Overview

overview

8

Static

static

1

New Text D...4).txt

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    118s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/08/2026, 00:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    New Text Document (4).txt
  • Size 65B
  • Sample260815-a9bmdsda75
  • SHA256 52117e447187821cb62a265c99f6b073ec7248293ee90026cff32f2539a7763b
  • MD5 SHA1 SHA512 TLSH
Score
8/10
defense_evasiondiscoveryexecutionpyinstaller

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 44 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\New Text Document (4).txt"
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\New Text Document (4).txt
      2⤵
        PID:2060
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa3472c728,0x7ffa3472c734,0x7ffa3472c740
        2⤵
          PID:4672
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,17155070342833321332,17738454089152592298,262144 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1952 /prefetch:2
          2⤵
            PID:4168
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,2842568059570788677,11246504798823395264,524288 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2252 /prefetch:11
            2⤵
            • Downloads MZ/PE file
            • System Time Discovery
            PID:900
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,9513523164212772524,12059762447951257848,524288 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2440 /prefetch:13
            2⤵
              PID:2108
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,8287067592373254,13081846526091413341,2097152 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3444 /prefetch:1
              2⤵
                PID:1224
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,6111209452680088372,8974814228306095319,2097152 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3480 /prefetch:1
                2⤵
                  PID:3020
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,12118658731961114614,7672706782708780867,2097152 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4308 /prefetch:9
                  2⤵
                    PID:2392
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4484,i,9670750553122570897,16107353528044439568,2097152 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4804 /prefetch:1
                    2⤵
                      PID:1788
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,13244380929243996812,3914984756314089972,524288 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5536 /prefetch:14
                      2⤵
                        PID:2608
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4708,i,3478667981772755479,7673994967019992241,2097152 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5580 /prefetch:1
                        2⤵
                          PID:2296
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3424,i,730003031352021564,1063993184033062336,2097152 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3688 /prefetch:1
                          2⤵
                            PID:400
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3604,i,12449908894721589292,566593096911063523,2097152 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4852 /prefetch:1
                            2⤵
                              PID:4308
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6256,i,4002901775133995754,3348857795057655964,2097152 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6276 /prefetch:1
                              2⤵
                                PID:4512
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6420,i,5318512556076622442,11924600939721348746,524288 --field-trial-handle=1960,i,567110578035748159,4203067669917549250,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3664 /prefetch:14
                                2⤵
                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                • NTFS ADS
                                PID:2148
                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                              1⤵
                                PID:2200
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                1⤵
                                  PID:408
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:3300
                                  • C:\Users\Admin\Downloads\minecraft.exe
                                    "C:\Users\Admin\Downloads\minecraft.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4908
                                    • C:\Users\Admin\Downloads\minecraft.exe
                                      "C:\Users\Admin\Downloads\minecraft.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:1632
                                  • C:\Users\Admin\Downloads\minecraft.exe
                                    "C:\Users\Admin\Downloads\minecraft.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2428
                                    • C:\Users\Admin\Downloads\minecraft.exe
                                      "C:\Users\Admin\Downloads\minecraft.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:4464

