408f377a5eed34412a9
MD5 fb78d1d384a1b60280f42d1a5e2fbe97
SHA1 8c7dc94b4cff054b96af68c61643deadea5abb36
SHA512 51da5ecd8d3c138297ea5cf97327f80038a136cfc727c22fbfab6392f631a7545cbb6e642abd63ac7186fe29b426f3d24295f8345009761436674c3b02f3f266
SSDEEP 3072:QqkjNdQNpZsLTEFtLkUfmJY0soz7W6tZmiAZvF0H0Qt6xyV4Ugm9cXQgFpe:ojvkzsLyLDsW6CZvF65qy6Ul9cAv
TLSH
T1D0E42E01BF94D6C1F1724A328CA6CF855636BE92AD21660B37C4730F8DFEBC1E922655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Ntfs%4WHC.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx
Size 68KB
SHA256 fcfca467d9b7b3530c522f8c70043729018d66812062f58af174b7fd966f5138
MD5 c097df518e44e385644537615b019b29
SHA1 f05c8964cf8ca924780f7826675b58ae4bd47a18
SHA512 b9a11b782daa0c07ecf869149ba6a96308c85b02ba3bd506b84b38c4523256952e4a96049edc1990947976afa4dfdb8c6b1d5ae63b4ff2a3f6c645d52d358d22
SSDEEP 384:rRhvIh5VIhImIxIS9IVAIAEI0BI3IiI/dIdIcI0IZ0IQIEQSIFeIlI3kI0IWI:dAX4W
TLSH
T166636E030FF95829E1F28F3E8493073D2B77F51459898B8B1110A1ACAD5EA66CF70BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PCI%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-PCI%4Operational.evtx
Size 1.0MB
SHA256 cb1e7de0ffa09bc84ff8ef9d51d94624f7895f4faf4a3b7e129af546b591666b
MD5 0b0857245c2751d8cb46a432408722af
SHA1 9dd83212c145f044226234d8f81262cbf78dbcdb
SHA512 4daaa1f89640ff4007951ad7e00e377c16d8c4a8a6ccdfd54c94465e05836c70feb2164252ab0eb83f0c9a5fe82e93eaf73712bacd05c5256baffc7a217ebbcc
SSDEEP 768:iABxOMdK29ZrQqoN2xvh3bm3zCrbQPYRWSYvlHYkWlkEXfW0xUBVA2MoXnjXUJXL:JeUn86igX5IEbRDLHzqkUUIYasgJwgJ
TLSH
T19A252A023BFE6518E2F2AF3482E30B37277AF9585A6287075244939D9D525618F70FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PCI%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-PCI%4Operational.evtx.FileSlack
Size 768KB
SHA256 bb240dd5ddcd8bfe1c86f3ce8d012b159c7cce129b1dfea058cf1b62be2b1f9c
MD5 a36539ae692a7a31d692703cb6d36838
SHA1 d9d91829ee7b2fbff885d91336d46ca02a488d15
SHA512 888138227a143beca8a11a7280103fa2b0cd27403e852dc673bc81b7d8f546090bc441da5af485cd098ffc7db0d875ade9e70390f0c7f74e44908c90c171e65d
SSDEEP 6144:5jKlqr5wBtbVRhkFz/9OTp4EZ1OTeXuzmSdds:FKlw58BnpD
TLSH
T145F4F52450C40548D2B142B1E6BDFB91FB76DD4302425670397F336A1FBAB838BBB5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Partition%4Diagnostic.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx
Size 1.1MB
SHA256 54fea4dc91f8c2c02bfb16132ed0540423063795c28f2c28374dc3d457b499fe
MD5 6bbca85d197bbc624cad81f8e17088fd
SHA1 2d6e2565ea2d6f0a92ab7b6c3c070e20a0a03738
SHA512 3d9c3e5a260884cfbf2eb237caab56fa14902981bd7a67b5f484903a22b9a1963f2b504c17a4e48c708f72e623141d8c34db3e1e1cd8928b0852c41e9003ea66
SSDEEP 768:Rm1X8zfFFMa21SZ1k1x151w61E1y1811y1E1z4111q1+18161x1q1V131a1SS12S:sI3dxScAgd
TLSH
T1AB3521061698171DE262C73186FB5325663F2BA88FA1F54F308CB39C1BE264D6F60BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Partition%4Diagnostic.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx.FileSlack
Size 960KB
SHA256 b526e504c3247eab934615484edd5db59f1d4be35a02bd671708ed8b4fa57a7f
MD5 bef2bcf4a8bee9e81cabfc58db2c2793
SHA1 a2721b917fd55d4ae8bc441b435a253dc9f11b3b
SHA512 0158e360376f9f613fdab553b96d2906162f0dc07a0cfa5595fabc494dbc7e422925cb20aaa87c1f5dd2935ad99b47e2871ee6b4d71c23f6fa21e9ddafae9caa
SSDEEP 6144:y6v2I7ygWV8mbnhqZqUMX0Igx7DAJoNNMX0Igx7DAJoNKrEkMY:BPK
TLSH
T12525BD0267FD4209F1F37F705AB642A10A3B7D92A979D25D1289701E1EB2E60DD70BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Perflib%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Perflib%4Operational.evtx
Size 1.0MB
SHA256 55b1bbb946e181bbaf433b27fdbf41dc67ff7fe2627bcdc121b9acdb02111dbd
MD5 d834b2fba632ed7fdd90c3df0889056f
SHA1 a66eb37cf5b71a474233de509f44fdbb658e259c
SHA512 a24235f85566ed4f13b486118eeca437d6319f8b190618c2c41c12eb74ed57cb83eeb4a7ea37529b19867ebb777dd2920ecf149883b652351f53735fcb44c4ad
SSDEEP 3072:ziRMugUmd0jJawob8LnXfb3MVvvNCji8XGhgG3sWvXGTmvli4WQfEzVyOkaw5hQZ:uIngPxe8j
TLSH
T1D625EF121BFAA434F1F38B7544B30B69183AB8240E06E98F7150D3EC8D9B5559E71FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PowerShell%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx
Size 11.1MB
SHA256 c86720ccf9a2e1ec3069eebb80a4e8cb2ae4806ed47742c6259b941894f07664
MD5 11cd2b6e48ba1bb2c66acf6115d0be00
SHA1 c563baa67191e30af1728956d46c984711088f64
SHA512 83ce9a21a6b77c8b38570cab39b8650d1e88ae93c2aff5c57f52e6cad3d9d811c757d108d011ddd50632f6173c134b6197d23d2ca267d9103c3fef4a935b31fd
SSDEEP 6144:VUfDbCDbfDbXDbZDbUDbqDboDbqUTDbCDZLDbXDb7DbUDb6Db2DbpUjTQH3Db8DS:VraUGP+VMvXJ2
TLSH
T140C6AF5253EE1654FAF76BB9E97E24741A733CAD5A38C26C109CB05D0FF3A0488A1763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PowerShell%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx.FileSlack
Size 768KB
SHA256 6d91af921332dc3748cd5410151599f08eed9f0dd74692bb102f4f2359ed530e
MD5 a4e454cecb95f197c33de8b0f9d99366
SHA1 21e339e24296dec1475b18a327e1ef45e32bedf6
SHA512 4ac9564dd821cc0699a9ed48e7795a27384fb797b4271a4f6afaa62a4facc364a1f3367551c831dabd25fb175dbe9da6417798ed19b71af029bee7d6688fc309
SSDEEP 12288:NzAOpQShRYe7NUQ/HI4RVkbtny+RPLm8f:NRYe7RBkRny+RPLTf
TLSH
T1BCF4180233F8522AF1FF0B75BD7989944BB6F8456EB2CB0E1964155E4CB3B4089627B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PrintService%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-PrintService%4Admin.evtx
Size 68KB
SHA256 e5461b5effc36aaecc8ed5dae80409266c8a848bee64eb4e8d502eadde47a534
MD5 00e5857b21a558dcc23a5076bf28c644
SHA1 3f0f91dc3f58fe9022e4ff579cd6af0c7090961c
SHA512 df41518cd63472ab0fea1b10e591a1c1e0e8e205e6761b57558a597d1ef23dba54307a7890c6f4fa8e78eebd425f5c42bf5c8511334876878ae0a6d51c24832f
SSDEEP 192:G78V7QpTpRfpRTpRMipRUDpRFrpRmpRaKpRo4pR2p:GohuTpVpRpmipmpLrpopgKp24pYp
TLSH
T179639802ABFC4E14F1E38B3984B607153DB3B8504A21AB2F1638A19C4D66D65DE71BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx
Size 68KB
SHA256 8e36108c4f0c0a180d1f5e3fb8d9f545d711a7750cf29f840d92cc50d77472b4
MD5 c605c53714ef70baf3ddfaaa80016c4a
SHA1 d84d5b21f04d9425c81e00002fb3d60c7e489730
SHA512 b1208010cc782431b1e22b1077c4ef54b7d972e947f90ebcbc6a89f7e23a4e44990babae3e98df965dad8ae78702aa7f699bcdf894963bec1e801b9e8bd0bb97
SSDEEP 384:zuhgsjNseGsBsscns8sGsusxsUCJsPXsbsesFsiosesOsmaws2pus6zfsuHvhs6N:yriaLkpS
TLSH
T10163100607FE0268F1F78F3C99BA0A6128B6BD45AF518D4F126051584D32E56EEB0F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx
Size 1.0MB
SHA256 c417fbfdfd8115c9a00060c1eb2e248a1af2089111c69cfa4210df95b56b797c
MD5 d27c83376163465b011d9e4b7252fd05
SHA1 d626b1ec0c030b13a0a5b8ce63db52bf25f72f29
SHA512 2b152ceedf50b6b17f5708b6a1e246c5d88a81ea681bc6d00dc8b5f1464400c3a0472332725ec8de43c77efb6151ae4608ced2779be15c1f92415aedf1bae219
SSDEEP 768:FCIQLxJLPzfAwNK3KJTVPDJFVEfdbJLPzfAwNK3KJTVPD:ZQ/fAwNK3KfVEfdVfAwNK3K
TLSH
T17B25990257FD4A2CF6F38F3990B72B6818BB7D690F42A95B2311625C18959118F70BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PushNotification-Platform%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx.FileSlack
Size 896KB
SHA256 b2090bcb10ef1757cdb71b2f08386b2b7e9ac8cf9ad539f8aea7c27d845bdd22
MD5 d18739d4922aa67ca0f0eb1063e2b969
SHA1 aaa0cb40c6eb3e6ddbf19244a3046c54eb70ba27
SHA512 63816527934ef0be9c9f73fab47f2bf2aa20412173ee1707b5095910ffec6d031b53e19dea155712022cf9fafc342d97ba0ac33464f98d06fbbcd37d92fd24d8
SSDEEP 12288:veVhAeCUc0e1q+VHegSBae51FeeQwkluE90o:EgUsq+TSB1Ewcus0o
TLSH
T11F15ED35E99A43F5EB9E2235FE4C71C3E91D6CF09191C520914AB94F8CFC2419EF4AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-ReadyBoost%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx
Size 68KB
SHA256 107e7be567874f352a0a1d84e80624a70e61c283682d97a3342c888e5a3de4b4
MD5 92b4c5fde71e97ebc5fdfe1a8b437bef
SHA1 5b0698fbff58ed88d9ccc7a3e289209d8ba7325c
SHA512 4673d810dedcb5b4588c2514fdc1397c85a4b3e1761106e9658c089209a2515d7eaa0a756d8dc0ec863902626dcf01e788b34284f425334c482733058c4d8c03
SSDEEP 768:7JANcDU6IZSyimfyHwvfcoxFSux7VQRXe3P9m6UnSL8fpT3f5qeGSvrgv:9gpTybG10nSL8fpT3f5qeDrgv
TLSH
T15F6305031AECA819F0B7AB75BA7A85663221BD78DB51D42F7045235D9871F40CFE2B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-SMBServer%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx
Size 1.1MB
SHA256 87615d483ba009d2e97099cca10b4c0fb4c429b9e4e034c2cfe4f491bb56383c
MD5 2cf1633b09b7383f1c071003c41f38bb
SHA1 0149dbc317098ae2b1625f3aeb2abd2c7e334a13
SHA512 d9fe4d0001b3f46b5d90ac238f44de8c073b6cf3b1bcbf01910f9b38d72fd8bb4ad0967627f59fa74de427e1dcf01fe54158e27f559ecc73ce8935c2cd0e0289
SSDEEP 768:B+DzRHpHlZl4jbUW9fWKgNkb3E4I4tdli3Mi0DXxsCWJDtwrh41iXT2Ybcdgi:w0EpT3M2T
TLSH
T1A6355A0217F85834F5E38F39D0B34B393A7BF44496825A5F1064B1994DA79B28FB0BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-SMBServer%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.FileSlack
Size 960KB
SHA256 b1d440c71c9d07ddd10e1329ef41577a15e2b314f8fcafebd010d5cce938b897
MD5 ef557060e7fd504e3211f11c0734d40a
SHA1 eeff8192899b1b2ce96d5b9ff794b02b4ca71b52
SHA512 0cb3694a2c4b4893861a04332d8d9504ebc28ae4298f62c8b72216260e599f4b80426482e467a794420419c1f2a0187ca4e417e1ad877d09b4807e97aa3f548e
SSDEEP 12288:AvQ7a67aD7ahRRPXidhV7MAO/RUgVvXzz8nuxUHGZUdQ+:AvQ7a67aD7ahRRPXiD9O/RJhz+HGZoQ+
TLSH
T13725064382F803BEF0BAC73585F24217E6717859AB258FCF5252421A1E53BD59E38F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx
Size 68KB
SHA256 82362db22fd396f1891844ece950f5552d26aca25b5e95d5c67feb6cdad4887f
MD5 2ccd318041e6e74e3221d62f06995b14
SHA1 77316a106f14f7c09db1d55dbe342c7664de5762
SHA512 fcb9c2598d266c071f60b8ba3ce6886fac2eda15d4a1b9f218df979ff2e69e68d8b26df17d252e750e0d39e8393f23461c73b01b31ec9507e2798fc036f7d928
SSDEEP 384:ethV+Ti+6D1zNvjibQFEYie53iGNJieqi46D1zNvjibQDiBTiqigiaiBHiCiBKVz:mPd1PR
TLSH
T138633310EBFD0139F3F34F38E9B39A11A97ABC461D29CD5E1155128D0826A15CEB2F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx
Size 1.0MB
