hxxps://pixeldrain[.]com/u/C9QWBv35

Resubmissions

25/09/2026, 07:12

260925-h1tevasdqa8

07/09/2026, 19:46

260907-yhcblsba668

Analysis

user interaction
yes
max time kernel
183s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pixeldrain.com/u/C9QWBv35
Sample260925-h1tevasdqa

Score

8^/10

credential_access defense_evasion discovery ransomware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 11 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4260	chrome.exe
3648	chrome.exe
4788	chrome.exe
4828	chrome.exe
4728	chrome.exe
4060	chrome.exe
5156	chrome.exe
5328	chrome.exe
5264	chrome.exe
2020	chrome.exe
1768	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
5348	node.exe

Loads dropped DLL 61 IoCs

pid	Process
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe
4628	okitas_takeover.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2724	msedge.exe
6056	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
5264	taskkill.exe
5436	taskkill.exe
2728	taskkill.exe
5788	taskkill.exe
3172	taskkill.exe
4024	taskkill.exe
1236	taskkill.exe
5192	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347939672478962"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{328C3118-5E6F-43CE-93DF-BECF1E8E4917}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5796	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
4260	chrome.exe
4260	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe
4148	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	5264	taskkill.exe
Token: SeDebugPrivilege	5436	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	5788	taskkill.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeDebugPrivilege	3172	taskkill.exe
Token: SeDebugPrivilege	4024	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	5192	taskkill.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4628	okitas_takeover.exe
4628	okitas_takeover.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1776	2512	msedge.exe	87
PID 2512 wrote to memory of 2724	2512	msedge.exe	88
PID 2512 wrote to memory of 4584	2512	msedge.exe	89
PID 2512 wrote to memory of 4584	2512	msedge.exe	89
PID 2512 wrote to memory of 4584	2512	msedge.exe	89
PID 2512 wrote to memory of 4560	2512	msedge.exe	90
PID 2512 wrote to memory of 4560	2512	msedge.exe	90
PID 2512 wrote to memory of 560	2512	msedge.exe	91
PID 2512 wrote to memory of 560	2512	msedge.exe	91
PID 2512 wrote to memory of 560	2512	msedge.exe	91
PID 2512 wrote to memory of 4300	2512	msedge.exe	92
PID 2512 wrote to memory of 4300	2512	msedge.exe	92
PID 2512 wrote to memory of 4300	2512	msedge.exe	92
PID 2512 wrote to memory of 220	2512	msedge.exe	93
PID 2512 wrote to memory of 2088	2512	msedge.exe	94
PID 2512 wrote to memory of 220	2512	msedge.exe	93
PID 2512 wrote to memory of 220	2512	msedge.exe	93
PID 2512 wrote to memory of 2088	2512	msedge.exe	94
PID 2512 wrote to memory of 2088	2512	msedge.exe	94
PID 2512 wrote to memory of 4804	2512	msedge.exe	99
PID 2512 wrote to memory of 2360	2512	msedge.exe	100
PID 2512 wrote to memory of 4804	2512	msedge.exe	99
PID 2512 wrote to memory of 2360	2512	msedge.exe	100
PID 2512 wrote to memory of 1628	2512	msedge.exe	102
PID 2512 wrote to memory of 3664	2512	msedge.exe	111
PID 2512 wrote to memory of 1508	2512	msedge.exe	112
PID 2512 wrote to memory of 3664	2512	msedge.exe	111
PID 2512 wrote to memory of 3664	2512	msedge.exe	111
PID 2512 wrote to memory of 1508	2512	msedge.exe	112
PID 2512 wrote to memory of 1096	2512	msedge.exe	115
PID 2512 wrote to memory of 3704	2512	msedge.exe	117
PID 2512 wrote to memory of 1904	2512	msedge.exe	118
PID 2512 wrote to memory of 1672	2512	msedge.exe	119
PID 2512 wrote to memory of 4936	2512	msedge.exe	122
PID 2512 wrote to memory of 4936	2512	msedge.exe	122
PID 2512 wrote to memory of 5676	2512	msedge.exe	129
PID 2512 wrote to memory of 5676	2512	msedge.exe	129
PID 5960 wrote to memory of 4628	5960	okitas_takeover.exe	133
PID 2512 wrote to memory of 5052	2512	msedge.exe	136
PID 4628 wrote to memory of 5264	4628	okitas_takeover.exe	137
PID 4628 wrote to memory of 5436	4628	okitas_takeover.exe	139
PID 4628 wrote to memory of 2728	4628	okitas_takeover.exe	141
PID 4628 wrote to memory of 5788	4628	okitas_takeover.exe	143
PID 4628 wrote to memory of 4260	4628	okitas_takeover.exe	145
PID 4260 wrote to memory of 4148	4260	chrome.exe	146
PID 4260 wrote to memory of 6056	4260	chrome.exe	147
PID 4260 wrote to memory of 2248	4260	chrome.exe	149
PID 4260 wrote to memory of 2248	4260	chrome.exe	149
PID 4260 wrote to memory of 3544	4260	chrome.exe	148
PID 4260 wrote to memory of 3544	4260	chrome.exe	148
PID 4260 wrote to memory of 3648	4260	chrome.exe	151
PID 4260 wrote to memory of 3648	4260	chrome.exe	151
PID 4260 wrote to memory of 4728	4260	chrome.exe	150
PID 4260 wrote to memory of 4728	4260	chrome.exe	150
PID 4260 wrote to memory of 4788	4260	chrome.exe	152
PID 4260 wrote to memory of 4788	4260	chrome.exe	152
PID 4260 wrote to memory of 5156	4260	chrome.exe	153
PID 4260 wrote to memory of 5156	4260	chrome.exe	153
PID 4260 wrote to memory of 4060	4260	chrome.exe	154
PID 4260 wrote to memory of 4060	4260	chrome.exe	154
PID 4260 wrote to memory of 5300	4260	chrome.exe	155
PID 4260 wrote to memory of 5300	4260	chrome.exe	155
PID 4628 wrote to memory of 5348	4628	okitas_takeover.exe	156
PID 4260 wrote to memory of 5328	4260	chrome.exe	158

