2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
Size 7.5MB
Sample260814-e2fctsvcka
SHA256 2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229
MD5 9755fc54ec2ad265b59950640ced7f7d
SHA1 50bb628c5e25fea08197b1c9292bcb1d96dface7
SHA512 7c086942488d2743789a1dea359640e3e991741d3fa3369de88fd046f030636bfa451d0a914c9faa75fb877a818b57d6bbefa89c7d0b231f53668edb5b1b74cf
SSDEEP 98304:zQPq9FVyI7rFde1HwlUJiM/ftZ15xbNwOjcETFP2bT1QA4Ts8Ch/Y7iY:zdre1Q0//weiQA46h/YGY
TLSH
T136869D01FB8644E9C0BAC470861647335A7578DA1B31BAFF42D482792F76AE05F3C76A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	handle64.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	handle64.exe

Executes dropped EXE 9 IoCs

pid	Process
3552	pslist.exe
5228	handle.exe
4460	autorunsc.exe
4752	handle64.exe
2184	Listdlls.exe
3136	Listdlls64.exe
5752	PsService.exe
356	pipelist.exe
4900	tcpvcon.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Recycle.Bin\S-1-5-~1\desktop.ini	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
File created	C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
File created	C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
File created	C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Recycle.Bin\S-1-5-21-189034102-168398478-1159367937-1000\desktop.ini	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Recycle.Bin\S-1-5-21-189034102-168398478-1159367937-1000\desktop.ini	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	handle64.exe
File opened (read-only)	\??\H:	handle64.exe
File opened (read-only)	\??\U:	handle64.exe
File opened (read-only)	\??\V:	handle64.exe
File opened (read-only)	\??\X:	handle64.exe
File opened (read-only)	\??\Z:	handle64.exe
File opened (read-only)	\??\O:	handle64.exe
File opened (read-only)	\??\Y:	handle64.exe
File opened (read-only)	\??\F:	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
File opened (read-only)	\??\I:	handle64.exe
File opened (read-only)	\??\K:	handle64.exe
File opened (read-only)	\??\L:	handle64.exe
File opened (read-only)	\??\N:	handle64.exe
File opened (read-only)	\??\Q:	handle64.exe
File opened (read-only)	\??\S:	handle64.exe
File opened (read-only)	\??\W:	handle64.exe
File opened (read-only)	\??\B:	handle64.exe
File opened (read-only)	\??\D:	handle64.exe
File opened (read-only)	\??\G:	handle64.exe
File opened (read-only)	\??\J:	handle64.exe
File opened (read-only)	\??\M:	handle64.exe
File opened (read-only)	\??\P:	handle64.exe
File opened (read-only)	\??\R:	handle64.exe
File opened (read-only)	\??\T:	handle64.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2436	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5848	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pslist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	handle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autorunsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Listdlls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PsService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pipelist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcpvcon.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
292	netstat.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
292	netstat.exe
6084	ipconfig.exe
4800	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
6012	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
3552	pslist.exe
4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
3552	pslist.exe
4460	autorunsc.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4752	handle64.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	autorunsc.exe
Token: SeImpersonatePrivilege	4460	autorunsc.exe
Token: SeSecurityPrivilege	4460	autorunsc.exe
Token: SeDebugPrivilege	4460	autorunsc.exe
Token: SeBackupPrivilege	4460	autorunsc.exe
Token: SeDebugPrivilege	4752	handle64.exe
Token: SeDebugPrivilege	4752	handle64.exe
Token: SeLoadDriverPrivilege	4752	handle64.exe
Token: SeRestorePrivilege	4460	autorunsc.exe
Token: SeDebugPrivilege	3136	Listdlls64.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeIncreaseQuotaPrivilege	5848	powershell.exe
Token: SeSecurityPrivilege	5848	powershell.exe
Token: SeTakeOwnershipPrivilege	5848	powershell.exe
Token: SeLoadDriverPrivilege	5848	powershell.exe
Token: SeSystemProfilePrivilege	5848	powershell.exe
Token: SeSystemtimePrivilege	5848	powershell.exe
Token: SeProfSingleProcessPrivilege	5848	powershell.exe
Token: SeIncBasePriorityPrivilege	5848	powershell.exe
Token: SeCreatePagefilePrivilege	5848	powershell.exe
Token: SeBackupPrivilege	5848	powershell.exe
Token: SeRestorePrivilege	5848	powershell.exe
Token: SeShutdownPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeSystemEnvironmentPrivilege	5848	powershell.exe
Token: SeRemoteShutdownPrivilege	5848	powershell.exe
Token: SeUndockPrivilege	5848	powershell.exe
Token: SeManageVolumePrivilege	5848	powershell.exe
Token: 33	5848	powershell.exe
Token: 34	5848	powershell.exe
Token: 35	5848	powershell.exe
Token: 36	5848	powershell.exe
Token: SeDebugPrivilege	4900	tcpvcon.exe
Token: SeDebugPrivilege	2436	tasklist.exe
Token: SeDebugPrivilege	292	netstat.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 292	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	90
PID 4108 wrote to memory of 6012	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	91
PID 4108 wrote to memory of 3552	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	92
PID 4108 wrote to memory of 5228	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	93
PID 4108 wrote to memory of 4460	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	94
PID 4108 wrote to memory of 1412	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	95
PID 4108 wrote to memory of 6084	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	96
PID 5228 wrote to memory of 4752	5228	handle.exe	97
PID 1412 wrote to memory of 3560	1412	net.exe	98
PID 4108 wrote to memory of 2184	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	99
PID 2184 wrote to memory of 3136	2184	Listdlls.exe	101
PID 4108 wrote to memory of 5848	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	102
PID 4108 wrote to memory of 4800	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	103
PID 4108 wrote to memory of 5752	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	104
PID 4108 wrote to memory of 356	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	105
PID 4108 wrote to memory of 4900	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	106
PID 4108 wrote to memory of 2436	4108	2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe	107

C:\Users\Admin\AppData\Local\Temp\2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe
"C:\Users\Admin\AppData\Local\Temp\2c850bfd99155f6ac5bcf05fffe6963bf5ee8c06fce3ecf52ea65cef40ab4229.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\system32\netstat.exe
  "netstat.exe" -anob
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:292
- C:\Windows\system32\systeminfo.exe
  "systeminfo.exe"
  2⤵
  - Gathers system information
  PID:6012
- C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\pslist.exe
  "Aralez_Pexwevza_2026-08-14_05-26-04\tools\pslist.exe" /accepteula
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\handle.exe
  "Aralez_Pexwevza_2026-08-14_05-26-04\tools\handle.exe" /accepteula /a /nobanner
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Users\Admin\AppData\Local\Temp\handle64.exe
    "Aralez_Pexwevza_2026-08-14_05-26-04\tools\handle.exe" /accepteula /a /nobanner
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\autorunsc.exe
  "Aralez_Pexwevza_2026-08-14_05-26-04\tools\autorunsc.exe" -nobanner -c /accepteula
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\system32\net.exe
  "net.exe" share
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    PID:3560
- C:\Windows\system32\ipconfig.exe
  "ipconfig.exe" /all
  2⤵
  - Gathers network information
  PID:6084
- C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\Listdlls.exe
  "Aralez_Pexwevza_2026-08-14_05-26-04\tools\Listdlls.exe" /accepteula
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\Listdlls64.exe
    "Aralez_Pexwevza_2026-08-14_05-26-04\tools\Listdlls.exe" /accepteula
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command Get-ComputerInfo
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5848
- C:\Windows\system32\ipconfig.exe
  "ipconfig.exe" /displaydns
  2⤵
  - Gathers network information
  PID:4800
- C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\PsService.exe
  "Aralez_Pexwevza_2026-08-14_05-26-04\tools\PsService.exe" /accepteula query
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5752
- C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\pipelist.exe
  "Aralez_Pexwevza_2026-08-14_05-26-04\tools\pipelist.exe" /accepteula
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:356
- C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\tcpvcon.exe
  "Aralez_Pexwevza_2026-08-14_05-26-04\tools\tcpvcon.exe" /accepteula -a
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\system32\tasklist.exe
  "tasklist.exe" /v /fo csv
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.aralez.log

Path C:\Users\Admin\AppData\Local\Temp\.aralez.log
Size 4KB
SHA256 19d180d5108cb7528024d69c56e6639e648a4d1a107d3bc5c3cdfd1315096a23
MD5 96dc060158e5d82209c8535967043c52
SHA1 c8246b2e2207849e59646d8405a4f6bc365b1edd
SHA512 553c32973baedd9257666aeebe3d9e48acf94ed66f86e0b3f036b038d755e9c0588cf1c4111e28a423fa1b00b8c2d996ae6ef426f076b6e804071d1ea61010fc
SSDEEP 96:ohjbuHA2KgchcwuOciB4AwWASIA5JEIA5JEfAMJEAAhJEQAfg1rUCri8s4UTs4iL:M+Lqnhzq8YgJBeJCrJtiJN51QC+T8
TLSH
T1CEA11B22BCEDACF2CD2BB089C55EAFD19290F16703D26E086B951D5DECACD6114BB00D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$Boot

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Boot
Size 8KB
SHA256 4620f04445758567e665d01ae37ea494d288d3dcd5e9b6e2741dc32d4ad718e8
MD5 6c50d23beb21bd0bf88ed9b2da55c66d
SHA1 77dd9c72b9e3273afda4d27485d2d072408962b3
SHA512 5899365e7fe6334deee9eff1f98a92c8b7fcd5b8a0850981e420c6a6cd69536033bb520d3b262f47608d7f62fa9f23422bccfbb99e509a7b31d8c7ceb00dc4f8
SSDEEP 96:vmaNcdCmGUyH52j0V6nPt4ihC/U8remKrQUqjfyJB7y4AIwVoouE:/2d/5yHEj3Pt4ihCvresUDBm4lwV
TLSH
T19EF1B4F72C02290DD0C26779DF4DDC666CB7ACD4AA7087B4A190B93A254178066BFFB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000D000000011946499EA0DB

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Extend\$Deleted\000D000000011946499EA0DB
Size 83KB
SHA256 9fd239fc357fceb207dc38525fb89d6f355c3d1fed63be5a47f3a47f38f7e84d
MD5 69d54f4e06dd33640e37284692250622
SHA1 501134a2297201c39731e5020ae28b783f00cf84
SHA512 0480be446ea7cb9f8332e0fce3fae8a4dff628fe4025d077fdb3f9c4e19ada68448691494ef6f609b39477f298630fb2cca7bb25ea0ec80fb8a422c7e42a5233
SSDEEP 768:jkEGr9DAbzWuZ4BLYOOmGA55Wpm1ylsLBHJyFUCgVbF2m+el:jkFmbzW04nJyFU5VH
TLSH
T13783AB243AF58625F2F39A725EF1D6999671FC529D128B0F2181734E0931E01E8A7F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$Tops

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Extend\$RmMetadata\$TxfLog\$Tops
Size 100B
SHA256 c97be3a2ddef881765ec9e9d2f6980998d99760cfb9dff39d5928f30ea656e8a
MD5 2aac302712dda154f1132db840689c9c
SHA1 a740ba90c295e09ac1b6bd6750de13d0480af287
SHA512 4b8c85ec6ca6cd5c756ee138832a08b127659b26fe98d70a1a09071f48f9a997d9ce195b6f8f55b71c3c52e6b0e6bb075ea997ed01b65a3dd58b32e84395e2b9
TLSH
T1EDB002413421D90DC02281B51CD4D2F5E4613C549F094013704AB72D5D35B001016450
MD5 SHA1 SHA512 TLSH

Submit Download

$TxfLog.blf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf
Size 64KB
SHA256 ec83871e747b5eb34d361f2743dc64c147c2716ac5e857006d3e09b1acc710fb
MD5 ae1c438488b43b086f1053c7bdc5b162
SHA1 5d229e3fc5cc9389271fdb98017f59ddb7838b5f
SHA512 7e53ab5c44c78467a22058e7ce9feefae73dbf58ddc2b5eeab4c82a060e71887542e933286063e1591aee2bbf196f8b475f229bb1b879b01f478a20491ebd0e9
SSDEEP 96:m5tTtuDI/Fiw0NCaYO+PffCmlunL5t2tbDj/FW0NCaYP+PfICGn:mzmFb2l0WDb
TLSH
T18353A2A4BAB1282DE559D2B394FF61A37335DF2149CA420D6031DB3A6D71A8F123CF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$TxfLogContainer00000000000000000007

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000007
Size 10.0MB
SHA256 160a235da57a786a3bd46c626040d801b17facd1c7fd77a3faa65a291dc7cf69
MD5 175ba3e34f42862ac88eb92c9b7bf97c
SHA1 1a7205473586d58ae7418259555b662323bf1e4b
SHA512 2be51a4a32dabc5fa2819f2249697d01a8850fb1488f7c52bd6cf45877e256360c10dd4d20d297f32d37af692ba0d669c7778284c2134eda4c9ac738695db430
SSDEEP 24576:kDBpIDrT0nnf01HNnTTTTTuvIZmr1rKuswV:km0nnswrKuswV
TLSH
T1DDB6791457E40B1AF2F60F38A8F353567A36F896EE418B8E004792591E73B60D9B4F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$TxfLogContainer00000000000000000010

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000010
Size 10.0MB
SHA256 ecdcb15997a891dfcaa49692c4d011e181d486b8a0fbd87b110139593b5552e9
MD5 e367fcb09394f960c25a36c515faf6e6
SHA1 6fb41428db3766faf9069041d6a21e684e71e65f
SHA512 38c13478846c850919d9b9996e754a76921e800d629b200caadea5a97c66c138c5f7d9e9ffd8a71add2650ac1c69e4ba702d57a55609acd10c2f1b8ebee74111
SSDEEP 24576:2VotznDLcJzWQtPpz2mkZZSbbCbb9ADnWQOb/N6YjC:3tznDXQbbCbbWDnWQOb/u
TLSH
T126B6CC1467E40716F2F24F34E8F763667A36F89AAE419B8E004753580DA3B60D9B4F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\$Recycle.Bin\S-1-5-21-189034102-168398478-1159367937-1000\desktop.ini
Size 129B
SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
MD5 a526b9e7c716b3489d8cc062fbce4005
SHA1 2df502a944ff721241be20a9e449d2acd07e0312
SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
TLSH
T169B09B0A41476664B05ED15DAC60E147117D547A4D14A2008EF0B345D1A33550778D69
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Size 174B
SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
MD5 7f1698bab066b764a314a589d338daae
SHA1 524abe4db03afef220a2cc96bf0428fd1b704342
SHA512 4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
TLSH
T119C08C38D2E9322141728D33BCB4A002DBB1F8212C1BCF9E06C0918B08A0A09EB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 b7279d1110e0c1f86354c5f69f9bd1763d0df4a15fdcdad929546a7efa0a6ccf
MD5 92d835481f633cdf9e257f31ae9e5102
SHA1 4054aed985ccaa5ec6f6be19ea1f5d4638d6b8b2
SHA512 2f6c5df7d07d12d6638e3c6903747e18b7b84065ed973d6da5cab30d2967b0eb2a87106439ca2a9218243d27d8ba56c2ba0e896a180a45ea60d11dd32f1a658b
SSDEEP 96:bhtdFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqD:bLgH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T1DD24EE4E5F343722CDBD913668E744A35C7CF03F8B5366DA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOVEDI~1.DOC.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\MOVEDI~1.DOC.enc
Size 409KB
SHA256 1abaa765290d42e48eb1887f2577dc1fd3326d80955c6b220b6dab098175461f
MD5 f12b4e28837f1a048a18b35aba5fd3e9
SHA1 d6623413a1fcd20504ff85a0855036a68e2da61d
SHA512 b5d85de8cb26c9019b68e67f35abf8b82a6b4a93c9329386879e6856426120e6a1f3af0fe971b6948579d64881b5245eb21f5d271342f199d1844b86e3405395
SSDEEP 12288:CTKp2Vo4doykM9F+wUAXXn4BVqeAxyULyJsglJ7oCF:gCCo4lUAXXngEHxymLgrz
TLSH
T1C794232CF59628FEAA37E014148C39DEE4541375F1FAAA724EE3684E286CD507D33672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectUndo.xlsx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\ConnectUndo.xlsx.lnk
Size 636B
SHA256 e48964bbff370539ffcc764151f007c29ab746ae5be30155bd006643d3e2c950
MD5 3a10fed38134aba7a50b80e9fc6c3337
SHA1 c1ed9286d886d21a236e44950b0040ef4295f0bc
SHA512 59e2f29efb01bdbc27faa67b8c0deb8eaca68d326eca12eef8230b1b154e318f684ebabe512bee6ec07c8de5ad9a1ba596dd7acd849b82c2d21fd11599e40981
TLSH
T14CF08B0A05AB2F26CB7647BB463942A1E635AC00DF74DB494040A07E18AAF118428F3F
MD5 SHA1 SHA512 TLSH

Submit Download

DenySkip.xlsx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DenySkip.xlsx.lnk
Size 621B
SHA256 1a28357852d06f64a3a8a2730846fcf990dcb510993b0643070e7a0170097d4b
MD5 0d577e57bca1f88bab7f885270a32d5b
SHA1 0c35ad0a1202ff5d33aea395c7f9e0a10f461f23
SHA512 df5f3039e040f33bab9ffc1bebb06d9dac033d565549a6f19652905ed109d8ebeca02433d554a94fcbedee1b1c4f6e6e968cd556f4397cabc822c1463f9eacdf
TLSH
T1F3F08B46258F2F16C37247BA56795262B239AC00DBB097098461E0AD2C9EE12C064E29
MD5 SHA1 SHA512 TLSH

Submit Download

LockOpen.docx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LockOpen.docx.lnk
Size 621B
SHA256 b006782a348ec3260d522fe6320172d696f1e9047c72ba992f3070ddd901071f
MD5 385e01926a5b26c251f6623b18104d4e
SHA1 e1f1cff65116a83991b63bf343f1587e8dea7a15
SHA512 39076894c3e2018c704cbf05b3786e03e880780142652d7ab8c8b5c708dea24449035034d86cf2c3490960ede88faf75236b975babe52825b0051c812f4de51e
TLSH
T1EAF08B0621AB3F07C76646BB033A42A4EAB5BC00DAE5A70941C190791C78B519858F6E
MD5 SHA1 SHA512 TLSH

Submit Download

NewWrite.docx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NewWrite.docx.lnk
Size 631B
SHA256 2ac159597a8886f91b1ed7dbf48f47b8f743592f79e92b5c8e590e3f73e48e94
MD5 17c5224af2428fd217fe1ca4ea06f64a
SHA1 f331ce0c9af79f406f619443bec3fe7fa8a2d08b
SHA512 47f07c205a280e9b51ec9772a5f13890849c8092f5a59bc6bbef3f32582635787f79dbc634a7124472f886a4d362fc144657e381cc5294d572ce29f3a82afe85
TLSH
T119F08B0212EB3F06D7A709B605266361A9B1FC23E974B70D861164AD0928E159A58F2D
MD5 SHA1 SHA512 TLSH

Submit Download

RevokeRegister.docx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RevokeRegister.docx.lnk
Size 661B
SHA256 afa24e4b3c1d53e47c1b6b16abec4aaecdebd66602bd907ca23174bfef8dec65
MD5 6c8d2dfb5c6a15dd4c8dde37084692ee
SHA1 093f19cd2eabf0c5f9e1046b1be45c96939912d5
SHA512 21f3aadb6bff98935157954eb1d9313219bb7dcc89911d0a496af6ba6dcda8aa0a126956250034cf217fba610113ed14cbe1b1b276381f4c0195b19054088ace
TLSH
T1A5014C0508EB3B0BE7A709B702359251DA71FC11FD24A70D460060B94569E15FD69E2A
MD5 SHA1 SHA512 TLSH

Submit Download

UnblockLimit.docx.lnk

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\UnblockLimit.docx.lnk
Size 641B
SHA256 d84038ba5e2d94ad269148ad9cec20acf475e294afb26332dc876c6664050066
MD5 34518735e14a4280e7398f2adbea6522
SHA1 253ec3050dc326997688c68ed77fdb97c566cbc3
SHA512 6916cf5eaa91d0314f754241625d194f5cc9d1bfa9b8b50f3b4fa566e766df9d62a7b7dc86a1fcf802ed32d06560f5c3dc18f5d3d99f41be4efba1391128cdf2
TLSH
T18FF08106547B3F0BC29642BB05150295DB76EC01EED09B1A5050D06D58B9E519858F7F
MD5 SHA1 SHA512 TLSH