SHA256 239eb1c8de6f7ef28ca9c1de7780d64e26a392cd1e8f0a28ab2d9ab1f0587d4e
MD5 9c412c44db9413a9ba3d41907cfbf497
SHA1 32c32b951ab37dc533eec30314872a50f6ff4ea2
SHA512 54fa8fa6331dd48b965840119910918d3a13b6b4cf71bebfdf27ab5571a7050dee276bf55e408fbf66261adc2b4360247d91f23252a63e0ef5fd10de99c4fe83
SSDEEP 3072:2lLLpvhXZ091wf6JxvRoR1yiNEB/emx7pb1DZvaWLUWkxvdK53PexNwx1785ZtUC:iQMK
TLSH
T109254A0567F95034E1F38F36D8F20B2A5A7BF8294F26AD0E219082544D36E16DD71FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Shell-Core%4AppDefaults.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx.FileSlack
Size 832KB
SHA256 7e0e6c6482191486186a367e2a6b15a3a655d978f9762385942d57e99bede88b
MD5 29fca4dffd18cc3f056bb473e4c91475
SHA1 5afa358c80216b84140d82b55ff4375655f25151
SHA512 d0b5a201b931c490d4a9fe7603c989277a4b644b40af2986632d95615d65ddd4572b9c566dbc3e37c85044ea687c3a2e7770cd2c0330c09f1dbf8ec682a5a807
SSDEEP 12288:3o5olPPu2zMo0QmvFFNcjN+KzIXIBz2Va+N3/W5hY6h07FsvMaYbDoWqQEju0+VQ:Yh4
TLSH
T10005E200BFB4D1D5E2B25F324DB78F452775FD12AE21890B2A94230F8DF9B81A51772A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Shell-Core%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx
Size 1.0MB
SHA256 618ba8310ae0d1114e7bade30f8ef95e298bd03394f9e83dac9ac0e8eccb901d
MD5 4883c706afbd9250f002a8013cee3d47
SHA1 4c3377b362dbe70d2f8df4767eda0f404755531b
SHA512 5faae0d5f234935977e80bda370dac89aa6f423dde8fe7f25d4ad5d88e858837b28f6ec42340974c9441b86fea894edba4b352458161e89bf22c52ffdbdd9ff0
SSDEEP 3072:RjfHKEtDAOxVoPMT4PrBVfU9coiJbogxukHskFBxRoTbl7tyRIPyiOFIPD4FfHc5:Vjg2mwlSK9GSJ+
TLSH
T1DE25250267FA9434E1F38F7998B30B286A7FF9685F47685F210451584D36E148EB0FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-SmbClient%4Connectivity.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx
Size 68KB
SHA256 d94f4f220970c8ba2c98936daa86336660ca37afbf591ef5e9c6d3c4bd70e9b5
MD5 aa28ec805fbcd4b004785a18183542af
SHA1 097c4033800a690af93ff318bb0499fad8327448
SHA512 bcb5f0d9cb254759dfd0df178a6131a42a897211ce69f9f7eff291cf729f58530872f6345a577ef56c3e75964e9053d4f4ea615dbb96480319fc2e49e70a61eb
SSDEEP 768:larc013uX1yzIfeLUEDdYDV/TkJ9NO5k68oN6mtgP1bAA:lKjCDP
TLSH
T1D56366051BFC1434E1E29B7E94B74B2C6E37FD385A81CA5B1054A09C5C25EA1AF70FBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-StateRepository%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx
Size 1.1MB
SHA256 ee21f531e3e1911f721b7994b33ab02add987069f97b1d893b0ef1306c45e1b1
MD5 399a79da39ece71e65a7cc08bec1d076
SHA1 ef511be4026f23ba6fa98dfc434ccdf583ec4168
SHA512 10535bbe320603f5a30e279326a09bf275ecbaec9460bdb22d91cecb49d103bcfedf7a46cb180d372b069f9906de88ad3e5e3943a7231dd57a63d97aa5a27f41
SSDEEP 768:TSoyoNwu/ey40HCRFd0b5ahHj/yQyPXB/06d+Bi0GiUQ9ASH3720fdi9SSt9di:C/u/+A5GjCPyX720fYnt9Y
TLSH
T10B3528032BF90938E6F38F3A40F30F38667FA924199AD60B1144A18D5FA7955DE70B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Storage-Storport%4Health.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx
Size 1.1MB
SHA256 556d5f50e9707cfded728d38e225593d60e749f2d55deec58c04f38b694dd561
MD5 97f224a74f367d858dd2cfab6c3422e1
SHA1 a3c183da824d4b233cfd4b733de681b0abdad194
SHA512 3ba273d9857aa02ff5d3ae6356398924a38be45534a8a21613ac78d5d5da796014b1dfdd02da712f54adecfc63a203d8b76e604c0a95e059e64dba605fce5446
SSDEEP 384:TPh7pIBpBNpBIpBzpBIpB/pBypBtpBMpBflSpBpxpBZgpBXHpBh+pB19pBjspBpS:L2X8pK1ql2fBQpzWTa1w/J3WnpMQ
TLSH
T12735F5551BF70629F9FB8EB516770B74AA37BE342A95F91E508090EC5CB24108F207EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Storage-Storport%4Health.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx.FileSlack
Size 768KB
SHA256 599c1bb5ffd4b87229a81958f33f1060821cd01cd7aa7ccafa0d862f4522f3f6
MD5 cb18a5d28e77522dfec6a6255bc3847e
SHA1 6db99ec3aead0e567d869c2f5676483b66422d38
SHA512 6033893c75b32cc906bcabdff02fdbbbb75f0b4d568962b38ea023c00b2273f90bce4482358d4ecc64c22bceaa628d55d17877c8301a1406f67c55c86fc08723
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft-Windows-Storage-Storport%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx
Size 1.1MB
SHA256 241e73ef842f8805fd205ccee9fa25d65c92628dd08a86053597fbeb5e31b174
MD5 e504d806723c3321ccf448af637bcbaa
SHA1 75b29cbf005b80ef9b21f1f53310563fc2a1b801
SHA512 dfc0569fe96ce61f58d322d55b8d8ba93381f93c17dd84c098b7ed1deaabb076d5258ca5d967058d53357cddcbd4d43d8eeac42e877dedb19f1b3194badf9284
SSDEEP 768:qvyAXnvUG1ZcKOwPmqH1hltApyYTGYNtU35Oow0BJP5OKs6oUF/6GZgWy6rc59la:TyYaStUJOozpx
TLSH
T1513566062BBA453DF2F3CF7558E74B38693EBA142A41D95A304462EC9CB29449F707E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-StorageVolume%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-StorageVolume%4Operational.evtx
Size 68KB
SHA256 619bb8a6cf2472c3baf57b17665e9959062482a2976cb471a5b5e892143f87fc
MD5 6222bfd18e7ce7cf30f77b55251550a5
SHA1 50b27808cb13ac94a1839f071dd0637a4508869c
SHA512 0736b79b166d4ea67f14b3b9f0869d77704ab17e0c2ccee6e0a30688baf2c0018a421239c5269256bd7b02a6bfdeae3b87d83dc826a546660e578cb0535bbc97
SSDEEP 768:N2NkO3Ln0TwsjWur+kAOy6mvvCuidG0FJP:yn08sjWur+kAOy6mvvCu8GG
TLSH
T1E763BA021AFC5429F2F3CF31A9F7473A613ABD255F51D15F309463AD9861A008FA27AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Store%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx
Size 1.1MB
SHA256 1d604eb17a55acf8ada59cd11162afc8ff6459fdde28c5c5e84365f450be5079
MD5 d40d9a9a55f95177f72b20c9bc8020e7
SHA1 2870f87d665e0882ec847c9d6357ddc2514d6462
SHA512 90598fbabaaf792afcdf4e30bbe6e9ac84308cc8a5943b57ccf6785b7be5e85c3c52b5270bdc9276470ac0866e3bfee74443dc8c1963ba72c89734a4e97cc814
SSDEEP 768:pwXDCXYnTc87i1Fd68+fvKt8EUiMWX1lgH2vl/hi8PbWvVjgPtt7MaHphqs2Lz:iXeY79Q8EUXWllHd8gW+Pt9M0DqLLz
TLSH
T126359E016BF90538F2F39F7998B30B2D497BB8081AD69A4F1454528C0D76E519FB0BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Time-Service%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Time-Service%4Operational.evtx
Size 68KB
SHA256 1a8f71323b4b60d4a958e7559565224173367fca5c2a7eecb2cebb994a465cee
MD5 e42e5deb6d3906e350921d0eeb217159
SHA1 d320647161bf9ca07d4154e9bec5fdd581c2ee35
SHA512 b15accb57cf4005c12c94b60e02680783783609c5452a00720b42db4a17453e92eedca9bba97246df9083d5be5ba3ae070d21e4fcf8b14e0b0bbf9101f2e9588
SSDEEP 384:RWheep1lp2XpwDp1IpwpQpjpPpnFc40UyZ5ScyRn2r+SWIRz1EdptmpgLZjf9+Vp:4o0acj3HOY+SzRadptmahfEEFXmj2i9
TLSH
T1B063B6027AECD848F1B35A706EBAD0ED57727866CF11D64F71C1137F48B1A018EA6B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-User Device Registration%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx
Size 68KB
SHA256 7a9997d267ede737dccc986ccb45828d32b4b6f79f55731b59b87d07a7816afe
MD5 d7327c0bc41eacb569ff74db6826aa21
SHA1 fab2a1bd1313df50f225af69b44f87a3e6b752e7
SHA512 90780333798c77a0554694b5ffc6d2b4a51bfcb734d3ac2e3ec860d96dae5e6a1144541838a258831c80d44ca64f62613102bdf3c5e56d4465678e2a03dac165
SSDEEP 768:G84XPsPfsuiip+vXh5BFnUVrbLbcK3BD:SPsnsuiip+vXh5BFnU5/cK3BD
TLSH
T1B663110017F95A28F1F27F7A85F607290D37B8580D35E54E1224824E8D61EA9DEB17FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-User Profile Service%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx
Size 1.1MB
SHA256 71bd63a89501a2e0c39bcfcfd747fd951b768cdf85bcbafd7139aec9b63ca808
MD5 9abd8d51e1e4b47e89ef6e8938d41677
SHA1 8d7ed83c6c039c5d7eae563fbd72cbc2ec60f308
SHA512 22df74302565ec5efd63768ea5d2a22a8602bd93a60e23d389ecabffa1a6a0c1c2e71fdde6d0274153ba0705511429387bb22a5fa3a56e6203826238aadfa78b
SSDEEP 384:LNhPmPmCm7m8GmcmbmumbmSmMmpm6mlmem4mVmTmBmZmqmfmdmsmH6mUmEm7mim9:BIQHc/DpQHc/
TLSH
T12F35350297F8492CF2F78F3894B31B293D3BB9A40F595A4F01A460544D659798FB0FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-User Profile Service%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.FileSlack
Size 960KB
SHA256 c8e30b8c91b331941b27d2f3d7d9b5f22982ab26eeea927d3b9feb91bbaadc81
MD5 252be6438b963bc9eabe045de2f68fe2
SHA1 b8a73f7e7a430350ece9e94642a414bc9171bc22
SHA512 fba3f7ebd97dffb0864d894961a74fa765d04fb7d1fa6b3c75fccd33faef600069f88ea408f04fb2dedd90a5342f0337f81e0f46264800106fa2a66fee3a822f
SSDEEP 6144:ilsHsJUGQkDyPTx4VWLliYdWLlSeRZ2AP:uUGQVqVWLliYdWLlSeRz
TLSH
T1E025750263F94204F5F27B746AB641B04B3B7D95AA39C65D118DA01E1BE3E60DE70BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-UserPnp%4DeviceInstall.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx
Size 68KB
SHA256 efe5a808cf219349c97aede1442a5e13ac813daf65d085aadb69df371da44d34
MD5 fa7b8784bd0dacbee9dfe0f6a8bcfa5e
SHA1 3d7e66ff26a09d4cedd23828bd3fb619e40751a0
SHA512 a9f9fff79eb1f4c9fa5c36bd7f82bcb2d4ce20abd0d9195f7e04c860abc418f431b4686e3e117a2d510f97d9066f6f97d7217250e6f9bff59100ec21a6c95f78
SSDEEP 384:88hi7i7R7fQ7V7Uzx7mI7kH79D7o7B7M7vt7Y75787uS7I7Sd7zkLq79o767v7WD:phek
TLSH
T15C63860117F1593CE1F38F3D84B70B6D293AF9100946664FB164A29A9C76876CF70BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-VDRVROOT%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-VDRVROOT%4Operational.evtx
Size 68KB
SHA256 8534891ff8f28d1628a922310641fcaf6d77bcfb976bdda9fe6774eaef5e91af
MD5 540b65dc57148f0d0faa8a3346bb68ce
SHA1 b5a6155e744701d266af0d26a128af58b146df8c
SHA512 26be5f9dd09182e16867b2d1ecec29bf0de821c4838b761cbb67d8a9929df4faccaed0c23cdb1795f9b3fe6d98932eec5c3ad63903c90bf07e6301c21add196e
SSDEEP 3:MgAWl1l0cQ7MfaltpRTtPl2tVRl/l:Mk8vMijRM
TLSH
T11A63020477099812D1080A3944878B91BF70FD501F7A9753A960362C8D753421D52F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-VHDMP-Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx
Size 1.0MB
SHA256 9838e7dddf184e2e4dbf06cdbba99603d560893249dc441b875666f4391ac0e5
MD5 6d2a4e6957682787a4579b071593f215
SHA1 c146ca3c2c91bfd88e072eeaacd097ba21080e4b
SHA512 f1a550d6f5d7cb1a30210165b4862702d5dc9e20c4be25e3697bcd8b91ef4904a8f6cc1305130be7ccd2403d4cd0153839d9ca477b6485e061ef52e1cc38b9c8
SSDEEP 384:E4hXm+m/mCmU1YmRmwaLmkmjm0mymvm0mwmZm8mwm+msmFmTzmT5m+mUmTmdGmL9:JOyasfMp3dZaz2bmKXtu