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pixeldrain.com/u/C9QWBv35
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb55bec188,0x7ffb55bec194,0x7ffb55bec1a0
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,10357191912718554751,5280257897169951993,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,12127085362395457351,11970511589849390654,262144 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,18225640959881735265,9475597653174156943,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,6586147916229967348,15553856327625232593,2097152 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17886601137302457733,14784082834597945177,2097152 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,5644761599705137263,7446653298118685816,2097152 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,14925478119877813766,3783114105494203171,2097152 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,291077943969486782,13095291225409446187,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,12187307506146207456,18179420276648484214,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,13433063375849335211,2474290893335519062,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,13433063375849335211,2474290893335519062,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6368,i,1185663859715397653,7054448350031743995,2097152 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,2577073787549467647,9395845917289775594,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,13861883882866995660,9165905742984193040,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,7362674718906607182,10119268252901505264,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,601888985256879051,3599698184187046590,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,14663403827670968233,9342954001127770376,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3008,i,12085867505561109056,12333860176125941358,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2050861230587823277,8184960290140898960,524288 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5060,i,9093099219040034265,14424552370195150373,262144 --field-trial-handle=2232,i,2759633663141870165,6291561005209027362,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4924

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\okitas_takeover_137_throneupdate\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5796

C:\Users\Admin\Downloads\okitas_takeover_137_throneupdate\okitas_takeover.exe
"C:\Users\Admin\Downloads\okitas_takeover_137_throneupdate\okitas_takeover.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Admin\Downloads\okitas_takeover_137_throneupdate\okitas_takeover.exe
  "C:\Users\Admin\Downloads\okitas_takeover_137_throneupdate\okitas_takeover.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5264
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5436
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chromium.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir=C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile --profile-directory=Default --remote-debugging-port=9222 --window-position=-32000,-32000 --window-size=1280,800 --no-first-run --no-default-browser-check --disable-session-crashed-bubble --hide-crash-restore-bubble --disable-infobars --disable-translate --disable-features=InfiniteSessionRestore,TranslateUI
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb62a7c728,0x7ffb62a7c734,0x7ffb62a7c740
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,7848127911813024763,4400037091917813280,524288 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2092 /prefetch:3
      4⤵
      System Time Discovery
      PID:6056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,2670324800675499897,14846254157819573858,262144 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1960 /prefetch:2
      4⤵
      PID:3544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,6421138932723204827,1345492113028090639,524288 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2100 /prefetch:8
      4⤵
      PID:2248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3352,i,9947666149167313354,14856219079573496865,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3376,i,4687772022477785854,16729449286112516787,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3960,i,6095529987600146452,15824818299355547412,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3940 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4000,i,8966798328623519731,3080875345866254029,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4012 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:5156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4836,i,2898235669376340517,7187149672725768233,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4852 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:4060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=3356,i,2099449368822917088,14775312478738562721,524288 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5040 /prefetch:8
      4⤵
      PID:5300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4996,i,18381829281660842478,3301256014520083115,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5060 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5180,i,8209190690967341131,4416560817466673092,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5144,i,1727681280558976739,13214441198214117424,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5900 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,1810096563192188547,1227807238817666128,524288 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3960 /prefetch:8
      4⤵
      PID:1968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3536,i,11777285360952785617,6706582588215425383,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6100 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6072,i,9418005885801523399,3606484726575653033,2097152 --field-trial-handle=1964,i,3068679922254661519,13402066917432502711,262144 --disable-features=InfiniteSessionRestore,TranslateUI --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6108 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1768
- - C:\Users\Admin\AppData\Local\Temp\_MEI59602\playwright\driver\node.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI59602\playwright\driver\node.exe C:\Users\Admin\AppData\Local\Temp\_MEI59602\playwright\driver\package\cli.js run-driver
    3⤵
    - Executes dropped EXE
    PID:5348
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chromium.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

39701b1f-e799-4358-a560-7107d54857a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39701b1f-e799-4358-a560-7107d54857a4.tmp
Size 10KB
SHA256 625324ba5079aea6759957b137b707db1f57f1922fcb821e19dfed85b0217108
MD5 4961b4cf1368892ec8af8744cedccd10
SHA1 3dc8f9c6bc10e6c24c1d7a553b9afe61532ba0ce
SHA512 0fdc074d6a2ba3e873957065211fb72778b7e8e3ba24cdc40dbbee45baa60cd54e022565d5c1ec57b6a9ea1200f14cb6f24df4189a7144473dba75e057e09349
SSDEEP 192:sxZQRgnr/fYsoPLIdp0hEHW6+WNFf1/YapMlZIg5RJ:sxZQcr/fYso802HbL/gt
TLSH
T15022C956AE38697B8CC7E24DBA257F63E6F9103265D11E44E6FC861C05E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

