Overview

overview

10

Static

static

3

pentyakernel.exe

windows10-2004-x64

10

pentyakernel.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/09/2026, 21:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pentyakernel.exe
  • Size 30.1MB
  • Sample260928-1akdcsvx6m
  • SHA256 0c94ac1c64929bffc086ada7929b9007f5902ebb4f4663e064b0eba1e29ac804
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitdefense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 1 IoCs
    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 54 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe
    "C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe
      "C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Checks SCSI registry key(s)
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3820
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:3888
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        3⤵
        • Executes a command shell one-liner
        PID:3592
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Add-Type -AssemblyName System.Speech; $s = New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Speak('Your system has been infected by Pentya Powerful. Pay five hundred dollars in bitcoin to recover your files.')"
        3⤵
        • Enumerates connected drives
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5048
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "PentyaKernel" /tr "C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe C:\Users\Admin\AppData\Roaming\PentyaKernel\pentya.py" /sc onlogon /f"
        3⤵
        • Executes a command shell one-liner
        PID:4440
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "PentyaKernel" /tr "C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe C:\Users\Admin\AppData\Roaming\PentyaKernel\pentya.py" /sc onlogon /f"
        3⤵
        • Executes a command shell one-liner
        PID:1696
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
        3⤵
        • Executes a command shell one-liner
        PID:116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB"
        3⤵
        • Executes a command shell one-liner
        PID:4364
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4888
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2f4 0x49c
    1⤵
      PID:3044