TLSH
T1D925D44266FC8538F2F38F3AC5B70B24597FE6980F896A4F1140D1884E15964CEB1FEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-VHDMP-Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx.FileSlack
Size 907KB
SHA256 f608bee2565b5288bfde099e7c10b0c56b70f64cfc6fb71ed25d2410da79e13f
MD5 e09998b2b395e26a08f96044949edb1d
SHA1 add94c6367c19c2235a36247829ad11aa7ef8ee1
SHA512 3b57dbdfc0d58c78b3c049b2499957e40f1e78fa9712167c4099a1097e09bf7b36b9eca34009fbdd3ed8e4ecd4db2c45de3012e8b91bb98ade036f8c257321c9
SSDEEP 12288:1gnC2oUJOwQuisT71sCT0EHFgwA4LVI6zDBpW15G4ifta0EF2cOMfx203R8RebPq:1gnCsJAul7B0q4+Vzmfjo6fbfeq41ca
TLSH
T1F015F1425D687D51F398B072F9EB01616FA7D89874D33D2E8F3A6A322553D80DB3381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx
Size 1.0MB
SHA256 b1d9d60add4e4391df664b7ff203372d5f58396869c466b0995c20dcf8517813
MD5 7c8d19ac7189f4a5cca3ad4bc9f8ab4c
SHA1 1f1dcd9ef34683d6f7480361ecf1574b5022e270
SHA512 033c6c583532dd46647898dd2f7bd5167843885d4dc82f134134336c3c7b304d2027a7bc993d74a5a8d1472f1917267c9fd069c277d3bc074da1bfe899e8fafb
SSDEEP 384:8chj2zr2s2i2j2w2R2B2m2q2i2f232j2fGU2+r2wi28x2M2b2C2V2h2K2P2Y2h2M:hES8GNgR3r46pdR6+l/heExhB7P
TLSH
T1D32547176BFC0928F2F38F7884731739257BBA980AC19B8F101071599D61A61CFB5BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.FileSlack
Size 896KB
SHA256 10c689fce2d9461cc19538d29f7c1ab07e21136db7c1d0d87d3a0663669347bb
MD5 b40f0d653dec250684e2905d3ca3f8e6
SHA1 17b1d2287da9eab9b97992984a9a079980338e91
SHA512 6d295cc8339e1d770f05b358ffcbd0b653e0389d041effb07a1c4043822cc5d5ecd56ed7c81f59266dd9e0ae71ae820d556aa8353f47bce7386a4e730e1b5e24
SSDEEP 6144:kDiXMyArr2eYWIlnbnteUPfkmRiSfOZ0PFvCavJ1pgD90IEnOkoLbnLC:iDRYjLte+tdvZvJ1OD90IEOJm
TLSH
T15D15FA12E4CA292DC473B138236D9771D703FB44A5B8C6AC42E339585ED7CD72EB58A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-WFP%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-WFP%4Operational.evtx
Size 68KB
SHA256 71b713e3efc8f053f635137afe3b9e16f465473aa104c20222354e30c114bf39
MD5 6e40dfac92a4c118eb9d88b4d8d93f32
SHA1 a72ee849cf0cf2340b46538ed1a169b7405e6bcf
SHA512 da87661319fa8cebbc30a3d732ed2cd78dfb816fc25cba7b149b6f4a216399763ea7b9818f4bf8c496ce26ab6988d6817237ec961eab8a99c7833b2f626058c4
SSDEEP 48:MSvSsW/lrP+MZQNRBEZWTENO4bpBOo1ObQIJR0XtHt:5CPKNVaO8eo1ObQgR0X1t
TLSH
T1DA63FE03EFEC490AF9F34B7E427A8226293679268A11D19F3514326C0D72F50CFB1B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-WMI-Activity%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx
Size 1.0MB
SHA256 a21c22ccf3f96f2ea7425583d898868425b72b703bae21276348d8f6b4315c11
MD5 6c11a21f588e6a1e7e34cd69663e66b8
SHA1 4b80e5bb86390b4f10ca9bf657aa34ce4470bf46
SHA512 b784aca78a1b8acaa95263c7eae3d5b2b6a297bac72b4bca2dc90ffa196485bce0669952988653759f3fb523c1ea89db6c93543a4903100138868eccb22dcd55
SSDEEP 1536:73kNyJOU+ThGJy5fPkVwFGs/wOAvZ+Kjk:73kc0U+9GJYfPowFGs/wOw+K
TLSH
T1C925550266F80529F1F2AF3D95FB171B5A777C89096ACC9E1054138D0D629B0CE72BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-WMI-Activity%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.FileSlack
Size 448KB
SHA256 b2f55341aa950fb5d0c49c958c102138b0f8c81e2a2b0ca28b6b6ea5a8ec5ce4
MD5 a99879ccbbadd316a205b1b8f4e0cd7c
SHA1 15a76011343fdcc2ca0d698dfaa447d113682c08
SHA512 89b61bdd8fa1f15006f0d0149f2857e2682b40dd41e5eafbda88064a14f6217a317fa0c0086bee49bd0446f277d658cc3741d3ceb6519ba672f83e951e52ace8
SSDEEP 1536:z+3j2jpx8IwF4R8b/Vr5xZpnX14aTqmlMTNqTY0pLMK9s/z2ZIV7w7nUgcUXa0y:z+B4R83HZg
TLSH
T10CA4BA10B8E6D742E5B33A462540F755EE08308F68FC052AB9CC6F6BAF75582F663487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Wcmsvc%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.FileSlack
Size 896KB
SHA256 64e13439a9f2f61a0a4f102ad89e2b7f7ba9de50623188b3464c8d624e471131
MD5 a9d0d0f7fde408849fde2d802d151b61
SHA1 cbecb1e7be6ac1b74ca1735512e11ab82c53e71a
SHA512 4c4a6d018465dd1e8b61bebad667b6d9f430f815f49bc2f94a507cb5befa561b6800d9d30523ef8092f0c01fd40004597c621a1c27ccccc7f1c1dfccd7d2af85
SSDEEP 6144:itvwdFYHzFYmeFY8FYOFYqTfpM679MA0TsXVj:gwVfpdGo
TLSH
T12B15B61233FD5209F5B36B3059B581E19A3A7D966B34C25C318A650D3E71E239B32BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-WebAuthN%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx
Size 68KB
SHA256 3d6217ea05b2c77021b470c78193061c5e8dcaf388048d50d8c54abe02ad93ae
MD5 50f8762ff92533e7bee75a00868c1dbe
SHA1 fa979425b573233d77976ecd4d7559cadf0b3bf4
SHA512 cb3b3409d8b1fdfd676bf263bba57b14e02a6f24b978c606e83643efc09bfe5448280dcd8b6cc97ed9c5115a457e2401b9f6c166a9331d8a5507366433b12a89
SSDEEP 384:d0hlVm0VZFVRVdVQV1V5VsOVfqZVFVEKVrLVckVLhV7tV4wVbV6VPV1loV3ZV8bI:iQKkO0XrMc
TLSH
T130636D111BFA0938E2E28F3E95F34F3C397BF85458828A5F6110A2ADDC56561CF717A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx
Size 1.0MB
SHA256 e92afbb2bcda5c7c0fce278d290f841e6f6e6707af26dd3d7211e6b22305486d
MD5 2a39170423f0a8647d6e13cdbf51ad87
SHA1 981975d8932524c46bd044e55598cc5620e5f895
SHA512 d92138f901a767c61a12eeb9576b040a3cd46d4066ad25a789d3a540b557ed9d2475c81e6653b9bd0c2de23f8ff463d3be8b7960052420d36e5773cbf0121e6f
SSDEEP 3072:4+fYvbwYavnHnFzZrjAiDOzeOXnbwYavnHnFzZ:4
TLSH
T14E2557406BF40618F2F38F3E99F22B2A5D37B9541E56D6CD0251718E0C26FA4DE70BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Winlogon%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx
Size 1.0MB
SHA256 5deed8966c41049e460ccfb41df2eca9f15eac38147d49c987e0fca067909295
MD5 c5e38b4371eb2805a2a84b9b01f00b35
SHA1 35e5aa3dd861535702db8c6f03de7a5a761845aa
SHA512 2f4fdf490b8e029d2250b11e362950940b72cc566363071b3f611acd2cd64603f3c4e6249a32c27d9cc2142c68d3b144ba396393991b5d4e21b1a0ed917c8712
SSDEEP 768:KCk+P/nBdRpDLl8iUnJIwtGdwGhLYZJoLNh:dRpDLKb/GdwGyZJIN
TLSH
T10825084667FD042CF4E2CF3D94B71B683A7BED680A86994F200062785D56A524E70FFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Winlogon%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.FileSlack
Size 704KB
SHA256 547c7dfafa10d3c76da2ce018afd591c2e9b3e420815858361c15f775837bda5
MD5 8e0811ae0cd6302fd3cdb14a5cea4cad
SHA1 d7dcf5a7220ac35720f6bb03c3e8e70d6792d577
SHA512 bb49ef8b8a8c00db11fc318c232d0aaee61e8fdb839b770812c38eb1adf85f86c04608d98f73a84975301bdccbdd4ee8ac5ae5284e0d6aadf1db14c57ef264fa
SSDEEP 12288:XT/rA8vLUv/tmktuUu4S/zCc2aa4/BhzAqRfInu6FP8NzlGalcTurXP14G:Qo4NZu5z32uZONhFENh1lcUfOG
TLSH
T135E423294E23CD3085A7F21680857773EEFC15754AA325A89AD9C717F3CC257C90DB8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Security.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Security.evtx
Size 20.0MB
SHA256 43d9ebea8d3420f6acac4dbb2cee18dd75d573ca935fac1ca4341f1f320bfeee
MD5 2edc3eee0e0bb08f9973e0e5c9cf1a02
SHA1 920f9e959c9d068daccee932cf282a57bc0a75b1
SHA512 89215ef57fd045074f4ce9106a34d32cf069f3c39377b4188fe387118f29f10d26954856f30ffd920895a0254aaee8808317ea4a6ee0a4c9b5524be3f730619f
SSDEEP 12288:keoOZQ2DAUd4/nFaoditYdgVWf4+gmKYZ8PWQhqviTbzsqlW8cTwOC:JSQYdLf4+gmK1PvvzsqlW8c2
TLSH
T1CA27CC44A7FC0639F3F34F7695F3034A6932B8626D029A9F4149038A4D52925CE76BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Setup.evtx
Size 1.0MB
SHA256 93451939644c594db3c9eee87d3d213b94fba7c717174c4687419831c7c85f5c
MD5 57edcf93ee9e776fefd9ea085f1aeb04
SHA1 b1ee88cb7d3d8300bbefbcaf68fb1874bb8b89db
SHA512 6ccb4ee8a1221ed05856d5c014e5b3a652fbedcbc1490a370572e2e0d7b94044ac25a4928c4a8870251bdd0a61ba9a8a13138d6deae946ecaa4952c956803b13
SSDEEP 768:M6l4Wag96y6Dfb0vDjW9bLjL9hpDrpIkKTRCS/pjGOjH7J8GJcsi/cGJc:bn3sL9iWSqa
TLSH
T13E2526422BF54428F1F38B39C6F60B162F7BFD849751AE4E012052998CA6D558FB0BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Setup.evtx.FileSlack
Size 768KB
SHA256 c1cb66521c348b8b4343368e8673c3e8803952c990439b810201912567ce3bf2
MD5 358e1e1a5760cb9ddfefcc8dbf96d86b
SHA1 12ae4c3e1a88471ce3b09074baceda20039ec3ed
SHA512 bd98d1b2b6a4fe04b0b80b15ae1f1859ed52a99c7d191cdb5345442c7db54d17780a9d2c404ad54823fe69392916267ebdd545b387ef1b787f38b3dffb8d49ba
SSDEEP 6144:L/V+hVXXFxjUapJ1qNjmsz5IEsm/baxc50:jbaFqNDIZxcG
TLSH
T126F4634167FA0648F6F75F7869B966618E3BBDA6AE31C39E0190154E0C72E44CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\System.evtx
Size 1.1MB
SHA256 e7eb57f7bc72964886efe15f9110dd6ef8854c6ccfa1ff4aca5acadb62e89e6a
MD5 aaf1884f19bc94c1767102e94b3171f1
SHA1 a0678c1bd65f4ab310a9dda9c5d74db1cf8a5eb6
SHA512 afbf997220983c707d843e0e7375edf32d130a906a8c63674ee6bb762d12fd3678696101be8b3e214400a1a5c0ddf314fd35408760bc0fd26d94adf88667ec88
SSDEEP 6144:+X2NeM3k326F+T0571awLYINBXdW2NYTWhlUs4s:c2NeM026Fr571awLYI7XdWOYTOlUs4s
TLSH
T16F35EE0127F84838F2F38B7A84F747392A7BF6601A82974F21A4B3D8AC115A59F717D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\System.evtx.FileSlack
Size 128KB
SHA256 add4e26781230aad7a7ea3e5a67122a72ab8b540832d0f79e93ca7cd79f0ed9e
MD5 374c5600722694f324762cc421ed2777
SHA1 21f56de0c3ce749c01f38d19137c994531081368
SHA512 434b74a62168215aab6a0ad2e4e2977868f8012f9c0f5d2f55ea7e09aeb490f1b11c5d893752b6d7d78a9745c860e145a0cf0ec6946e47cd5c6a2d38d0a699a0
SSDEEP 3072:jLeWYqub2bEwYuTHr0wkoMWEeUrvDlxQ1flSCLHbz:jKLqubUYAkoMOUN210C7bz
TLSH
T1D4D37C4BF1D900E8F04DE1359786A223EDA2B4860735B7DF065047A52B7BEE01B3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows PowerShell.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\System32\winevt\Logs\Windows PowerShell.evtx
Size 1.1MB
SHA256 582965b4599c80740f57bd4583a57fe5d1bac76a4dde413334493e605b3d4ef4
MD5 e371e34c4162cb052a16f68535e16842
SHA1 e39a5d2ef5cb03b294f8ed78960cf5f0c93b6200
SHA512 89cc1f37899d5b51edc869af7dbf888e581f32b7c597ec763c30ddc355257cdf76ef9ee20b3974f4ab8681f5dcc9fda895b8a7de71a2572527666e8f98f2b839
SSDEEP 1536:/dIwrw5y+m8JFXbI3yEITmPxYH53bVjwuirD/kJy+YtrEy+QcJy+PDJ/Hcf2tmip:D0QyIC5YDn1v/nQyIncQyIktsV
TLSH
T13B35CF0726E85014E5F3AF78EBB351B59B3A7D206D39CD9D61C1404E18E1E80BD62FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amcache.hve