641abb02-6f81-4096-9793-89bbfed66fe7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\641abb02-6f81-4096-9793-89bbfed66fe7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b3318a392c60c50f49698b35d4755856c872ff3b98cfa0b48e02f5d6fbb211e8
MD5 251f791176e86762fc8713f31c16c530
SHA1 41d8417fbb8efa231b97b35a6dc37a31c892e859
SHA512 2647209e458d71da0ec8ba5bf879b637dc75e3e4944b040f4c9eb1cb05f3d7d999ff21fd5534de433e1c250e055be2b53331ac6f8f880164d9d850fb85c16a3e
TLSH
T1E74161889D900470FFAFF53E88D6268F3F316A85BD531E123DAACC79E88A357D125204
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 37aeb976e5b80c6a6f51a4bb3920207052e83321c2e3d0b7b81c3d06ca39fe24
MD5 0f0cd8362712d0ee3200ae51f53d13d7
SHA1 b4628ba20a58cef8f3cbf2f86cf8f166e5e97a2f
SHA512 19810f7fbf37c38471d1d60c902fef4ac0621be0cfa6524ad1fe55bd638ae43fdd4ca3f083dd8ec8bc57ebd4b5c4f6a1d54c6ef7dceb39dc398d92ac655c7aa6
TLSH
T16311BAB7C3D585AEC90516F05A24AE2BDE2C0606822C7C19CAD4EF2BD3F3076E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5d7b30f441eed0edf6ab756efcdf0526965d7c22a64a1baf515e1968b1641318
MD5 7396cbce0c065e40f786e0cf419c9c18
SHA1 3a2c8b4ed587ce7877e6cc474e15e60dd1940bf8
SHA512 3d35a0193bc40eaa7df9f46d4ba9f92018ab61ce298fbc6a55b77e0b8b44837bffff512c77273257eae9cc9d16d301bcdd41f3d8a7648945d94497a61a4d6984
SSDEEP 192:sxZQRgnr/fYstPLIdp0hEHW6+WNFf1/YapNlZIgrJ:sxZQcr/fYst802HbL/b9
TLSH
T1D822B9566E38697B4CCBE20DBA257F63E6F91032A5D51E48E6FC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 71790b435d2015f6cfb7c155da6800b7b7071f1993f4719091690ae0e2614478
MD5 56b85b825bb95271b3edfaadc953e103
SHA1 151859e5503edece57767ed2c10efef7a9326502
SHA512 627311c0019225417bd3d940d6869949580726d2444c1813e2bf91026a6bb9a0bb6293abcecc9e8e913913aa59cb2a6c1fe94c934e5d45f462fa340a9777de38
SSDEEP 192:sxZQRgnr/fYsoPLIdpKhEHW6+WNFf1/YapClZIg5RJ:sxZQcr/fYso8K2HbL/St
TLSH
T1B222D956AE38697B8CC7E24DBA257F23E6F91032A5D11E44E6FC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 aac93aadba2278794059219679194a1771ea2083a630b98913c664d5c2d7bce1
MD5 f8d95c5918cf3dd972ec160fe5f200b9
SHA1 a13c4c78b650ad7c721bcd6269a336e448f83f05
SHA512 172ddc27d18eabd38091caa3a72fef92bd1f206703a88f862e75cfd225fb765c0b12295442eb5a69562f2eb61634d932f16b7c53a661d10beaf3f74ea35d1c68
SSDEEP 192:sxZQRgnr/fYsbPLIdp0hEHW6+WNFf1/YapNlZIg5DJ:sxZQcr/fYsb802HbL/br
TLSH
T19322C8566E38697B4CCBD20DBA25BF63E6F91072A5D11E48E6FC861C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ad614176790f70db616f2ecffdd31df090729992cafb9841d6afbd1bac9e631d
MD5 8050b2f0d4bf8d2e6bc1e44d23cf6c63
SHA1 254e380baa865f84439e51bff81d7928b434006a
SHA512 a9baa4c1277f7ba7fef205e4f29b8a4f31967f3673343bd1c2f1590e5134bb29aa5e33080f02c8d1ebf0205095c6550008b4bf3725aa16e0cc57f59bdcd11170
SSDEEP 768:wcWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Dro4GfeamRo:wcWPcLKWvKeEeu1jaClLiF7w4GWamRo
TLSH
T170C2EA3B640CCB7E5FC01E9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d68a2351bb3f12486bd7bfef175f8a182cca6bfb80370817f813c62985fdd531
MD5 aeda7ec2615b8bd7069fa333c3fdbca3
SHA1 344d07241b8f3ee9afdfdd3543420e98e6e927dc
SHA512 a1b7434194a3c074f0ae5c2399050552ed4e7b9ce5227aae18d96e90f3653c48d01ba37df262fb64f9acd58baad75c5aa62c9048dea77459ca9445fb8bb3005b
SSDEEP 48:K0Q/26gK+/b2NWISS/K9u10/xIvY1mOUyLtMBdvbfAbzGTISVAK9V13AxFQYWX3c:KgvaK0w6im0KjSwTuKAc69
TLSH
T1B991F44172BA0200797E394C84E19B5F418231737129F62BBFAD4166CD6BE190EFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a9b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a9b3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6614b0ec0869d5c80053c584d8a638de1106182b099f0679f3e8d7dff7f8dcb0
MD5 1d91a32af1aa98f627d6f23f9e82f62b
SHA1 fa984e57a25b85cfd9a1991b50ac85a1f5d62731
SHA512 0cb99db08014e54f11c6101105910da6e0b2307dcc5a18a83aa76547314ab2e08de2d160d49e0a6ccf772cbbc2c57c40ebdd9498c78d26bc5f03bc082cec4e28
SSDEEP 384:uiFBZcI0GsNQ8TUNTUlIlsV6y1d40zIGmQw+WUwjEimtgOIwZOyacoo:FFJNZwgs6yIu/wZ9EimXs43
TLSH
T114C23BF248EB987AD9AE5747A77E2D134EBCC057B5849690B3D84A0CCC971BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bf07d9f5ac7217ea84acfaa1aa4f8ca7e6b5bd7a65a35e42cae59b51cb4e7ddd
MD5 dbb0eb9d5c9176ca6e8582aaed48db5a
SHA1 b3d317f4f3b637583e8f28344c33b67104c9119a
SHA512 6fdc84826fefea366b05daddf3b2099bb57370b19034484337f006f34766d9eba0573fea9d21757e5b5b2389d20359bbf58dc5875e2a7b4a6c4c79820adf6921
SSDEEP 96:3qONkjQsjpfe/tyng7X5ih/cIPURHl8h4otop5bYDHNBnP9ZvEI0IG2jbb0lmtIj:aONj6IE7QmiUyiHTPuIGmQw+fC7sj7U6
TLSH
T16502E835AC787CBB9EF36D05F4877A23AEA5112BE9952F84D9E81A0D00DB24C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c34f714c3fdd2680dfa4f5462b2e7288d2d5db0271ae59a4f42e2a3ef8d0c53f
MD5 18b7770aa29c1774d4db8a9347710a3a
SHA1 26774e223d617fe829aefab895fbdec4480ecd5f
SHA512 7aca26cc72bc7131aa1a84e05ca5b6ffbc058e102195590580de14ca644b50e3f81d2312fecefee3b6284bcec19fcdab39eb0e99a3ad866b5acaf58e0f03421d
SSDEEP 384:KZcI7sNQhV6y1dK0zIGmQw+WUwLimtgOIwZOyacoo:o7n6yau/wZ5imXs43
TLSH
T17C827D369C7CAC7B6DF79144F5873A135EB880679AC86B94D4EC5B1D01DB298030B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e2e5be78e41d4c8c4f87d0f29a9701496acd543e92fd0391f171a7c9539b8372
MD5 c002397c54900d53fce66d3a55d8dfcb
SHA1 7cc356170ff10f4d44bb62d7f6f52f6f91a411d3
SHA512 b428fdf181437b2684548d2728788c7f2ab402097f83a150b03eb64dce0b4479daac590a214514100bd48e457bd5c286db73fe8467200a0d1c744dd5d1741041
SSDEEP 384:6ZcIYsNQsV6y1dK0zIGmQw+WUwLimtgOIwZOyacoo:4Ya6yau/wZ5imXs43
TLSH
T1FE828D369C7CAC776DF79184F5873A135EB480679AC86F90D5EC5B1D01DB298030B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 684c70f752d3d10a63a914a518ef4e3e4c95812cd09a53f01000e8185444b58a
MD5 65670c90c410fcc5eb15325f86adff11
