dd9b9e5d235c56bf32fe32d408fd69f0b40f87d721172e8bd8e89f762f5e06cc

Resubmissions

25/09/2026, 18:15

260925-wvyz2atake7

25/09/2026, 12:14

260925-pec93a1zbs7

Analysis

user interaction
yes
max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PlexusX-Setup-2.0.0.exe
Size 54.3MB
Sample260925-pec93a1zbs
SHA256 dd9b9e5d235c56bf32fe32d408fd69f0b40f87d721172e8bd8e89f762f5e06cc
MD5 5453ea4fa7c8e2e5bcee2095db0da98a
SHA1 ed2253cbb43c8d23b3293b7a63106ee9e9d5045a
SHA512 81016cb08928169bc0ed68724a8f4bccbc61c58ec84609ee45200f290ba303ae12a3d30710edcc4c4d7393780d61ad51ec8b1241b6b81b6becfc6aa470e64010
SSDEEP 1572864:BJpJ3jlURQj5upJQksdfkvYGFKgwmq5aQFx04Em+2iKb:LRUR5oRPGF9EFFqu+2iU
TLSH
T13EC72313B389653EE4FB5E39683FA255583FBA2035128C4A9BF4095C8F35640AE3B753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5928	PlexusX-Setup-2.0.0.tmp
840	PlexusX.exe
4700	PlexusX.exe

Loads dropped DLL 64 IoCs

pid	Process
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PlexusX-Setup-2.0.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PlexusX-Setup-2.0.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5016	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4920-0-0x0000000000D70000-0x0000000000E51000-memory.dmp	innosetup
behavioral1/memory/4920-7-0x0000000000D70000-0x0000000000E51000-memory.dmp	innosetup
behavioral1/memory/4920-556-0x0000000000D70000-0x0000000000E51000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3016	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348121892637593"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\plexusx	PlexusX-Setup-2.0.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\plexusx\ = "URL:PlexusX"	PlexusX-Setup-2.0.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\plexusx\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PlexusX\\PlexusX.exe\",0"	PlexusX-Setup-2.0.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\plexusx\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PlexusX\\PlexusX.exe\" \"%1\""	PlexusX-Setup-2.0.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\plexusx\URL Protocol	PlexusX-Setup-2.0.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\plexusx\DefaultIcon	PlexusX-Setup-2.0.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\plexusx\shell\open\command	PlexusX-Setup-2.0.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\plexusx\shell	PlexusX-Setup-2.0.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\plexusx\shell\open	PlexusX-Setup-2.0.0.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{D421AEC8-5260-4452-A5C6-6B32B14DA13F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5928	PlexusX-Setup-2.0.0.tmp
5928	PlexusX-Setup-2.0.0.tmp
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
840	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe
4700	PlexusX.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	taskkill.exe
Token: SeDebugPrivilege	840	PlexusX.exe
Token: SeDebugPrivilege	4700	PlexusX.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5928	PlexusX-Setup-2.0.0.tmp
840	PlexusX.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5928	4920	PlexusX-Setup-2.0.0.exe	88
PID 5928 wrote to memory of 3016	5928	PlexusX-Setup-2.0.0.tmp	98
PID 5928 wrote to memory of 840	5928	PlexusX-Setup-2.0.0.tmp	103
PID 4700 wrote to memory of 4888	4700	PlexusX.exe	116
PID 4888 wrote to memory of 4104	4888	msedge.exe	117
PID 4104 wrote to memory of 5008	4104	msedge.exe	118
PID 4104 wrote to memory of 5016	4104	msedge.exe	119
PID 4104 wrote to memory of 4952	4104	msedge.exe	120
PID 4104 wrote to memory of 4952	4104	msedge.exe	120
PID 4104 wrote to memory of 4952	4104	msedge.exe	120
PID 4104 wrote to memory of 1528	4104	msedge.exe	122
PID 4104 wrote to memory of 1528	4104	msedge.exe	122
PID 4104 wrote to memory of 1132	4104	msedge.exe	124
PID 4104 wrote to memory of 1132	4104	msedge.exe	124
PID 4104 wrote to memory of 1132	4104	msedge.exe	124
PID 4104 wrote to memory of 4340	4104	msedge.exe	123
PID 4104 wrote to memory of 4340	4104	msedge.exe	123
PID 4104 wrote to memory of 4340	4104	msedge.exe	123
PID 4104 wrote to memory of 436	4104	msedge.exe	128
PID 4104 wrote to memory of 5428	4104	msedge.exe	129
PID 4104 wrote to memory of 436	4104	msedge.exe	128
PID 4104 wrote to memory of 5428	4104	msedge.exe	129
PID 4104 wrote to memory of 5268	4104	msedge.exe	131
PID 4104 wrote to memory of 5552	4104	msedge.exe	136
PID 4104 wrote to memory of 5552	4104	msedge.exe	136
PID 4104 wrote to memory of 5552	4104	msedge.exe	136
PID 4104 wrote to memory of 2492	4104	msedge.exe	137
PID 4104 wrote to memory of 2492	4104	msedge.exe	137
PID 4104 wrote to memory of 2492	4104	msedge.exe	137

C:\Users\Admin\AppData\Local\Temp\PlexusX-Setup-2.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\PlexusX-Setup-2.0.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\is-0EWQTLWB3F.tmp\PlexusX-Setup-2.0.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0EWQTLWB3F.tmp\PlexusX-Setup-2.0.0.tmp" /SL5="$402DA,52477462,863232,C:\Users\Admin\AppData\Local\Temp\PlexusX-Setup-2.0.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM PlexusX.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Users\Admin\AppData\Local\Programs\PlexusX\PlexusX.exe
    "C:\Users\Admin\AppData\Local\Programs\PlexusX\PlexusX.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:840