Submit Download

MoveDisconnect.doc.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\MoveDisconnect.doc.enc
Size 409KB
SHA256 7d2946c3cc65cc8f52b0af1b6514a12125400ca4cef5964a07a8d1169a1fb213
MD5 92e518ead256226a7e7b963d001cdd2a
SHA1 5199c6f9b58981a8713c6b1bf5c7a9d6c52db5c0
SHA512 0f49c33ce221ba3e7bf39bfbe39d22119006ce918dacb954defc9c50cdcfe70a32b6dfdb3876d14aa98dd8cb7c0ecb8090479f8b057e107c8193f3ce4f674aa2
SSDEEP 12288:RyTUFMASJlp/f0AdMJkqXGpGW4PSziGnWvu:Ry0hSJDzMzMGW4KiGWm
TLSH
T1469423AF7812E20980C5EE627752F73688846543F708EDB0AB92875D544973EBFCD827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TESTMO~1.DOC.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\TESTMO~1.DOC.enc
Size 1.1MB
SHA256 cdf0bf2d07ee86aa71321ee14f75090bc54330f20616bca708349788ab7fdb50
MD5 9aec35e940637e488d4de9b45df240a4
SHA1 c6b0fd23605f6bf210bbbd11de231c6b14e7b6b7
SHA512 20272b0720564ef0c37359340c1bca65687fd62fbe69ec8b824b8cc26696199163e0517d0b60ddc8c4c3ed4ff7c5e228f2861a264340df0321b0efda9d38bf75
SSDEEP 24576:H0gXrUabL+XivL7ekFZeApTzgI04WBwY+Rq7C/:U8bL+XinekFZeG24WyDF
TLSH
T1134533C06957A0B504B02C866B29F7F8C41EDF60F8C99C6746A0A79DD3748F9C1F689B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestMount.docx.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\TestMount.docx.enc
Size 1.1MB
SHA256 1316c9eb56ba67d02000772974ce137a33d6216297d887a31d337d703e8a437d
MD5 6da7e482d655aacd7c6c3c4b28e7cc7a
SHA1 0468ccad1b2389409c226e83b08dacd28cc59429
SHA512 28c727ba7d5249ba84d60ab1db7b25f5b49b83149a380c2ebf92c6cd0e5aaba232578f15b74cf8a2f3b066cd80d28620319c5c90c1d6ab65b6502ea31497cc79
SSDEEP 24576:g7sAG+uGGWBmlyccmtAUqp/5wBBVmuTaLRf75kZ1B:0UKfcRtBql5w/t+d7yHB
TLSH
T160453376246FCC2955F5B422A061435A885B3F228F392D7D23EF5D1E49E3140B89CFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitDeny.ps1.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\AppData\Roaming\WaitDeny.ps1.enc
Size 551KB
SHA256 21d7e63b0edb4a93af929dcc7a515b3179f82ab62111111a1587a68bae3a0a98
MD5 1bb0e53ff804026ca5355545b5db1372
SHA1 40317a85fd5955aa092a53fc44b1fc4777006e46
SHA512 186751a471e48c2b537e0f0cf9d544f6f678c5f1ebd61d4638586c20b69427c4c2086cea0b8c03476cac3c20ff5c65a519f9f6afcaa90eef7daefdde9ec76049
SSDEEP 12288:x2ewh1z/B85r+IGzDnMPqPSvPva6qJ32cuZrn:x2ewhBB85r+IiACsrn
TLSH
T10EC423B1AB0959E0C7833303477555D7621B23989D255C9B6BB638FC3BBED6ACB013A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CONNEC~1.XLS.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\CONNEC~1.XLS.enc
Size 9KB
SHA256 a3f457e13f9f57215b099225153e061791efdc20b5fde020189755526b679542
MD5 f1b0be5b72666c5d509343bb08384e9c
SHA1 fb03d5aec92bddc52904afc28403a66cb00af614
SHA512 ad37c0398ad6594539e6f4091e75cd9c430b31d45f7738ddfb94df6703374eba9ae1af43b3cb63560c5eb7a2d2a52171024678061267005e475a4f42f6616c73
SSDEEP 192:4OpsCA31RDsGCQ+ajyVDBZMEt32nNtBw0UUc4hQb9xFB3:hpsCc1aGCRlvMEtmNtBrFhir3
TLSH
T19222AE31107B8564AEFDD4B6E494033D440E2890D618CA85DFC75B71DE023A74B27C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectUndo.xlsx.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\ConnectUndo.xlsx.enc
Size 9KB
SHA256 d03f6947619450834aaae8d3514a0fe7486954b4f8af45c21e5360b2b065b273
MD5 a221ec226ed6bbe231d9f914bc64c4db
SHA1 882c3618868118a7ecdd573efc5fb6f81e4b92c2
SHA512 dfd690e5b48532bf2e9578114d357c6d1fcd3dffbc8bb93ddf676a53724e7ceefdf751d0756148db2c34b7369796dc92262e096b863ca9e90cda5fad21e7a34b
SSDEEP 192:Oiwxdv/A/IJDzMgJXOtvvFzXTUFYspN/+6wcnJi9qoi2aN5HkdlJ:OiN/IJDztXOt1zDrs+6Lw9qoiN5EPJ
TLSH
T13722B0E52E413211895A61C8366F19F77D260FC812BB5863D319F60CB74122BEFAD5B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DENYSK~1.XLS.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\DENYSK~1.XLS.enc
Size 11KB
SHA256 1fab2de237ca40cf6aa99792d058bc06735b6b7b8d61df5e8f8d8cb67a546c17
MD5 ede2f11a6e86a75360b94177b856f2cc
SHA1 51c79dae309b4adf71e2cc1876f4c1340b65b8bf
SHA512 0d108817c9032bbaf4e4bed43834a3961f32b2fa04033511ae0112f863a6bb3f9439589b77a08c3e802ecd3145410cfccd8ef887cf9d703c7bd262adcd6691a8
SSDEEP 192:DV55AfFFtZtRsxLqMBlGKuJOjJQLM8QRv93fhieVIx2rJ:DFA3tO5nlGRJO1hieWE
TLSH
T1FE42BF5BCC61C844EADA0FB21362DC354AF7040AE6265361217383F81AA7B5A73CF4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenySkip.xlsx.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\DenySkip.xlsx.enc
Size 11KB
SHA256 b6ba65f519aecca92062dcee31ce6b883d90c8181033dd34494a71fad664b82c
MD5 f80379d9a2ced44ecb40aba4c04e46a9
SHA1 05bee6091d3209cc932ddd6d2a00546581256b0f
SHA512 00ce770fe5c3ac7870d321f86c6266c33a433a00a3d2e64ad7a6be7affe08ad8c1ef07ed8a80b405f4c54842244555a05a04a4c1a4a4116a267586293462fa67
SSDEEP 192:cgr77JmefjCRmERMEzGGradJoIS1SqnVwxAlDVE4suwnoYqvQUdHCBwhylTQHSE1:cg9tfjWmERMEg0nVw4Z3pwn/q4+ZhATq
TLSH
T19142C0310A8553DF1FAA4FF03D718258E40E658D8F3BEF92E5E51908944C53192170FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOCKAS~1.XLS.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\LOCKAS~1.XLS.enc
Size 514KB
SHA256 20ff4779903c5f7c3bdf1d548b907d4765316cb686530bf0833f5e83d608f0b4
MD5 d4fb33b07b13d6db9c74aa2dfa3a8cd9
SHA1 baf7dd0d61fb38b876d3ed49f34e3eaa5385abf2
SHA512 8bd385549f8b9de23ecbc25986b16c146a7d31f7b03f2919e46f12c0ca9c96631cad2a08768b4eb4567adc9dc5ca71565a623138207854690ef9e1604d046da0
SSDEEP 12288:Om1b9SY9np3FQg9KH9+jAXlj/Dedq2BBK2qIJi:T1b9SY9np3FNjAXl7DOJjJi
TLSH
T144B423409D69621FD42E08483233A9C4ED4C9290A630D2BE6F6F23A19D67FF515EFE47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOCKOP~1.DOC.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\LOCKOP~1.DOC.enc
Size 15KB
SHA256 5484a69b226dd08f665b0dce53e1f57c3a450a19b62bd42651518701c1e03879
MD5 7b5e6cda5093171351c987433094c7c1
SHA1 759325afb96971a6895d71558151ddc29b402169
SHA512 b60fd26387f3efa717b254b13a1ec759f8b757daa014e3e03330cdec222523379234b8ad23fc8c18b01533bd161fe85ad98edf12cfb510b0b6da95deca1f97be
SSDEEP 384:NWAIqCxpZ7nG/u1dCym0qX19lQ7reJeXui9K2cnZUNRxyIGIZ/ENNReYulf:IAIqCxp5nQ7yBqF9e2U59KVsRZGIqNRi
TLSH
T10562D19D31223C736A662F39E5C418EECA35DE753318A5B805763F0D3A4E5202E6BD02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockAssert.xlsx.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\LockAssert.xlsx.enc
Size 514KB
SHA256 2c2da280900c789f415ec8226bea7a689c3cf637c187bf4edc04fa348a11b2d9
MD5 43e00a35b01f0a5f2113cb719bcf00ff
SHA1 f0bb573c8e27f04735ba717edf0cb80a76ffa6d5
SHA512 2886e261ac728ce092baccfbc044f60f05122a749c9a8559508312918273affd4744380390c4ae19f9483ca12b506b8708483d4701ace4d608b1050567882390
SSDEEP 12288:EfmXKPm2HtkM7rR+to1/5V4sGPWwNgHIm+xIVYysfmA4:E+aPmkt9Ht5V4sLdzC/D4
TLSH
T1A4B4236A3A1C648F6487CC7E82BEF47425C5827C43EB8E58633B5309F9B911C43DDA98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockOpen.docx.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\LockOpen.docx.enc
Size 15KB
SHA256 cdce82bd8f8c1a786bb7f3b27760e765ea330d851e089ea31c3626d9a38a12b3
MD5 8a9e64fff6e8949adb44a477cd3f52ac
SHA1 4dd2cc77ad7fd8dfe6fd41dd6f58541a503eff24
SHA512 09b7e7d9fd6b5815e96f99d16f16bbb7bd820df3fd46588e76d1951fed6f26375a5c465ef036d50f1d78dd30cd4e2c6acd76282c2a153dd39146e65a740b5f6f
SSDEEP 384:CpHtXwVJkmzGVoOUj2ZlShtd8GddMJqnzoiDyqO:CypzGVoOUj8MtuGd0q8cyh
TLSH
T17E62BF416675FD0249FB01CAE6BFCDF4AEF11AEA4848B7A00C95D199DD632D50EA2383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UNBLOC~1.DOC.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\UNBLOC~1.DOC.enc
Size 15KB
SHA256 e5dbacebbeae04e7e696a6a525e8948e0349be193cc85ca2db7d65f61bc9c9cf
MD5 8ef4821c1ac520df59ee4a073489547b
SHA1 a9e588bf9ed6fe8fcc3a6ff58876709445776e6b
SHA512 531206347e2d8a042760042fc7340462d2d0a2bd842e9b79fe9deff7b2a59446441471981ad9040759f353c3370f1a9e976ee832c21a93d3c9108afa16724b1d
SSDEEP 384:XlDVCEOQTCB5vrgcTHY9mNQni4d/I56KSTuKyZYZq:XlxC4QscLYlfd/USTdyZmq
TLSH
T15272D09B08D1E7EC094CB72346B0EB355854DCA8310869BAB72DD52F5462CC278673AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockLimit.docx.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Desktop\UnblockLimit.docx.enc
Size 15KB
SHA256 facb5322e409fdc50210c395b542d675e00e90f856b85655523feb7faedb148e
MD5 a4195d76a4656e1a552ec04e6a4af87f
SHA1 e9c92e806eb5914c198b534cb6a18134b4de3664
SHA512 2f369b778d08540f0ede8f864ec28aba1d09a4e0492f51a505a0548762c146f9d895b8acfb8e0f9864b4d712629174f4f232b3d469943bb400aee63a92bbe2d0
SSDEEP 384:IwVRC+Vy7SqYicT3wChsX1jmjqyPiPv7LueiQPh85CTdQSlyGs:I6RCO3hs6qiiPPuLOh84EGs
TLSH
T1B372C073B32ED6D6B919236EC02BAED12146185CFCA731277193DD9C9015E8CFDAE520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTAL~1.JS.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Downloads\INSTAL~1.JS.enc
Size 267KB
SHA256 d2012860c2dcb6968e4f9b2aa84d1287c81657be6d3efc984aa30afc3f022bd6
MD5 cd56e86a97a368ecfab90d96be02e667
SHA1 dd27f1049afa85736375a5bd4044a252f3f631a4
SHA512 09a4469e13d4b13b00521cb00c0acc1e4af0b05bee62512be126dd861c7613b666a27657f48fd497359a277b06505065c686777ef47ae67f492bbeded971f19f
SSDEEP 6144:mknkaDovUWMcPi3qpdC5juZcdcefdNQqCOH3WWzLNi6jHumXPF4NozkPB:1nk/MQvGaOcecq2WsIhPCoQp
TLSH
T1C34423CDEE5C39487883EAC0012B62C7BA5DB7671B2D241BAA76D7E11594DAFD104383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallResolve.js.enc

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\Downloads\InstallResolve.js.enc
Size 267KB
SHA256 4a034818a68ab176e8f22a829382c24b978a41e80505ebd46fecdf26c012ea5b
MD5 c489a84529bd00b1c567ea14730a0b6f
SHA1 b72dcbeb179b49150bd2e32230a73d630c478802
SHA512 53ff237891715ee3bdfa3b398a2546ddba534d4d3e89f56f2e0b563a30e56d64c41ef5d7b2b70d96fe86a9fd78ac11d46a9e98127fc7ace338b3a85f67d83619
SSDEEP 6144:QYikgf976JoJ51vvFX5eoDBOxCan2o5FgQpzUhzm3rzXi4U:QOgF+eJxXhwxCan2sgOzUzm9U
TLSH
T18344234D23E11FA937E5AB5CDEA449482EF7D5C006FFA282E97CB16DC873D091B01A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTUSER.DAT

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Admin\NTUSER.DAT
Size 1.8MB
SHA256 4b619d72d65ef643b6e0866599e4ec33d24df6c51e6fb69748e7da3c543c9f82
MD5 13dd34476f8697706a9743457344c015
SHA1 5fdaf224fb05c85622c522495a845ce80556fef9
SHA512 0ccae96fdbff1ceb2457c2f6e8e24c8a281761cfd869efcd9e63e205fbd19cf938813c38424ecd14e08b3e17fb8e4af0fe0c1fade5974fc88af55873bf7f1f2a
SSDEEP 12288:9G7L7o4R97147Qd0u86CJdYt327pRuE6QEdYsdUlsi6KedY7Hfsahcxu6dJdYuPi:moVQJ86Cs86QYk6Kvfsa76df0a
TLSH
T18F85B558F966D492E361C6364DA25B9737F37F832D084D0321CD2B9E0C7F1269889EAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTUSER.DAT

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Users\Default\NTUSER.DAT
Size 256KB
SHA256 337c7ecc3119878ba4215f23cf89421a0ffc0f129e4888ce78d7435bc4696817
MD5 e9f54e44ab434f094d7c7bc6b009514b
SHA1 6b1d7fdaab3c193550983145c0c26ac39ae72eef
SHA512 811b40a7d5715c8a69aca01177bf38eeb73a7f1e0c75822e54942b40f7472a5d717daeb14e890157cb948c5075e1b657c013a1a3180291c27371a21dec29d0a4
SSDEEP 1536:11zlGc6PeTYH1nf/DzHLgKy9CZJ9/3Ks8O+1KoA:NGc6PqYxfHbLJ9/W
TLSH
T164440E41BB90D6D1D1B349329CE6DF966737FC51AE12834733803B2F8DFAA469E12681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1LZOYW.EXE-3FE71C36.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\1LZOYW.EXE-3FE71C36.pf
Size 3KB
SHA256 2f17727c97701c4a466d3b8c392ebcf76a348d356012ee526d8d4810ff3363a4
MD5 485ee4e14b1faca963c83fcca381f4da
SHA1 e684ceab689f4035d629927b0cd477fe45417535
SHA512 3d924c9a983ea9c259ea23d745819040a4dadec1aa3cc80e765d13aefbed7e5682f838f2280f773a56a7f6ee2e1c5c8cdeca1f39ae64dd7b41f69881e2769077
TLSH
T1F5815C8B5CFDEFAACC1C04B8CF4962E957655460049C7D8454F7A511C8BF4693D11FD2
MD5 SHA1 SHA512 TLSH

Submit Download

APPLICATIONFRAMEHOST.EXE-CCEEF759.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\APPLICATIONFRAMEHOST.EXE-CCEEF759.pf
Size 17KB
SHA256 8709896d79c169a7f5f95567154fcd9ab57e2952b2e0a4880b6bee50a3bb2057
MD5 4cf052ce80e1bc0118efd537ac08d9a9
SHA1 44cc557c949207ed054da49424f91cc6a06e2588
SHA512 d0eb7702310897cade321d1f3fc1f139b8685d5e35de69e9714990d057f36a9c73f7c153107370de957f95ff1eff8e62b4c9807407ebd49c47796432c8505dc8
SSDEEP 384:BYqe+VmlV5dWrxDn9Ug2GoCV31BA3L8+Tk7ThYK6sVT:BtqdQxNVFBATkHDfl
TLSH
T18C829D76052CCBAD9A0A0473FCCAEE792DE61F15B894C18F7C6744FCAA424655EE0C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUDIODG.EXE-BDFD3029.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\AUDIODG.EXE-BDFD3029.pf
Size 5KB
SHA256 ac38a740d993e474f875d6bf7eefc579b94c767302ae03b27ddf03e5b7666a88
MD5 d607bdb5e6d3993a3a0048c2f982a21c
SHA1 921276af3e61899894a2504bc251581e620ca44d
SHA512 af6398cfd3d5c4991e5ed7ce4b34c904a6b5115b1c07bf2e146abfbdb65a40db404747cde95e8b78b8c7a24d17e92e0bc62d1630dfee054f30e516cabbe445ac
SSDEEP 96:oQ7LkNHLH7Lm21Di5jMqx1hxIqfr928CXNHaLsy73eGxViZJMnQMATeXUe/:jnk9L3ruTcP8CXdSV6SQMHN
TLSH
T18EC14DA0113A5B8C649FC0B9F1CA817E403E8F9905553F537569F2DB6FAD7D111E088E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BACKGROUNDTASKHOST.EXE-104C7847.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-104C7847.pf
Size 11KB
SHA256 b24ceb989d2b13d07a702d623451e71f54090a2184140791c71aed7e28298b0f
MD5 378b8f5121104ae14375a22d2da3534d
SHA1 b2c60397882f95aeda3243017b16854790ec57f0
SHA512 6b4b20b998b8dd797941543f46821591d803f3f3725b445319e0b1eeab8aeb711830ca019f2b14fead280a00acc99f8a712623264dd0e67e7e5694c1073d59e5
SSDEEP 192:LrkSAiPb/fovwZgXZjqkgSwda/kRXJykwL75KuD86yQuTy96uPkgxdwHlR+5YWl3:LrxAiPsvtpjV4YqPwL75KuD86yM96usu
TLSH
T137327D22643F2E481681D58FDA5F684AA111D931F272B9E30711159397CC2E276FAF8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BDEUISRV.EXE-4D0648DC.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\BDEUISRV.EXE-4D0648DC.pf
Size 4KB
SHA256 13b35987f634b7f0a41c1ba9d2945174eefb88cd1c194eede5cc1f9021bb942e
MD5 e1344d842125eb4bc6f109c0c6c3c5be
SHA1 8700d4d57f989328b50c53775b3820a1538585af
SHA512 b411f922202fa308dabd0be6ece4719bcf0a1ae15598b3b4e63243a913ef7c2e330c6166101ca0b2fb0a4cf3df60d4dde0fcfa4c2d06c443b272a1cde250d1bf
SSDEEP 96:EmXGKbmH5/4t6GOnvGgwNq4TINbkIql3Eeiw9Qcm/ptT4eKBFq+RPZn:EmXGKiH5/4ElIcg2wNiW2p94hTv
TLSH
T1B3915C04383A1BC9D945817DFB94808482374B6CC3A21E395FF497BB6F4B6BA412131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CONHOST.EXE-1F3E9D7E.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf
Size 6KB
SHA256 58c2ed3ed30254b71365f69bf2eeaa96704e98d023b539ac0460929fd5bd6483
MD5 442f1c8da5bf2f829f56c2c69eed3e8f
SHA1 e5727ce52d00ec0b4a6d7b69149b3b33ed6d4551
SHA512 a70112c5e1f3e8ab535576b9fe0f4fcf647fb4b27fd2fde1cedb3103d6161e81f3cf25a1395f33f18d1cc65c16386a2a4fbbbd9968fa74a4fe38b076766ef7a5
SSDEEP 192:sfJgPov/5vWzEk9sej1DFxxs4S5V82MR7lRq1U/n:A6P+5vf4seRDHxsFVyzR
TLSH
T1FDE18D24C3572DCC98BCEBFE08AB78A65F2096D26553DA83934C617B541CFE01AE463C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CONTROL.EXE-817F8F1D.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf
Size 10KB
SHA256 de17a122bb15d04ff23420befef9b62e3663819c65a7d69d9f8b20f173a60210
MD5 75163b97f71b0c6828942cf4b05bd11f
SHA1 9e540bd919a6212dbb5241c358c25fbfdf14baf1
SHA512 99293afb1f86aaba32f301c5ad8680f2042c5265638a6748cbf653353708761aba1ea075837d545f4bcecc06b2c954a9be07214c17c5a329f22079102fecf523
SSDEEP 192:92haL89jxcADLh4LDtgKJOqOFuRwMbv5ZE9902/JYZpI8HpRdPlM:WaL891cAHeRQqOk++v5ZEb02OZpI8JRA
TLSH
T13D225BA0B5B91E4D1B82C42CE149C8B564508223B23BF6623B143683E7CD3D272F46BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCRIPT.EXE-D1EF4768.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\CSCRIPT.EXE-D1EF4768.pf
Size 9KB
SHA256 3fc2bcdb9f64c8bd5f16d1ade62001a8e2a51f7f6f75457bd6e7c0b8cf0f8727
MD5 f15087c75b56058bebc4306cf9900fde
SHA1 f7c594d6ce93cbfb0ad0cdf424a82366e048f842
SHA512 59632aa0a42af24e90b048163975cb073e330b044eeff95ec5c9a8571cf0ed901b447df6c61ee84a5398716e8b9b4beb9e7616b22e453cdfebf845f6333d6cde
SSDEEP 192:o3mIMqdT8qzvCXEV7FHEMpWpeEfosHSkRnYkOKxtPVlmPL+cUjmw:D+dwFSREMgpnfdRYkJxgrUjB
TLSH
T14112AE22EF4A3F45B687D23DFB050B732120C225E928723BEA25C146B3C22E73534696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTFMON.EXE-9450846B.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\CTFMON.EXE-9450846B.pf
Size 11KB
SHA256 8c9dd956e5acaf56b58078882657ed37230e9664c9ca4ab4741955b8e65629fc
MD5 35e272c85ff7df6830470b5ff80ec735
SHA1 fd08ff89bebb3cf950af8d6d4d293ea8f27ffcbf
SHA512 e35ab94e152c4b50b0eea900b952081dbac95e2354aa04aa065c01c662cfcd76aded06082508a4f68a79a8338bc5761a47b466f353adf5b68b1f734ef9a7f5fa
SSDEEP 192:mgakS8mUQ2FUOJLAVkPNbfmg4eanyxTx26F2/hQlshSWT2I+q3QjLXJQphhFisaL:mC7x7JhPN9vayxTg6ShQEN8LuHis7ex
TLSH
T12A329F1165362F0459F7EA1B8BC1927BE51AB8FC52EE609FAB113A0367CF1D6F041782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DL2221~1.PF