SHA1 c6a874900450c5dc901942b20c2f0db5b7918a45
SHA512 f2bcaa8d59070d15c52c9b36c1b538165e25088afbe69c12eb26c053b1e8577fb290f0806f859a30413970f3a4445f54705384c26c638e995d5ca2fb1df4b64d
SSDEEP 384:KZcIhsNQhV6y1cK0zIGmQw+WUwLimtgOIwZOyacoo:ohn6ynu/wZ5imXs43
TLSH
T103827D369C7CAC7B6EF7A144F5873A135EB880679AC86B94D4EC5B1D01DB298030BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ddcd9613a7d62755c6f373912c17a8010f65ddffa3b0be0ddf34e952d40f3b5f
MD5 470055f2d0c118a4c887dbedb9db77eb
SHA1 2947df77afb6c2fa1f0152e2d703d55dd06d264c
SHA512 6d59cedb991d271ae2a0dc6784d3a1d4922f67e666be493edd2b4f80ad2776fcb18beb8e6626977016c3b9a6522016ac091fe56aced3fbaa8b3327c8fd1decea
SSDEEP 192:aONx6IEGQmiUyFHTUuIGmQw+WUwFJn27Hk/nU6:aONx6DiCUuIGmQw+WUwIHmU6
TLSH
T11C121A36DC78BC7B9EA3A884F48339235EA54227DB886F84D5DC1B1C00DF25C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9a65430-4dde-4674-b5db-4644b0d4ed79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f9a65430-4dde-4674-b5db-4644b0d4ed79.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 31f251b29f2fe5f9991a0b6f80faf06d6a06c6c8920938db33489884ffd6a32c
MD5 3dcaa685ba94c9fd7d31ee98b2fd51da
SHA1 a8b519086fa163e1eb38fd3b95ac1348ce0efc67
SHA512 ce41653feae8f0ee14eebdd165b8d27146faebae94608c4b4c02f17766ca0be67633433992d0519c1fcdc81ea988a0bcbe236080732fc08d188391393a6f8ebf
TLSH
T1FC411A5CA6F91158B7B7AF56AFF6A92D447BB9372F0AD46D00110E4E0622A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Default\Web Applications\Temp\scoped_dir4260_1805208715\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\OkitasTakeover\ChromeProfile\Local State
Size 263KB
SHA256 888b636447142144e812254ce5a9856486ed56aca0a228c98fe58a0a72a42eb8
MD5 b35a959a795705c23de3541fd6232696
SHA1 1a113a59923c83f3a57dc8f8f4d788ff087cfe4d
SHA512 66f0b0b56b3b112a0c823248e10f00327ed9485d9a3229a2ef1e09f649262b07be7b63ee9fe99dc07476498434b4ce1285c10b41b6e4977de595282780e789bc
SSDEEP 6144:eR35kRoNe+kLw7U1zwnq4USf7whn1qP+hFD+7t56OD9ZfSApprQ:eR35PNxE1zAfC1qPyFSXD9ZfS46
TLSH
T1CD442334BAB8EC13C6FC1526A41A4615DDB0D8FB82E6264D98933AD5E15FDD90333E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\SDL2.dll
Size 2.4MB
SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
MD5 83c5ff24eae3b9038d74ad91dc884e32
SHA1 81bf9f8109d73604768bf5310f1f70af62b72e43
SHA512 38ff01891ad5093d0e4f222c5ab703a540514271bf3b94fb65f910193262af722adb9d4f4d2bd6a54c090a7d631d8c98497b7d78bd21359fdea756ff3ac63689
SSDEEP 49152:7Vj3jF2sAlo/43FCPLQ+Ebh8NsB+f94OKLvci5R77CuiY:RrjFiOmC/65TowxCui
TLSH
T1B9C52A0AB3F6179CF6F78E749676A7225832FC298910DAAE2150953D0C31F908975F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_image.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\SDL2_image.dll
Size 122KB
SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
MD5 b8d249a5e394b4e6a954c557af1b80e6
SHA1 b03bb9d09447114a018110bfb91d56ef8d5ec3bb
SHA512 2f2e248c3963711f1a9f5d8baea5b8527d1df1748cd7e33bf898a380ae748f7a65629438711ff9a5343e64762ec0b5dc478cdf19fbf7111dac9d11a8427e0007
SSDEEP 3072:6bsejIuO504fzsOM05Nmy7iGpJ7SvFisgf:6bmX0qQOhmyPs
TLSH
T182C34A17F2E3A0FCC617D0B4A297B637F43138551630BEBE1BA09A345E61E207B9D916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_mixer.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\SDL2_mixer.dll
Size 285KB
SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
MD5 201aa86dc9349396b83eed4c15abe764
SHA1 1a239c479e275aa7be93c5372b2d35e98d8d8cec
SHA512 bb2cd185d1d936ceca3cc20372c98a1b1542288ad5523ff8b823fb5e842205656ec2f615f076929c69987c7468245a452238b509d37109c9bec26be5f638f3b7
SSDEEP 3072:uHT3KS12sljkvy5jXabgwdIFwix1Cvmm1xXLLPAgx+3BfZrzJ9qYdt2mTdIssFor:E3Kdy5eb+wix1Cv/7MBJJ95IssFo2p
TLSH
T199544B4BF2A365ECC127D03456BAE737B8B1B4A002217CBE5744DB316E12DA0A72DF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_ttf.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\SDL2_ttf.dll
Size 1.5MB
SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
MD5 f187dfdccc102436e27704dc572a2c16
SHA1 be4d499e66b8c4eb92480e4f520ccd8eaaa39b04
SHA512 75002d96153dfd2bfdd6291f842fb553695ef3997012dae0b9a537c95c3f3a83b844a8d1162faefcddf9e1807f3db23b1a10c2789c95dd5f6fad2286bae91afb
SSDEEP 24576:jS8/9uHym3+c6zXD75JqzkiTPxk6saGjhn7+DNvY1vDe9tnYP05pi8ZpFUcjt:n/9ub3+c6zXDrqzkZ1vjhiDNvY98W2UQ
TLSH
T157756C96E2A394FCC22FC170429BD773F531B82000256DBF99A4DE70AE11ED06B5DB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\VCRUNTIME140_1.dll
Size 48KB
SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
MD5 7e668ab8a78bd0118b94978d154c85bc
SHA1 dbac42a02a8d50639805174afd21d45f3c56e3a0
SHA512 72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032
SSDEEP 768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
TLSH
T1F6236CD593785082D49BA9B08197DE17BE3CFA924B50928F0BA1D15C2F637D0A73D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_asyncio.pyd
Size 69KB
SHA256 0d4fbd46f922e548060ea74c95e99dc5f19b1df69be17706806760515c1c64fe
MD5 2cd68ff636394d3019411611e27d0a3b
SHA1 da369c5d1a32f68639170d8a265a9ea49c2c8ebd
SHA512 37388d137454f52057b2376d95abcc955fa1edc3e20b96445fa45d1860544e811df0c547f221c8671dc1a4d90262bb20f3b9f114252f3c47a8c3829951a2ce51
SSDEEP 1536:nhaPPkvDcBlqCTFFQ/ObfW11swNIGOnL7SyaeCxT:hanCDcnqCJFOObfW11swNIGOnLoeE
TLSH
T115637D83A290459ACD97A2B4D5632F57DBB1F5430A01479F62A8C18F2F6379242FF722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_bz2.pyd
Size 82KB
SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
MD5 c7ce973f261f698e3db148ccad057c96
SHA1 59809fd48e8597a73211c5df64c7292c5d120a10
SHA512 a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
SSDEEP 1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