C:\Users\Admin\AppData\Local\Programs\PlexusX\PlexusX.exe
"C:\Users\Admin\AppData\Local\Programs\PlexusX\PlexusX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plexusx.lol/link?port=50577&challenge=eJzfBYVvpblL2FcqSHjcDTfarT61PyikG6Fq84n4_os
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://plexusx.lol/link?port=50577&challenge=eJzfBYVvpblL2FcqSHjcDTfarT61PyikG6Fq84n4_os
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x278,0x7ffdd85ac188,0x7ffdd85ac194,0x7ffdd85ac1a0
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,18348798019903660586,18059622411782674083,524288 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      System Time Discovery
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,17555532656971592969,14230694348926414628,262144 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,3505939566853982233,12725011379216123323,524288 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,2747517592853187084,3053717305843093850,2097152 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,9996894901448782229,7538600745512077804,2097152 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,18135239601651444638,6160944566944766565,524288 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,11963350469153401541,6841969346710640840,524288 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,10341885709202287290,10197053038762004900,524288 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,10341885709202287290,10197053038762004900,524288 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5764,i,11580641143950616810,625022288802872899,2097152 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3620,i,6237676666302806574,9032652900871937295,2097152 --field-trial-handle=2264,i,1912180088356686110,47910837517306723,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
      4⤵
      PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b76d338ddae307a13fa471697cd0ded343068f3b2d16c3fc7d6523b868ccfe59
MD5 3a1049940f077c1f940ffa56c5fbb978
SHA1 5af75df42c5c3d2ea4a81a1d96481c0af8c6364c
SHA512 305a7e7983b7b89f8baae71c3ec7c6e600dd38b6831197b0cfc1363cd17c73c9a510a83f129a0163117aee5be173efa70a734785459dad7b539297ef597042e4
TLSH
T19EF0F4AAC921AC3B08FD1B6D60D40B46F760232B2A41984F3B3E820C8FB053B858582C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a703952969c51d5a079bd31866f5adda35cf6441192dab699a52b793ed0b4ca2
MD5 2c88ce86481bcd26b11b0ea071167074
SHA1 bd6e5b70e00e4ba938cb35c6039ffd83c9dd2f22
SHA512 87c10404d2a9bd031c3ef051d5c4d028e2a6e6ff6820e4dbb2b25744233037550fcc16efcb1b55b142dc8b692bc8e91566c65c4ab435db7b64d8e371218dab7e
SSDEEP 192:sxZuRJaTX/fksbeaQZLjNe8xzodpLHW6+WNGYohh2SFLKIgjtFjJ:sxZuaTX/fkszOPn6LHbGISsjtFV
TLSH
T14042B619AE28A97B8CC7D219FB557F52E3F9503394900E44AAFC8B1C15EB9DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fc4403f0e508f7c3c58f3739d53b9be6f9932f27e09f91b4af5726abe5f3d7f0
MD5 ab1543e42314d40b56489c371db0e3be
SHA1 ae56eb3c7dd2379ab9ba055e971b50652d2ff454
SHA512 0ed500b851030b8a7276d5f6a2a22178800810d19798e7c55bf7f5cd88da73cba2159ef289512a7bddfba4d68dac1bbc206ad2419e7658a436a3f60ed691f244
SSDEEP 192:sxZuRJaTX/fksReaQZLjke8xzodpHYHW6+WNGYoS2SFLKIg5atFjJ:sxZuaTX/fksJOPi64HbGdSs0tFV
TLSH
T14E42C759AE28A97B8CCBD219FB557F52E3FD103294910E44AAFC8B1C15EB6DD120341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a2ac8d4b7205fc1a9bc0dcc23eef92320fb9d92f5313ebbb7f5d08434d6a12a9
MD5 85cac84ac0de337c5306f9fdd501fc5c
SHA1 82aa1fdf61c458c573ceae52d72e0e6d54992616
SHA512 6b51e9c1d09f7d3994bdc2a334b6304f7499078e72acb29be978951f1768b88f6cb1b681dc9e42dc80c86df626188fccc28e62ac5392a43a2dc2bb7df0c79094
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OV71qpLlvVajYro+:Px6r8s2EbG+WviyUKu1jam1qpLd4jjor
TLSH
T1EAE2E97B780CCE7E4FC04E9DDD1A7F8A6DA802CB9698C95087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 e9498f4b05fd671f6f3400020ba7e74f1c510036aaf58dfc4791f95e1dd7c3bb
MD5 83aca1650aee3c69b02d0049f49f14fd
SHA1 3068e82b9593c052ee777176542918349ee9f9d4
SHA512 a1d5ccac9912d21abccc61b087e07cb058e9e7f31bd79e5cc0d74ce20b152bcc928fa050e78aca59a9371cad6cd5534ea0a0aa30be303299a8c93bfa892d42bf
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdg7:ST/2dXOJhJlpfnpp3tNXVrN3GVL4
TLSH