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\DL2221~1.PF
Size 5KB
SHA256 88a63586dc780a64b942bcf45966e3508239fb880988898d7b731c2f74df3ad9
MD5 5227dbcbdd1805a81a4cabc81e5919a5
SHA1 3e5286da2da201867b310642f955ed3e820c5212
SHA512 566e40256663d1ce201d90c57721258a7b361843600c69480d15b3254f087d909812568c7357c8597a579eccff6cc02237ed1b35900b04d2fa5125383d913ffd
SSDEEP 96:mS2DaSmrotdqZKg6w5+LBKiexQ/+XwMKhHKo9hjRBIiXwfbs/LbK:luaS6otdqZNMLB8XwLvnIiXwfw/i
TLSH
T1C1B16C90D21C9C90C907B1B29BDA57267B71F10BD4DD3C41131279F6FEC2C5E114839A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DLLHOST.EXE-28A8211F.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\DLLHOST.EXE-28A8211F.pf
Size 7KB
SHA256 6dc8ff66f4cf683050618c4f440c6a8276e11781a4419b9ed7f8691080262b7f
MD5 efb0365d00ed6cc9b07c1aee0e6db6bf
SHA1 7c8d4b826208c7a14bfc9a744199505b48f03dc9
SHA512 1c8fbabd6607920425bcc876640d7eb56a03c197ce3a577cb3a48197899ab930911ecbf1e26b2f311ca87149e1ed17016bed9033bd974727ea315e94fc0d5398
SSDEEP 192:pXLng6mS/vy7Bu/RQxjd6Gm1qZzVgNxw05AHp6hoVw:5rB/a7BuqBJRz2xb5AHE
TLSH
T106F16D7156BE0D8586C3D05E824C8DABA005883205B7F2633655635FE6ED2F675B0E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DLLHOST.EXE-61F58501.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\DLLHOST.EXE-61F58501.pf
Size 2KB
SHA256 4b96a0d865f2bdd01c9727716d51ba608fcc5378e6cee9ec180941e736154109
MD5 4b16b4b718f277deedaea2f02d78fe89
SHA1 237fa43f6e75ed15a8a44bc4cca61ed5e925fcb0
SHA512 d079acf48899f582f5a546e07fd1634b18d081844f8168ea28fb8d2fefb9e46d8fabca87d3bb6d2b3fbced4cf7199a172350aee2ebe2831b41e8f990ee2f173b
TLSH
T176514DD5B9570742F4A77B39FF94808042357D7B5623522FE0B03642B606639D15B6DC
MD5 SHA1 SHA512 TLSH

Submit Download

DLLHOST.EXE-D8E67ED6.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\DLLHOST.EXE-D8E67ED6.pf
Size 4KB
SHA256 223b079766e8ba232358ec937bb6ca803c69db09b216e55801e8c8935bb2ad9e
MD5 97dfdc4c510da1d1cdf96d919c191c35
SHA1 950429f0fabf29595203ae6c61e86ce333985195
SHA512 e10d82a02b2cd8ebd393693537cc1739592eccfd508dffe6b17ad7274533f651a1c5d74eabd84c00935853e8827bd284993c9f3bb4e4edbfc4cede5023efa054
SSDEEP 96:BPYZHKFNJr/OzWKe6Kt3LxS+ow/Vu+D87F6KfU48GYMWQN:BPYZ2JmheLLx+S87gJlGPWm
TLSH
T18D912A02B4E23894A95CD57D5A4262FBD12ED121D67A8DC24FCF457B7673223A8E010C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DLLHOST.EXE-FC981FFE.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\DLLHOST.EXE-FC981FFE.pf
Size 3KB
SHA256 c00b8e786bb04629d443668ab809517bb7ec09dc0210bea868cce40502e4f7fb
MD5 db5dd6d05f315e7e0cc72811e42442cd
SHA1 f6b761565289ea669336ab397dcdc555ec32f6c6
SHA512 480ce83bdc7fa1559e3556eab94c251500a2060c189f3c0bb75263b097dec7f6ff6c95c98edacb110d5b851be388ccae0e978c7fecf0befaa22bde0955e7be99
TLSH
T1AA8149A839225FC58703E239E0CBAD3146295D2AA85784A59302F1E173BCFEDA4FC1D5
MD5 SHA1 SHA512 TLSH

Submit Download

EXPLORER.EXE-A80E4F97.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf
Size 32KB
SHA256 6fb37148ba7433f4f9790e7c6412f9c0d3645d9057189c9aa1a78ecbd6a97b38
MD5 e932bcf4a243783e3b9cf6b5fdc7e00a
SHA1 ed7a9118396dc378aaab7c5e21e432e5ed2ca2db
SHA512 038e0cdb840e5b2b3ed256077bb172cd06fe83901adb3c8df35bb5a85301a64f625370c25ff9005fe7ebef1f46520baecbdfa244f095e585311299fecedb297b
SSDEEP 768:qlxIwQp7CvsZ/5lfsWTTrj9gB/yVzkRIR5FlPin0nb:q+wFGFCZAwmRVanSb
TLSH
T1A6E2C09FD4FD1521BAE3D45634030B3A3606E029702ABB734B8BD5A3539C3E118B52BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FSQUIRT.EXE-BBD9646E.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\FSQUIRT.EXE-BBD9646E.pf
Size 7KB
SHA256 e6b2858b1adb088d69a5a96267391eea89dd6a97592af011e2b6cc2d1324a07d
MD5 dbdd26c42baf9ff6224fca64caad3d1f
SHA1 df022a71b1d6dd8fa08d61e8235fb50a71206084
SHA512 53a4863bbd884e2a272f0f2b5eaddee0e6626ca0584f8a3964d0546d9c2ca734d819307307ac052b6905edcdd3c7d515596be0da9c6e79f5930b05619614e023
SSDEEP 192:0x7Vqgoyt5UPw9vBcy0HUievSj8wVsthifLL:oN5UPOcldl8HifLL
TLSH
T166E17C372CC95E80CEF20228F5AC4A16E26C4897B9505581DDC11FBB595E6F2C332D8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOGONUI.EXE-09140401.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\LOGONUI.EXE-09140401.pf
Size 17KB
SHA256 2f48b08e06b6834b4b31fbf6c5c76a427dcc9bde3f2fe3411990c8430e308ba1
MD5 d67b94142167e6488f51265fa56d28db
SHA1 dcfd2a73ea85154f0e8fb5d031fcec910f175c23
SHA512 65d1cc5806ef9910619ae8dfadd8ec996b8e111affcfa6913ab2605214f5c5ec0c158e9b3a225c91a0d2367dca09bd27de3fa9ddeae71604fdc1cafd5c05f588
SSDEEP 384:SMkgdTtwR7qKZG10CmGgfqRULwndTDC9c+9itTDj0EPCD0pgx4:DxUcLRB+jc+9MPOiA4
TLSH
T168728D71EC72188E52C7C438F1145CA66001DA2AF4A779B3571A5AA7F7CC2F33271A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MICROSOFTEDGEUPDATE.EXE-C4317749.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\MICROSOFTEDGEUPDATE.EXE-C4317749.pf
Size 9KB
SHA256 e6d0b7bff1be82bd47494170b3dfe23e5cf64c1b326993e3d6d07b0694318f80
MD5 53e475846783a56bb8b065e6c5bee2cd
SHA1 e4d5c30c47a91a9aeaa412a37fa22dc3f19cb624
SHA512 b8f7f7e5055ab01ec2b369c572c1b05e269b4464e1e34367f357c8b04b416cae02617f3f0c0c645a39d3591ab6d213da1928b0ec7fa8ae5b7da89545517545c2
SSDEEP 192:zE1d+UmjdQBWYtM4i1lsagLkvgx2AovQow8Fii8FISgQs6RTDUab1To/:lrhQBWYOR1lspLkY0Lvw8kBjhgSTo/
TLSH
T141129E594D899F29CD3C8D253F019B9BD93BC976078CE14495EBCCC434CAC542269BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOBSYNC.EXE-C5E2284F.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf
Size 7KB
SHA256 35734cb6408833682772f309e85d2800c113674dfb70c7fd70c247a82dfd7e31
MD5 b69a5a103ad8a84cd255f40e0aa745b1
SHA1 190c2566234e4109acd896fc69c59955e51d2780
SHA512 038aa36315c2f28fbc2faa622552ef73712e86611b1ffc0fac246ef9c36e330953a0fee86228faa8c0bed53adb1838b88d0e714c43f13fbbb61171e5e35ae501
SSDEEP 192:djmU0DYddJBV4kp8yDKNMR6CnjujxpXFOTu/eoAB/:NmU0DYlvWMcKifXFIxo+
TLSH
T19BE11B91A4BD1F0C1BC3D0ADDAC974F0A403C116B35BF2A22709A6D777891523E706AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OPENWITH.EXE-5C93E816.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\OPENWITH.EXE-5C93E816.pf
Size 29KB
SHA256 6a283e1f4a37556d4c64a37fa0ca19ef481531d064307bf88c9d7b086991c253
MD5 8c540df498552f73870d9837590cf661
SHA1 87e43260ed58335f55c9c60e81516e54b4aa17ce
SHA512 32c73c35c51739e81a6a689500ef9f716855403622d8f903b87ff6d5d49d7d3e5166d3e2176651623f9f938e29f188581a06cc1cebc8ccb2bf8cbc4227fb4dfb
SSDEEP 768:m90Dghy/37xQglTm6pBc7xpQBJdLkHmvUqcQWK53:A4fyEclYKxqCKZ
TLSH
T145D2AF76C73DDD1766D044FBB0C4A4282131CC6FA4D8E8825F43905DA7466B274ACFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PICKERHOST.EXE-B8A68B3C.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\PICKERHOST.EXE-B8A68B3C.pf
Size 20KB
SHA256 27baa1b6608eb3fdf39f1baa47be7ac449ef6b71154039de5f2512055c37d05b
MD5 326d6cc0ef035d0b82f05d5c2fcb3b25
SHA1 670774a449161ff72470dfa583f0b42f57669c87
SHA512 083d80b8b210465bb38645e33a1f798ef61101f8d1220a099fa01bed8531626bb921012e9c71a6fc573a33b8788dc7515a2ff6b63bf9f45e137d3bade82a02d4
SSDEEP 384:5GUr+soD/3RQC11biJV5K9YjJBEqhd0BC8jHkJyVQhluhn3QKJ:5GUqsk3m29Y1D0BC8oJI00Z3lJ
TLSH
T19192B0EA49A1EBECD60F03E7666DBD6A30E9F60C14819E51EA131C3CF016E8910E35D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

POWERSHELL.EXE-920BBA2A.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf
Size 46KB
SHA256 c341b1cb4fd3af4a2fe41180112a96816e54d99563fb74cd44b1ba10393fbab5
MD5 72fda1750ec6bee850532a9c9c95e70b
SHA1 ad494eb7a60d19b8ac88fffa3ba94cd8c3126121
SHA512 e2f28d3b35f0d31d31fa13eaf93a00629eec915c727c89dd4d768916f95ae0083a9b4cdf4c0e7a712ba448107d7c29f9beeda324ed9cdc93af5bfc51d213910f
SSDEEP 768:HM+XPk2/eZdzyKhz+xTbFicBEHoI1y4kuOGfnlOf/RWXHcBOViTw//UUWhLzGlO7:b88y2JiOwy4kNIlOf8XvikEUW5Clg
TLSH
T1F323F11C43354ACAFC9241FD38890A379DA764CF64A275A1E45A397F3251E7C7C2228A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSEXEC.EXE-80F89DAE.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\PSEXEC.EXE-80F89DAE.pf
Size 6KB
SHA256 9f26d261aaa3b698a6ea66466e9b5f52aaad7b89d998f29407affab87500eee3
MD5 4b2daff36a601faa3527b1682a8c6ca2
SHA1 2720e63dd59b1edf8b90589cf63317b5d424f077
SHA512 3de95beeff84d7d60f79316d2a3f768e86195c8945c3f52d484a6e7d8f74c6ede977b4367808ee0e235bc57224dd9d0b4b7f59a2544495fe6d428516c0f8371f
SSDEEP 96:X5Ny37mb08pnF9JqpfEFDzBn7NB06RhPzyQ/6pO/0+fv9F:X5I37SBvJhFhn7HLx6ph+fv9F
TLSH
T16CE17E1A1407112CFD1C38F2ADBAC5CE4EB9EC366079223D42B25D6DB4E586A175506C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSEXESVC.EXE-7F956DAF.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\PSEXESVC.EXE-7F956DAF.pf
Size 4KB
SHA256 d2366e0bd7e45e680ed12ff6297ca01ab57980fbace8947c37587bcab6090580
MD5 ee26755cfd51bcf8faf94c063f2c7d64
SHA1 f9f0e02783622c25187450a97d80b12b95e8ccc6
SHA512 6f2ce69b17e1b375cd3e31bc893d08b662ca025d548c9a5fa78847c1c5282d765f692188c1c8710903184f625ca13488a6dc278c23ac180506005c5a6267f685
SSDEEP 96:SgGyDqXzuQf1SLSdPFKH906TiBoKr9/YHqYAuv8CDRv+:SgGyDq6Qf1SLSKH906uBPxQ5Rvtg
TLSH
T129916C4582BB7605BB6C553C0EADCE82B9818622FC75AD3D36061B6E469C2B920913B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REG.EXE-E7E8BD26.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\REG.EXE-E7E8BD26.pf
Size 1KB
SHA256 9279a8c03f0fe70c720229c91e00eef58a63dddc146ed54f3e541a0846a69864
MD5 9713264eb53fa87e81572395b0fb5d70
SHA1 0e7426f51546fd55517abfce8806dae83956406a
SHA512 c2ec029a39df20bcb3315bf7bc33a7f6c156c0246b7d1f055e1453c5bd28881c252460d9cc9e4a40bac51dd4f6c87362eec20ccc6a058abdb57469770f7fac80
TLSH
T14C31E95C32E72560EE3596B6488A03D86613CE1BDCC386BC4BFFB12818937CD48CA168
MD5 SHA1 SHA512 TLSH

Submit Download

RUNDLL32.EXE-23EA2E5B.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\RUNDLL32.EXE-23EA2E5B.pf
Size 4KB
SHA256 fd3cf772322e5712bf5d0fec06ee49b40b7e167ccf3ea75af568da9a90599b18
MD5 f3a9ac087be3b3f5d8f63cc90b495867
SHA1 257d7d5778476c08c24305a9a631ba33f4a4fbce
SHA512 5de1e053e10679526da7543dbefb274e927b7931ad2c533e3f6ebca481902a4a9b93f95232f9b2f01e81462a63d4990475ae4c3378ab043f8f92eee2d8a38e5c
SSDEEP 96:8/XUcY5CmjLwA4UKm40r1+c0E4j3PjMpHM7Q2:8/kwxA4bkRfaj/jMQ
TLSH
T1A1815DFE45C147ECD304A9FC95A5AA2BF92908332F0873D6D15C1C9A705B4386AB2D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUNTIMEBROKER.EXE-4C0446C5.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\RUNTIMEBROKER.EXE-4C0446C5.pf
Size 6KB
SHA256 bc10533e30c212456f34d28c3984cb9b1e863122db4229cdd7d1580042e7677e
MD5 73621bb21eeb8a976c33b1125f526a84
SHA1 4e9b41aa98374b3c1d9ef71da0b0e72f658f4f37
SHA512 687c3e2e2ae52e200565a5ffc9a59426118181524966c7418fcc735fffda1d5f1e0a38347cdb822cb3472afbfcfc37deb218d14433468f471284664c2c238906
SSDEEP 192:mJp7dizWKdftfXw/6PsL8y9nyeZjdUNdoMz3U:6p7dEpRy6PsAytyadUNWMrU
TLSH
T1FED14CF2B0AE1D4858DBCCE7D18A11B0B520EB1751E36265470976977B4E3A21CF48ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUNTIMEBROKER.EXE-75A37563.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\RUNTIMEBROKER.EXE-75A37563.pf
Size 17KB
SHA256 2ec044bfc44c766f9c9c935020d4e18d3633b32c73474c2931c3368f0e98d463
MD5 4875036d7cc79f08ececc11d07fda511
SHA1 9f4ba2eb53e7da11b5cd18b2f57d56437b7b73bf
SHA512 d42384b139016f13795f186868d81931ab0a26e5125a17696166771851ec317842158cd3fb2d478d79da90506347abe185203a5abd342c9ac17b09bbda23ab9d
SSDEEP 384:6hQLjWIVsz7Gf5ns5nwHhL5H6pAZj0De0x45TZk6oRYlnCpfmjLUJUU6LS:6GLaI97NHAm/PkNYxCJ9eLS
TLSH
T1F382AEB0B06A3D4E1AC2D0BEB445A7D27018C263B232FDA33B05569177CD19263B576E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUNTIMEBROKER.EXE-86343F85.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\RUNTIMEBROKER.EXE-86343F85.pf
Size 13KB
SHA256 aec2ccb51ca403d0810b6ce575b5144ab939242e2f9ed07a5f977db14fd4aced
MD5 6347387103baa1abd23f3d9e2d1ea3cb
SHA1 ec8f9206df1b4ebef9bdb8daf147756ee09bdf9c
SHA512 2cd3e9a87bec8665513b027aea95fc8b72162e4c46ebbbe5ac14838fdf0aaa4527cd360a9d6ba709e661e53915985b47fa90e2fdf9e273d2f1d3793d0ee221af
SSDEEP 384:UtAeH5veezj/UqieMhMoxwwW0kg1v1iK8gLO5yb:UtAekSdTYkgyZgfb
TLSH
T19A528D91E4AF198EDB53C83FF5422963D015C427A226F1731F066687B74C1D162B8BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUNTIMEBROKER.EXE-FC4F7215.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\RUNTIMEBROKER.EXE-FC4F7215.pf
Size 3KB
SHA256 2bf579ea24e1788d087a1fabbd9423e4eeb2e288ac05dfc1f5ebba01f79811d2
MD5 0b61c0723a9c0696f50acd18a4cecb97
SHA1 13deb1fe1fb5a6cc319e73e7defadf552deb4797
SHA512 b4272de55d86b9277a9ed6363c1aa1eb170d7f4eb042edb56d3d84a36992b8e3b91d6ed035fc713768f6c7b493cb5c21d82e3a128789d6596b5d97d366a9948b
TLSH
T1A7818E2571BE3C58CDB97B39B4B7FB594400DE08917163A1BA61A5D0AAC716272540F8
MD5 SHA1 SHA512 TLSH