TLSH
T1F2839E93F3A055B5E41BA27699A10357E371FD4A039093EFB348835B2F13B913D6932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_ctypes.pyd
Size 121KB
SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
MD5 10fdcf63d1c3c3b7e5861fbb04d64557
SHA1 1aa153efec4f583643046618b60e495b6e03b3d7
SHA512 dc702f4100ed835e198507cd06fa5389a063d4600fc08be780690d729ab62114fd5e5b201d511b5832c14e90a5975ed574fc96edb5a9ab9eb83f607c7a712c7f
SSDEEP 3072:kuiS11BYNd+5AWdu41qOqJ/f/EX4lCPIWu1ptpIGLP+z:Pl1U+Ke/16f/ExWI
TLSH
T13CC36B0B339410AAEBA34179C5B36E07D7B1B45A175087CF12A4C69A2F637936D6F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_decimal.pyd
Size 247KB
SHA256 a28c543976aa4b6d37da6f94a280d72124b429f458d0d57b7dbcf71b4bea8f73
MD5 21c73e7e0d7dad7a1fe728e3b80ce073
SHA1 7b363af01e83c05d0ea75299b39c31d948bbfe01
SHA512 0357102bffc2ec2bc6ff4d9956d6b8e77ed8558402609e558f1c1ebc1baca6aeaa5220a7781a69b783a54f3e76362d1f74d817e4ee22aac16c7f8c86b6122390
SSDEEP 6144:DV0lmIvcruIDCiryrjqPBTn9qWM53pLW1AuDRRRctULoT3TdTx:SN0rQiryr8TaV+QTdTx
TLSH
T19B346B57A2490CA4DE73807499979B57FBB278850320D2CF43A48AA73F577A327BD348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_elementtree.pyd
Size 130KB
SHA256 9bfb6f4a1ce9507cc6858b29f218341fa43d4b1ec77f44fdb58333170874bd22
MD5 7c9856091ddfa30df70ff7f16b9cf2a2
SHA1 2abadd70828a3266ac987137be125f64ce05976f
SHA512 2837a8f96d7b8ce02e40bdd94d4d52ec850639a9099b65445c0c9af819bca51e61804ad42435a32c3a4d8af6791c2da47a85f57c89b5b91e98ddc0d03aabab1f
SSDEEP 3072:zBJ9IQPxvKcwscYk26lf4YkPQ5OgtEk2KGw/PzrFIG6fb6z:FJaQPxvKJck26SbQEmXGw/Pzrhz
TLSH
T1FFD35A5BB261D0AFE452403996674F16D7B2FCA20E0187CF6288F6AC9F333563E69315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_hashlib.pyd
Size 63KB
SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
MD5 f495d1897a1b52a2b15c20dcecb84b47
SHA1 8cb65590a8815bda58c86613b6386b5982d9ec3f
SHA512 725d408892887bebd5bcf040a0ecc6a4e4b608815b9dea5b6f7b95c812715f82079896df33b0830c9f787ffe149b8182e529bb1f78aadd89df264cf8853ee4c4
SSDEEP 1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
TLSH
T1DA537E46A2814498D92781B5D9A34E97FAF1F1051B11A7EF0368C2CD2F337C396FAB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_lzma.pyd
Size 155KB
SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
MD5 4e2239ece266230ecb231b306adde070
SHA1 e807a078b71c660db10a27315e761872ffd01443
SHA512 86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
SSDEEP 3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
TLSH
T14DF33992A394F4E5F7228C78D6624F13D7F678490310929A12CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_multiprocessing.pyd
Size 34KB
SHA256 fb69005b972dc3703f9ef42e8e0fddf8c835cb91f57ef9b6c66bbdf978c00a8c
MD5 811bcee2f4246265898167b103fc699b
SHA1 ae3de8acba56cde71001d3796a48730e1b9c7cce
SHA512 1f71e23ce4b6bc35fe772542d7845dcbea2a34522ba0468b61cb05f9abab7732cbf524bcff498d1bd0b13b5e8a45c373cca19ad20e5370f17259e281edf344be
SSDEEP 768:VAIvrenSE0PkA9c0ji+m9IGWte5YiSyv2pAAMxkEn:6ITQSH9c0jlm9IGWtU7SyOOxj
TLSH
T168F28E53EA941856D837897694D39E2AE671F7470B10C3DF2355C24D0F723823BEA39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_overlapped.pyd
Size 54KB
SHA256 5d298bb811037b583cff6c88531f1742fae5eee47c290adb47ddbd0d6126b9cc
MD5 f9c67280538408411be9a7341b93b5b0
SHA1 ccf776cd2483bc83b48b1db322d7b6fcab48356e
SHA512 af2156738893ef504d582ace6750b25bc42ad1ec8a92e0550ce54810706d854f37a82f38eb965a537cad5d35c0178c5eb7b4d20db2a95bebfecf9a13c0592646
SSDEEP 1536:2ND3ua5sIRL9EiqXxpNdtrtBIGXtz7SyNxM:2NjOiUpNdPBIGXtzi
TLSH
T1C1436B4AA79004E9DD27C57EE4A30E17EBB471825611935FA2ACC24E1F73B4337AE385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_queue.pyd
Size 31KB
SHA256 2ad02d49691a629f038f48fcdee46a07c4fcc2cb0620086e7b09ac11915ae6b7
MD5 6e00e0821bb519333ccfd4e61a83cb38
SHA1 3550a41bb2ea54f456940c4d1940acab36815949
SHA512 c3f8332c10b58f30e292676b48ecf1860c5ef9546367b87e90789f960c91eae4d462dd3ee9cb14f603b9086e81b6701aab56da5b635b22db1e758ed0a983e562
SSDEEP 768:/k+Ea6rfMkAYY0J/MpIGQUG5YiSyvHAMxkEJ5YSv:8tfHY0JEpIGQU87SyPx/Y+
TLSH
T103E28E93AA546C9AC833C57194D35E35F970BA53470087EF2318C29D1F323837ABA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_socket.pyd
Size 81KB
SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
MD5 899380b2d48df53414b974e11bb711e3
SHA1 f1d11f7e970a7cd476e739243f8f197fcb3ad590
SHA512 7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
SSDEEP 1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
TLSH
T179834911A69050F9DBB3C17AC6635F23FB74B4C01390A39F1196C66A1F33782BE79A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_ssl.pyd
Size 173KB
SHA256 a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b
MD5 9b4e74fd1de0f8a197e4aa1e16749186
SHA1 833179b49eb27c9474b5189f59ed7ecf0e6dc9ea
SHA512 ae72b39cb47a859d07a1ee3e73de655678fe809c5c17ffd90797b5985924ddb47ceb5ebe896e50216fb445526c4cbb95e276e5f3810035b50e4604363eb61cd4
SSDEEP 3072:KXGEr/16/nJxNOJW5NT6X3l44K5WOSCSVRJNI7IM/cbP7RHs3J7VIGC7hN:Y/r/16/nDNPT6X3l1CMVS7i
TLSH
T1F4046C47B6942DB7D813E4BAC1230913DBF1F015331247DE49D6D6490F17B0AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
Size 222KB
SHA256 df5ea1b515f4e6677196f3d8c2f40a00b008d8e09152d08425f794e1b55f890d
MD5 d66f0edb0e1bea4403c1f38fe554a620
SHA1 3bfd2dee7da0d0641ed370e592c964e67252bbd3
SHA512 f3a535e31fb9e5bbaa7575eef02d79029e067f24fcde0548b8fd185290fed7c09b67f5dc7034186f3345b23d8a53efadac7fac5a01d98ae03d9452a31e6eaff5
SSDEEP 6144:ifUDesVRGeIiW1mrnHGGaxkP8VXaVlaz8fnt4HtFmiGJ/MIOM+033X+:KxsV8gW14G6le
TLSH
T14E24193662840066ED735275CC63A123DAF2B1610732A6CF05E0C7A55F2BFDAB6FDA05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audio.mp3