T1FEB2121571BB421039FE391892B58B2E068231733119E66B7FBD04B68E6BF485DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 43e87432d53b3b411c0f74abb0c328e75cd9d51b5cbfd1dc6f6755276aad2d26
MD5 78d5309b03e0d059bb5fa56c6926d30f
SHA1 8f0ca7d5a5cef636260fac028ef14ab7b24f5147
SHA512 8b1db2b5431626f9a6f258280f8df58e3891e6693af2dd6c6303b2629742d74787afb12aefcb16674b12edf33fe19848781ee1ea31170b91c88df5d71f6f2548
SSDEEP 384:nYiFiZcI63sN/8TUNTUlIm2aKMi14w2fiBCWrBP9RFusa+VY68gL/7IzuoA:jFQ63qwgcinBCgBPvFuhgpP
TLSH
T1D8C24A36EC98D9BBE8EB4FD6AB4A3A03EEF4016395DC59D4D9D91D1C108359D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8b66f24b897204604f78dfefb83866f5822c52630afa474317ff184a3747753a
MD5 60fe73f8de4f1e4f723b0e4703411167
SHA1 e0d2ee3dc0828a2db94e05105ea024ff6aaba76c
SHA512 62c354a2f97d35b96c4e8f283d5ebc569f2bb53c3baff2088e07efa655265e8811407a6905a68350239175912f0ed8606d6dbc975f253acbc4bcf921ce90966c
SSDEEP 384:naiFiZcII3sNg8TUNTUlI4lnaKM/cUuw2fiBCWrBP9Y5+Uii8tgOIwZOypgL/7I3:RFQI3FwgTiyBCgBPIrii8Xsy5
TLSH
T151C24A36D8A8DABBECEB8BD5B74A3603DEF44163858C9AD4E9D91D1D00974ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e5f573c25740f1eca843c36b5f58536b37948ba7cd89af2f6b4f0e8f79049b5f
MD5 867698f22c548d62853bdbcf5cef4a10
SHA1 ca18152d49731e0679490ad07245f90ebb6ae18d
SHA512 01dba135740fa420e57e862b95bd538c46c23a66ba70bc18820cb5fd787e67ec20e3a6e01d2013660d06a4ee4a1c7d3dbe7258aadf75dceac8f8125d1ede61ce
SSDEEP 384:naiFTZcIv3sNg8TUNTUlI4hnaKMjcUuw2fiBCWrBP9Y5+Uri8tgOIwZOypgL/7I3:RFLv3FwgnGyBCgBPIrri8Xsy5
TLSH
T1CDC24A36D898DABBECEB8BD5B74A3603DEF44163858C9AD0E9D91D1D00975ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4ea192327aceea01ebba3542ea5aedfb8ca0784575057b486119551cfd8b0186
MD5 89aced3e7768e5a4ae5e08de6fe94a2b
SHA1 bc328187fea5a20a6c92409d0794d3032ef28e88
SHA512 6e8b7bad3d2792513f5c2396ebe6b16ee478578cb48f24c71352471392e3ad022c4c7e9e8839498c93e65a4e6b88b68f0bd10e5f7ca55517ca02d25995830172
TLSH
T170411758B6F91148F3B7AE5A9BF7A86E487E79732F06D45E00110E4F0A22A40C971733
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\Microsoft.Win32.Registry.dll
Size 117KB
SHA256 a8cc5503bbba36472d1dd3a8eebc3a8b26f0b2882e770851aab486690b23ead9
MD5 c78b9af5d48ce436d8bddc2fc1e182b1
SHA1 31246c066db0dd15373ef042dc982a92a9c1fec4
SHA512 38227e39f03b08ecbcb7fa61351c771e27b5853e83c0a46441e844355353b0e8b1285162bb5f04fd8ec266431b2be6e0ab8b1a4570aff4abef2472faf76d5616
SSDEEP 3072:FD16NXwrxG7wECisvqzJSvEVcULViy7iB1dsd:2NIaFC6zJSvEVz5om
TLSH
T1FAC33A1177C8030BFAABCA7998638985E272E1871701EECF96C5C15E3F5BBC6E671601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.SystemEvents.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\Microsoft.Win32.SystemEvents.dll
Size 93KB
SHA256 ee167eb734016fb3b29360eeef2a022b0684411e53367dd85c7d67b0263c5208
MD5 a5b919247059513b2667a0a1e7e3517a
SHA1 94b084d7090b00e547c7f16fb74d8642ed8f3c86
SHA512 9d0d84c89bbb56f897cc5a391b40d8449cfba756709434ca1b2d7b669a0c384d706aa7d5fc428ba941bec222e90b3d02d710c3802bdbeef7ed5fc1ef368cedf0
SSDEEP 1536:Nw4eFaiCeq4od3IljMH1dKCAw/4IGr/sDAjvSJJLczuu:NZeIijq4o2jaHLQIGrZjsJgKu
TLSH
T15C935A1673840632DAAE8E3BAA278A01E574F1C76752FBEF11C695090F63FC2D775182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlexusX.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\PlexusX.dll
Size 4.9MB
SHA256 0334676fcf1f6c6bcefcd315f9d52c54d50670e22755272961c12e7f2a25d52a
MD5 609f3b5990dbd29c9abdd8bca74b3a4b
SHA1 82986404b9afd8e7e695f495d5ca11bbbacfff16
SHA512 e76b77b7b2f70fe69bafe0ec1726511b7194695c3a4e91b8ac0a3d0fceca702a29b7e948414eac746721a690eb4f30c3fd63cc8bcfc4831fa54be8da24fce654
SSDEEP 98304:taGpzfBLwh2vB+iv6qNDO2YAH1TuM+u2tgXMXcFDB8w13boY00ivum+6uDK:taGpzfBLbyqNa2dH1qhu2aXMsF9NoT0r
TLSH
T12D36E02133F48A36E1BF2B755475117423F2FA05A73AEF8D1F08A5791CA23684D16BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Collections.Concurrent.dll
Size 269KB
SHA256 ed653ccb5dc40d0bb4ea3429165a0825705f2935a65c584ca67cba45671884c1
MD5 df66ef3b3626830614bf3ea9608a305a
SHA1 abe7fd18ffef92dd27ab44caa9281386a9c2b927
SHA512 26674a84c314a434c86b6ba91106da231ab67e5900d0965ee4c4c3efa183cb26faee7e1e734bdc06375214a5cae5a78c3aa9284fd37b67b28ae17b6635951832
SSDEEP 6144:KPA2H9j4tByYOTblcFe4khyO2fIykwXLps:KI29j4tBypHfhD2fIrE9s
TLSH
T130445B2173884B12FC6F497D9693D514E2B6A8530322C2DF0274A9849FDFFD2AB77522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Collections.NonGeneric.dll