Submit Download

SEARCHHOST.EXE-C45BB68D.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SEARCHHOST.EXE-C45BB68D.pf
Size 54KB
SHA256 c3d892ca64665ef39ec77ff64582d34d819ab091bdec64661a0019433361c96d
MD5 9d2e03c6d5c443cdfe786b866fc445a3
SHA1 a41789d1eac33091e7d393420ceb5dfce63be579
SHA512 864a649b8d9124f80f17c2975f5f7cf8f9cb823f74e8a570a851e7c549e5c8cd9c346af264ed63ccb3046fcbc31ba40c2ba209b2f442be93a84c716a8c58af9e
SSDEEP 1536:m+md5xu2yx81AZh88iO1fzXFZBAedR12s45uUwtmMbZzTkOwnhzeoUv:/mjxu2yx81AZ2tO1ddWs4AUyjNI1nhzs
TLSH
T1FE43D03035FF5F0E8A8BC8F9994612BD7923C939B656CAA31114F153E68847322749AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECURITYHEALTHSYSTRAY.EXE-41AD6DE1.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SECURITYHEALTHSYSTRAY.EXE-41AD6DE1.pf
Size 5KB
SHA256 152ecc1cd05ac212554788909922e5f89f35b772479b30a4892c3cd405c3ccaa
MD5 2e435be2473df87d1d7a1aee4dc05a99
SHA1 cdb2ca25df368162dd40aea840bdd87dfa36889d
SHA512 d9200c18cc6eb35e525312ba6d1c11870e7a6fdd02610175974c90aa8a370234d3c09b5885564016e7a8078524e53f13c7b3a668f7f2644e096da1f326bd0430
SSDEEP 96:HwvXF8SsP8FhAt/1VOo8RE1dXvgU+XuiH7H4rmC/6I2BH0b851ZVlmGnXnNHs:HoeSsEPAf4SXvgpIrmu2JJ5HVlz3Zs
TLSH
T1F5C15C9D715D1DE5E7B9007C788306B0163E8C6C577F81198A1BA283BACBBF9143C4AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SHUTDOWN.EXE-E7D5C9CC.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf
Size 3KB
SHA256 39571e5e877aeb8fb2d4c3b62e2e63f065e818166bf35ea2b956b7b54ced70d3
MD5 e9ab7b79913d74f2ff656d01065aa703
SHA1 3ccbb59d7b73a783122bc8d9a7e7567317bb7958
SHA512 5639ac494a8e4801ac44e52ed4437973b9ac8fc5cb8c8671ae4905d8b8c825d2a92cd763836587f4c8ddebc6aa03e2b2f6a60dbc7ed49d6230a21780e7affe55
TLSH
T1C1614A3E1617092AC1A43E36268305A0AFFBC7C587C3569530A06E114CE37F5B7E1894
MD5 SHA1 SHA512 TLSH

Submit Download

SPPSVC.EXE-B0F8131B.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SPPSVC.EXE-B0F8131B.pf
Size 7KB
SHA256 3581f360f29b956c1573d37183f9f2355dd1e59221495f7e32b0c2a595837175
MD5 e0ab9eec4ec39ad8b48f7f71b180b905
SHA1 06bb58e28753e9bea556e773dbfdc96b0cce66b8
SHA512 74e2e0f6db35667351bf5f5f7ba2f59dbb05b7919db6a999c71dfa075bbcef0ededcc76bbf7067932cfb508674d38dad1cc58172ea2df36442966524226c3af1
SSDEEP 96:hlTkswaapkyTP0ryiH6Qxc4dy3W+mPuy+0yBHmVJktqx4li2rUQcfymmrOvsv/c:hVks9SPFQGLS6BHyulO3rmrOk8
TLSH
T157F15B72D02E1D0C1A93E43EF416EEB73514866BA613B5731E1269CB1BC43E562F889F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

STARTMENUEXPERIENCEHOST.EXE-C5508DA1.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-C5508DA1.pf
Size 42KB
SHA256 c740ff51c7eee9fc242d25e699d2af2fa4a748ec1a1658289459d9d6f492bf57
MD5 c112006b469dd5d7eda501889b2f5716
SHA1 e0983ab226034941437cf1b6186cdaa7de35bdbb
SHA512 79bc1dcd7ce3298bf24fbb8f37a82f8641819b35c71916c5fc5ea10b5c3cd9c5124ec5dd423c6d8df4ed39a55979951b531413060dc062f7b6d8d5826d4250c1
SSDEEP 768:s0ZuynewVSqtBgx20zRSbhOoqFoE2jaVjLiGmXAUcPG2/Lmzzf3g0l0mC:lPnewcqtBIRFBFoDjaVHFmQUEJKzDC
TLSH
T19C13D13158976E4946D7EC3CFC9A245FA404C635B236F0D32523B15B3ACA8F516ACE2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SV163D~1.PF

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SV163D~1.PF
Size 3KB
SHA256 0fe0d00711336d20bc4982aceb9b84f594f472d528a48588efa750a6d11dc4ad
MD5 3902d33ca179b6485a2a652aca9d4deb
SHA1 6e4086a38f238c6b6e66112ee28b1c599c9fb92e
SHA512 e0c89e300ea17c4ff8e205f55d35aa76ff38664c66a2cd579cabf0f6c4356f3ca9cb082ea6ec2e9c80b3e69dae851499a874f1da8723195c26fee8361a63b426
TLSH
T1F7612B18656F5746F9CF8C7575529A89BB30EC2E9C4320CCCEB176192054D6D49F21E3
MD5 SHA1 SHA512 TLSH

Submit Download

SV36E4~1.PF

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SV36E4~1.PF
Size 4KB
SHA256 bce209ebee925916d866681e6c6417a966af41905a2efa6e5d2171e0b3be9d6a
MD5 22f07255bde560e3d55f552dc08d064a
SHA1 693e3dbe415fc3db3ad05630305305df8fb3e0b9
SHA512 b449a6c51ad671ad47ca9a39bf94f15a12078cf8d8c2f666ff6fa30e4ebf7698269fd8eebdd96e353f4a7b11c994dc6f45cbafe2eadaf447940d37d5704f4fc3
SSDEEP 96:sXkuBDt3BUEtI54Gc6ZoLuJr97BbKyviAGsdrPpr/U0Fxrx8vojU7Ioqyq+VMyTu:7uBDtRUiO4Gc6577BbhvBvDtCsjiM67y
TLSH
T16AA14DA1686D32D6D5CF597CB745E7825A820154E7155103ABF963831F80C783EEC7AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SV5C4A~1.PF

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SV5C4A~1.PF
Size 4KB
SHA256 ea0f65abe4c2612599c51d176f571a71f8b28d96ceb1a04daf341bc14bd597ea
MD5 83aeab334d5498cfccc498be509c4af0
SHA1 0a30d7de16a07d18dbd52f19ca3f4f21573d5b2e
SHA512 5dfcc579ebf557e9ecceedf446f6b50f93cd0096b77da44709924ec1f8119634cff08659c9405378e4c6e28e37f079c159ad20fc940489c235287eea470db14d
SSDEEP 96:UKl4ey1yKML5xo1ZS58iMFEtJ2Q5tCog15mFfMKP:14ey1yv1xo1yMWJ1fMKP
TLSH
T1A5815AA9D6CC7DB5C8A5813AA4C219734E258A3695F6787083D63C6B40C3F073884D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SV94C2~1.PF

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SV94C2~1.PF
Size 4KB
SHA256 a0d7fe4dce40cab4aec16c6b2b6791877d8869e8a53725523b0b77b28f77afef
MD5 f65e126a680d4d0fef29d099d1c48593
SHA1 2523a2a771bdc365fa7cdd252acb177f43099fda
SHA512 525c29e641d11637c9713f6e9459f8dd1d60de73ddbecfda390588a637303baa5f82c2b07c7e5f3181c7c6272fc4794ee83eaa7fb40c9a0af8e9a329ce0ca7a6
SSDEEP 96:m6m3ufPcl/2gpuNkETgD+EPT1G7b8rIE9F+/zZ9:m6m+U/2pNkETY+0T1GsUEP+/D
TLSH
T19D916C2C28A81B42D50AF43D90101A72C6319C7393F8785D62357DC6625C3F96E25DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVBFA5~1.PF

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SVBFA5~1.PF
Size 3KB
SHA256 8a5ddf93c20bff65d08a507b86b5f7f63b901e1f4cf221e4acbed3dd2b9ea6be
MD5 da7ed8f1cb21a764d7af143c348ba8d5
SHA1 1930f25003326da43b0a7fa849dabed4d68aab60
SHA512 516fdb76aa4b1154b9c54071065dd7e33e649e890c0c8c54017301ef7a58bcaf6a20ffc5dce54302c14f5ffd97396079890a2cb6f90111e15ebf5a1d4409ce51
TLSH
T19A511A6E149A175DCECB7AF37CCE0B50AE73D5AEB839309A51A4627E28056560180920
MD5 SHA1 SHA512 TLSH

Submit Download

SVCHOST.EXE-2F0E0AF4.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SVCHOST.EXE-2F0E0AF4.pf
Size 11KB
SHA256 067b003a9af6bea92eaa583582674b4cbbc6923a3af179335bb0230132ec9360
MD5 d61a4ae6bbab61c7f89c7079081a7770
SHA1 6daf944981ddfb3fb929b3da03222b545971334d
SHA512 db5d660b5da7ba30d1929e10ce1e7d09a52582ef03b18f7e4eaa490012707ab74f075c2ac9391f7e3b93faadb06f4d743380ba3b1c0828de9fd220b870cca4e6
SSDEEP 192:tPzdT/PHH38/ym9wCazhvWrCeVQ2lKR76H05ir5L4Zz4aqcYj3ex6JiG20n9sfyK:V9/PHX8/ZuCazhvWBlC6UEt41N9Yqx1X
TLSH
T1C0327B68E57A1F0D2BC28088F1988DA26214C837957974533F063BA373CC7A321BDB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-893DEE50.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SVCHOST.EXE-893DEE50.pf
Size 6KB
SHA256 935e326213032e8263444746b85b9790916968d5f06be2bc0045c7428a311890
MD5 55b909f22cc1952b43c4d2a59e62eef7
SHA1 329638b1d2072c1f2815bd120135ee86c39a0214
SHA512 5cc9fa4bccb6034d0a0b57e64be6ead667630677752339768108e20f9630bd04f4617bd79292f6394af57bfe4179b07bfdb26c01144ee389246e50b5057ac899
SSDEEP 96:BgQaWsZUZPmH0/jpgmrGosmT5N3ZOMU/9dFQHZVklxJmDbLwa+eMJx4xEj5akDH9:KQa9NHvmrG5m3p2Q5ClDyONJKlKH9
TLSH
T1B1D12B51217E2B1C0CD3856DE15D55B2B000E53AA5A2F3F23F18728737492DA49F5AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-96A7E1CF.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SVCHOST.EXE-96A7E1CF.pf
Size 4KB
SHA256 b442309d26219c68578b71f845a2a0b50d22a831badbe282de47cdd868fd2e81
MD5 cf5d5419b0eb58c62bd27fb2e158e906
SHA1 2685ab351d98321be63c832969e35aa91bd268e3
SHA512 47923b5bb7d347030ddba3f860918789a8eca68bd0e0a0a6b3b7a2944343ceb4bd876d59101f9fe91c66a764bf1f100bfa6c2525acb49eb09232bd5956bbb14f
SSDEEP 96:HZdt19scnp0kTfngsB4OcoP09QWTdP0oAJ07j8f4iM:5V9sWRTfgycOTWTdP3AJEUO
TLSH
T174916C85684EAFC8D0FADEBA63811B7BD2A55905E948D7213640F5B6F0CC0AD65C03E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-9F4DB6F5.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SVCHOST.EXE-9F4DB6F5.pf
Size 4KB
SHA256 34d7ccbecff872dbc4f8a9ef51598a8930e31c04e80d098821cc1d8db1e60b2a
MD5 49c3c522b9b7342fac4628a9fc1af2b8
SHA1 d47b8dcb99aeffd0930831d2a37d2b4e8309990d
SHA512 002abd874ad69c0c9864c9636726117a55cd393d4fb3061cc67b42688b2fe64d009cc72110da74a8ddb86cc0d9861506b3c38b9f7ffa2fd8302353f664d642e1
SSDEEP 96:++RSKzqQ65Us4z8CImcTqoc9EhZmEVCxTL55tDMarBxQw8Ny:zRAv5Cz8CIn2oc9AIEVC1t3oo/oy
TLSH
T14C915C443BF3F684ECEA67B0B31E0F7449966CDE225E19E25D02237A675903D85693E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-A75BCDAF.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SVCHOST.EXE-A75BCDAF.pf
Size 5KB
SHA256 1a0ae673c6b7af2a25e90c917aa22f32ab52cb061bbb9dc3ffb4957297593575
MD5 d508b98e0f445d91ba99d14beb0895d3
SHA1 aeb22acf3ffbbc5b906dc5c564a5d64b32333442
SHA512 1a438dad777eb667581b99abd558f7bd5708e2d77e0e0a31bb138858c715dbd0b501cc603f56db216805ceeaf34bf639b5d40dd3d8a753d1b2613ed98e37b6bb
SSDEEP 96:95ASoNlBcbHLSoiPWXVOtBelROvd5Kp/1clG3CKEyMcPDchV6fZdzePV5jhErXtz:XZYcbrGPWlOtElROvd5KpCoCzc7pzs5E
TLSH
T125B15D0270B37F1FF4D9EBB9C3F447676472C0B7D15A302224261AC7B09A1274D91889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-C49E779A.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SVCHOST.EXE-C49E779A.pf
Size 10KB
SHA256 8c7b589c6185c4c1ee20514eb0110cf1a5cc5c34250f2cb832283815aa193522
MD5 b95288f5f0f04475343039a74448e970
SHA1 d37553bef53a484a5a4ccc5e7c9d2e852eb64437
SHA512 eb06342eae00b81d1652727c3afb4ef32e1e275eb8587fe8f3c9559fb658da334340cd1fdf20d0a5d86030dfd167bedbfc628bdcaf0bcd3826c4e4e6a7c7d88e
SSDEEP 192:j0gGZrMb4tbudCevxr8YjMdqU2ZHwueg8Be0+Dvd7RAnZY9LqQpz/i4qH7xpvURa:g/g8tCdz5TIIU2h3rGOxIYMJ4qbxpvUw
TLSH
T152228DA2A07A0F4942C2E09B951714B1B165C732E675F573320AB257B7C83F299F981F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE-D90AFF7B.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SVCHOST.EXE-D90AFF7B.pf
Size 4KB
SHA256 9e5f4b7598f022ffd0c5ff7476af3017104d7a509609739061d5ba3835eb1329
MD5 eeba27ca31f3f9c7a61e00f9985bbe36
SHA1 65fc375ea0ddd9b45e2583d35ba3d4739192b217
SHA512 b4cc88d308b871aba703ba7b521cd02132e7d896da5314bdb6c3e41ce0f257795e266d13d674162f8327c78ba838fd04a3b1550f58cfb4443630c041de15f710
SSDEEP 96:VkwNFZAVNXJZ3cm22nvn/sFBvGwFQXukBqf4EOYw/I5Yohyz6:VHW3cm2av/0L47RoUm
TLSH
T145A16E3159BE6C49BCCBF4B0FD2782EF2822D5376A20725273316295375B8C746AC1AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SYSTEMSETTINGS.EXE-F13C32B6.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\SYSTEMSETTINGS.EXE-F13C32B6.pf
Size 55KB
SHA256 6d965dc7c857ac114cc68160d49658402f6364f213f0327f903f942d9cdf80a5
MD5 086bb7487465ec6635ddbad6aa55949d
SHA1 11f6c31bb4bdba2ac34dcd447de4007419b0cfb8
SHA512 ecaf893645c3d8426b9cc41b396ef24424e32851a4fe3a9621271190741018aa7881683ed376f1f1a5d3f72d33dda4d45e414ea6b1c48d541893d526f1c109a1
SSDEEP 768:mrm0jkX++1plr0FPY9jHeiR3mat5N6LAmK/DZzk6lnccbPhKRk8T7Nb2MrfVBKns:HDCg+E2kWy6IcEOkMhb7nKJ/AkxYx
TLSH
T1EA43CF22D4EC198D9ECBC4B9F0E64EE61025DE375024B3A36B0274CB66D96F52134B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAKEOWN.EXE-A80759AD.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\TAKEOWN.EXE-A80759AD.pf
Size 2KB
SHA256 39265752ac2d02db66d94d84e3afa42df6f03856fd7e4c78788702fd014bba5e
MD5 b509b3ffcbd16117eed4162cf41432d4
SHA1 02c094aa12ac8e4c8ff0224cc8a6492f90d563ae
SHA512 af408a8c1cab6b3b211c98a7798ef0d0d41c2b0df11296174eee06a323f5d31d3e279c370bfed40b75003370c9ca48b3fc141d1343d18eff36998a989db6208d
TLSH
T130411A9D45832A4AEEC4D073316BA546A739E94DFA6A9ECC60083D1AC5D0C8FC504160
MD5 SHA1 SHA512 TLSH

Submit Download

TASKHOSTW.EXE-3E0B74C8.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf
Size 4KB
SHA256 90bc7a0bae95f69e6e44e59b27ce947e089ae100de6ceae34cc707d85c8bba96
MD5 2a4276e0d114d9e84af7c6c01182efe8
SHA1 a7d5731490dde269abc4fc08320ff1f731a8e665
SHA512 5c7c6cfe58a01cd29718ff7e34389361cc71d733141205a9df0096b8f5a57f838ae127a70b7b7d6ab1af81a84d674049beca29f3527bf32ca9c6ec0d82522472
SSDEEP 96:6UtKdmomZmUH0t+fG95T76eWzZaa39p6bzXg8xH8OZJr:6UtK8oMmSyN7tWoHlxHzN
TLSH
T1C4A16D7C8E2F7A48BAC335BCD1F40B7004327711A18A6232540AB806A73D9E112E6196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TASKKILL.EXE-8F5B2253.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\TASKKILL.EXE-8F5B2253.pf
Size 4KB
SHA256 3985719b2e1e88c9c34371c42737e746e385dbf27cf4232a26dbd7ce924705fa
MD5 8e9dbecba2a119affd4292bc4ebe7e13
SHA1 fbcff466ab90b3c762f17974b18280445e5756f4
SHA512 f69a3f2ff802868509ee9ea13bae53fb1a90d262dffbd09c14fb37895d006093c8af6fb8149d7a4c5bd57b5a3ad5c9b62e4fb2d00efc2bd998a30b77a3e1c2a1
SSDEEP 96:3YsAzo0gJiEodmJdu0LNyUs6rd6hy4gCdq0Vjl5o6xJDY4ty/PN:L309EomLbL4Us6p6hHFdq0Zl5oG9yXN
TLSH
T133A16E2A3FD96602D9C67A34AB050EF2943985F3DD2275C34B42C613E84AF46CA617F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USEROOBEBROKER.EXE-D2992F42.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\USEROOBEBROKER.EXE-D2992F42.pf
Size 4KB
SHA256 bd8b313f831771b39f342107ed4cb8b55008d9f461265d7d981bf35e25395f11
MD5 fc6046bcf555c5093c35ea75fe04076b
SHA1 df11a9e6ea980bbe94ff2740036709c69e762271
SHA512 52f957ac8b9b89c60ed9b050f1e87d7551932351eac30f1a96233f8948f59ddb47d8167e6b53b4a26192edb1d44a058dbb355a10bf7498f1c11606c0c9edc1f9
SSDEEP 96:tEB0vGCbQAMZl/xM2Yl9WTiZPFPC4Bsx4jgpRh2y+4:+slb9MFM/lZPFC4BgpWD4
TLSH
T151A16D326DFA97C4D6D2A077F740B7A4520061DC811639461FE1BA071FCAFC186A95BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WLRMDR.EXE-C2B47318.pf