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\audio.mp3
Size 6.3MB
SHA256 9fe39c768ec1608a49081205877bcbb40381d1cb68961678e5a8b5f5f1ebae86
MD5 c1e40643c3869439af5ce7007d8be952
SHA1 2d200e44b14a0edfc76974abb79d8b239d8ac6f6
SHA512 9b42c9be18fdd36934f04ed74caf41f979add75b0f0ca02c75d53cae0dfcd46089b5d47e73ff706a210fc15f4ec13ae6d565f2f97a7f710f3c84f165e86abbd7
SSDEEP 98304:qvacxSt3KQQsDDNV1ruxFHl0Nw7UKTK6dRVJUtTATB2GIHXRT32Xb4XSo/meICVP:qCcxSt6QvDb8Hllet8QhT32mP1MUV
TLSH
T105663397265DB538F8D802B10FA70B60547B3FA82299E1B67918F65732F2753B3C2D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\base_library.zip
Size 1.3MB
SHA256 67260f560e4e59704b6d4de6383dca722522a6b880e3a3376eba08111ebbde3f
MD5 4739958974fa5a896fb9a2c0eb21e493
SHA1 7dc6679a33fe92ac999594223166fb59b95ab1c5
SHA512 cb388ca2dc6c3faf2ae508354209e0e7b7c23c73d10dae4a60f1e38a5f5d2798672b2f143901c2b8d3040aaa429f8de3514a5aa0ce8899193d7e0862ee965ab2
SSDEEP 12288:P4HtzJYTq+zYgEkA1qJuA/gRD9waYcKw9w0P6dY5MQOmgRDgCWttcY+brlVYj:wtJhROaYcKn0P6dY7HCDsttcY+jYj
TLSH
T1DE55D681B692A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\config.json
Size 5KB
SHA256 6b9c0c2244133c51f335ca14786ba537bc42dfa89ccec15a88f9141175475ad8
MD5 decf3ed6c68826ddf1e3470bb5e7199c
SHA1 328bac0e6a29106fd4465ce3a147c4b9804e7248
SHA512 b85ad7cc68b4a5ffada056f8c3cc4afc8a332ecc6bc3d1a7ba9a0e1409815bd153f018675857bf4605ada21e4926c8f8948636681e4eaeaad9158b0d4d22e2c6
SSDEEP 96:oGMRrOJX8leXja63OOPPed3L6zmZ0SvMuyAHPabPmLXH1XryAbGSiDM81:ohRrOx8fldGhDZ
TLSH
T151C17623E6790C2152F5B76B595BC692FB231A37DB51943EB07EF21C0B21A15803E78C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\freetype.dll
Size 639KB
SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
MD5 236f879a5dd26dc7c118d43396444b1c
SHA1 5ed3e4e084471cf8600fb5e8c54e11a254914278
SHA512 cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254
SSDEEP 12288:9rVLid+Cjymyr99WvoHkeFP+MppfEWmHa:9x4+799HkPlZ
TLSH
T1BAD48D83F3A515A8C667C2388717832AE77670051310ABDB16E45B6B7F13FE66B3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjpeg-9.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libjpeg-9.dll
Size 238KB
SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
MD5 c540308d4a8e6289c40753fdd3e1c960
SHA1 1b84170212ca51970f794c967465ca7e84000d0e
SHA512 1dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b
SSDEEP 6144:I7wNZIYb0maLgCaqrWqg7EdP8J1dJHoFaeghCbBL:I7we7gCaqrWqg7EdP8jpY
TLSH
T1FC347E16EBE3ACECC927C1B4079BE732E860B4651215ED2F1694DA313E52DA05F4DF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmodplug-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libmodplug-1.dll
Size 259KB
SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
MD5 ead020db018b03e63a64ebff14c77909
SHA1 89bb59ae2b3b8ec56416440642076ae7b977080e
SHA512 c4742d657e5598c606ceff29c0abb19c588ba7976a7c4bff1df80a3109fe7df25e7d0dace962ec3962a94d2715a4848f2acc997a0552bf8d893ff6e7a78857e5
SSDEEP 6144:AT91DT7fIooHEx09YvFTAPMH3eqSy9eNdUAK0l:ATPDnIKxWm2MXeqD3
TLSH
T1BF447D16F7D35CBEC267C07482DBD773A97274220312AD3A42A0DA733D65D901B6AB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libogg-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libogg-0.dll
Size 25KB
SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
MD5 307ef797fc1af567101afba8f6ce6a8c
SHA1 0023f520f874a0c3eb3dc1fe8df73e71bde5f228
SHA512 5b0b6049844c6fef0cd2b6b1267130bb6e4c17b26afc898cfc17499ef05e79096cd705007a74578f11a218786119be37289290c5c47541090d7b9dea2908688e
SSDEEP 384:OJJhN0Zr3dtX7q96ZSd/Y7AulE5P1P/X7WCRsS7TP:Ork3dVnSW7AMEp1PPaCqS
TLSH
T1DCB2291A729299ECC64FD1F8C6E9977062FE7840C6963B7A07B0C3361D7198A1738E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopus-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libopus-0.dll
Size 359KB
SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
MD5 e1adac219ec78b7b2ac9999d8c2e1c94
SHA1 6910ec9351bee5c355587e42bbb2d75a65ffc0cf
SHA512 da1912243491227168e23fb92def056b229f9f1d8c35ae122e1a0474b0be84ceb7167b138f2ee5fffd812b80c6aca719250aca6b25931585e224e27384f4cc67
SSDEEP 6144:giqhiJwDR6q7f4jNOSO7lMv1EzSvwz4LhPqu7c6m1OOzzih22:5yDRpf4jXO72IcLNqHtzzi0
TLSH
T19F746C06E6A38CEDD167E470539AB733E831781412285C7B57E0CAB02F76E505A8E77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopusfile-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libopusfile-0.dll
Size 45KB
SHA256 ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
MD5 245498839af5a75cd034190fe805d478
SHA1 d164c38fd9690b8649afaef7c048f4aabb51dba8
SHA512 4181dea590cbc7a9e06729b79201aa29e8349408cb922de8d4cda555fc099b3e10fee4f5a9ddf1a22eaec8f5ede12f9d6e37ed7ad0486beb12b7330cca51a79e
SSDEEP 768:fjSfWfmLgQ4sKxsyEZtUeM3xZaGYWJajk0qgm/v/40:uufmF2zEZtUdxZaW4q1n/4
TLSH
T11B230847F18590FCC2EBC03887E69233BA72B85589253F2E9BA0D7365B25E50772C725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpng16-16.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libpng16-16.dll
Size 206KB
SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
MD5 3a26cd3f92436747d2285dcef1fae67f
SHA1 e3d1403be06beb32fc8dc7e8a58c31e18b586a70
SHA512 73d651f063246723807d837811ead30e3faca8cb0581603f264c28fea1b2bdb6d874a73c1288c7770e95463786d6945b065d4ca1cf553e08220aea4e78a6f37f
SSDEEP 3072:VatMOImapxER0/vnm2mjq61IJJT1fX0yuWUQstxZw2TnzFEY5IQ:VatMOImapaR03nmnYJV1cjtnwunw
TLSH
T194246C47F3A35DBDCA97C1748257E772A671BC242234EEBF1294DB302E11C60771AA29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
TLSH
T188F43B9DB3B8059DE9F6D13D86534623E3B6F4152370EBDB065186390F23BD52A3A388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtiff-5.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libtiff-5.dll
Size 422KB
SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
MD5 7d40a697ca6f21a8f09468b9fce565ad
SHA1 dc3b7f7fc0d9056af370e06f1451a65e77ff07f7
SHA512 5a195e3123f7f17d92b7eca46b9afa1ea600623ad6929ac29197447bb4d474a068fd5f61fca6731a60514125d3b0b2cafe1ff6be3a0161251a366355b660d61a
SSDEEP 6144:d8x4RKXHtEOtiYFJEn9RX9kgr+6Dr1Xu1ih/QpGJylW:qx4RK3tvKRH3Dt4ih9Ji
TLSH
T13194C505CED109BFC97A813056E7C621B273B4953B12EF6BA258F1303E51B9026976FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebp-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libwebp-7.dll
Size 437KB
SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
MD5 2c5aca898ff88eb2c9028bbeefebbd1e
SHA1 7a0048674ef614bebe6cc83b1228d670372076c9
SHA512 46fe8b151e3a13ab506c4fc8a9f3f0f47b21f64f37097a4f1f573b547443ed23e7b2f489807c1623fbc41015f7da11665d88690d8cd0ddd61aa53789586c5a13
SSDEEP 6144:t2lROjMXfhVy+tEZzshykv2SxgQceWni1UC2JCsJ5zIGWexIaZOovMPVt9ACB/1O:JMtVykiiiCsJdpxIaZOokPVtW
TLSH
T131945B0EE69335DDD51BC47046AEA7B3B9647C2D4220A83B1755FE312D32F80970AF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmidi.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\portmidi.dll
Size 41KB
SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
MD5 df538704b8cd0b40096f009fd5d1b767
SHA1 d2399fbb69d237d43624e987445694ec7e0b8615
SHA512 408de3e99bc1bfb5b10e58ae621c0f9276530913ff26256135fe44ce78016de274cbe4c3e967457eb71870aad34dfeb362058afcebfa2d9e64f05604ab1517d4
SSDEEP 384:GZBiKpE2uNn13biY3zlwbRk5pDrXdJx+CxY0IF5ETUhYF3STo0Mte4TxL1e1/s7e:MrbELdnDrtJzghYF494Zp0Vr
TLSH
T12113EA7B9773C45CC0EFF134AAC785B3A075BC211A71566E07468A123F678A09E7E8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\pyexpat.pyd
Size 195KB
SHA256 e1d56ffbf5e5fab481d7a14691481b8ff5d2f4c6bf5d1a4664c832756c5942fe
MD5 f554064233c082f98ef01195693d967d
SHA1 f191d42807867e0174ddc66d04c45250d9f6561e
SHA512 3573a226305cec45333fc4d0e6fc0c3357421ad77cd8a1899c90515994351292ee5d1c445412b5563aa02520736e870a9ee879909cd992f5be32e877792bdb88
SSDEEP 3072:mhaQEuYCUDWuc7VmkqrgVrLJEKAAKJadAT0nIgjWdopPb/+mVApIGLhSZ:yaJh6v7VRVrLJEKAABiuXKd4GE
TLSH
T100145A57B1A6C0EADC83803896D74E07CBB2B865038197CF12D4E77D9F277923A69319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
TLSH
T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\select.pyd
Size 30KB
SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
MD5 bffff83a000baf559f3eb2b599a1b7e8
SHA1 7f9238bda6d0c7cc5399c6b6ab3b42d21053f467
SHA512 3c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948
SSDEEP 768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
TLSH
T13ED29E97AF601845D823C972A9E74E26ED32B6A7475083CB3368C15C1F227C277BB764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\tcl86t.dll
Size 1.7MB
SHA256 28b61545d3a53460f41c20dacf0e0df2ba687a5c85f9ed5c34dbfc7ed2f23e3e
MD5 b0261de5ef4879a442abdcd03dedfa3c
SHA1 7f13684ff91fcd60b4712f6cf9e46eb08e57c145
SHA512 e39a242e321e92761256b2b4bdde7f9d880b5c64d4778b87fa98bf4ac93a0248e408a332ae214b7ffd76fb9d219555dc10ab8327806d8d63309bf6d147ebbd59
SSDEEP 24576:+AZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDA:+A0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDu
TLSH
T1A5858E1BE76410A8D8ABD1B8C527BB0BEBF178151350A7DB51B08B912F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\tk86t.dll
Size 1.5MB
SHA256 23a195e1e3922215148e1e09a249b4fe017a73b3564af90b0f6fd4d9e5dda4da
MD5 ef0d7469a88afb64944e2b2d91eb3e7f
SHA1 a26fd3de8da3e4aec417cebfa2de78f9ba7cf05b
SHA512 909f0b73b64bad84b896a973b58735747d87b5133207cb3d9fa9ce0c026ee59255b7660c43bb86b1ddeef9fbb80b2250719fd379cff7afd9dbec6f6a007ed093
SSDEEP 24576:gR3uXVFKflt2zwvzPYHURwgVdF9EWyCzfdmHQnveD4CGan9nViFoHb15K3cmwdbi:SeFSpvzg0RwgVdF9EWyCzfdmHQnveD4r
TLSH
T19D754C06A261C198C66EA134C91796FADBF17C14931057DB76A0BE6D3F33BE2273A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\unicodedata.pyd
Size 1.1MB
SHA256 2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
MD5 a1388676824ce6347d31d6c6a7a1d1b5
SHA1 27dd45a5c9b7e61bb894f13193212c6d5668085b
SHA512 26ea1b33f14f08bb91027e0d35ac03f6203b4dfeee602bb592c5292ab089b27ff6922da2804a9e8a28e47d4351b32cf93445d894f00b4ad6e2d0c35c6c7f1d89
SSDEEP 12288:IFrEHdcM6hbZCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfctZq:IFrEXcCjfk7bPNfv42BN6yzUtZq
TLSH
T1BF354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallpaper.jpg