Size 101KB
SHA256 b40cdf234652b31b443164350f73e25f98c5edecfd30698789d6dbf9ca456e44
MD5 178e456b341fefb82d4462c402df3000
SHA1 b485c2bfb5d6e76cd0dace1b27ce0db55522f9f5
SHA512 ad84881bc3b4b1593affa8cba4f22f658b5e46b2f1eac69f7d7d94067995e19bde0bf01d37c2f2f39cd66da6d4b0c4af7aa87c91b1269c05028329df864b2e6d
SSDEEP 1536:P500tJVDX9L8IbwNC5IQ7XVrMZqz9AeWuUdnz7f:Pm0dzN8Ic+IQLGZqzKe6/
TLSH
T12DA3281633D80322C69E6BFC91938A01E676F4D26717D1DF1618A9CC0F9BBC2D6B2147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Collections.Specialized.dll
Size 101KB
SHA256 24022887037bfaad8c89c26642712c920dcc0ababd3396d80d8b2be16637673b
MD5 c3af4e9dfe84840b7a096881a1493cf8
SHA1 a7d3f6c6a0e6205262eef5988135edd494beb69f
SHA512 a2a73f871f2857adaff7b909901f52f893dfa68c6f4f26cc057257b6f4db4023e5661ed5dd0e78c892937bbbe141a9bf1fd0a8d7f8a792a8cb509cf714519b57
SSDEEP 1536:1SidRfAiP9WSJLeI620hCYCARk4YIAO8xocgA50Dd0VIOYzdd:1SifAIpeJDPAOSocgAaDOBYhd
TLSH
T1D7A35B2473D84B22CB3A92FC85978941E730F1E31322D2CF1559D9891E9BBC69B7612F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Collections.dll
Size 253KB
SHA256 c6bb79b8fb32504b6327b516e6ff32017a073669ab749d3c86ed49cd5f2f0c45
MD5 7197df56c528a827e396e849a5fc2ba6
SHA1 548148d8e677d974ae24bc4e276d1daf5b62ba7f
SHA512 c6147edbb6e17abf6d4ad03b9c94293857322770d57c2e089475d7b30a955c409a354a39df3f433f4cbaa6018fffabc8d770b6ee3272420b92a0494a59653200
SSDEEP 6144:inxoXL+DXDiKNYX8qTKfAyryS1rIgb3Bb:qxC+DXDiQ+jTURrhFDBb
TLSH
T108444A2A778C4E12F56F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.EventBasedAsync.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.ComponentModel.EventBasedAsync.dll
Size 45KB
SHA256 ce813a7cde09eba1bdd7d6661fa39c09057beddc78f554c5476c43766d763ed0
MD5 54610411e6b04786fb98f96c0a1e1457
SHA1 df6707828cb772cee46c7305f32535cae9779189
SHA512 1d49d330bed94551b5658a96a0877f909ff4b3d7519ecc12560eb63ff726d3d4c09c373194a4741883bfc44b13a6f68bbb2cb06cf6a5d52cc1dfa6a048389e1d
SSDEEP 384:UWvZwW3CTenPadWBj/Dwhzq1c8dgfL9ikyr46JXfCvDXxO88+aEZ4jIwVMBvEN4T:DtpUYlkB9n88IVSE8lP9z6wJ
TLSH
T193237C71439C0113FFB74A7D8AB28A13A578FA415743EAEF2464D20D1ED37C1A73266A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 d981af410d4ed7939fdee47a1ee58e3db472c05f17c2b0d48e4b1ebfb2fea0e5
MD5 d1ac858cc0346514a357bbfec000df2a
SHA1 7e87f41c7557cde47f37a2ba566d84631533500a
SHA512 e4a8dd6c3dd107b6e1eabdfa3ac640f06c9b0b1145e80558a213b4a496e6d359e937895515c3c0fc2afc83d38722720a3fa5079f06f50638cf63265d7991f268
SSDEEP 1536:Ku5/UZMu4Vhd+Cv8A/oqevD2ols5cbktPMPzN:KR49+S85qKD2om5caMPx
TLSH
T1D6733A1823EC0126EBBD46BC9573A921E574F6821713D9CF4AA0D90E1F5BBC2E27152F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.TypeConverter.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.ComponentModel.TypeConverter.dll
Size 729KB
SHA256 db04940603c749719e133bb567d142d46af3a6f2f37597db398955a3896b84c2
MD5 3c44a53f8d80e63226f4a4e49c0815f0
SHA1 45393ed44ce1a951eb86b5b03d89ce05dffa55d5
SHA512 e27ae25af1e834b04416870f526f6a21e2ad4cd78f6a6aa4b19b9bf20240761e010c51cd66f2bf15bad6e13c68841a1132096b03555dc237f3224741fc2f3308
SSDEEP 12288:tubWtrTtlAqmrIofhCXvdb+/ipZ7DvBEFBiXMSKB7QLohk+xLRxP:tuWtrTlmrNfhCXvdb+/ipZBEFBiEBMS5
TLSH
T155F45B459BD84A05DABF8278D672C801D570AC87533A86CB19D5EFF51FA3FC2D23A122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.ComponentModel.dll
Size 29KB
SHA256 4d9e2e21ed5c16c100221433d1aab01409ec199c9f617e48b9fe1617989bbaa6
MD5 7fc83e22d9987e358997d147e3c52397
SHA1 536298d84c599afa1331d71e86f075edfc61706e
SHA512 0c48b364911c1ad6198df0c17db29ee04b16e9d52aaf09c60b049081f6f6ac8b9f24410d9a88f566f587dfb728abb5ec1896c303cde65142c154c7519cb881bb
SSDEEP 192:IW4q1WSqR3Ok7+AWx0Lu7uEWCWKie1BzBWseaAW8pGMsc+6UQ/X01k9z3ABo7unI:IW4q1WSqRF+J0LMrZlNOprj/R9zt7uov
TLSH
T1E5D25CD287648213FD9B5E706AA8DA433E3EA7C58E02876B1685F64D0D937C5EB3013D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Diagnostics.Process.dll
Size 329KB
SHA256 7083c7046ac4cbed1068b6ae7a777d421eeaf180e5697283fc1c6af731c32a3d
MD5 581db0f97e2b0e00b72063521a15bb63
SHA1 9396b1beaf8fadfe9c265de28baa4d4323fed4f6
SHA512 afc73365c0e309cb5f19d6d555703a4c2ba6a0d66dac28a9e6383e5f992a2155c3900521789f0bd43d7e483acf68ece67e43823a4565a88d79f0b64ebc6f0752