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf
Size 6KB
SHA256 075110bd659b973a9a65a1c6cd666c509d614f9e6c482c16a8df1c880774a434
MD5 dcbdcfd349976b118ec66144644f2412
SHA1 22ba070ac3efc5f65ad1237ca05cc980d17c9d5a
SHA512 78f14082e3cb2da55260ffd033c47fafb46fba01742f448c9485ac71e8c4c2dcb9a8e4992d96fe3fa6592f9a6a8d4844cfc560872b3cdba9779eb1a9448109e3
SSDEEP 192:Bimx90YZVQ4uWZFyhFjZFT838FPSfYPT6ymfenLZ:BB24AjZC38FkyDN
TLSH
T121E18E30F0892F0D8E9B44BC95679AF3821DA60A5454F551830ED317EAC97AB6EC069D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CimFSUnionFS-Filter.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\LogFiles\WMI\CimFSUnionFS-Filter.etl
Size 16KB
SHA256 bd3c9475efd71730be218b226be7e239b790bf9b34eec038c813bdb9672c7398
MD5 f83188cf6a5538936e0202e16cebb33a
SHA1 4f8f4cd57ebcb02add510d110db1cb8eeeba0e31
SHA512 2d3d06965432edc649d868d1b5dd778f40934d41a6a5d57afd2d2b691bcf05ec453c0110128cc383cfbc3051abc90e1bd5bff69757205577417dc2c7bcdb7e64
SSDEEP 192:mIa1gWrVEREUtO/X7sqKqAqeqkIFx0Vqdq5hTQ6za:m99TR1JY8
TLSH
T180729A79E7522888C5FA4472BD8FF6242871CDAF0E559F02054C35CD293339E9AE1BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaceTelManually.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\LogFiles\WMI\FaceTelManually.etl
Size 16KB
SHA256 795e9cf40e0569a6d671c3b48c62a8237554cb7558985feef33748b1f6091c03
MD5 eb3e4df69c5fc9bc45f3c27a2bff20d5
SHA1 9e496c07cdf0483a75c2e2c8d4a497998cb71011
SHA512 ea244dcf691d3e40b8c7a9ec92f0263cd8f45e6a335fe655e3b6d523b90b389b0d4d62120425284d45eb6e947f6449ebd7d54588605824d3e0110f0250c672be
SSDEEP 384:y+0zPuMhurVu+Pu39miuYPmWuYk15eu4GnzEMHzQABMuYU0uYoJuYswymFGgA8sk:9YTC/jDY3k
TLSH
T19572BCD6D64C426EC82152346C1F6BA15853AD43050BA63902CB7F75F87FCFADB226B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaceUnlockManually.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\LogFiles\WMI\FaceUnlockManually.etl
Size 320KB
SHA256 f9bf40d68f2b075141d590afd876ae5d0feec76e27cee02b6cf78799d7a6961e
MD5 29dc4bb837ead0ec5c3ea4b109cdc615
SHA1 fa61e7479044f0834d471ea76d04fcd80b83fe31
SHA512 7789c22b2afaa39dfcf8196c4f5df8f91ce7472a250b3ef81dfe8d4b5009083ddf4bee7ece5c13a604a344bea57472639b61afd40d85ba786fc46b8af43beff3
SSDEEP 1536:dv3X0FN1XldJT/RpGi9kbLZKsSO6uDSc0kzgxiFwRxEMZhyH:tBZKsSO19
TLSH
T11F6422F5445C1859DC6D28B8FC2B1FA559932D8705814E364BC2BB39ECFFCEA9E00998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LwtNetLog.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\LogFiles\WMI\LwtNetLog.etl
Size 192KB
SHA256 f685baee5c0bd85775d294b3c1409b3f744b72277bff945ae79e96baf3ba0824
MD5 aa9792a6cffd76602c341c32ac03b465
SHA1 0391a7e91d49c02439dd6b37c8a9fd24d97dbadc
SHA512 4dcc73a4bc2d2fbe490e4fe5cb318c965212b48e7ceb0b21aabf753db20a3d6801597d0ff78af2f7d6d577926950c72047647bf58095b36941ade29033135c49
SSDEEP 192:tpcXOtPMVCiq1SHjXhg8LohDYLmKHZpz/yyLdX/6qQsxMxElv+Bdt7ZRkWeribkC:tD1AJKDqHZB/yopMxhDZEOb41H8eWEc
TLSH
T186145E617A1A81E1D917B172C4128FDD76F1BD9003B08127E7607A3FEFB6796F892908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetCore.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\LogFiles\WMI\NetCore.etl
Size 22.0MB
SHA256 afa5fb145f94b8e9f41195b5c76c0570e725aaefbbc5b74f63f641c906718b7c
MD5 c6fa8d78bbe28a658f72755978ac91ac
SHA1 8de7117f213136a61479eda0a091803efd34555a
SHA512 0959b888e10e144cb441be0af05c3116a9356f7562df2f1838219a2fda273d36e839ad3aa2a9fcd43365d7294ecadcae851be5ed361e273b6fecf155f2892706
SSDEEP 12288:vNHc7nIaLl+dQpsr66PuPA8q1GMm9C/mrwF6QaDkpdxXTwkxlHr7tfgEw3IgxdD:vNHc7nIaLl+dssraq1M4L76U
TLSH
T17F37B83DA318B62AFAAD107219B6173308351D6F3311C9AF474DB6399C73B81AD0769E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RadioMgr.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\LogFiles\WMI\RadioMgr.etl
Size 6.0MB
SHA256 3317319d6cd4c413b0c3a495c717922f3fec83c6502649ae4db8d99a54dc2b82
MD5 74e63de93792c5a39219cce15ecd3809
SHA1 66349c251626eed4b3f59384a8a9db0c0a062efa
SHA512 7409220be9c7a9886c71791ac4db589148b2d0000686513ac58c391d8c28f92b11f34b6e768f07040ec33382aabd58a7b840b87717c63a2d44db0cd2973904ed
SSDEEP 6:cfUBB/QIosMcln8MclCoUll97cyI9m3n+SkyGkRkJ+lr8KlvyITDc5X:cfUnQIDncCnlX4yI92+Uc+prlyIv4
TLSH
T1EF56CD129BED42ABF171C735FC77910433327C18A7024B6F0E8432B90D71B549522F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFSLog.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\LogFiles\WMI\ReFSLog.etl
Size 4KB
SHA256 333dcd47681d15b617b2fdc0510921a8ff22cd15bd8a4cc027d98123da49548b
MD5 b6b69a7a98b8bf6eb82354f0cd77cd79
SHA1 77682b490549f7f359f9bc98e4429e078609ff6d
SHA512 9a2e828fad9310216627cd4d815f26dd24297c75e33ee2526e448013ca89502919e0d7f0df400e73409ff0bee6180d8f9be723d3cfa129a804bf53f9d29e8b5e
TLSH
T1828186116BE557AFF1658739F87251002331AC2C9B064B5E0A0835B91C747649562711
MD5 SHA1 SHA512 TLSH

Submit Download

Wifi.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\LogFiles\WMI\Wifi.etl
Size 400KB
SHA256 7a214a509f89c7fe93ee3ff9dd690649fb957f48b3434fbd6752b8776a8c3b59
MD5 196be7863f6fd2584f7a7ed5a306f34d
SHA1 f4024dd8028cf6625bf9c5b63d2bb83d158b5b3b
SHA512 c5af441ee44fcfd75c31aa414546a4660c0c0b7042eb2350db2c150536f0461e7d425a0f97770fd46e52085e46ac64e303f8bd0760f3b47c1c1c294c27f1a465
SSDEEP 3072:/jsFlnkNo2QPVeD+XoT2Yn3mTBLH9IkczmkNd32ybz:4ts
TLSH
T11F94ACEEDF585568C4391033681EBB0140632ECB1F25BDFB25457EB8D9B7BE188049EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootPerfDiagLogger.etl

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\WDI\LogFiles\BootPerfDiagLogger.etl
Size 19.7MB
SHA256 b35acd8f8173fd023b906576ccccf95c9a61a8a96564e13dc7cd9aa7f55184e2
MD5 e11b0da11aebc16bd033b6fd8f9b3d3c
SHA1 1086e7e319d2126031791767b7dc612e3fccc0ed
SHA512 2d2335a3108862a5b51c74a7e82221dd5add2d5ddea585d2863f41e83a9c644c04eb43d0818ee4c29c7a99074725a3286cec21560e5418b9dc9c11b43869eed6
SSDEEP 393216:LEkmk5yushan5mX7wNBSTH6oE9K3vALXTp5bSZO:LEgUhanlU34XTp5bSZO
TLSH
T1CD271224F9005FA7D4E88BF450E756357AF29C9BEEE26101D87A72B60EF17229C93D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEFAULT

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\config\DEFAULT
Size 2.2MB
SHA256 b5008aa8c56da2531f9118f1ca561dcaefa498629a4cdd8b6b094cb278484a2f
MD5 123b1e6c32f2a12cefbeb265f73d7492
SHA1 bdf702513f467205d3b6e8a8fb866624d27622f1
SHA512 5c320f933ec3675002a751487992c74bd8104e15b7d8efc698a73fdd248c7cfc5dad21f2771620b72a42ea8ad7d46e7b4b41aa39cf25242532829da885be05b0
SSDEEP 12288:CCZJCp6OFaKrirT5aAv8X8YjAJdY16+Y91NG:NOd8BYcO6H
TLSH
T16AB5CF257B99E748F2B386315C31C3A0662EFC96EDB0834F7A44F74D9C3A4158D62E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SAM

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\config\SAM
Size 64KB
SHA256 c819294c735d2164e543d1a41979964f6f217d1b255677cfc130461430ab4ffb
MD5 9396342487948dd342208c1f9cd73452
SHA1 475c49f3843df5076d3f5060a4a8fcc3c50553b7
SHA512 e5019b9e0da83d9b04921db2bf958b9cd91c1dc27611e138d9fea09550652c1088ae880bcde683a5807b9281419d0928822010e13b99d2c095a0559e4051b3dc
SSDEEP 768:XLQVr/mznjPYraFp/NVYBiKmraSX3zZa:XJSa
TLSH
T1B2537B41B684C686D4B60B31CCB79BA07776FC929F76830B3305232D5EB5B919E9270B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SECURITY

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\config\SECURITY
Size 32KB
SHA256 3ea4c957794fc93a3269a428149a5606c7ef658a218365534d10f39622fc6d3a
MD5 536de0aabd981f499861a3925738a808
SHA1 cca784935074c1af7f6c513f98058ceec65f4518
SHA512 a59f06c93b8b09bf33da14277e95112b3e125c5283599fdda8594ea144037483f222433fe2c51f9e2fef343aa8646bebfa32bd0ef3e5cca63a22b9b00e09e3d1
SSDEEP 192:/XdyNBsGYanldVDlKX9iz7th6JGs68NzhLvmlq+ppsnI2:/XfaDhlKX9iz7f6Jw8N9vesnI
TLSH
T1BDE21112FA00C2CBC06546328C67CBE97766BC169E5643033B45332F6EFE7A2AE57149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SYSTEM