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\wallpaper.jpg
Size 870KB
SHA256 e2b40e5dd92c595e2bde55ec7a0d4cf3151c6227f49a45c547740b7449b8b5f6
MD5 1edaebb4e0013040a0ee63c65f5fa6d3
SHA1 f9e3da2e1d1b472ab12c14b94149010c881a7a0f
SHA512 11db573f034325abf16c3102f86c56ea00d3d141eaba2901cef7faf2525616bf759697315d6d9ddbe64ac27dde0d5f9e79f2a915357047b1f6bdff9c5ea50b12
SSDEEP 24576:AiR44yWyAEVjckL9aiWDdgbAqO4RXsNII:RRMvc5zC8q/SV
TLSH
T1C71523031B85A24DC95DB3F12CD70B29293A89DC23DE8FFB59C5AEF1660E7607805D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\zlib1.dll
Size 106KB
SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
MD5 5eac41b641e813f2a887c25e7c87a02e
SHA1 ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5
SHA512 cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5
SSDEEP 3072:wLmjK8n5MYk+NqZSB23eRenGvTBfs9Yy0J:wLl8n5MYCjFnaTBwYy0
TLSH
T16FB38E9BBA9362FDD972C17052E69BB4E930BC0109705ADB5148FBB02F12C906F597EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5264923-da30-4886-8002-121a5f3ae526.tmp