SSDEEP 6144:bXkDhqaP75vD9eEIdghrT9jb3b41PlmFOfZTdiX2JV:b0DhqAeDdqJB8V
TLSH
T11A747D247B980506FE6E96388C63D502EB78949707D1EBD743A0D7DA3F4B7C2E632116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.TraceSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Diagnostics.TraceSource.dll
Size 141KB
SHA256 2b5489bc5a6d65e109dbed6557dc2af3ba9dfb549efd18a64f37fd64255cb756
MD5 694c92a7446a0cd1257a72266c084b03
SHA1 438139a62c128b1551576699457c51e3e09cc3e8
SHA512 5a0acab2442d35d05e2f084feb89ba124bdd830ed1418e09c38d5bc79d3fb1b389788244d2b88c38b743c0e4798b006461cd384f16bf902a12dfd8aace8bbf4b
SSDEEP 3072:raiUYBg3TeY0dpwQn60x7cftbgZ7eIReT5DFve:hBgqY6aQn60x7cftbgU1lo
TLSH
T149E34B26739C0507C76E87B88663C702F6B3E4870302D2CF5AA5AD591ED7BD1BEB2485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Drawing.Common.dll
Size 1.5MB
SHA256 dd17bff899c655e78ced0bfcfbd4c48d3545dfeb90dc9fb6fe07d315dd0bc2ca
MD5 ef4c09b64a992308ea41cd9144d407a4
SHA1 e7299481ed3b545f09ef3a75d948ef201839a74a
SHA512 26b9688176ff697d866f74937705727b76c1155fbfe401e9d3a37d34a49c1bbe65d3c5bc8695ef74c1107f756d30613c8009d1493f4a8caae47d258a6a12f2f8
SSDEEP 24576:AMn2eHkg196JNYqaM+s9unBgBrubG2dXkOJxPkq10dAcdsm:AMn2q5iSLls9ungrub1dXkOJm
TLSH
T177651911B390992AE62FCA79C55AC504D270F81BEB02E9C715C1DA853F63BC3F67A1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Drawing.Primitives.dll
Size 129KB
SHA256 02bd1f5644dd73789b82c3a52c8f86ef726baa1d4cce2a0c64d9dc1c29b9cb02
MD5 d8d75b61841283ce4e6d9087e392161f
SHA1 ce72d82f21e2ffda749dd02a8c16eb5cc7a1848e
SHA512 d6e5b3c202afe8e98769fa8ad69d736e977aa957b916d898eb310e0864ce6d0557aa0de0711fab497a64e7fc970af339003c25c66bb8cb9fbaa336a04bc533ee
SSDEEP 3072:kTVFF64yeP4SyuvmH00N6no5WvCIkcoRcq2:SFFCimpjwoS
TLSH
T174D35B5DF34CC4ACDAAC577D61965826DA26B2460361E6CF9DC9808CBF023D8F5B31B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Pipes.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.IO.Pipes.dll
Size 161KB
SHA256 35030c28374b6ffa6393c2ab8ae80cf712a2f88e92a16dbbdbf6ae03f0e0d452
MD5 44a3aef5ea90d547132bc08aa51afea6
SHA1 185227fa9bdbee6bb7541cda26929ae8acaa65b0
SHA512 4763704a4a4c35942c9ee82101bcdf39d4e5ac37d442ec84994705cfdb9123ba28bb5423efab4b9988049a2cd5609c2c4da24b77384b87313baa877a9b19ca64
SSDEEP 3072:szBbvU5yRF8ZRra/yJJ98pLSx1w9fd6AqDVWq/q/ge:kBYPZU/g98pLbZq/qF
TLSH
T166F33B2A63D8110BEFAF867986A34501D773B4861B02D7CB0186D5A91F877C5FB722F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Linq.dll
Size 529KB
SHA256 2b375e90fc687967bd95a0f47dbcba44d396923f3c98b7fe5754e34c8e4befaa
MD5 da3bfbd2d8a72e9c94827b340124c484
SHA1 cfd8e3b53a03dc365c4bcdadd036fdf19459e051
SHA512 70b16bcf15a76f4064ebcf08d9ff16890ee8241db97621cdd217ed51eabe7a073e4cbf3666ad0a3a0841def4e2f5c90dd1c5268cac88de894c5e74c69e399b3c
SSDEEP 6144:1NYb3JypY1hh8r4bdhR+JU1/0kxryufbFHJMyS5IHcYz0hMxjCkoTcEF:rYb34S1hh8rwdh8UxeEvAETmj
TLSH
T12AB46A2493B80F07C2AF86BFE553E151D7F1859283A2C1CF995CEE961E93BD165BB020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Memory.dll
Size 153KB
SHA256 84242cce5eacc6963a77163986066bd0a1c2eb698b5f26dbdd5e6706e002fbc7
MD5 cc4296eaa7c770df0ccd22964e84cbc0
SHA1 c186b7d67d7edd477e49c790099573cb12530a17
SHA512 92f6610cdade0be2c352b8b13310ffbf3274382faa826ef9f4af05e812eba3fad490f64bc52d83a84dc257ef9b0b987b694f7d3dc03a0f7e157373e48a458127
SSDEEP 3072:xWyykN/j+0sbFbqX63vwZuIBo7M5F8966oYdMCBuqmwShtTihdXkYg:6kCb6oIBo7qDGMCBuBhOg
TLSH
T17BF35C17E2980657DA3FDAFAAD225302D7B36142572192CB4CE4DA842E53BD0FF734A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Net.Http.dll
Size 1.7MB
SHA256 5102639c2037d77949340d94761c9a4c5053b940b8ae4ba2fbbe3507b8a5ec43
MD5 fe96e269bc6464be3e0b9765c802870b
SHA1 e32fe89df6e51f8517db98db946ba5d00b27c2e6
SHA512 b38adb2eacf6b45a3614ee2afe62dd443efd8b759214b5b4d877187ede0bb69f1e0c46cc6d80cfaffca9d03068c9bcc3a5f9ead090f759449e78d0f2acdb4d97
SSDEEP 24576:WJ3LtqLomt0jBiawo451oQf19Ip616/N0Au:WJ3LtqLom+jBi5oO3J1
TLSH
T1D3859E05B3E48716D62FC779C16A8421C671B0834712EADF559CFD883FA37C19AB22A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Net.Primitives.dll
Size 225KB
SHA256 0f929e8581f09fe85275df7b38549bc51415cd110aadfd89eade53943174511a
MD5 de926a44d90b6230bbad0e2633c33a17
SHA1 51f00cc77d9a633f368209590ce7aec58f4351ab
SHA512 778d67b7a09ba3d0e5fbac92037a8f399de515fa21b86ec5594056432de0f036154a1b6560771af4c0245287cb69ec095444b9fe1a738ed591c0034321caf95e