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\config\SYSTEM
Size 10.2MB
SHA256 b8cdbfd260812b302a0faf2c6b82a7c55074ff0e58bac82e1d74880b7282334f
MD5 61c009651323b6045ae7fb4c5aa97478
SHA1 7ccb4b5172d95b48a6a93650aced092295ca430a
SHA512 5b11507e7f7225af90f1412016199e3b1ec54382aed13fc3938d84dd6126ea94d81e6fd758f90ac46534c82458c85f93632f987b8b112e5d37287e0fea26aaed
SSDEEP 98304:+o/6EMdICchc75ma/g/qsSlVVC27WdjHUK:cw
TLSH
T108B6FC01BFD4D6C0F1A64A329CB6CF855A36BD52AD215A0F3794330F8DFAB81E913616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Application.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Application.evtx
Size 1.1MB
SHA256 7e9faf188e9111e2608a391a1c147edbb632088eaeca5ce34a7dd2e23df1b973
MD5 ce01cba6c422683f70d4ce020697e554
SHA1 a2ffe94b906909f6ccbef146587d27c95fbf50e4
SHA512 0b3ecc9f66c242adf771a2c5b1beac4b6eb695270cf513277b36c1bbcb540cf969a37343e21488dd7e669792634fbb3153f3220310a14b0db5badf47f6df9da2
SSDEEP 3072:B3Ccsctsey+nBpfrPxAvcUPcEUsWKBGv9+agrZP/cic5cTIcpcOcxc3c:B3vsey+g/W2+C
TLSH
T11435FC15AAF42166E0B38B34E4F342076B36BB112E31CE4FA290538D1C52D5D6F99BDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Key Management Service.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Key Management Service.evtx
Size 68KB
SHA256 f5f9e97a6b1ec8d46a9bd5b9d4ccae96521b85517b0337b248814d2e974a968b
MD5 1f83dae35478669aef357fe90594264a
SHA1 c70bfff0a559af8cb76ad80a504dd55bd6cc484d
SHA512 94cee3ba110b815812fbb1339e54cf4b7b2942b0145315019d2a5acee75a90326a6bb0e74388ff5545afe23f85856c1404bf35698b5bdd6fdfe2be6645ce84d5
SSDEEP 3:MgAWl1l0c5MfaltpRTtPl2tVRl/l:Mk8IMijRM
TLSH
T16563020476099812D1080A3944878B81BF70FD501F7A9753A960363CCD753421952F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Client-Licensing-Platform%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx
Size 68KB
SHA256 8bc1edc008a06f76369e2659cdcf1532227742edc7007c7105390d90e0567261
MD5 49d1b80f7f4848fc2ce2e62176c0f390
SHA1 ec4237a30aeec36251b4cb642903e8271c6e2405
SHA512 f2763728425bd83e7e7b51b7c9d2b26a173bc0e239e94b2e9cec3601061fa1fda592ed57593ee401ff0ac964448db832317c9f4aa33c7ac72d4eb69ccd6c0da5
SSDEEP 384:Uzfhv2uYtHSRlNRob5ShIeJqlDOHgi+ngUb:Kp6JSRVQeJqlDOATb
TLSH
T1EC6337020BED541CF1FB5B70B97A41792A22FD35AB10DA2F706473AD5871F118FA0B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AAD%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-AAD%4Operational.evtx
Size 68KB
SHA256 00a94400c8383f3be99e9c4963e7a73ee8797acb23f4646ffbbda0b30e35bd92
MD5 a6253554078835e469de3ff4c3f49658
SHA1 ea572792153219edfd0b48f63661b56c27a0bc00
SHA512 410c3d9c7155d3b49a6d056aa0050267e7db0608a87ec061a8933f85161a4b2dd6715d233a3d31433e7369b05458b62a175571df2e0107a929e892f8454593a9
SSDEEP 384:lFhhK6G4LRKgiKnt47K1KDkC3CPCfCeCICFb3CFmxCDVNCDefCtXqCFudCD2JCDN:rVG4LVt4T
TLSH
T18F6321285BFE1669F4F3CF7985B20A411CBABD556E40AD8F10B052980923E61EC74F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppLocker%4MSI and Script.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx
Size 68KB
SHA256 18828aa80f9f742eed350ae770f2944890425d319a1d71b290eaac2117c9427b
MD5 9cb0c3e01b644dc42c31c182a4b1b1e9
SHA1 83d33010b907de7a3c18d420e7755070b0565bab
SHA512 0dff32d757ef4748ec0fe17e630de155af645fa9164eb0b519a43ca40ba9a30e3836ea37ffc698ff07dd72b848b89f25728491f2cd6f88c7d0278c2b6d216efd
SSDEEP 768:DgeGn9rt9I6p4utrmtkvpzp1pg6fFYu9meq:Uea9kgHFu6fFYu
TLSH
T16D630F107BF44225F1F24B7DCAF31B11AE3AFD65ABA26A8E0014F2551C16D618F60FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx
Size 1.0MB
SHA256 69d600c206d5bb60cbe0c10b2fcc4d63013c6b10c262e98054eec1f855a3b1ba
MD5 d4309b29f6544196a76c062022bf6088
SHA1 9d43e2a5e19d17f7d0f260044f1cefbc17709ca1
SHA512 2a12cbf2777f97c9670cf1ee5de5696e8850ff815545fea9f1a55005be339689bfe9fba396666bef911fe6ef09497ce08b3bf7a19c19ce2299a79bda1c174e3c
SSDEEP 1536:g6sb4OUVAQUOR6tI3d7xluqfO8gngWU26Qe:3ge
TLSH
T14F25AC013AF80624E2E28B3585F35B25597BF8A98E51DE9F0120A19D4C1BF759E30FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppModel-Runtime%4Admin.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.FileSlack
Size 896KB
SHA256 03cdeacb6a286652f8b3a2e4a6d6a3f81d4952762eb12b1659338722c7ab4a5b
MD5 76e581e76c804d6a4362a79bc4c91d81
SHA1 f49f55989cb390794d120a97beb60563de5512b3
SHA512 9470930cfb14096ce4eff16518508965236e0377e0d871cbf81fe60122e0ac966ced4caf6612b5e5564b8f127b4733ed6ed5d4476f4e3edd28d4c1f3e9cee94b
SSDEEP 3:RRD:LD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft-Windows-AppReadiness%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx
Size 1.1MB
SHA256 fa8cd44b24a8cf1142243c8e3ea9f219b5dcf6dc991b3d77a19998b9969943de
MD5 720571b9141faf5aaba1aa9d1a1cd73e
SHA1 646b2df1790870d8a2a74049e1fd43ae420e271b
SHA512 cff4f0208f667e2b7f2704c6a936313f817b9d9f66378c8e5cb8a1662e3673ec3f069874103a8c7f57ce1a874bd4ba220ba4a82d11ecde06ee34cbec343d3a47
SSDEEP 768:oIGt+ZqeBxkwULuefHY/kz3HKNZJMf+z3:wpWUjfHY/kz3Lf+z3
TLSH
T1753557102EF12530E1F34F3EC2F31B19A67AB8651E525E8F0190A2A85D57562DE70FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppReadiness%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx
Size 68KB
SHA256 b14f7298a21c5818a304261bb30ccf3ddfd30535e46b6948abcaafdff4b335e2
MD5 c212cce6c03cd6129349aa0f79c69715
SHA1 4f804d97f3fea33d3438acdc2fff32a166e4ce0d
SHA512 951a6c100380c9b689aec02a2e4399fea2fd2d15b06b4ba4074fedc9d1e9a73bb462c581def9a68b194ab501d98ac96f1fe090d561ee047847f5239bc9252cf1
SSDEEP 384:8DheILI1jIUeIiTIiSIisIOIicIiOI7IgI0IicIJcIitIgzISIUIinI+IiSIGIi1:+eC
TLSH
T177638B062EE52424E1F38F3EC5F31B19657FB8540D829E8F1084B2A81D56962DE70FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppXDeployment%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx
Size 68KB
SHA256 89cfb7099f07461f9a3e62f430c16bd41a66c956eaa357db6c231cb04928b0d2
MD5 602b54ec2d334da8fa5dc3ea6a341687
SHA1 efb1c662f600f686aedbc02f4f9b84f4c09e8e6a
SHA512 35bde8de4b0944439c9ae1a26264501486fa2149ac1b95e95a7d45f452cf18b697e8e3a651165e1c32f614d9c56a7c41ef8900bc778078b2b49a71d599713904
SSDEEP 384:XdhLVjVjv8BD1cpJVI61Vl+UVBAD1cpMVl+mVfVl+8V4Vl+nVaVl+TVenVl+cVfR:tx0BpZBip81AKfz/8jy0D
TLSH
T1AA6334256BF00715F1F2CB3585F22AA76A7B78E69C41ABCD1096930D0827E529C64F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx
Size 2.1MB
SHA256 f21501b649c16bf766e2487f5b7b7ec4637cf1693d3fa86d413b2fb270211912
MD5 204285efef2b3b4d254e318673088a9b
SHA1 a8cd493c5633829dd6671e12eba324f790c5f5c8
SHA512 425d6a71f5cfb7ca1f35958f8e6d255d2e2e0ca3f80d60686be2a88c00ae8f819f7dfd7f6bfc142fc975b4badb21835dc5a1fbee4f106cc1672f1397f49b7b91
SSDEEP 6144:t6tCkwN+MxqapaClfYLJiBeZHKbL0saK0bh+k4SvkgIQ4SvkgI:IU3
TLSH
T1C0A5A81227F91629F1F38F3585F36B1A1A7F7D9549518ACE0124B24C0C66E229EB0F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx
Size 68KB
SHA256 02b89ce25a79a4b321d30a70570346cad97c701303e93838bfe015e658728d29
MD5 eb341244bbd6eab90e9fae52d3031944
SHA1 3d45f3d254e36f3173fa64b65cdbd9370cd9333b
SHA512 0bee23124ba642876e8245f016f4b49a347a6c5749d14e2d2ba33f4203edd197b9d46c81757cf5723f9ff082f0642fdc851a2419d86a42fed46800535d011ac7
SSDEEP 384:wThmm8bz84m585m58jm58I+m58Dm58Sm58Wm58:KyHCzNtNVcM
TLSH
T1C763C926BAF42718F2724B39C9F357634D2EB9569D14C98E112963490C23F20DE72F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx
Size 68KB
SHA256 bc6572f31d3bbd663d385ec85533129c6b55a700bae878e2c1a79a041390efaf
MD5 02e7810ca7812d9627ddc7aecd5ea4ea
SHA1 34c12674345c7c214f471fa60743955a181b8722
SHA512 63ab3ce4820cce70af5a2836372faad1d5dc84d1b42b1f3fbed8c5c13fb4e8052d0cedb78357190bfc3f46446f12ce247e75098a7cadb83254fbfd86faf533b7
SSDEEP 192:a7f8V7Kw9BbKA+1z9BY9Bu9B09Bm9Bd9B:a7UhKw3bKA+1z3Y3u303m3d3
TLSH
T1D5639C167BF9513AF5F34B388AB75B156D7B79244A01E54F2068A16C0C76A208F70FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Audio%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx
Size 1.0MB
SHA256 208dac6363109204fa2b5a56198a99f49730ad9723cfc903458c71d2c690dc78
MD5 cfc139c2be33ba05c5402dd199137d7c
SHA1 2861c86b12187a1dd165fdcac422613758440b26
SHA512 030e97201a1c39701b35018beae032b2363405e46db398456854fc6bb6204f3804bb881421bfd848f49b8e8f8200ca62e2b80609b6b99111a8a584a808e21247
SSDEEP 768:nAX6KBKgXajKcwKfjnK1XKswKHdKCWKWoKnGKpnKSkuKhzK06KAOKlbKvdKmLKRC:jYDuCNSi2I
TLSH
T19C2588141AF55738E1E3CF39C1F3072B1D7BB94689824AAF1068D3949C15AB19F70FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-CloudStore%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx
Size 68KB
SHA256 48730df7eeef4a0efcb111fecb074092ef6945703467cafa7b8ca56e8939d63c
MD5 e36fed082046f7924f4e5112dca96f6d
SHA1 a8d7d8e02f04d8afa0bf541d37862546c9f2c91b
SHA512 20022f92fb070f1b97fedbd5bfa884c3706bd98c8cb3e4012838bbfe2238190dfc1f30a06e0a8b33e3f926d2bcb13861451eb10ccc6d531378c6f7c58e40a245
SSDEEP 768:4tfNICuIss/TXGt/xi9Ey7xNUZZizCVRWPxBCAqw:oVICuXs/TXGt/49D7xqpVIBCA
TLSH
T1D0635943D9DD841DD1FECA31A66E0BBC3B33646FCAB5931B936C812C6D12B816E14782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-CodeIntegrity%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx
Size 1.0MB
SHA256 c780074203fcb53af758c4662226b170926d486f6a6b47e689679e3c41249bdf
MD5 897456fc910d54bd7de12b577f61adea
SHA1 77ea6305c313c4d50ef5429f09df0cd2b774d66b
SHA512 5ec47144a18d1facd43b5a9eaa918150b375ab4b22ab5357c4636d48dab37ddfff91c3e291808efbb55a0021ef6384fbc6dcd5cc43d2544d3f24450867f05f8e
SSDEEP 3072:NXoeTOoE2jQwN+8HbdgpT+nIR+8HbdgpT+n:lK
TLSH
T193258C012BF81538F1E38F3984B30B185A3BBD684B5AD58E1220715C5D5AEB4DFB4BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx
Size 68KB
SHA256 910f86eef7101ac95c484cd39ff789609145cc3009dab176ab4f7a8208e6529c
MD5 e8295fe0ee8eb4b85f615ed286971662
SHA1 c1755ef583e6f7cbf0f949d0abb3f99b2e18d567
SHA512 b0750b23aa22a004f1bd9101ed720d5b532825ac8773561cca5257c44707834611d12c4554c84777446a2cf1687b0f4d4f554757be2e3266943c0c64221a18f8
SSDEEP 384:rRha5JJZWyJJUgJJ+H74JJ+EmJJ+IjJJ+wcJJ+tMJJ+MVJJ+btJJ+o3JJ+3CJJ+N:FQ/Lp9MfOjVu7b+1fVM9azDNdT
TLSH
T15D6337411FF50810F0F38F7944BB0B14297AFD544E96AA9B6120635CDEA69B5CFB0BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx
Size 68KB
SHA256 a9374b60ac2c0b06cff45fe3e83027335066b7f211a78edb5a761a47d1f29b17
MD5 c65506a9cd41e7b1d94b4aa0ddb7e957
SHA1 2987dbc8231e58e3c2f0b3aa20fe06186d9825e9
SHA512 f2fe34d506231c5e85cd1e556c04e5fe2e0bd77b1f8bf9a1cd41484a2e91a8c90bdf8942e82d65e7ed718d01b007a6df5c9c268e5ad535bfac21a7c2347ffcc5
SSDEEP 384:AahqhSahYvfheh5h1hnhLI5hRh1hG7hFhkhh7h/ahwhgh4h+h+hfhXh7thgyhCdU:vn0IquI6K
TLSH
T1DE6336036BFC0539E5E3CB7582771B0469BEEA24CB579A4B0254B14C1C79C31AEB4BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx
Size 68KB
SHA256 91d65e322eac57baec8baf963c2aa6fec531b3b0f81c409c35765a1f47ca6d58
MD5 851250472c0fd314611c4beb53c45e37
SHA1 6c8f5345bebb6c6ab6766bc9517e141c632dc60b
SHA512 820d38df11034d87600fc60de0f763521b6ff890f5b1a22b0b2b99c039c754c1c0f6a19990059e5c61878d1bc93b466458fb5f50cd744be7d00f7e8bd89e7c3b
SSDEEP 384:xYHhqChCGCCbCnkC3CPCfCeCICFb3CFmxCDVNCDefCtXqCFudCD2JCDtjCtwQCX2:Y6L
TLSH
T1D26332285BFA1669F4F3CF7985720B411CBABD456E40AD8F11B062980923E61EC74F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx
Size 68KB
SHA256 cf274177094efd610cd37c7252bcb1b97bca6f1f6cdc8117d6d5059b40f38686
MD5 94e0dd043f8241161666f3173d70f985
SHA1 39c153e4b70313dcc0830ac66ed26c598216160b
SHA512 0cd0449e6797debe166c493fc306acfd46cdd9e0641447346a50e557540f5d1b60bd6ffc320eaa195c395aace5745786138821f9f3312d4dcc0bbe7e8e1d8ed8
SSDEEP 384:/ih7C6CYC2C1C+2C+C6C+FC+uC6TC+7C+0Ci/CieC4wC4VCgQH/CirCi2Cg:a8/H
TLSH
T13C634F5597FE1A68F4F3CB3989760A1409BBBD452F40E98F11B062A80927E64ED70F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-DeviceSetupManager%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx
Size 1.0MB
SHA256 a6d9da3ef7e5445377c206631c2cb078c7de94934ff8d802e0c9e504d039fb0d
MD5 959f9574faad5618cb099543bd1566ec
SHA1 15ef37206e0695502dbc83f8b40247e95750d1b9
SHA512 9f5b9600648c121881c489ab9fca4ca3071a5511ae48692fb8cc11d08f921e9c2991d15ccf555d9e8503a5b0e93895fd63f3ae0c82510069fa993bbed2f3ddd2
SSDEEP 1536:b98auWtirlvkCzu3Bj1HsNBiR5BQcMOBQASb5zuL:bWaudBkGmBoiRR
TLSH
T1D02527002AF45A2CF6F3CB7A87B317262A37FC5445969A4E1030A1585C57DB98E70BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-DeviceSetupManager%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx
Size 68KB
SHA256 95d092e2834344c685712e4e95e2d558f773f720c8c1745d899bf6f1489f836b
MD5 7617c3e6bcfd8d23c61ec3f81b926547
SHA1 52f7fbfd31bc32f6b0d16968a987570530d128a1
SHA512 406eea3f6d9f6efa6c1a980ab42c0069cf727a9d5c710b2bcfc830203c64680fea4ac76a1c7133b5e9ae6a61789799437b69710efec8ad613cfdf9999ec33652
SSDEEP 96:EMKNVaO8ZxoofmgmGQ2HzmgmfNmgmD8vmgm:EM8V7sLjpLSL3L
TLSH
T1B0630E06ABF8492CF0F3CB7946FB5726157ABC595512C98F2070521C5C23EA08EB1FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx
Size 68KB
SHA256 c1abfc87ee91287c702803b9a5aec1f0dd3890155bf3bc7c6a6c8f7b7df6a136
MD5 e427043ffe9fddb21453ed3ef5440ec3
SHA1 be97c53b7c93da8204eac538c412a4eafbfba7ec
SHA512 e02df5aa0a46d29700309d55123cfb9d6ef44c56bed347bcd52beb62dbac8407e8806fcbc5e188fe1a3d7bff89dd4faa5653ae5c6d00c8071b8107117ac115ba
SSDEEP 96:R0KNVaO8ZxoqcnPtIcUtcap0capOcapsc3tc3HLcKNcK:R08V7OcnPCcccaucaYca2cdc7cmc
TLSH
T14463CF0267FD8629F1F2CF7E8576471019BAFD604E82C99E1114A2989C67934DBB0FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Diagnosis-PCW%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PCW%4Operational.evtx
Size 68KB
SHA256 9b320832d7fa47de9aee87005b66a67190bf99a358f4fa25e2112a3226a119f4
MD5 d433d7dc703970e6b7efe5c646990ca9
SHA1 139100043a42dafe36cb6b88f8f03d2e060af7cd
SHA512 45acff8e035c7148d3c28b4f8d71843cb00a0ee0ac2f8b9d3c63dee7b0c4bbf4b86e580721bb9f8b02814d6b4c9a5cfacaf3ddddfe91a6c3e422f8d6b76fea0a
SSDEEP 384:b+h15W59M5h5L5x5T5D5S5k5j5o5c5F5k5+5l5O545L5S5i5g5H5a5L515O575nP:a0t
TLSH
T1286357021AFD463CF5F38F3889A71B14097BFB640ED6594A1220A164886A979DF70FF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx
Size 68KB
SHA256 f1274f886e7054c909d51db3d863e5e69d11395e61093da4adc79aebc0f5a884
MD5 f208567f76aa853d594f20f9a29ffd64
SHA1 c1cac35dbbbe4bdcd96806a022360cda79d0bb5c
SHA512 f589668f569614bd331ed0c37027c7398de0e6096160e57e3b4d4a07d489ea96ad4e634c12fd50db9dbba638afea3ea99fb62961d1a931ef79e108ea8cfaebab
SSDEEP 96:5oKNVaO8ZxonCgk7jMKxCHyhipM2M9ERSErZL6EaFREgQgwbk:5o8V77Cgk7gKosipRRl0Q
TLSH
T19063C201EAFC492DF1B20BBBC5BBA63668397E151A21D1BF3218736C4531D448BE17A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-GroupPolicy%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx
Size 1.1MB
SHA256 458ee27465afa742374f68751f107f83c85366fab78d6bf7600c1c365f4f40b2
MD5 cc1decb6d04c6cd247a074708ec06be5
SHA1 5a8e43b6f8c189aa5ba23e575d934336c4bb99e4
SHA512 a8fb6db2b18e4b9c44dd91eebf6eed9a613a8401a5d824858acf7c00ebf3e188f2573c582fc745d005eb7b9340a704952c2680a0db723ca177dab120c093f059
SSDEEP 1536:hVt4i8IXtlnC96BTENY+ZHyF+2IaoSc+3N/s3TBGGpO/tDlrtc6meYcUsu24IVoI:XGHgnN5UlKcRY/tDlrtc6meYcUv5K/
TLSH
T148358F427BF81A28F2F34B3994A70F242F7FAF481B4659971050A1585C6A8399FB07F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Kernel-Boot%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx
Size 68KB
SHA256 297ce15875cc14cab205de13c91a37e03882eb61c6f956f4829466ef0a76630d
MD5 06c412cf6d3482e97757d6390a593f7a
SHA1 484f8408745c84b6dbb0697fabe5313293167f17
SHA512 d06f5182b89430b6f9761b80121042120bb0a9be2d766a1f98061ce61e47f83c62cfd265bbb4db6be949dcd9514d1c9960d2b0cc89387c2ce5850d50aba8ae2b
SSDEEP 384:MBhWDhxDmEDuDdSDFD/DHD4D+D2DqDkKDl5DowDHvDaDgDoDEDcDWDCDaDi9DODz:c8EbzTBi
TLSH
T13B63280667F52938F0E28B3A88F317382A7EFD0419825EAF1150629C4D759765FB0BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Kernel-Cache%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Cache%4Operational.evtx
Size 68KB
SHA256 dcb3d836e059c58c4086cb346af334326940d435b9bb39b4abaccd65dbe6164d
MD5 d2842b6479908b2b61afabf611f17e9b
SHA1 e2354740ce6c48cd8094712510c312b2a6e4e4fa
SHA512 4c4207cd8058defcd6724d09d76139249b25f4e76df1e516b2857101f58a4e474b7daa1399a48a13a8bb3b80b2ff3bdb807dc2e583eb137574a9a70bda796487
SSDEEP 384:qXXh7O5OYROySOpyOYoSOBOY8OynOYCO8+OYZOyl6OYlWO80fOY7cOy0OYxZO8zi:QgtvM23
TLSH
T10563D70527F80438F0F38B7A64B74B141EBFFDA48A824E9F2120615D5CA99758F71FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Kernel-PnP%4Configuration.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx
Size 1.0MB
SHA256 5774f2a713a70a11511fe04e18368b84b032bd1483cc9e22cb57f2f9b584c94b
MD5 8cde9dd372884745ba417e84922476c3
SHA1 45344de3bc58dd817e25028b5a1a1b585279cce9
SHA512 8fe2e44b7693f11afe33f7926f5076ad0eddc9da122006df5e5d97f31b793f63077007844fccebf5e9975b9f19f833c1dc46e35bf43dce30914becf4ffe97af4
SSDEEP 768:ADCKtTlTimE8BmwZIocSW7bPtsCOdFU55XZer8SxZerlS7BmwZIocSW7bPtsC:ACKtTlumE8BmxWFe8Bmx
TLSH
T14825972132F44228F2E3CB7684F30B1B693EFC916B4259CF2160A3455D65A619F71BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx
Size 1.1MB
SHA256 b72fbe2eef7803d4280e10674dbc4c07ace8ee497f5427ff1c153b1d0bafe322
MD5 9def8ee3278e18ab4bf520eb671ba95c
SHA1 7a0d8c430bcadb3e8a76d3f8b5fb8d6868063209
SHA512 ae0c05ff85d1ab3fc147614c04b24de54a5d6464c2d2a666fcd70885b13a65d9bba7b59aad66ff1da996b5a9395f3fa8d73e42766e3075e84f5753cc90844695
SSDEEP 3072:iR0wRgjsXnPsxeHckP8jaBeHckP8jaLi6lVpA:ijRgjCsxeHckP8jaBeHckP8jaRlVpA
TLSH
T19D35ED0177D04C21E062477588A3DBA0257EBE448E42524B3A9C736D7C7BD7CDF6BAA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Known Folders API Service.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx
Size 68KB
SHA256 058e27c6a9fc6eb08223ffc6956e2b19529366e3d9b2d4344a80713cbed9d0f3
MD5 6aba14ebbb327f5a88e44cc384166e4c
SHA1 b7652dc3c05ab1f42684579b759dad9c295c6948
SHA512 350406b40086509ab062389bff2d04650f7f6659a9dd269aabafe0dd46e6a22eedf32934009923aa9fbbd3c51d3d86e40c83d7dce577c08f45ec643e0079da85
SSDEEP 768:BfiYEkgPvBa2Q1hZDVTVFfylyBQlK60V/SGqysVbOWS+oV/qCqqYV7O:w0
TLSH
T1A063682113F6492CF2F38F3A44B31B146D37B9644F52A68F4294628C5D2AEB5DE317A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-LiveId%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx
Size 1.0MB
SHA256 ee8f301ebf1fc3dbb92ba1a461fa1daa78e8020510e6d3f2a756f0351f7c72a2
MD5 ef4e9d2ab50672bb6c2b60b95d2a1bba
SHA1 e662ae9c87f8fa18b23a5cfa68d4ad3637652f58
SHA512 d9075a0a02d0744b167fcee753d68790782762de0d483ddb190472c459d72401b6c42868740769e2f9e94f3647c35c0a4561ba4d19c59f01eb6a1187f8f6f4a4
SSDEEP 768:T89ZT+fRFN6bV1BoAvv0Z6dxClX2WbZejPFmfFrF6/I:SlfVzoAvsuxAX2WbZeMG/
TLSH
T1EF25B70E9DDC4801F3A3CF34DAF3AF8824B1B75A84EA555E27A0515DFD80CE88165BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-MUI%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx
Size 68KB
SHA256 01a155bf4b777d65b7df7bfbe8700a3f0e4efc2b98db00d4a2289867d536e5c4
MD5 27da4e0f259039569d9fc011c2092f71
SHA1 c4e1f5a71615313d455c7a66a20d54558c899108
SHA512 7f5cbcddb2879a52fed20dd5804e94431ee08e9e7100f501d2b5c0409b47c6da667a116b8f7f49bff0d4692a9f973f4cdcd9882e634bae06b4c8b2a2c9d569b1
SSDEEP 384:ythhXkBXbXLKXyX7XdXgXvXZ2XLeXGXxX4+X:6J
TLSH
T11A63810217FD0518F2F38B3D947B9B242A77FD1589439A9F2260A3585D16874AFB0BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-NCSI%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx
Size 68KB
SHA256 d7299516adf026544604056b7e20b0c4b846151c1ad5233f275d9fd4d320f235
MD5 f9aa3afe4b6ab72d6e65140c059c81c3
SHA1 cb4b6544df3c17b812c1bc8fa8c812c9c5ee3945
SHA512 1ff73dcf4644366b10b6d7cc3586d6936c455e874a0579263eee3d532081b25a0e064c855f6f8b2e5c3911712425986b3441bbaeaa029da25bc6646bd21cf015
SSDEEP 384:XehESM/1jxMwwM2vMOHMJrMpkMdCMXSMxiMluMJ4MXkMtAM/5MZIMm8MWiM2LMo9:uY18
TLSH
T1D8636F4366FD4428E1F38B3984A30F24153EF7785A82AF9F2150B1699C166296F70FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-NetworkProfile%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx
Size 1.0MB
SHA256 db0fbb576c42e8bcb370c4c0d464096bea55796d06c5ee8d1df6d04c8125dec4
MD5 58c0387faeda79f6dbb70889a9e04aeb
SHA1 709ba5b4518a40287d01682ec60969e0ea0784a8
SHA512 60723acc47871a56db6602a430d2a0bc847af43e5fb33fc6a6bac4e5cc2d9d890ed0b69e8943277d6fdb1346a720051a0019a4cf6bf43e72c5eef4d1169b9fd2
SSDEEP 768:2467xgXD824iUZJm9oyWhpTqciomxM/OxckpyXlLhxeF1yF5OBB65oIq3TigphTS:gUhT28kQzpq/0
TLSH
T19625280317F50638F1E28B3598F75F24397BBA2456829BDF141470AC8C669758FA0BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Ntfs%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx
Size 1.1MB
SHA256 9b0aa3fb3814fb8a97955369e4eff4bbea347f2df2e14a3e1e0af575e05246db
MD5 6506abdc0ad0a44f3f105e63d319e934
SHA1 83b88f0d5a8f343fa3889535608fa6ec02a2e4e7
SHA512 18e4b66748f3db774be81ac9778cede564632a3680a442d1b1aef300e1cdf1986990d14a9e82c641d55d22ddde7dfd233e879adad32e446b41f8efa8dee18525
SSDEEP 1536:Po8nXMVr4+yHqSnz6uQTebKnrvPXnmeA/JknTNUUD:o4HjQT7
TLSH
T182350F051EF81528D2F78B39C0F303271B7BBA115E969A8F10D0639D4D96A15DFB0BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PCI%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-PCI%4Operational.evtx
Size 1.0MB
SHA256 c73d7fac5dcd283e5a6f2432e33f100d70bc3aa0f8bbab81128e41303b6d4b44
MD5 3c1d542a0a7758187707816931b661bc
SHA1 53f62934a964a0f60728d0235260888494b96c31
SHA512 b8cda413cee3db79c1d0120a33a766c93effd581fda15498389215b0d873d6d45b90a2d4f957fb7d039d487cfb43c8df1e1c25ba99edcfddb245629a89e2540e
SSDEEP 768:ns6gY5aBCZTHhPnYAxN6ZNucmb1CLmQ0qGIRVVLvwRtpgZ/jNcOXWSfK7fY7ZpGH:1oL78xRUJ
TLSH
T1872569023BFA6118E1F2AF3482E30B271776F9588BA387466254939D5C565628F70FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Partition%4Diagnostic.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx
Size 1.1MB
SHA256 d350d293203fc5a5fd7c73ab3bd6c39b7158528d1b7af359c4efa2cb1477fff8
MD5 27ab6ca35f871159a382c21c549eebea
SHA1 6d8375f688251861ddddba7a4596536f20ef92af
SHA512 7ce229c33f0dbab7c7c9856350a814dc7afa6cc1ca6e39abac3d5b028bd0a5749c43d95d629fce28754695d26fc750998da3da4d57b6d26e481c659859d43bae
SSDEEP 768:4g1n8zfFFM+18u161O1a1b1v1I1C1V1C1Q1f1f1J1k101q131w1n1A1DE1KS5OAX:LwScA
TLSH
T1D335430626A8131CE262C731C6FB53256A3F2F595BA1B14F708C735C1FA2A4DAF607D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Perflib%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Perflib%4Operational.evtx
Size 1.0MB
SHA256 ec7b1fddb45d9d3ab9cdae10ef1bba29131cf6278df09401c025178a50fd2180
MD5 8b4aed9ed3c6e897cf646f21daf898bc
SHA1 02c3eb893f20849d872f799cad105ecfa7e38363
SHA512 5962b4085caab446d6d45878ca64fd3f983ba1f7afe787a56db88dcd18db8c6329830bd80d689c47f6ebac5b410d7caaac3afe5889fc2dd1730a6ba497c7addd
SSDEEP 3072:KcmsAWEkuNAHtDfADgfXfL7bw9Tq2te72InS146nUGj/u72zpyEGr77BWWkmM1lX:Khvc+JeYU0s6
TLSH
T1C125DC121BF66534F1F38F3558730B19183AB9251E02E98FB160E3EC4C9A5659E31FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PowerShell%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx
Size 12.1MB
SHA256 b53948a20635aa89981084343fd7021741efd750390815d806fdc3837a22d1b2
MD5 2708e29257e82b93511f360c51f967aa
SHA1 0f60d26f2a771485c419f5a1a08ef87a238b6dde
SHA512 86549fbb7dbaa0071b8c759e4dbfa858eb5a3a0e8a0ff97450d8b6e4d07a67ee3b63dad64c9627b49a3fc125b7a1cc29db77700001682674c662966c14f8bdcf
SSDEEP 6144:nUWDbzDbLDbwDbuDbjDbqDb2DbDsRyUUDblDb3DbXDbDDbfDbqDbaDbiDbyUVkP+:nnsRyBQ610vX/
TLSH
T19FD6905253FE5654FAF76BB9E97E24640A733CAD5A38C66C109CB04D0FF3A0488A1763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PrintService%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-PrintService%4Admin.evtx
Size 68KB
SHA256 ce8c022db309fb71d8382f8efcc58d49081b16c23f1118f4bcef452e51a28c95
MD5 96ea720456bbf40a9627615c6eed9227
SHA1 ff2363105a5780409b6475866c4082fa9510b621
SHA512 c6b294e8ceeefbede86c3111f5150edec5ce503d47310bfcdc81434b19b4900d3186afc4f3a535c4903da7d602e58d8ab7481e9e8df6478658edb8c2f50d1d82
SSDEEP 192:ca8V7/0pRVEpRArpRqpR9pRPpR8pRsrpRrpRlpRTpRTp:cNhcpQp6rpspLpJpCp+rpVp3p9pJp
TLSH
T14B635B01ABFD4E24F1F38B7584B207153CB3B8500B21BB6B0678A19C5D66DA5DD70BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Privacy-Auditing%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx
Size 68KB
SHA256 a6b28dd08dcd35ceb6e533fd84d551eedb0eca5ae5cdf5a385e9d108c689d904
MD5 da7a51b6069e96ec6853c882e59c326d
SHA1 90ec56ac1035ec20ceb61439d6d1c1c0fe96e336
SHA512 2cd21d5ad10b87e0f7597dac36728218d72de4074690936a47c27c62d1c77b3b7d82684cd95c3fde8a63c9b77415a48ee4340a239a822c89c6668add5ef7e42f
SSDEEP 384:HxBhcKXlRGqESw+Ij2XQN+w0lwkzwU2wWUwqQwoEwxbwU4hwYBw94wQgnwSUwPAB:P2MAzCICDJ
TLSH
T1E9638A426BFD5618F1F38B39D6771B180FB7BC050E52899F1164228D9CA1A258EF0BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx
Size 68KB
SHA256 24c3274df80f59100722aa066d743f3f07780cb6a41d52724fde03b901dc8834
MD5 9dc7f8991813cc3e247e9788f08e582c
SHA1 77d44b6e612e9711eff71ace4886ccc688c2d096
SHA512 9fedb30d315b572358141a1d503b21e163169b69273088f7945d70ded7eec79d58e250535738be8c6c718f1d5d96d96fe111323e4b8b7060d018a59c63fe3c2f
SSDEEP 384:zshCsjVstvsBUsF8scsys+sdsUCFsPFnRsTs6stsiMsCsWsma8s2pqs6zzsuHtsf:g9rqaKe
TLSH
T1A863100607FA0269F0F7CF3895B60A6628B7BD45AE419D8F127051584D32E21EEB4F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx
Size 1.0MB
SHA256 031a77c2163d7947ca951bea48a6ad9faba62bef7b6d72a0e348f679b2b564ba
MD5 4092024dbcef5ddfff34ea36c0516f5c
SHA1 558a1c05458741c6649c6c7aa3b3c12608408d47
SHA512 8351ce6ea806e00be1b3ef419c2a186e83b05f81bae90523f92ef7ccf6ab0f78fa2b3839a483521a56eb81565014e343b323206e05018ae211f88ed06d9c8709
SSDEEP 768:ae4OUuWIZw3HXRjTf1nLuHbaXaHXRjTf1:oOUBjTPXqBjT
TLSH
T11725DC035BFD0A2CF6F38B3998B76B9818377E594F41E95B2310625C58959208F70BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx
Size 68KB
SHA256 def7a51517b392e4ee139b9003e2ecd1f815a47caa5234475d16091f5484d95a
MD5 c1ccce2d84fcf35e57d945b6ab997ccb
SHA1 b3314efa12dea4a982e04f80f6afc4ca89fa2418
SHA512 c5d60f177cbd436b9f41b8fcfa9a52102a4a399cc1ef411b5f340c37b5fed889d9fac1e7a54a1482cc02e1f41c68445a982daeabd5b7ce709000b66ca0f597ac
SSDEEP 96:avKNVaO8ZxoFblbRl5elbRl/fU2lbRl/slbRl/uB8glbRl//lbRl:av8V79VRneVRFs2VRFsVRFufVRF/VR
TLSH
T1D8638A016FFE1528F6F28B3C46BB4715283778665D41C99F6124A29C186BE50CFB1FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-SMBServer%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx
Size 1.1MB
SHA256 6f3bd6529f3b8eba1a2a831d077eb972d87a7c8e774d1ccb15790354491b24f3
MD5 079285d61fa71486352f4053f8fff009
SHA1 14ca47f89d2560cac8016fea529c64eb30acf31c
SHA512 43a810b4a222a32c116c8ad9eda03cc494514444dd27fc819f480bde00009a7dacde292ba623190be6dbc78edafb0334e1040def8448c812ced7a48b8c2669bd
SSDEEP 768:KKz6iFCebE3zElhtj34oz9+yrv0wI1+8lLqcbcopts:w3IZvwbvs
TLSH
T12E355C0217F46835F1E38F39C1F34F293A7BF44496929A5F1064B1984DAA9728F70BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx
Size 68KB
SHA256 79062ff5e59c9e590e5fdbcc3f76e7cd709b9748df129fe0f79f2ef40370a388
MD5 88b496cee0a4bebda1ae0992c6d24461
SHA1 4b6d85edada307fd94f3c942476083f426b44ef2
SHA512 b025502c0874cad31634d9c8e9855e4979815422792c7497d78ada9d588277a7b565103c0cbfff6d3d3132731aa2a931882d37c287e504527988e275d17bab53
SSDEEP 384:IuhWxi+6D1zNvjibQFUGieeciGeiieVi46D1zNvjibQfiMieiBeiBfiBhiYiBniv:/x3vN
TLSH
T1B0637615ABFD0139F3F34F75E9B39A11A83ABC4A1D29CD5E1151128D0C26A21CEB1F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx
Size 68KB
SHA256 1f80329da7f2680b37887ebd518ca82ad675ad643102f7330f91b978e2c7921a
MD5 1b7301f40c88e5b04b919fd89c69f767
SHA1 9e92821e9573ea9d283f41a3e9eb71e2560a00d5
SHA512 582c6bc5537fbeeb33acda25a8a1468e66df5cbcaa0ac923b884ad619d0f2b919876b24ca864bc9529670b286f39162dc7225b728b5ea56c8084db0a16353e53
SSDEEP 96:P9PiKNVaO8ZxoiCaapCaFumE/tCaapCacS8eWCaapCac:P968V7OgpffktgpjOgp
TLSH
T18C637B029BED492AF5E24F3845BE67191832BE554B12DA9F2220916C1C76F50CFB0FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx
Size 1.0MB
SHA256 7f83817e3f78864f147d5c453b704892b928c68cabf407ee0a82089b9c58b8c5
MD5 07106ec6c63544100ff5eb632ad2dfe8
SHA1 95646ddde69ce3899a6b28b290ba81c540fe9e33
SHA512 c3f9788ef027b0f3e1201ed5d2012445cc191ab7f02ca0657fac034b0e23e1b1cc160ba4ba8114e915a255f963b7e11ad9f6c0227ad24f669138bddc5056e227
SSDEEP 3072:+hF1tJx2FxJNwA6o9fVBht+ahTh5aNh9d7dqt7W8zNaWle5nJljVJ0IvVx461mw:
TLSH
T1362565143BF95039E1F38F36D9F317055A36F9698B22AD4E215093184C7AA22CDB1F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Shell-Core%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx
Size 1.0MB
SHA256 56b524fc21ac1106179d720de3b5f33afd5450793ea8c37117188726be3cd8b2
MD5 6ff2582b9b8fc62433fe2b6aa7440bb3
SHA1 a7f6cb4ba64ba23885bff030f2b20972cb308d5c
SHA512 6b4cf99f7000d7d766c10f388b1e452f9d5d134125fdf24f4c2b95332c3f760175778126a5749a6ea1efa5c37cfe220db48654042975e21d321ee7007fe351e2
SSDEEP 3072:LORjs6+LLg8ZdIX4WFVoUmja1490sp9U7o4L7ImTSi/20ofwu3uiJiSp8rjGTOnQ:c1TMTolO2eQj
TLSH
T1C425170627F15039F1F34F3998770B146A3BF9A89F43AD9F111461588D7AA248EB0FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-SmbClient%4Connectivity.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx
Size 68KB
SHA256 3433a60932fd058cb3b4a30745074e745f4f424972b55914949b97002abc508a
MD5 9157df4b8191f5d87c0788883069b745
SHA1 dd6fde30e5633f3d02be1e51608ad4063512558b
SHA512 233af8ac26ff4b8620700f90558a329577418b02bf3753d45054f77c1baa6853738931c494483cef5fdf73e9620b53aa20e234252504aabb1085d187e0d195d7
SSDEEP 768:C40iJgQ48Ryfa5jXQJtELy96sl2dSKpz0swa:C4rx790r
TLSH
T1006385052BFC5428E1E24F7D44B74B2C6E37FD386681CA5B6024A09C1C29EA55F70FBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-StateRepository%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx
Size 1.1MB
SHA256 1b52f8977dc7fbcba32276b4dfe1dc871ccd46db6fd6f42c8bfec686f7a8eb44
MD5 0b6be22269d99ed2012ec4418d527f36
SHA1 7cba3f344bfa040d53c793a804205521713509cc
SHA512 b4c5eebd911e05d25dc27ad07e12c829619f0e69ee1fbd56a9e22651f25f4aaaf4dbae84da0d7361b788ff191a856faa50c00ccfddd328fb45a62f3256adbf3e
SSDEEP 1536:SFu/u6m862IBHRrCdT1RaHBtY4pYapCXf6jTWArJiA4AZzGxAv9:Sg/uhtN4I
TLSH
T1B13537032BF50938E5F3CF3A80F30F28667BB9245986D64B1154A18D5FAB964CE70B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Storage-Storport%4Health.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx
Size 1.1MB
SHA256 d608ade7ea963d5a9ee42c5a09ad625749cca00ae77a0180483ae1945f675625
MD5 c0e7a9ea8ee23446cc9bdbbe97698532
SHA1 fcdd33871b2981c368563cf03a1dfb6b51082b41
SHA512 5fae531d6ad056e1753d62f6e55bed77b16c4022916d28e2da353383a9e66e4f2082d9706622316687c1210b658aea1f5872d400e9db954ca1fcc24163ce11a8
SSDEEP 384:TJhPpI+pBapBDpBQpBvpBkpBVpBYHpBzpBVlpB9pB8pBtpBipBBpB2pBvpBcpBVy:NPkMBm2S+MHbddcMq+dE
TLSH
T1CA3515951BF70629F9FBCEB416770B64AA37BD342AD5F91D5080A0AC5CB64108F207EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Storage-Storport%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx
Size 1.1MB
SHA256 d81ab44e39a99f146dcfdac0f44504e8cb02b5f39fd424bde1620b0eacd80cd8
MD5 27dbc782a29908d8a7f0f92091adce27
SHA1 9c3cdceeeaebe868a980d468a4dcbd2f6c93513b
SHA512 b96c1edd7e56b94a66be41157523e2f1d87b70846506a2962a302e2b4bc25231df0e72e59b33043c27e81f6fc050995f77282a0e693111eb54afa703c7dc6c89
SSDEEP 768:oBgQNBh1C+RhGzUXwhfB9Gp020FEpFjnLds/U0sONVj9JVoHAR8GqIKzvnuIxE:/znKfq
TLSH
T1B735BA063BF2053DF2F3CF7589E74B28693EB9142A42C95A304462AD9CB69549F707E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Storage-Storport%4Operational.evtx.FileSlack