Path C:\Users\Admin\AppData\Local\Temp\b5264923-da30-4886-8002-121a5f3ae526.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6380766-afdc-4d4a-a2d5-6eb9c1bf943f.tmp

Path C:\Users\Admin\AppData\Local\Temp\f6380766-afdc-4d4a-a2d5-6eb9c1bf943f.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\Downloads\okitas_takeover_137_throneupdate\config.json
Size 5KB
SHA256 317d0b0f6269ed19ff08448bd28446e0fa4f84951abb2673cdd3a0e956bab768
MD5 52970b18f617fd92659e829d4b9a61d0
SHA1 e33a515260fbd1bfc900ba4dcaa65a9f40be21a5
SHA512 18e16c24f88be6d7678039a87c7e6c09d7940b6f3db4756127fd43b6a419783b02c3e82f6ccad6e7e46507dd747f8a7a11ec5d5c9bb8f4c04e9457f9ce6454fc
SSDEEP 96:oGTRrOVq8leXja63OOPPed3L6zmZ0SvMuH1XryAq8NsHQ36sRnw7:ouRrOU8flgqpRnw7
TLSH
T1E7B14533F6755C2192F9B7AA5C5B8652F7221727DB50983F707EE21C0F326164029B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-1919-0x000001B69DB80000-0x000001B69DBD2000-memory.dmp

Download

memory/2728-1608-0x0000020E984E0000-0x0000020E98532000-memory.dmp

Download

memory/3172-1917-0x000001BF66110000-0x000001BF66162000-memory.dmp

Download

memory/4024-1918-0x00000276EAAA0000-0x00000276EAAF2000-memory.dmp

Download

memory/4628-1550-0x00007FFB4F1E0000-0x00007FFB4F44C000-memory.dmp

Download

memory/4628-1522-0x000000006A880000-0x000000006A8A7000-memory.dmp

Download

memory/4628-1521-0x00007FFB4F1E0000-0x00007FFB4F44C000-memory.dmp

Download

memory/4628-1566-0x00007FFB4F1E0000-0x00007FFB4F44C000-memory.dmp

Download

memory/5192-1920-0x00000232E9590000-0x00000232E95E2000-memory.dmp

Download

memory/5264-1606-0x0000025522AA0000-0x0000025522AF2000-memory.dmp

Download

memory/5436-1607-0x0000024204FD0000-0x0000024205022000-memory.dmp

Download

memory/5788-1609-0x000001B109D60000-0x000001B109DB2000-memory.dmp

Download