SSDEEP 3072:whaBNI7bgmZrgyBHSchuzeQ4X1Sji6uJQ+Y6MFot4TyloV2O1wss:h7I7bgmZrB0cgeQ0RJNtyDV2Yq
TLSH
T1C1346C2AB3D44D03F66DC5BEC657C502D372A9425B11D6CB86A4B78F2F837D1AE32122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Private.CoreLib.dll
Size 12.6MB
SHA256 99b168b84597a4f31fda8281efce7d42a14e2df0f4694194735e049dbc0f6418
MD5 b4f89ce8fd7fe98c81893dcb76a4d209
SHA1 d3e7b97e8b4dae2ec228476a02f5eead6560a7ee
SHA512 53e68a5436a5f275a1eb421a08c8b33e2630f698b4cb47677392019ee8a14630b966555d4d9d4733aa302344c20d1ec8054117b61063f18d8c4f6389c5a994cf
SSDEEP 196608:fmhN8mtl5F/v/u5ks5OtsFnyQvSNT/k9B5c:7glb/vG5L5OtsFtSNTai
TLSH
T144D69E11B3C89F16E56EC27DC2635285F3B1F4A2135296CF980DEA882F13BC15B7B265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Private.Uri.dll
Size 253KB
SHA256 f2a695dcd4073eaba43b4ee26f006c0174bff42673e17b38914450ca7d2547f5
MD5 21373db278a83864806aa7da87a161ee
SHA1 0e4242ba053a00534016e9825e137152cf957e2a
SHA512 44fad7e729f144f378383c029045fb924728359294bbdebe602a75a56bcf7b8fdb7806db2082bbbfadcdd229590a9af70c92d3bd463982871ee9f5e7d7a7c926
SSDEEP 6144:afAAcZWInBPKCeDc6Ci9MG3CMeVmtGsFsGu6MyL:lFYDciMG3HamtGsfuVU
TLSH
T158448C25E3840E67F73DC2B981D3D112EAB270665315F7CB0AB5E1821F177C2AA36963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Runtime.InteropServices.dll
Size 93KB
SHA256 1930aea4d91654a4daf13bf95b2daff023d3104a9b3794059ea139e550bcfb5f
MD5 0b668c7c9cc09c272adf1d9a50f6e87e
SHA1 2648da62157e6f6e4bc255e2205c3dcd3f9caa22
SHA512 08028583e5e29f43ceb3e3abf995394af7c7b3fac8d3838941f9fbf1f2d95445ecca543911ca7cd5be5ede1f105b91d5ae5b3ee236d62282e0ce8d3d0db491eb
SSDEEP 1536:sf66upEelCtJfKS6+67NspnSPM+l5+/kmV9KWHuzVfSp:sf6P3lCto+dSPM+rMkmfNuYp
TLSH
T1F993592437D8466ACA2A473C8C775D60C9B1F6C603A2E6DF5781885E1D9B7C0C3B23E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Runtime.dll
Size 42KB
SHA256 e8fb5b78dc75b0650520042936fca2165a060cb4afa4b8cce90524c9c9fc3563
MD5 62fcba507117762a3fae8b07017407fb
SHA1 77ea720546550780d31302877c157b6ce25a8928
SHA512 1804c79075faf97bb47275206d8847c870852fffca250b2cc664adfd12716565b7831375379b336d268630d42534b136e6060299c78a249af1867e6b3ea8692e
SSDEEP 768:U+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLR:YB/LuYdy50b4b7RSHvY/1z+
TLSH
T1A513B3A5AE484333CD8AAB719C73AC811DF233C4047A597ED88ED95913877B48236B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Security.AccessControl.dll
Size 225KB
SHA256 149888fd2b8f15b37ba115e2bb3c0577c8db9aed6f91221902ad6c9a61a69a49
MD5 99b45ac379d1e74f5479776a78595d55
SHA1 11c30915ab9de7f656a7c5979f216ce661e2da66
SHA512 fb8cf9f56964ee1e9340c24aa3b1b49d5bd61d9b53f7c54c6bc8dcd2399a2348f01595e905e47c0c789639e6a551dd29590b50a2e6daba572310ed09713354f3
SSDEEP 3072:2pyFwNow9j0rKu8bmb3KD/L8V8/6Xe9QF+wVkjox7r0e+DGA/+PXro9:XwNow9A4bmrA/mt78Wfw
TLSH
T124347D2AA3880907F6AF867CD557C501DBB2A447D767D7CB0661E1E52E43BC2BE33122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Security.Cryptography.dll
Size 2.0MB
SHA256 1e4c4ce04a46e2a2da8221bf583ebd4f6b5149d4b32792cacc5c33978d0bb121
MD5 bf4e7d9531a151a333048bb7a7bfa5ae
SHA1 2156daae8b2d27ee46e43ed5f2131196c04bad2c
SHA512 24761ea56b087233fadc529102bbb1c787e0d8262b1ab8ab9839d5cfb92ee6ab58acc1862621ebe42fc5302a9f436e9d4d665d1d95e5290ab018009c45f458fa
SSDEEP 49152:PmRKIpxajTJDMgmJE2JjdQLxObmIwma41j:PmRKJQgeQ41j
TLSH
T1DC957C18BBE44B5AD52EC57E83234402D570F48397829BCB2689CB592F53BC2C7B6367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Security.Principal.Windows.dll
Size 181KB
SHA256 aace487981f8c9077620abf9c9d236ce5ef98241cf4222fbb49c717286f2cd0f
MD5 0cd020001e252ba47de21687097b50d8
SHA1 10ef66abc08d058e9660783162ed033f3526ce84
SHA512 967db61a2fed0620e4992aefe6b667fd1bf37d355a79cb95782f368d21e9763bf716b7b7dfb367ecc7c12b8e5cf0310fa1e7ca4ca10616f7931109eef4ec7bf8
SSDEEP 3072:IzXkZDNCpsCTyRdtl63xJYrwr7oDi148T2TOK1BguZdT:NUpsC6Ll67YrOoDwT2rPjP
TLSH
T112045C12A3D8090BE6AF967D81638601D6B3A45707079ACB5590D9DA1FB7FC2FF32213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Text.Encodings.Web.dll
Size 129KB
SHA256 94afad93dfdd00e132467753615bfb4bc3fa6633701082a9553d6cb4eaccf2ac
MD5 c8eea616950cc7097729cd50b954592c
SHA1 a2638ed220818b4b2bc5e6fe490d6ec11a4da9b2