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\appcompat\Programs\Amcache.hve
Size 128KB
SHA256 4fac0f108db737b15d655286101aad146356873bc4ce5e8cbd71751a494a2770
MD5 43f73aa11f69a394f7408aa2833bea81
SHA1 15cf1afca8e565423b1cf3e032b47565f4222a20
SHA512 0714233b66baa7daaf7a850358f9f32773ea4ef8cda687aae1ef86f9bde3aa822851237d2cc1011a9446dc65a5a85db36c695cddb4539c77cd54d85ae5edee61
SSDEEP 1536:qvr/KsBcPGo3BjEaQlD2rMh/mVu0nGE/b3v:GGA63Vz4ED3
TLSH
T140D3CE597F9082F1E270C7350EE25F036A75F816BD205A4C6380274E8EEA755BE12BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amcache.hve.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\C\Windows\appcompat\Programs\Amcache.hve.FileSlack
Size 12KB
SHA256 15842e92ea84302aef0595956cbd4f478e796d733a4dab4768188922ce3f3384
MD5 c506118c4dda74425c38adc36bfae3a5
SHA1 dbc32997aaddca5f40546b2666f6d61e68718fe9
SHA512 4c847838303860c1cf6830ed0899a43fdb0968f99204e9384ab61632f58bbaad9a23ec90ae295032839c4acc8784fb6fe999509f555200528e8b216c104c4e49
SSDEEP 48:rzK47KLZToSz1pqfYffSKGmG5a8v4nHLJd5bMYexdt:rztSAKGsLrJd54B
TLSH
T10B42141133E8A61EF3B31F7279B491201439BD5A9E52CBDD1B6871990C35B60CEB3356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$MFT