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                        • Size 40B
                                        • SHA256 1e4f54776b1b40b456dd805327615b3c5deffcf2db33e589d5bc6b52bbcd1933
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        BookmarkMergedSurfaceOrdering
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                        • Size 6B
                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        BrowsingTopicsState
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                        • Size 414B
                                        • SHA256 2e7fb63a7c299d55f1e002b1e9eaa41cd00e4450fd5ea820653efbad719ebb6b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        • Size 648B
                                        • SHA256 e3a5850055d43734ee448537b3487bcca0682232a4ded04ed1cf79c1760474f8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Network Persistent State
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                        • Size 9KB
                                        • SHA256 91a5c036fafe784a5ba638ca38e83cab30250da1c1aae3dba660878d415c2ec9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        SCT Auditing Pending Reports
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                        • Size 2B
                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        TransportSecurity
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                        • Size 1KB
                                        • SHA256 3edaf7116502b55031fae5a11bbaaf61a31a008d33b8f44f037e81d3edddc670
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                        • Size 13KB
                                        • SHA256 37847cd8a2797cff7876a67069b32554e125a70592269c45f77de6dea81852e8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                        • Size 14KB
                                        • SHA256 986e5e423a2514661fb718e76969c54f5383ef70b9f8764ab49d588baca39e43
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Secure Preferences
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                        • Size 17KB
                                        • SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                        • Size 120B
                                        • SHA256 258dd27695dab3562e2bfb1bb742aa6f511ea17fdb85c4792031bdaa90b79c51
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        the-real-index~RFe588846.TMP
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588846.TMP
                                        • Size 96B
                                        • SHA256 9364367dc744e2d7b56cbdc3cb4a40b7c99962f0aeac1fef599e9dc0b9b36231
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                        • Size 115KB
                                        • SHA256 0e0cc537142652bce873bcaa59258057720f5685806d456b967ced971330e10c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                        • Size 239KB
                                        • SHA256 e47b14eae5290ed38072d93d653297379e39ae51075d991bea876b82d557f3c0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                        • Size 239KB
                                        • SHA256 1ebe2fc3100c6b53676e4c9a209f80ffc28c0ab6a63dc80ed2d32360b15a3afa
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        data_1
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                        • Size 264KB
                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        VCRUNTIME140.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\VCRUNTIME140.dll
                                        • Size 174KB
                                        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        VCRUNTIME140_1.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\VCRUNTIME140_1.dll
                                        • Size 48KB
                                        • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _bz2.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_bz2.pyd
                                        • Size 86KB
                                        • SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _cffi_backend.cp314-win_amd64.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_cffi_backend.cp314-win_amd64.pyd
                                        • Size 177KB
                                        • SHA256 9e99b2184c60f21a88cafc374386ded3559e8694ed7cf111f2869e066d303334
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _ctypes.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_ctypes.pyd
                                        • Size 139KB
                                        • SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _decimal.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_decimal.pyd
                                        • Size 284KB
                                        • SHA256 bc3a61685825ae37a4cd2b2b87fa27af12e01575c4f920788ea806e6781a2c79
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _hashlib.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_hashlib.pyd
                                        • Size 67KB
                                        • SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _lzma.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_lzma.pyd
                                        • Size 157KB
                                        • SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _multiprocessing.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_multiprocessing.pyd
                                        • Size 37KB
                                        • SHA256 cea83c9bf3131d079c20066b626f67ab33021b476777be2d7be26d1fa5e4eb66
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _queue.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_queue.pyd
                                        • Size 35KB
                                        • SHA256 2fd8668f52b34d0e71ae48784bd2e7d35e5d99df6f641edb0fc279235a187c8e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _socket.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_socket.pyd
                                        • Size 85KB
                                        • SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _sqlite3.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_sqlite3.pyd
                                        • Size 129KB
                                        • SHA256 ec9694e5929747e93e05bc32427d24350dc4de5074b61a37bc961c3048794a67
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _ssl.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_ssl.pyd
                                        • Size 186KB
                                        • SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _wmi.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_wmi.pyd
                                        • Size 39KB
                                        • SHA256 b6fd41f079da0c0054829855360e88b8b762f5c42bb474c2fa02eae367839ad2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _zstd.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\_zstd.pyd
                                        • Size 491KB
                                        • SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        base_library.zip
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\base_library.zip
                                        • Size 1.3MB
                                        • SHA256 a8b8cd7d7d72b02d1a8a1ad9a4b7b2c5bece0b3d815f7e48b14e94d912b6e0de
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _rust.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\cryptography\hazmat\bindings\_rust.pyd
                                        • Size 9.5MB
                                        • SHA256 05fefb14b1cb1c90bcccce87e82d205f5f2396977bf911243972790ba2376849
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        libcrypto-3.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\libcrypto-3.dll
                                        • Size 6.0MB
                                        • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        libffi-8.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\libffi-8.dll
                                        • Size 38KB
                                        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        libssl-3.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\libssl-3.dll
                                        • Size 1.3MB
                                        • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        pyexpat.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\pyexpat.pyd
                                        • Size 217KB
                                        • SHA256 e34347c4e11b2ecc57df2ce1627ba7f98fd076e9df59951e9034f5aa8e95a2fc
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        python3.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\python3.dll
                                        • Size 72KB
                                        • SHA256 6c45910e7c82617ca6360820de861699cc99f9efee434df290aa4c6e38f39886
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        python314.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\python314.dll
                                        • Size 6.5MB
                                        • SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        select.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\select.pyd
                                        • Size 32KB
                                        • SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Lorem ipsum.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                                        • Size 1KB
                                        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        sqlite3.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\sqlite3.dll
                                        • Size 1.5MB
                                        • SHA256 9a8fb79d6b7e581d127314028dcecf754b8d7fe4aca1247f82c1f33ee8fccc7e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        unicodedata.pyd
                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49082\unicodedata.pyd
                                        • Size 741KB
                                        • SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        minecraft.exe
                                        • Path C:\Users\Admin\Downloads\minecraft.exe
                                        • Size 18.7MB
                                        • SHA256 ee1e19cacb7321ffd75cb0bafc437096ab522fd2bfc3b88c4d4d954aa0e50200
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        minecraft.exe:Zone.Identifier
                                        • Path C:\Users\Admin\Downloads\minecraft.exe:Zone.Identifier
                                        • Size 314B
                                        • SHA256 d4e9a45103d7c7d6cbc9287795403ee00ebdc45310c54f3036690cbb7337ffb3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        memory/1632-409-0x00000275599C0000-0x0000027559FB9000-memory.dmp
                                        Download

                                        memory/1632-411-0x00000275599C0000-0x0000027559FB9000-memory.dmp
                                        Download

                                        memory/4464-510-0x0000025FD5960000-0x0000025FD5F59000-memory.dmp
                                        Download