SHA512 9c2d816cc0d406fcf99da45a5b4dbc9183e8dd7ae3eec865cbbc70229d2df73c69009b60403c00cfb6be80204d4adef47e4db0b602a735116212d142b472327b
SSDEEP 1536:/9T5QlE37yim3E5T+zpq5D3lhjdPTp8K76+d05HzdyRNXSIpm4+SqUH1zd:/9T5QlZn3E16qvZ5N77uLINCIkSqUH1p
TLSH
T17ED35D10B3CCCA49DB2D9A749153A6B6E5B6BEF6032293D7156474481FB33C4B2BD0E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Text.Json.dll
Size 1.4MB
SHA256 9cf2e2ae44376dbea191925e571af703c6d7b53a5c138a0f0f13cd6b8af2c904
MD5 afe58b7c8f8b9ac1dcdaa85e021bf15b
SHA1 7aa3e2ab8fbd7b9bf5e9bd4cb512b73d502127fa
SHA512 d07d1067e3faa54e317737392c356571eaf958acfb9dcb2e5491a24ff8f9c92be6e14b1e69328cc8dc567f5524d9f41b0ec9e21e8ba8f3daa66eb0bef879c27d
SSDEEP 24576:Utsm4uell7dAfc1mK9U5MDv8rwAAjuR5K9Ge6RdqU37M8cVnMBHlJSuB:GTCmK9U5kv8rwBg5oGC8cu
TLSH
T14A657D05EBD88717C52ED379C0B3C112CAF6E4225B11C3CB1464D9AE2E937C6967B1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.RegularExpressions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Text.RegularExpressions.dll
Size 997KB
SHA256 8b3af9e3e0215b46c2dcef1f11c4cdc7ad477140883bcb5c778d04cc051bb0dc
MD5 a7422df385557314bc5730ec3cf091bf
SHA1 3f6532811222b9691ca2b6d997391c98d6dc5d13
SHA512 a9e83e23bc33282aa761638d17ed6c532cf74443d7a089ad6ff9bda7623cf1a2c3bc7d7500ee356a8e90a806422f300bf83a86cdfd6b7fe843167acbeb7ca056
SSDEEP 24576:9x/dskQ+B/b44HO2inDiv67tAEehjanQfq:dQEb44HKivIehjCB
TLSH
T159256C1593982F42C22FA23EC4978602D7B16C57636987CB4950FAE61F3B7C2E6F6113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Threading.Thread.dll
Size 15KB
SHA256 34ed4d7d03bf9a5a5df7addc37a5b75759956fc0d949e25df61d878238bc560a
MD5 dd426982c0b28b760b96d2a0df36b509
SHA1 04bfb2cc2acf01aeab75192d96cfd738c34e36e0
SHA512 498a8ada93dd9e39376c4a0986e467fa0cde67912dd1bb64c8bc7650595a57df2a9eebbd2007f4eee9eb76df7005e973870b7afee91fb3675bd81f17e9d6b34b
SSDEEP 192:q0fAz4dEpSVx0p8UgWcg7WPGWCWKie1BzBWseaAWle5GMsc+6UQ/X01k9z3ABo7R:Z4z2EM0p8UgWcg7WGZlNa5rj/R9zt7R
TLSH
T1AB626BC28B7C4253EDABAEB095A8DA833C3B67C64C518A5A15D5F1580C233C4EF31A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Threading.dll
Size 81KB
SHA256 435c110b598d30f118d0e673068b535b693c5a77fae17398ad46821ce1261aba
MD5 2f1f6345ddc6647e1dabd551b2df817c
SHA1 2962ff64ce9d0853518cd97883f4e81c600b12f7
SHA512 51d9882b49786a751c673a69db96e84ffc95e6fc5d05260c424e91a8a0741ed31a31c14eb93839f8dd52d30d084ee1ea03656cf4e3bdbac2fe7854f46622a3d6
SSDEEP 1536:5agoICPLfImrmODZcUBeZ8j0GEH9wdE3jGRm3LGgfkzUV:5ago9PLgFtZ8j0GEH9wdESR4GgfkYV
TLSH
T18C835A1A7BE8041AFA7B47F9E9769946C472FDC20710C6DF9059900C2E67BC0DAB2277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Windows.Forms.Primitives.dll
Size 2.9MB
SHA256 e73d093d04473648a70ce7a072b56cd2a2c084364d173773bbb4d8d401851fd9
MD5 070c315d2f66e09f516ff0f6818c5df4
SHA1 69247f48a101e91a816b9d78e525789e8767061c
SHA512 1a651891447678c48fd8ba7e4661e580ea5c301bce4039592d4d3ba566327020762917527a3466437d87749d16073e6627fa8733675c34c06e764fe086c35351
SSDEEP 24576:P+oFBwGGJ6udkncfb9/v3R7dL7VOyrnMHCH/PLvlvKJdnELnwLIlcq7VHILraP:22oJbdRh7ECH/PLvlvKJhh/0
TLSH
T103D55C00B3A627A1FD29CE7599254E419173AA476382DDE7D0C584B83ED3FC3AB3B191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\PlexusX\571r2af4RvCn\System.Windows.Forms.dll
Size 12.9MB
SHA256 2f06c91958c240fb4ed07265dd886d259457642cc151e9620ddb4641fdbc404f
MD5 3351cbc47444b9a36f8ee7658bbc8911
SHA1 d6389d9015f02a84779aeced03b9279168d87a7e
SHA512 9bf34f761a5d9cf5ff47616a7cfefea7ab815a7690cd548c7ac6a818be91f145fefbbc94e5ec34f9520939b79bd167af5481e3fc80e9fc0db5b245901b688075
SSDEEP 98304:d0ShxsDDz9cHqTE0PydxeM2EpGCYoy960DawaMh:d0ShxeDz1TEIHhEpGCYoy9tDa5Q
TLSH
T16AD65A5252ECBD86D23A4279E37393E0D7ACDC168351D2CF0590BE063ABE6837636395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlexusX-Setup-2.0.0.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-0EWQTLWB3F.tmp\PlexusX-Setup-2.0.0.tmp
Size 4.2MB
SHA256 23d1ba03d6aba591a6225ca38190c3d365002ab6d319a977fa6bb87de6bf147f
MD5 174eddd88497714352a0197b7872af6e
SHA1 cc89e992e5e5afd51e2c70485ad09413533a3db9
SHA512 0c4f975f27f53eeb78ce1770fcf190b8ef601788f0b46f83360e56e91b3e02679e726348d6bb47083dd94e61780302f5e3742c54ccefcb7a6685fa751b74f28e
SSDEEP 98304:g9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J7333+:3ItJj90Z6RgKwF
TLSH
T1F7168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.bak