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\F\$MFT
Size 256KB
SHA256 1e205694f57b8c3e9631af566512eab1e99601b2b89cfa89b6ea0a3a2877ea04
MD5 017bc33002c10930fb42db0c2f9245dd
SHA1 ef7abed759db2de652285f4354decbdbe08c87b0
SHA512 e6a188bcc2a5646b141ce62d36d77e9773f4df2748eb0ee61f2750314179896afd15470f4447ae9cc4e9d7a8da9654e3d9a9c8a1f6403d6f21c6ae1fc89f9a0b
SSDEEP 96:fMLLkBOemPUJ72ZMxzRz51UitCyPV5SGgnzgzQ39H6GHka4/kiXkDhlPqHkAq:bMRPdZYzRzZVV50ncz6p0iiSqH+
TLSH
T144443966ABBF9A22E1FD67F185FF07022765F1194E71470B2764B3AD6EB22400D21D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Listdlls.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\Listdlls.exe
Size 414KB
SHA256 b0f6800b2bb4c86e091120e9087c75f9b1b3e46b89cf65744d65cf5ab01fd385
MD5 60a2331a2b28968585c7c7229d2424a8
SHA1 fbac538166d61b4f10db934bd4bc1b86c81e56fb
SHA512 159542a30195f58a6957d70282bd2dff79708bd2228ebebf7db48e25d80e68ea17714b518a029d2e21acf564d37982b43850249c944e99ce1b38864ffa00b009
SSDEEP 6144:IejqfgaIqi0N5fZC9kqf7Uxv9VYO1s+rTiMCOoRb0pyeZ7:IinaIqi07C7krtxnkmB
TLSH
T153945A1173E480F1E4F35A7099B09626AA3A7D724B34D68F6394426D1E72BD0EE39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Listdlls64.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\Listdlls64.exe
Size 215KB
SHA256 29d23bc492e48a5ae68444302d3430e07d08e04278d53aa70d9367d9cf8bceb7
MD5 8336396d50dcc9d5a5f66b078a8460dc
SHA1 42bf0bb282512e4c638b8f03617dd973ee09afd9
SHA512 08f34405f8d5ebf695391f9cb1deb6eb22b318b698ce9540d37eae45d36476a96d379e9f338c64d5f2f3e9674751bdb7f3661845530605b8fb1eb14ee91702e2
SSDEEP 3072:CcSIBqf7UxpYs68VYO1KpygluJrTiMLGcaad5UFyn853tOwDmh8DaNv3EL:Ckqf7Uxv9VYO1s+rTiMCOoRb0py
TLSH
T120245A5173E800E5E4F7AA3089718606EB767C564B34D78E13A442AD9F63BD0EE39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsService.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\PsService.exe
Size 261KB
SHA256 d3a816fe5d545a80e4639b34b90d92d1039eb71ef59e6e81b3c0e043a45b751c
MD5 136f9205a5945681ec470b8461dfee5f
SHA1 1ca7e6ac6128bb1f4e0318a28310525baf7c67c6
SHA512 a3eaf3665bc8a227d139fb0fd6032c1510288c3fa41a50ee5a774301f88491fa69297c437b4ddec1a0df18ba5085c9c5e61254bfcbd38fd3b5f7c4d074ede142
SSDEEP 3072:e4iIB7s+H1oGlMqE7PbxxY0X8xR1O4yjXUnJfELaQdUFvJPKg+SjWAg0FubMr/vV:e4p7sG30xTX8tajKJGa5pIAOCvM6+e
TLSH
T1E0446B1172E18432E4F32A321DB497661E3EBD614E35D9AF5798096E8E71BC0DE30B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorunsc.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\autorunsc.exe
Size 701KB
SHA256 666aa8972b4b0a1e5df53c076af44479f2f94b16f9fb56e15e6d104ed86ca9f4
MD5 b76978d483ee6afcf5b919a51a7d111e
SHA1 6b0292325505fc3ba638d42330a75cbdf237561b
SHA512 2e7f076441f7cceb1e1eb38044d7a7df4226249d4526621bb23e28fefaca80820f5a5899709862191b03837aa659be076dfc960488e24a8dd5f87b28aefe804d
SSDEEP 12288:WN/2Ekjc139fb/AJEAs8K85G3wwgwI6Ox1y95:WN/LX/AJ9s8/5G9gwI6gy7
TLSH
T1FEE45A0076A59035F1F252B029399776383EBC719A358CDFA3C0695E1DB5AC1AB3872F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.yml