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx.FileSlack
Size 948KB
SHA256 0f1453164eb8d2f6ef2a9b89b317046540331d249aa99a24dead8ac2294c3103
MD5 86ff8abb67866066ca8d68ac9fcd7058
SHA1 010f82d78310114cc4b1fde07dc74cfc06196c1c
SHA512 0c016061560c100f423365c8b7cf324af1d85a4611e5b8797b8214023f7457fe8f9ecf50d591b5459db1cee2e37cca67ad6abff30dd64dcfd49dab2669daa30f
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft-Windows-StorageVolume%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-StorageVolume%4Operational.evtx
Size 68KB
SHA256 89718eebbad2ce16660b810130e6b587a0218ea6b73975021e75e0c6264f54f5
MD5 b42e80a6452c8a07ce3c1979ed6da6b4
SHA1 4c03dc67bb9f21664b99ad87e3c95d71148162b4
SHA512 86e0403d3809c9676e9f6e6b086e32621e6f6228d4467e87d2c6e487b9d783f667f667a26fed774b3cae8520e0dd5df0b72029fcbec127ccaf7d2c288d76fd7e
SSDEEP 384:1Ohs6BO6r6N6x4E6r6n6A6lm67F6e6660J6P6F656b6Z6r6D69606G676S6e6R6P:MlL4y8sjWur+kAOy6mvvCuidG0FJP
TLSH
T1DE63B9022AFC5428F1F3CF31A9F74736603ABD255F51D15F30A4636D9865A008FA2BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Store%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx
Size 1.1MB
SHA256 ae1a91e11b6cd016adfdcb8ed9db1931678a9e4c0c4c831ae37555d29bdbb549
MD5 44b304dd31a65ab0c0f2e863501d4837
SHA1 582b781d23737f879430c44d0005328347224a62
SHA512 dd65d31fd88b4d42bd880d0d1625e6db1561d27ecaf1f43819704d4b7f7fa519e9b239a543beb76e11d490a5a942a26e94fabbe33ff374515f56e6c1e2b5275c
SSDEEP 768:LiJkYDFzYlJZOCqKhD90wzzoxO9zStVz6uHzG7E1BJOxZG5dx7ZH3s:+atdzzoOQqEbJOxudx7R3
TLSH
T1F5359A012BF50538F6F7DF35A9F70B19097BBC091AA68A8F1060529C4C27D659FB0BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Storsvc%4Diagnostic.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx
Size 68KB
SHA256 c9a77842f7c5747a3a3f56558c5e2d90617a7bc3a880b2e18c419531a9104c55
MD5 554920808924f9f62eeea8abbbec3bf9
SHA1 ca750daf9f421de70add24d446ccb4706216e083
SHA512 9374a76c7a4102ce134a57d14015c52b52611f17849d89b1847235696d154eb2301be9ba6256156c8cbb992f798dd88a1ae22e44d97b0ca0b2d572ac3ffc33c9
SSDEEP 48:MHvMPW+hrP+MZQNRBEZWTENO4bpBJlPo1CSCCS/TR5VGzcrvjgdrdpH:Yv6KNVaO8Zxo1C5Ce0kgdrdp
TLSH
T1586310019EEC8529F5B34F7AD6BAA7356D763A514D61C19FB264233C0C32E00CFA1795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-TWinUI%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-TWinUI%4Operational.evtx
Size 68KB
SHA256 ee4ebc3797c0b91294bab05ada316da3e5814bb2d27e9075ea1f88345b101574
MD5 0b9d6d42ebb814b0249013420b7e4425
SHA1 adcd7a802c0d709d465af2d1efa867caaade7444
SHA512 871f4d1b6d346fc713857b8c829b1debdac07f74e916a457eb3c4cea4e4b92ce3d7b486f2234f68e2c912547f4f91da876edced19c5a0abf758fc689a38aec25
SSDEEP 384:I8hiGIyGvGFGJGCGjGpGWGqGRG/G/GCGCGeGdG:N
TLSH
T1366357162BF94018F0F38F3998B75B186937FD5989865A8F2014619C4C6A932DFF0FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-TZSync%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-TZSync%4Operational.evtx
Size 68KB
SHA256 cdbf7dc06756884a441de8121182bce8cd673df4323189fe6a2114ee3269a340
MD5 15e9d8dc81c15bf92817888a8ffda8ee
SHA1 86a3743b319fae8e2837eab763dfbfdc88a7d952
SHA512 811efb0c45a7e2f7c23216668fcaf476e2c4f780c1caf20a4ffb723b105eff9c5229d10f912acd07be301e47853a4cef6aa101148b9be9332f0aca83866cbe4e
SSDEEP 48:Mdo1vWDrP+MZQNRBEZWTENO4bpBJlPozNcAQmvNY2hiniJQyes8OCZFauSkO0v8:uRKNVaO8ZxozNtQmvNubs8LZDTv8
TLSH
T12F63DB02AFEC801DF1F3ABB45EBAC7195635B9A98A13C54F3054622E1C61F10CFA2771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-TaskScheduler%4Maintenance.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx
Size 68KB
SHA256 c3b897739ad80166f2612977f3883e84822459e7e33cf66b137668d71fb0f103
MD5 54896af86d2c3b0152a897bb9ebddd34
SHA1 8bb77fce63061a11cd0be3568d2d9174633e7352
SHA512 2233491451b302132a0065ff67c67ac210e0315ebe61dec6c48fa188cad9a822a30d4720c3d780ae94079d371194a81decf6a9a907565fb940ce9966f2502b45
SSDEEP 768:lSKTjKTjcKTSKT+KTOKTTKT6KTZKTBKTyKT:YKHKkKWKaKiKvKeKlKNKGK
TLSH
T148636C059BF44929F7B35B3A09F79B1C0973BD044A718A8E012063995C29EB1DFB0B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
Size 1.0MB
SHA256 c5f2e3bd325a490b0c823cd434fcc22c0f742d0519ce485349986445f849a584
MD5 af88af8d85d271963f1681da2bc506b8
SHA1 314e86d1bd2f5da7660aa837aac3440d70b0ebe1
SHA512 04ef71c1546b034f8b16b73f313f5290090d4546f58bbc1c46ddd9174e712fca4a4d6cbffe7034b432086575c77a2ef190911c066772babd2e68f2088a7d85b9
SSDEEP 384:HMhfix4iqiYoififi/i3iphibiXizinilnic+iPBioi7diTJidi/iri7iXi/i7iJ:soom1z2m9xCD/f0tOnHEA/4
TLSH
T1CE252701A7F91828F0F39F35D87B6B1A1ABBFD900F65499F115491584CA6A60CEF0BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Time-Service%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Time-Service%4Operational.evtx
Size 68KB
SHA256 e68f7639cd3ee5fc2fb56e99df7f25dd84eab0e9e30bc32c23764276810c1506
MD5 079194eeac49964459bc641214cf4f25
SHA1 cce72f0c87121e00da5b5a24192ff1fe20cc9866
SHA512 80fbbe85e572f77171e02f8da845c5ce2f2ef3417721e4bcf92d594c7e0db5891fa2f37da99856292b5b5012bf84bf6171a2d15ec161217e7b8987f3efd17c9e
SSDEEP 192:Gvv8V7ONpbHpG+wXq8JXuvOph5pC0cp86Pps6yptqtpDIApRWzp:G8hgprpwaOpfppcpNPpBypgtp0Apszp
TLSH
T154639C019BF81518F1F3DF76ACB326151FBAFA641D618D9E2050A36C0DA1E248F64BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-User Device Registration%4Admin.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx
Size 68KB
SHA256 4d6baea2c844b9997a21df5ace31435ca43f9dab664d86a1354186f38c4e5415
MD5 f230318a2687aa9b750b42ce1481837b
SHA1 5df130960c0737e1b34cd67d23953ace73bfeb22
SHA512 b2669047d076f1706f89806b0f610ab902ab6b7329b323516101e312714312be4f3d906faaf4348dab060c2009bc379ee4297ce04e86b1c2f909239f3a26437e
SSDEEP 384:TjhWXla6X91XXXcCXGTXZX0X4XGeXTXzXbXGiXnXdXZXGoXQXFXlXGAXJXW1XEX5:P9RV0Z9qLt7rAnBSvDIG4Q7tKU
TLSH
T1B16313002BF54A18F1F26F7A85F607250D37BC984D32D58E1224824E8D65EA9DEB17FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-User Profile Service%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx
Size 1.1MB
SHA256 0ea93bafba1feb00a3919679b8c29f0a138c33101dae7528e3f9a4f073f3d913
MD5 771f99597c039920492a890a8c725fe7
SHA1 7b6c6061d5266f3f95c942798b7b786f577355f0
SHA512 1820b23a466f0026696d839ab4a346dcd927227ea9cc63add4e492180ced23195d04e0dfa5278055b5892305b0a2e89e9e3edf79d9d70eebc8ac6d122020e094
SSDEEP 384:LohBmJm0HmH7mnmum9mbm1mbAmHsmom8mrmVmHmbOmHWmWmSm5mQmrmbSmH+mbm6:0HM9ZnXWW7A59M9Zn
TLSH
T1C93535025BF4452CF2F34F3998B31B193D3BB9A84F564A4E0154A1584C6A979CFB0FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-UserPnp%4DeviceInstall.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx
Size 68KB
SHA256 36f7a4acfb7da49d04242851f2e91526ea199d577c2280225f7a2ac0aec9643e
MD5 f4230379ba82a38760b00f76b1364245
SHA1 704ab119ee735f9ff4a1ba8c244d44461a45fc68
SHA512 85235c22738ce2c955a005d6efbad7057606e5c7d7cf913cf365f88235adcc9a024772d9dc2c8d59ffa7527f2daf1569999c4b4ad6ecc70764188bdd5fcc6d37
SSDEEP 384:UNhs7f7Y7Ds7Z7cE7F7s7hj727C7f70E7871K7vF7sF7R757078T7p78717os7Zx:EbrV
TLSH
T114639A011BF1193CF1F38F3984770B692D3AF91009426A8F7164A25A9C7A97ACF717B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-VHDMP-Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx
Size 1.0MB
SHA256 5010b14dbab486daefa090a8aacf4f08fd0f529b14ce81ccd92bbaa7ff3f1714
MD5 d10f00d92c2c48380d4322f9ba177020
SHA1 9b3a56776c9c3af62de881e38804ebee17962eb7
SHA512 d274f5f80330a181e284891da783994e8e6f026a4e02d0d4a1620f40ae0a3e739f1e75782b9aec18eeaea9fe04e573dca8df5c89b4de7484b2c0dbf56defaec8
SSDEEP 384:ELh3mJmGmemU1Rim0mYmNm2mFmvmkmqmdmkmd7mFmemGmmmBdmgmrmJmmmd7mqmK:iwPC1ffhoJ5si5iiq56hRUFit0
TLSH
T11C25075627F88128F1F34F3AC5B70B102A3BE79D5F85AA5B0190D2484D09A758FB0FDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx
Size 1.0MB
SHA256 fc3f3580562cc6be8027aa143d70d96dae20ec9e86b4888798b7bf60a431ab53
MD5 f86a416bae1ac3550af0e5916c0468f8
SHA1 07986cdbd762179c118070e9b36fda4d24e2cc28
SHA512 4b5d3ae338153dca7f01e9bdb9f136145922f06c418a16500fda138a4f2b4a50c7d6c8956eabce54e39a7e0f1a22a56555d9a0423486b1b15d20d71b7a6bb862
SSDEEP 384:8RhI2zv2c262H2A2C2C2u2+2W2D2L272RX2r2E2j2Y2j2a2R2ho2Fn2B+2Z92F2B:YjQv6X/9kZJ9
TLSH
T1FD25391767F80A28F1F38F788473272515BBBE990AC2DB8F102071595D61A65CFB0BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-WMI-Activity%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx
Size 1.0MB
SHA256 5b2b5a9e00b7e2a5096ec6bbc20f0446a5caa0a848a78799a120903a512885a8
MD5 586c0bfe7195573cac9e161b33b60a41
SHA1 9cbdcd48e54478baf424f65b8f7d8557bd53b6ee
SHA512 d7675d25889e2ca561551ddb27c477d622a9efe7436c76b04146d23a3ad307b4667a3e0ae92c3e1969c4e2a3b5d1df5b9afc6e60aa5d4882ac9102898c9c0b68
SSDEEP 3072:CsaQQSqvzR8PlyrUh9EbruDQwRasal0T2y:CsaYqvzR88
TLSH
T1402553022AF81928F1F2AF3D89FB571B5577BC89496ACC8E1054538C0D65DB0CEB1BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-WebAuthN%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx
Size 68KB
SHA256 1ae0187619e8a7ef5df309a93d4cc019112e418f93f084807e6845b9f339756c
MD5 7b40c043759afbc1ff14efa4163a84c7
SHA1 975789c57eafe908c852dc549505dc144607fbce
SHA512 5ce21d98e12c26768445d336c3337369854b625355e503cdd5841185b53e3089799d73c44e32282bd2f802cab58914589cae612700c558c051fb8447d570a57d
SSDEEP 768:uEipqSckVcCik6UuqaHJYQFSrsQVcCik6Uu9HJYQFSrseNVcCik6Uuqs6q60/2eW:4wJa
TLSH
T1796334011AEC681CF1F39B74BA36467A3537B93A9E11D96F7014239E9871B10CFB2762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx
Size 1.0MB
SHA256 eccb0456f49a054f65deb88c7b798c965e5542bdbf7e4fadb74f567161727edf
MD5 63723306c710261b63b282f54113ccc5
SHA1 8e7f6e6805cb6bb540aecbd3395a531f9dac077a
SHA512 05d2673439cc8b143684377e9ec6ee1fdd93d068c4ba4c7c7d384e88ce37fbf6ff45ec57f981a4dfa828cd712a67603c8c2e8578e007a70cbc89839a2a32e72f
SSDEEP 1536:dvYvFbnZxDYCgqABVtgh3T+jJX/GmxkajXS2qtFP0l6EmvuY3Z0W2Fah809ZxG30:1QX6CE
TLSH
T1BC2566006BF40618F2F3CF3E99F26B1A5D37B9551E52D6CD0261618E0C26FA4DE70BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Windows-Winlogon%4Operational.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx
Size 1.0MB
SHA256 d8a1e5361441ed3842fe0503e96a70a4ceac27324f642233ee2756292703f930
MD5 4f7b9d2a861f7581ca3c437407436a5a
SHA1 73b8555e414d1d2f3d792019a6683b1b85d9067e
SHA512 ca8586cc99eaa9b02819df7983f4d02832f81b318f5519f26ba0600b3e352fdf30f2d428862b1ba296c2ae1b396367c11085b2b9ec52e11065482d049862e82c
SSDEEP 768:ZSHwXoivtCNhzEC3M7649w7rtqFPIuKRY2JJND2G2CX:iiv2z3Qw3wFPIuKKyJND2G2CX
TLSH
T1E7253A5637F8041DF0E2CB3D98B71B583937FD694A829A8B104063789D5A6224F74BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Security.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Security.evtx
Size 20.0MB
SHA256 2a56672d9d6c3e82818bdcf13aee00ec2e53370623916f283afd39023f51cceb
MD5 6294f4b2d17501c129704c373fdbe110
SHA1 a05068c416b46e2f701153745588f7606b10d61a
SHA512 43d565416c276b20712c7ee42b794ce0d29ff03e50eac76a71361cd30ce91be59625224fe62a9dc3216a803437acd4d8ffab4a89ee5dfed6adf2df9897e1e1d8
SSDEEP 12288:uoBkuYVEvd2zXNGUwMzN2g/VJhKmIhO7ho1k295wu8hzoPTddVKcViYn:u4HY7IUwGPKmIh2ho1kAwufP/7iYn
TLSH
T16927BC40A7FC0639F3F34F7685F743426932F8626A42CA8F4145538A0D56A25CE76EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Setup.evtx
Size 1.0MB
SHA256 0a98d886bdc6f8c0a63f5d500fabeac99cc4d7e9dd7017c1ebd8b107030d66bb
MD5 306edd0bfc29c8d36202dce11abbff46
SHA1 2a6b729ced0394cc66909b0f3260c01be5619445
SHA512 0fb5a117c049942388dbf9e75233ede0e00199c02d7aa101f034dd4956c482a1b33b5dc039e9291fd842d7a45928ad554a14ce6d26b5ce2b8c30d5029b2ec372
SSDEEP 768:Eq9TzrEF77aocby4mKF1waG3TQ2mmy5T3YJWAiunGxXGUSCtjXTmCtj:zQHD
TLSH
T1142515412BF50428F5F38B35C6B30B162B7BFD849B51EE4E016051995CA6EA18EB0FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\System.evtx
Size 1.1MB
SHA256 d3fdd609729aa80514753667db1b637631e4e195ec0380d68779d3ed84caf9b9
MD5 7a34fd9cf1a3cf677d86ae957b8857c0
SHA1 ec87518eebc3ef18949d307eb6a3ef42a8a21498
SHA512 623f8af5a7f2922dafed2075e90f209da3366a1591088b1ce0620d971305390e6e7f2b6b727717cebfacdc6f9808d040a83fb262514b0dfc1d2a030eb227d1da
SSDEEP 6144:JMDvZul3TrgoPIZW26JJnxdutRyZE3DlVjtV:6DvZuljrgoP2W26JJnxdutT3DlVjtV
TLSH
T1FB35ED013BF44428F1F38B3A84F347252E37FA605A82978F22A4B3A89C565B59F717D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows PowerShell.evtx