Path C:\Users\Admin\AppData\Roaming\PlexusX\settings.bak
Size 5KB
SHA256 eeae3293b0ee2bed3eea109ade906865cd382eb7d3fb22e4ed7d0cd0368b206c
MD5 a2e0dec036f14223ea2c2aaceef86a8a
SHA1 ccd571751ee3192ce62c9b3e747a201b6c448f93
SHA512 c2318f095fb493a5a0aa49959bc42e66b9517c19f6c937e9f70aec413639c555b695d03613f7d9479b1f97679344d154d3b1cccc5fb758d45bd5bfaadd7a4f5c
SSDEEP 96:1td2Twm+4JRopzRoNLEjD1voRP3RNb/USRu6/1G14r:C+4fo9uNLEn1UZh/Uiu6dE8
TLSH
T1D2B1BE24D5201DBDB6BD611D99A95242E6658F2B22300D5FBBBF0D0C1F73A363182F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\PlexusX\settings.json
Size 5KB
SHA256 d8e947e5cfe62b10dc9d490290ffc74f39f970cd7faf59d4f25d22737c42df4d
MD5 f0e0f2a7128701aa7ac6250acfbae885
SHA1 79e425f5a6e178610537209cd381046d2ebacff7
SHA512 0d44ed35c4f3f04b771df515d462135a9ab771ce85ae0f68e7ca6fc2b7f836b83be6382cfaf393cf9a5e0d9b24d2509a39584c991e06cc8a74571e082ddc0f8b
SSDEEP 96:1td2Twm+4JRopzRoNLVjD1voRP3RNb/USRu6/1G14r:C+4fo9uNLVn1UZh/Uiu6dE8
TLSH
T1CDB1BE24D5201DBDB6BD611D99A95242E6658F2B22300D5FBBBF0D0C1F73A363182F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\PlexusX\settings.json
Size 5KB
SHA256 737049407e925a176a7dd393648ed504276b2d8d247285606cdc042101cd6810
MD5 fec2035d2e7e462570d71b1dbd0c2a90
SHA1 e132e390b0f7f667b52e1c5c29d0b4f86de0d2bf
SHA512 31aa30b0c900ff6455d951e04045b73087b3ab062c58503a7be0cad7471b4968599c62b995ed12f5aa03d7b0550f2367fb0e70136fb24c570a2fec95587e7667
SSDEEP 96:1td2Twm+4JRopzRoNLV+D1voRP3RNb/USRu6/1G14r:C+4fo9uNLVo1UZh/Uiu6dE8
TLSH
T113B1BE24D5201DBDB6BD611D99A95242E6658F2B22300D5FBBBF0D0C1F73A363182F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4700-634-0x0000024289760000-0x0000024289810000-memory.dmp

Download

memory/4920-556-0x0000000000D70000-0x0000000000E51000-memory.dmp

Download

memory/4920-7-0x0000000000D70000-0x0000000000E51000-memory.dmp

Download

memory/4920-0-0x0000000000D70000-0x0000000000E51000-memory.dmp

Download

memory/5928-534-0x00000000006C0000-0x0000000000AFD000-memory.dmp

Download

memory/5928-492-0x00000000006C0000-0x0000000000AFD000-memory.dmp

Download

memory/5928-8-0x00000000006C0000-0x0000000000AFD000-memory.dmp

Download

memory/5928-9-0x0000000003790000-0x0000000003791000-memory.dmp

Download

memory/5928-5-0x0000000003790000-0x0000000003791000-memory.dmp

Download