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\config.yml
Size 8KB
SHA256 6fe76b3e56eba816690f8254c49cf18ea9141e7df51e75cfa0fd1cbae1eb6072
MD5 c13e2e2cc082e69f9df5d49c23ca9b6b
SHA1 1949ff3d0bf9844dcf98088e14b9427ef12c6af5
SHA512 588111be30f719310a4e31fc2e952abe73057adf61f7cb5c6f10ea9afc9019ba44f103b614a69f23f7f4166a1bdd6325522dadd4d296fd2ae829a81b4c4619ed
SSDEEP 96:9CYvnEpsxsZ1KABR6rPRNJ4MYNVbdkoYPdasGeLb5TYES8lwoCzpc:9dCN1SyrSoc
TLSH
T11E02CF128421D8F378FEE34855926E439635A0C393E4E935B7CCCA944F0E9D984DA7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handle.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\handle.exe
Size 743KB
SHA256 84c22579ca09f4fd8a8d9f56a6348c4ad2a92d4722c9f1213dd73c2f68a381e3
MD5 9f637fba2d680e23da0266c1507f870f
SHA1 05d4842c6e9b5f9430dad76a20c2a4a6feae0bf0
SHA512 addf414497df3a057ba57afab06a61f0ffb7c50134b0c83b61fe6542ec25298b893a455b317262977786f30723a23948836b402d310d6ae4bee1e6cf17a0272c
SSDEEP 12288:Lsfe2MShO2bM1teJFN9rVY5C1lq7oFpuoIG6h:Lsfe2Y2bItIHY5C1lq0nus6h
TLSH
T126F47C01F7E440B5E5B36A304AB5D6569A3ABC650B30DADF2394466E1F33BC09E35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pipelist.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\pipelist.exe
Size 331KB
SHA256 2156d7d3158ea589e8187c5cb82442ee6c37ee982bc0d728edc8a50a2a1c4281
MD5 0e7bd3e144e966321068c5e9f5ba301d
SHA1 00919feaafecb87369d0605d3ecb9fbe69b41507
SHA512 0ab6bb567e2b02460c724ab3cd83fc94f27ca0e268417bbd3a96f37f8b237c8dcfb62acedb2081e21ee216168933ac49c0fe502077fdb9fd6ed68c1088a05180
SSDEEP 6144:Yxhmgd8B4mPalFmZUYQXw/uc1Jiq0MPiU44tzElX:YSgM4mPafmiYQ6t1L18X
TLSH
T16B745A1179D08032D2B33D305B78E6724EBD78211D359A8F53982AB95F74981EA39B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pslist.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\pslist.exe
Size 212KB
SHA256 ed05f5d462767b3986583188000143f0eb24f7d89605523a28950e72e6b9039a
MD5 6c08bae0981841e0cd22ff0f0e8f7510
SHA1 cad5355c534cccf48ca8df5a1007cc34d37cb619
SHA512 1080d9e7d3151122518c8ecc09da061086f1d490656f26df99153ddd3f933da049a8364af28fa104da54089271625f229007989a2dff713782066bd8fa142c25
SSDEEP 6144:UJTVdqTvShLDFQUH9To/JPjDXDzM/P77U8lvfhC9GEPyg:KPkQWdPjrgDJlXELyg
TLSH
T1D5246B21B6D08432E4B32A305AF4D6725E3EBE715F34D58F6394067D0E21AD2DA35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\suspicious\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 272KB
SHA256 4bd1dcf4ca2347b5181957297a22926bbe64fc2eee3dec93bca6f0c654167b5f
MD5 e255f1082448fcc9185d973c71bdcb50
SHA1 c0800fb7d2e66dcdd60414cf137db7b3eaf6eab8
SHA512 6cd5eeb4a31bab908354c0d1e5d37d87c8109ed253b793bb3b0e539217e4957e332535f8130b517d49adc3b6514f99c6f98593d49a84b25c2e6a455fa5ff855e
SSDEEP 6144:Xr1XLss/oct92xA1YXs2lRBN2/iJPsfUrcAe:b1XLsswWkxy2lRq2czAe
TLSH
T1BF448E28B7E408F9ED67827CCCA28512EA73785547A0E7DB03E489651F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\suspicious\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Size 10.6MB
SHA256 1dc68c7eb3fc39e118521c7425c47da841283a076cc422a480bf9ef637c43000
MD5 67e6e37998718f746ba52eaf94c4c0a7
SHA1 83e7abe8c919c75660b4f7e327dae54a92064bb1
SHA512 21521aac07b47a3386dd789a5ccdbe0175799dfbfe5758670a35a6b642b89578ecfaa4e0086dfe3b734bce1af317671339aa2f5650705ac317b182c01c193f3c
SSDEEP 98304:GhDYh+CeHpUwnAJV84AB9Jn8Ed00k9Tfd1WKh:2lJHpUwkO4QD8Ed0XBdoKh
TLSH
T184B66C62E7E480E0E6B3D2758D3AC672F672BC4129B1A71B5295C60FAF336805D3C725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\suspicious\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 257KB
SHA256 8c47f981e1a46a42a268f53ef1b1476555a54bed7077f7b13b1e562c4c9c049e
MD5 17dc54ade85613728a43f2d733527c5e
SHA1 6420a7744edb234f8cf989b7f261265baa381e94
SHA512 632541e69c61398c3eb07ea7b8e7a21a6a765b592939f091bf8319cacbf7f294860e5f80c82e8e7ab29e2a20e67dd4d1e34171b2c5858d30ce9b9bcbe167ee43
SSDEEP 6144:bmw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:bmw5HEjsChNVBFgl0WDm+Cp
TLSH
T1E8446C4677A40CF9E96795388697C536FBF2B8022A21DB1F0760C65B5F33351AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\suspicious\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.3MB
SHA256 d31094b8bbdd28d04cf290eca7920804b0052ab83faeffa84e799c4a3d45d1a4
MD5 f9a5b444d4032ef6d0247e8327cca3ac
SHA1 e6ac15d499bfff2af238e9dc8009cfdd15a08de3
SHA512 3989c59eff0ba479ad97470a283cfa99977a588fce26b7cbc16c2195496fab7fb225dd53d5d64764702998187ff88a1ecc7eefa515739c5bb6d01849ac937c96
SSDEEP 49152:FB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:ru6Jm0xd2d3
TLSH
T129B57C13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\suspicious\Windows\System32\svchost.exe
Size 86KB
SHA256 324451797ac909a4dd40c7a2f7347ef91f6b7c786941ad5035f609c0fc15edaa
MD5 0cd128f416a04c06d50ec56392c25d9f
SHA1 55efb424933087d755b18468bc574db4463d9ce6
SHA512 7d71e09d063a1f805abfb5d584b59e5cbf4ee357b67d48c3cd880ca904224bdb2684646829dcebc7ef59fafaa25c4ba82a9bc96ee740e68ff7736513eed058a0
SSDEEP 1536:fLXMvWgR/K1oAoJVqHY5uZgSV+lLNsUP4SzG:fmR/K1oAowY5jSQZrwSa
TLSH
T186835A9EAAE830D5F57A917484724256B972B930271096FF42D0C03D4F37BE4AB39F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcpvcon.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tcpvcon.exe
Size 197KB
SHA256 37621bdac3ced1103278e8c0ef7b73dfa1cbe9becfbaff421a46fbc78d636b5f
MD5 356ed0fc156993551a484964f99e65b8
SHA1 6b936b5a5b4451bc4f147dad6cd2a7072a799d03
SHA512 8060b018f256ddf4dbde002b6d6b526362c617cbe8f1930a88cb4f191542240530658e8a7b6ed5c496436bcafaac0a6898e67187c3c8854e73ce6f66809c5fd0
SSDEEP 3072:A/H4UqjYVxwTcy4jPPZAjjF/hd8i2pzjGf9j3nPR1IIqQdUF1cePZGkjqjR96xUj:AP4BjYVeTfjF/r8x3GlDnpCaO0Mxg
TLSH
T19B144A18B2E08072E5B73A3069F4D6729D3EBD705F34D99F6794466D1E71AC08A30B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autorunsc.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\Autorunsc.txt
Size 13KB
SHA256 d312ccd73d05f237c08f6854d1b96bebf88bdc1e41dd3b53402c7ed4bc21cc10
MD5 1f84b30da7cfe3f200da0502738bddde
SHA1 8173a4e59a60fb1275daf43c716ac7a17edf2c0e
SHA512 27eac5e8f14188d4dce7d13644b9181ca33cfa77571ab3b71067009152fa4a5857c3f1b40873d78c53884c87e2400fdc56898fb8c2e8478d1821c325a155ba31
SSDEEP 96:niuc8vMmuc8vMPlskQ8hqPTTLW903UCSNduTOcvOchKeC3IbZQq8UqmMSUCsK8Uc:MQL3ygG9Pg2kFvFp2ehrhJ
TLSH
T1C252E404E7F81218F7F69F5669B998668A37BC255C2ECACC02A01F4D0835E15EC70B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ComputerInfo.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\ComputerInfo.txt
Size 12KB
SHA256 6ca668fbde5507acfef821265430c6db92f635538b04acf031793dff3bde21b1
MD5 b9838758d29bed94e6824be8220e7e71
SHA1 64167e3cb49686d7553fc8ffda8938fe628f8017
SHA512 c0ef7166bfc60c4a666d8b0d64101d11bc2f35eca9d647a38a8315300020a642b8fb0ec5a73141ed2d8cdd09d1075f90b7d56272506d12d06babfe70ec99d32d
SSDEEP 192:23AREr9Wws1/8nNCiGzUToK2x6cf/U8a1:2N97oKSk
TLSH
T13C423F6759C8817BF89A013822519733FEE1AE463CC7731C708FA9049BA77487756B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DNSCache.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\DNSCache.txt
Size 5KB
SHA256 7fba63fb0456ba8ed0252a01144475591a585ca3751265dff66f67d7312fe32a
MD5 28e917ad749ba2fff52f6a9b9bf32317
SHA1 de9b3732c2865094af7db814dc135b848a533687
SHA512 a76fe34948b74103ae479ef80e311636cbc4ce59c104601b2a90037c6b470e13d6bbffbfc2b2eda1a2b8284a37d0aa1c71af5be6e761e3e0928daf47decc965d
SSDEEP 96:IGGN9ai5GNmiZNmipGNWiWEGNeiQdNLmNLcNL/NLeNLeNLKNLpONLeNLhdSGNHiJ:Dw5AVpshmQ2dSRRDm5GoIzEC
TLSH
T107B1E22B5E0A320B2331C662AE657077EB46FD2F858FD9493D8F02C54F74486264C2AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Handle.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\Handle.txt
Size 1.0MB
SHA256 3c4a4ce02a2ec6d5aad92006ef67965ffb674804a3ec949bb9f88628b69a7d4b
MD5 dd11235ca49ca7b2b3b2f2073dbc71b7
SHA1 93f653f551f55701e80ed3bbdfc8f90f107140bd
SHA512 78210f65b65d8db1639f8f0e3f9801dede66656a941a8bd6ff92b1651a742b9d6df325536c5f183a746367579587d5a0f576f37114ecafbed6df7b217d036b77
SSDEEP 6144:8BTeNmM2MQuVe6BdJzrwyKciOSCJSRtA25z1kvIhH3VwChVWWsW1Bvm7TaiUQcLu:EkP2dxZK0s
TLSH
T1712569050502CAB14372E33432044A07D7E5D7E76A737D39319F6AA49B7338A7E9E2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IPConfig.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\IPConfig.txt
Size 1022B
SHA256 0bf4899891ba6d2cce73de62e1561b90c5ec609a5f8b299edbfea0c179cc821e
MD5 cbeeda2f736473a2cfe90b9fa48e7116
SHA1 fbfd591fc26d98e7c2cab03e330303138d3a2624
SHA512 27a57756cffbb11bf6352c099a7236b80704038ab58da23e29ed093519220a85a48c39cc979d909db9cb324aba63d64336c7a84bd2b0604a9f6a3485d54d40aa
TLSH
T11011898816D4F41337BA46025C5ADB79E5984E97C003D5A0FC6EA5887D321F49B82EA7
MD5 SHA1 SHA512 TLSH