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\System32\winevt\Logs\Windows PowerShell.evtx
Size 1.1MB
SHA256 faa248f0707dcf74f251feafef5a2e1f1d158ab1477153c7112947622f0c7a7d
MD5 8847ad6039639c4c291c65495e050aa5
SHA1 28e005a8d3c2633ce48c3e5866672816ac5f0fb3
SHA512 3fdadf8da439995e9203afc1f801e2d14e3a42c15e4af99200e31f63b46eb4886230265696d4d52a167efec00abf8fd55e9590b17a7b5655a25e8ef946ad58eb
SSDEEP 3072:l8QyIs8mVpz9wkKWMW7W8WvC53oOFTNjfPruRmQyI7JQyIh:M8mVpz9wkKWMW7W8WK53oOFTNjH
TLSH
T1FA35CF0726E85114F4B3AF78EBB351B59B3A7D106D39CD9D61C1404E18E1E80BE62FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amcache.hve

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\C\Windows\appcompat\Programs\Amcache.hve
Size 128KB
SHA256 55ef76aa00e49536401516b96a3d903777bf9530fbbf7441e205d084e0d28213
MD5 2bb1d2461cff47114baa8e518a17e07b
SHA1 abd081cc931b05ca9f3cf1251004eb2e65b59802
SHA512 d78dbddc1867386b51a722736a7d74def46df6723b2786968b3f04f504654e22dc20896733d4fde96136bc0236b2c3449b3d4d0217694189dd65ad5a09872bf1
SSDEEP 1536:jdqXPr5NSo6v4aBCvmrrXu6FnkUDIx/6KMLcRH:xKPrHWvT3u2kSvKMLS
TLSH
T155D3BE597F90C2F1E271C7350EE25F036674F816AD205A4C6380274E8EEA755BE12BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$MFT

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\F\$MFT
Size 256KB
SHA256 f826e501de0b6792fca0610b23f76eca445c26dc2275418832c81af69a32372e
MD5 f71bbf2422c91ba1c3684b5123b9ca60
SHA1 c531a392d56d8da44b84f12ebf3d61b556d0dc09
SHA512 97f3166b7fef39dee96e755d3b338515ca8e48c8ff41cfbaedc8b659ae05b77c9efce111518901fc8afb03f41eee62a301478eb643f5d8a0a3bc82d61e489272
SSDEEP 192:Ll9u7JYTRTZuVpJttQCnMqocttWUBw/6a:7AJWuVppnMl/6
TLSH
T1A8449A93AB908A25D12D06B188FF0306B77AF5E562524B073658D33DCF7A3712D27E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Listdlls.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\Listdlls.exe
Size 414KB
SHA256 b0f6800b2bb4c86e091120e9087c75f9b1b3e46b89cf65744d65cf5ab01fd385
MD5 60a2331a2b28968585c7c7229d2424a8
SHA1 fbac538166d61b4f10db934bd4bc1b86c81e56fb
SHA512 159542a30195f58a6957d70282bd2dff79708bd2228ebebf7db48e25d80e68ea17714b518a029d2e21acf564d37982b43850249c944e99ce1b38864ffa00b009
SSDEEP 6144:IejqfgaIqi0N5fZC9kqf7Uxv9VYO1s+rTiMCOoRb0pyeZ7:IinaIqi07C7krtxnkmB
TLSH
T153945A1173E480F1E4F35A7099B09626AA3A7D724B34D68F6394426D1E72BD0EE39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Listdlls64.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\Listdlls64.exe
Size 215KB
SHA256 29d23bc492e48a5ae68444302d3430e07d08e04278d53aa70d9367d9cf8bceb7
MD5 8336396d50dcc9d5a5f66b078a8460dc
SHA1 42bf0bb282512e4c638b8f03617dd973ee09afd9
SHA512 08f34405f8d5ebf695391f9cb1deb6eb22b318b698ce9540d37eae45d36476a96d379e9f338c64d5f2f3e9674751bdb7f3661845530605b8fb1eb14ee91702e2
SSDEEP 3072:CcSIBqf7UxpYs68VYO1KpygluJrTiMLGcaad5UFyn853tOwDmh8DaNv3EL:Ckqf7Uxv9VYO1s+rTiMCOoRb0py
TLSH
T120245A5173E800E5E4F7AA3089718606EB767C564B34D78E13A442AD9F63BD0EE39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsService.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\PsService.exe
Size 261KB
SHA256 d3a816fe5d545a80e4639b34b90d92d1039eb71ef59e6e81b3c0e043a45b751c
MD5 136f9205a5945681ec470b8461dfee5f
SHA1 1ca7e6ac6128bb1f4e0318a28310525baf7c67c6
SHA512 a3eaf3665bc8a227d139fb0fd6032c1510288c3fa41a50ee5a774301f88491fa69297c437b4ddec1a0df18ba5085c9c5e61254bfcbd38fd3b5f7c4d074ede142
SSDEEP 3072:e4iIB7s+H1oGlMqE7PbxxY0X8xR1O4yjXUnJfELaQdUFvJPKg+SjWAg0FubMr/vV:e4p7sG30xTX8tajKJGa5pIAOCvM6+e
TLSH
T1E0446B1172E18432E4F32A321DB497661E3EBD614E35D9AF5798096E8E71BC0DE30B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorunsc.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\autorunsc.exe
Size 701KB
SHA256 666aa8972b4b0a1e5df53c076af44479f2f94b16f9fb56e15e6d104ed86ca9f4
MD5 b76978d483ee6afcf5b919a51a7d111e
SHA1 6b0292325505fc3ba638d42330a75cbdf237561b
SHA512 2e7f076441f7cceb1e1eb38044d7a7df4226249d4526621bb23e28fefaca80820f5a5899709862191b03837aa659be076dfc960488e24a8dd5f87b28aefe804d
SSDEEP 12288:WN/2Ekjc139fb/AJEAs8K85G3wwgwI6Ox1y95:WN/LX/AJ9s8/5G9gwI6gy7
TLSH
T1FEE45A0076A59035F1F252B029399776383EBC719A358CDFA3C0695E1DB5AC1AB3872F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handle.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\handle.exe
Size 743KB
SHA256 84c22579ca09f4fd8a8d9f56a6348c4ad2a92d4722c9f1213dd73c2f68a381e3
MD5 9f637fba2d680e23da0266c1507f870f
SHA1 05d4842c6e9b5f9430dad76a20c2a4a6feae0bf0
SHA512 addf414497df3a057ba57afab06a61f0ffb7c50134b0c83b61fe6542ec25298b893a455b317262977786f30723a23948836b402d310d6ae4bee1e6cf17a0272c
SSDEEP 12288:Lsfe2MShO2bM1teJFN9rVY5C1lq7oFpuoIG6h:Lsfe2Y2bItIHY5C1lq0nus6h
TLSH
T126F47C01F7E440B5E5B36A304AB5D6569A3ABC650B30DADF2394466E1F33BC09E35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pipelist.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\pipelist.exe
Size 331KB
SHA256 2156d7d3158ea589e8187c5cb82442ee6c37ee982bc0d728edc8a50a2a1c4281
MD5 0e7bd3e144e966321068c5e9f5ba301d
SHA1 00919feaafecb87369d0605d3ecb9fbe69b41507
SHA512 0ab6bb567e2b02460c724ab3cd83fc94f27ca0e268417bbd3a96f37f8b237c8dcfb62acedb2081e21ee216168933ac49c0fe502077fdb9fd6ed68c1088a05180
SSDEEP 6144:Yxhmgd8B4mPalFmZUYQXw/uc1Jiq0MPiU44tzElX:YSgM4mPafmiYQ6t1L18X
TLSH
T16B745A1179D08032D2B33D305B78E6724EBD78211D359A8F53982AB95F74981EA39B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pslist.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\pslist.exe
Size 212KB
SHA256 ed05f5d462767b3986583188000143f0eb24f7d89605523a28950e72e6b9039a
MD5 6c08bae0981841e0cd22ff0f0e8f7510
SHA1 cad5355c534cccf48ca8df5a1007cc34d37cb619
SHA512 1080d9e7d3151122518c8ecc09da061086f1d490656f26df99153ddd3f933da049a8364af28fa104da54089271625f229007989a2dff713782066bd8fa142c25
SSDEEP 6144:UJTVdqTvShLDFQUH9To/JPjDXDzM/P77U8lvfhC9GEPyg:KPkQWdPjrgDJlXELyg
TLSH
T1D5246B21B6D08432E4B32A305AF4D6725E3EBE715F34D58F6394067D0E21AD2DA35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcpvcon.exe

Path C:\Users\Admin\AppData\Local\Temp\Aralez_Pexwevza_2026-08-14_05-26-04\tools\tcpvcon.exe
Size 197KB
SHA256 37621bdac3ced1103278e8c0ef7b73dfa1cbe9becfbaff421a46fbc78d636b5f
MD5 356ed0fc156993551a484964f99e65b8
SHA1 6b936b5a5b4451bc4f147dad6cd2a7072a799d03
SHA512 8060b018f256ddf4dbde002b6d6b526362c617cbe8f1930a88cb4f191542240530658e8a7b6ed5c496436bcafaac0a6898e67187c3c8854e73ce6f66809c5fd0
SSDEEP 3072:A/H4UqjYVxwTcy4jPPZAjjF/hd8i2pzjGf9j3nPR1IIqQdUF1cePZGkjqjR96xUj:AP4BjYVeTfjF/r8x3GlDnpCaO0Mxg
TLSH
T19B144A18B2E08072E5B73A3069F4D6729D3EBD705F34D99F6794466D1E71AC08A30B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handle64.exe

Path C:\Users\Admin\AppData\Local\Temp\handle64.exe
Size 406KB
SHA256 24bafcc570cc9bbb6b6e6652a57a519e0464e3996891aaba6f55299cce20b04f
MD5 89f845fc4898f2d47a3a81f0b57c60f1
SHA1 b04a2347a0f94e87215424d816f9912c7bc248d5
SHA512 50bc14c4221ad984c3aa98327ee9127f7470a9a2b0a953544440a7b05f60f7f91209a96bd87d0d8f1e05551863dd43193f7f4231f382d6ad75d9f0a245939f04
SSDEEP 6144:MjRme/IYVCQ45De1/8GzfaD3f7oxakAuXeh3ohaYLCAyI5ub:MN9rVY5C1lq7oFpuoIGi
TLSH
T12A948E05F7E400E9E5B7A6348D758546DA727C594B30D6AF23A4866E1F33BC08E39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5848-1219-0x00000187D8970000-0x00000187D8992000-memory.dmp

Download