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          2
          T1059

          PowerShell

          1
          T1059.001

          Windows Command Shell

          1
          T1059.003

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Defense Evasion

          Direct Volume Access

          1
          T1006

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Indicator Removal

          2
          T1070

          File Deletion

          2
          T1070.004

          Modify Registry

          2
          T1112

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          2
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          SDL2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\SDL2.dll
          • Size 2.4MB
          • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDL2_image.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\SDL2_image.dll
          • Size 122KB
          • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDL2_mixer.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\SDL2_mixer.dll
          • Size 285KB
          • SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDL2_ttf.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\SDL2_ttf.dll
          • Size 1.5MB
          • SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\VCRUNTIME140.dll
          • Size 121KB
          • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_asyncio.pyd
          • Size 52KB
          • SHA256 b65afa3561034213a4218e1e7103f5a59ec71d06bbebcaae2ed0a980e9a94988
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_bz2.pyd
          • Size 71KB
          • SHA256 c46b2979e25b66827d0361a559e12879b8a250cf5c8771a54db94e4808e00685
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_ctypes.pyd
          • Size 116KB
          • SHA256 c10b0b0f800c1327cb627a342b9afc5960d436e9e08b02f5d6971da69e4722c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_decimal.pyd
          • Size 237KB
          • SHA256 5566518542e3ee6dd8cbecbae76e40a30015e82cc04ee4ea768a3cc9fb53f4ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_hashlib.pyd
          • Size 52KB
          • SHA256 5f17438d0e3091e6006048c873ce43e7e33d842a2a736500815a56aa8be4bf01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_lzma.pyd
          • Size 149KB
          • SHA256 0369454200d4b8deb3959415aae9bb9926e681b14bcb4427e432381fe57ecb27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_multiprocessing.pyd
          • Size 22KB
          • SHA256 8bd02152a04833cdde54a5a16754909fefee3d25d667156b725191375db16671
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_overlapped.pyd
          • Size 38KB
          • SHA256 994444b54f09d9f348ff50d5b5ebcfb36cd5da8271e3f563b41bc6e23928a6dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_queue.pyd
          • Size 20KB
          • SHA256 2dc5de29aea58fd5ef02d47d8590658df2fdebe8e85fb8b05cda288c330d94da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_socket.pyd
          • Size 66KB
          • SHA256 9bc8b64506c21e94457da274573e85777a06b67d4d6b98dddeab4b97172fcef1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_ssl.pyd
          • Size 163KB
          • SHA256 980f336c8b830e6e3aaa40ec8d442db61401dd88915b6c85ec278c351fe08eaf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\_tkinter.pyd
          • Size 52KB
          • SHA256 2cc987f71fe6a28e8ca5fc1f14c26bd6efa59b36e91d52901c17a5e57c4f0b2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\base_library.zip
          • Size 1.4MB
          • SHA256 0adb0086e5e039aa6ac8fbd6038072d5fe1c0449d9057093b72c6c93a7622ed2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          freetype.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\freetype.dll
          • Size 639KB
          • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3-x64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libcrypto-3-x64.dll
          • Size 7.6MB
          • SHA256 4ef4f59ddc79f232a76e7eee7a7fd91792974ba885011b00acada8debfc14173
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libffi-8.dll
          • Size 27KB
          • SHA256 d56b5e5aa064e35f9ae5d11d2f0833a591d946bc04b85e1772ddfa7c84eb33a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libjpeg-9.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libjpeg-9.dll
          • Size 238KB
          • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libmodplug-1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libmodplug-1.dll
          • Size 259KB
          • SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libogg-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libogg-0.dll
          • Size 25KB
          • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libopus-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libopus-0.dll
          • Size 359KB
          • SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libopusfile-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libopusfile-0.dll
          • Size 45KB
          • SHA256 ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libpng16-16.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libpng16-16.dll
          • Size 206KB
          • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3-x64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libssl-3-x64.dll
          • Size 1.5MB
          • SHA256 64e9d8e1627fbd3e683be652116c6f285982d573f5b772e5647f229cb293d597
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libtiff-5.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libtiff-5.dll
          • Size 422KB
          • SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libwebp-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\libwebp-7.dll
          • Size 437KB
          • SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          portmidi.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\portmidi.dll
          • Size 41KB
          • SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\pyexpat.pyd
          • Size 198KB
          • SHA256 2078cbd699c181466f3bd50e57e509842613ebfa82de6317beab6210d13b0a65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base.cp311-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\pygame\base.cp311-win_amd64.pyd
          • Size 30KB
          • SHA256 179b6803eaa24c8ad84cd85912147ec8ce423a136d529f564d2579aa405297f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          constants.cp311-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\pygame\constants.cp311-win_amd64.pyd
          • Size 49KB
          • SHA256 60dfd088ad8e333e8f13bfcf1409cbbdaa1ebdad9f0faf060d9c2860f801b2bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rect.cp311-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\pygame\rect.cp311-win_amd64.pyd
          • Size 44KB
          • SHA256 a761a244eacf7fb01923fc171aa4ef5468fb150518f5a5f99412d44c70fbbd3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\python3.DLL
          • Size 54KB
          • SHA256 8fda4948f6fc2bed1c7d1ece9596a3450c772775e48046c0bf701517d78ae9e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\python311.dll
          • Size 5.6MB
          • SHA256 06cb189016f6d5a593aba0e4c53ae972f2b7a257373c502e7da80f35f37dc1c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\select.pyd
          • Size 18KB
          • SHA256 ab91970ff8458849e59711e323dc49f09bafe7a650ddcf797fd7242343ebc49d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\tcl86t.dll
          • Size 1.8MB
          • SHA256 59488f67a8e75a5d51c7cb865436b5581fbb16014e9233b34db0c22bea6d4765
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\tk86t.dll
          • Size 1.5MB
          • SHA256 e9a5815ad39619e22d581b7124bbaa4192e701229956a2edbaffc0c420864561
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\unicodedata.pyd
          • Size 1.1MB
          • SHA256 aa489115a8139de6aa0db51e2c8771c78df430fd7c3c65b714f385833ccc91fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000103c2\zlib1.dll
          • Size 106KB
          • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_cxvxn3do.wf2.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cxvxn3do.wf2.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          @[email protected]
          • Path C:\Users\Admin\AppData\Roaming\@[email protected]
          • Size 151B
          • SHA256 816e5509ade90e5b069774d089d1f7e43441d28d61230b8828de0a79ceb584d5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/5016-1330-0x00007FFA22260000-0x00007FFA224CC000-memory.dmp
          Download

          memory/5016-1333-0x0000000062E80000-0x0000000062EA4000-memory.dmp
          Download

          memory/5016-1332-0x0000000068B40000-0x0000000068B7C000-memory.dmp
          Download

          memory/5016-1331-0x000000006A880000-0x000000006A8A7000-memory.dmp
          Download

          memory/5016-1383-0x00007FFA22260000-0x00007FFA224CC000-memory.dmp
          Download

          memory/5048-1247-0x00000186F8610000-0x00000186F8632000-memory.dmp
          Download

          memory/5048-1324-0x00000186F9940000-0x00000186F99EA000-memory.dmp
          Download