Submit Download

ListDLLs.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\ListDLLs.txt
Size 236KB
SHA256 2885f5b69d74ad524e73b9ea337cc591a2845b56b8970c0290d14bb51cb84080
MD5 295f9bf2b0ed44eb27f9c7026d7356c4
SHA1 9af0ef537c6815c4c0dc8ecb4b77d7b55b69de3c
SHA512 16991506f133800ad21b54477cd22648b108af567664afdcc680113ae93f166cb438aaedd9af84a76fc895cb98e13f8a1c5cb9d5456d10cd021eaf8063ae87e1
SSDEEP 768:xlHzynfZ649fq1vffNS5rpKPWXlktcCK+ajlU2oURCbDuYlY1UBz8uyUWTfI+Bk2:3TynITWSVcjW5FLLgXsz+x2tY1fwBwF
TLSH
T112342E688EA45CA1C071CC28751BFE5DC26DB9A776C356F3179452C0E96700BAE2F8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetShare.csv

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\NetShare.csv
Size 501B
SHA256 4acd111ea9e3a63fdf21a06d7f10e6914b58cbe88ca36370797681f4a605ca5b
MD5 e512078070991c5f3877f20be00d949a
SHA1 04727b0caa89d9d3108ae87de14f45f2e7923843
SHA512 b5820d584cb44f804c2fbc140b2e9e5d1a1327da74f47ae6fa1fe1c55e5aafb8649c9c750cbf8a45eca95e67a9c4cd551f235a33a550e8691182b4149f9d1417
TLSH
T1C2F022057C0DC1260231C343C299A921C8828B4570231000BA3EB2C85B78283AECC8C4
MD5 SHA1 SHA512 TLSH

Submit Download

NetStat.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\NetStat.txt
Size 5KB
SHA256 965f9bf5536eea95b78945009736e197dbbbee778809828e6ae074b486433b31
MD5 c405e9363913932611c6f5ce19bcf032
SHA1 f2a1e9e72706bf4a47acce6f9e29b9442ad8c2a7
SHA512 f91ae2566fb9ba85393e15faad2b9e539cae65e6fea02c02710e67f43441b50199f7356e6a428f65e18cdd6ea89e85da718275f4aa7b9c2a49fdcfa8ec88bc16
SSDEEP 96:01Lo+5BmFu48ddzSxuzHowNZEFfgap+7+t+H+QDVvV1V1+Vf+V5+VPx:qoiBmFu48ddzSxuzHoMZJqUe0FN71sfH
TLSH
T198B1A6A7A62C79DE34BDD602415FC94AD86E5252392F602E7D2C19C0C71C68E7BFB48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSList.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\PSList.txt
Size 7KB
SHA256 2601d89ab04bd07696d5d0a7b023d1d6bac9ed6d2d4f4aaa19c25e9dccb44a82
MD5 13ad980fde5856d64cf6ddebf137b5b5
SHA1 97acd6daeddad63078963c4e0569ecc7f103ed8f
SHA512 7ea3a3c1f113a5e1cbd532b480e464f1c72a8d019bb3beca189ce83bc4d118de375940a29cbdbfe03f6b3a97dbb6ad4e79a4fe5796b917ff61efba202ad33053
SSDEEP 96:rKcsI/w0HAKOQYozTy9GyXvUQcupV5hRGG17xNOeFM+SVos7:rhsJQYozTy9rXvUQcEhRV7xNroh
TLSH
T190F1DA48AB3EF988B52CF38352185223641DF01196930C4F724E9EE0976354DFBEE61E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSService.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\PSService.txt
Size 125KB
SHA256 b7d84916f0a906b7c490003279663bc1cff0fb5c213fe99bd1158f23b11821dc
MD5 41f09e115a166b1a923d2357b6c9e9a8
SHA1 35e41745fbd64c1a1b50e624a27be7da327539cd
SHA512 f338f845cd35d4f70b9f3aa763445d6f2f77ae84d95b694b1d29e94472754a37f0e834631a47009193188f76c64150becb395f46228fc0f75d0a89c2fd6c33e3
SSDEEP 1536:p9wo10wLMG0p1uFRoKNtRtXIWm/vitzs/hNhX/2Blzyw:p3VV0p1uFKUvtHm/vi65rX/w1yw
TLSH
T16CC343038ACD635D0F1782623E3A5057ABDE168E69B05F1139ED39E873AD55CC3A18EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PipeList.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\PipeList.txt
Size 2KB
SHA256 4d2ce9a75f6d3de4b566eb527edb0c96e33c69ce29ac46b07979afedd3c33f1f
MD5 358c34e6b1aed34e2637d3d1c76318b0
SHA1 0b4b93dbc0a6a23a86a1ec2ba90ff7e66f8f8650
SHA512 65d8069f0d259fa528cd03853fc61301603f00dfa55309acba075d7f992a20eb2411c5fa78ce9af2de175d1ca653a40176bb44ca96e997e8264d6ab82492650f
TLSH
T15B51DD662B5C226807BFC34B65836931C464E4840043E876778EBFD96FF4E856BCE108
MD5 SHA1 SHA512 TLSH

Submit Download

PortsInfo.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\PortsInfo.txt
Size 130B
SHA256 b3df50444861630240f4ab67d33416c8f57bdf8633dabd1b5a6eb5c562eae929
MD5 a71e5ba84c784766d47d761327386b8f
SHA1 639bd53c2cf68b2f8d6645711f7d326d56db4bcf
SHA512 8f07bef220ced52b2a4ae121ce1f51426891bdb7e400873ee136d50e28d514393b6d38711a999a6a80e2431892d7d88845fdcd56ded86e5987dceea55003e4dc
TLSH
T100C01212020071CD64190601415DCC80E859006F1E0D1019704C9A4003F032D1D55804
MD5 SHA1 SHA512 TLSH

Submit Download

ProcDetailsInfo.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\ProcDetailsInfo.txt
Size 60KB
SHA256 f8852fba2834851b4727153196184c18106ef918f80af63fc71ab54afbf6ef2b
MD5 539e07cd695c18af390ac516aef21434
SHA1 d4467ba61a1fdb2f408d0f2a6117b9ebc634ce2f
SHA512 a53f73161ea851459525fdce04c4c50b20f05e18840889e2f134724b6bab19b9a61e3eb00310572e4395056ce4bd94e59044055ed7b4d0514c1be81a17acaa41
SSDEEP 384:vh1PbVbtV13tBxVhlzRILnmzXM48dh1PbVbtV13tBxVhlzRB:qLnmzXM4o
TLSH
T12653F755C8788DE7528C693B7ABD4B839352829B0C293C01BB5CC14C5F9D23EA5B37DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcInfo.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\ProcInfo.txt
Size 4KB
SHA256 8a1a0aa722a2c4531cd09bb8283b12b04ec59f9b93c58719c1c267a1c3582bce
MD5 2cca377e9d3ed2c18020f4d7bf709905
SHA1 ca41135f9c5f5c2d8adfcc18779a694b1dd1cbc6
SHA512 f8074d8d47508c363229c36834628a233ee083e3b0fb442e157c461a72d64bb5f8bb41697bc920ff418548bace96ab3509570e79d0a04a0b6492fc3cab26e88f
SSDEEP 24:cCTFCdJgkF0U0qa0n35x1KgPrJURy8sUA9Al7bym6kvQv7IQvXkf8RHVg+P9Z:cCA/Z3/PdN8sUA9AVbUkvsEsXkknnlZ
TLSH
T1D3A16B19720E61B9D515DF7B02B026095BBB8212A0A764F4B4F97CD86C4842CD4EFBBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemInfo.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\SystemInfo.txt
Size 2KB
SHA256 6e912e7dbfa237f2ce26d21df1df2d70a82384b01b08d9d6cb2aff207bc24ea5
MD5 215edaa30c4945ad6889f06926856af5
SHA1 393a075ddb9aeae20903fb4ee5d3a7ba22b59fae
SHA512 e516baea915d361b200415b2879bfcccdfe91aacebeb538165c05d2e4f8cc79d4b09b9b9b85efe3a9a0c79955db4e806a82d83fa5eca0e7cfa4cac70e5b7545f
TLSH
T1C05188B94254B0703D5EC1553353DB01F4B595C766E5423430DC46445FFA398E3E5A2D
MD5 SHA1 SHA512 TLSH

Submit Download

TCPvCon.txt

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\TCPvCon.txt
Size 4KB
SHA256 f0d1d361ab846162edc32111b6d2edad1fd5343551a4701769823026e6e97fc8
MD5 cebf1bca936cbe822636dbe21c92e61f
SHA1 77ab0795c13af84ad5271077f25ead692295fe0d
SHA512 5750c32df338e87edf44622402ecb4f6a6c3bbff9d339d1402a5686d433f24e8564120283ca48078f5df65fe5a227e25d6a885f564c7cd543867adca15ef9f6c
SSDEEP 48:80y3NyXn0y3uzEv9LzEv990y3+0y3Zy3Ny39y3My3pmmmmmmmmmKKKKKmEy3AeN5:DAt0hB3gggnWFUUUA
TLSH
T1D08197CDB333AD0F885F2093E13F8829ED7E45D973C67188E50884589D2D69DC764E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TaskList.csv

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Grhzdfjn_2026-08-13_17-03-21\tools\TaskList.csv
Size 9KB
SHA256 58283a3f75ecd066dd5984e521be2e0b52595cbd4236cdf0aa7d327e85f34a85
MD5 4a92b2d791c53989e644fec8f4a1d0d8
SHA1 ec1793cf1309a937ff81952bdd3346f8e23f69d9
SHA512 bee8955d99289cc93eda169c10b6d0bcda81ff4eb693fed8fa29579f426d72aa9662a19d1e9e36b8dbd088ed7281de992fe45adda52cbf0a8514206bf3d40818
SSDEEP 192:zAbl1Bg38HX+DZbRiZbtmYI5UlH2mRTSg0OghAcT/jTUkJD:Etg3ASlRihoM1nRmkg3Yk
TLSH
T19F12391E41D6CBF20BE7F862DF41E30F519DE92062D36A9FA6C6521EB0E091C9437686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vcmreawj.43n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vcmreawj.43n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

handle64.exe

Path C:\Users\Admin\AppData\Local\Temp\handle64.exe
Size 406KB
SHA256 24bafcc570cc9bbb6b6e6652a57a519e0464e3996891aaba6f55299cce20b04f
MD5 89f845fc4898f2d47a3a81f0b57c60f1
SHA1 b04a2347a0f94e87215424d816f9912c7bc248d5
SHA512 50bc14c4221ad984c3aa98327ee9127f7470a9a2b0a953544440a7b05f60f7f91209a96bd87d0d8f1e05551863dd43193f7f4231f382d6ad75d9f0a245939f04
SSDEEP 6144:MjRme/IYVCQ45De1/8GzfaD3f7oxakAuXeh3ohaYLCAyI5ub:MN9rVY5C1lq7oFpuoIGi
TLSH
T12A948E05F7E400E9E5B7A6348D758546DA727C594B30D6AF23A4866E1F33BC08E39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/7624-2618-0x0000000004F80000-0x0000000004FA2000-memory.dmp

Download

memory/7624-2619-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/7624-2675-0x0000000006D30000-0x0000000006DC6000-memory.dmp

Download

memory/7624-2600-0x0000000002510000-0x0000000002546000-memory.dmp

Download

memory/7624-2678-0x0000000007390000-0x000000000794A000-memory.dmp

Download

memory/7624-2677-0x0000000006290000-0x00000000062B2000-memory.dmp

Download

memory/7624-2676-0x0000000006240000-0x000000000625A000-memory.dmp

Download

memory/7624-2621-0x0000000005860000-0x0000000005BBB000-memory.dmp

Download

memory/7624-2634-0x0000000005D60000-0x0000000005D7E000-memory.dmp

Download

memory/7624-2620-0x00000000057F0000-0x0000000005856000-memory.dmp

Download

memory/7624-2635-0x0000000005DF0000-0x0000000005E3C000-memory.dmp

Download

memory/7648-2610-0x00000000059A0000-0x0000000005FEA000-memory.dmp

Download

memory/7648-2680-0x000000006FAB0000-0x000000006FAFC000-memory.dmp

Download

memory/7648-2715-0x00000000080C0000-0x000000000873C000-memory.dmp

Download

memory/7648-2679-0x0000000007700000-0x0000000007736000-memory.dmp

Download

memory/7648-2687-0x0000000006D20000-0x0000000006D40000-memory.dmp

Download

memory/7648-2690-0x0000000007940000-0x00000000079E3000-memory.dmp

Download

memory/7648-2716-0x0000000007AF0000-0x0000000007AFA000-memory.dmp

Download

memory/7648-2718-0x0000000007C90000-0x0000000007CA1000-memory.dmp

Download