Overview

overview

7

Static

static

3

keylogger/...er.exe

windows10-2004-x64

7

keylogger/...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    1799s
  • max time network
    1801s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/10/2026, 18:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    keylogger/ThemeHelper.exe
  • Size 8.0MB
  • Sample261015-xaeakavw3r
  • SHA256 d77bf9aebbc22abf98692da3383c52e3a6cdbb51a5302288059a848ce561f9d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoverypersistencespyware

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:5752
  • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2748
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3532
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1200
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:6116
        • C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
          "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /pst "C:\Users\Admin\Documents\Outlook Files\Outlook Data File - slipfujydb.pst"
          1⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          PID:5228
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
          1⤵
            PID:5028
          • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
            "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\PingGroup.docx" /o ""
            1⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            PID:4464
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:5692

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  gb.xsl
                  • Path C:\Users\Admin\AppData\Local\Temp\TCD81E6.tmp\gb.xsl
                  • Size 262KB
                  • SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\VCRUNTIME140.dll
                  • Size 117KB
                  • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\_bz2.pyd
                  • Size 84KB
                  • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\_ctypes.pyd
                  • Size 124KB
                  • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\_lzma.pyd
                  • Size 157KB
                  • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _queue.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\_queue.pyd
                  • Size 32KB
                  • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  base_library.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\base_library.zip
                  • Size 1.3MB
                  • SHA256 d5158cc3f3fd64209fc375b5951fe38dae9f56e2fedefe16613804d78982573d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-8.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\libffi-8.dll
                  • Size 38KB
                  • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python312.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\python312.dll
                  • Size 6.6MB
                  • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ucrtbase.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\ucrtbase.dll
                  • Size 1.1MB
                  • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  unicodedata.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012d02\unicodedata.pyd
                  • Size 1.1MB
                  • SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab80F6.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab80F6.tmp
                  • Size 30KB
                  • SHA256 f747dd8b79fc69217fa3e36fae0ab417c1a0759c28c2c4f8b7450c70171228e6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8127.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8127.tmp
                  • Size 28KB
                  • SHA256 da2f261c3c82e229a097a9302c8580f014bb6442825db47c008da097cfce0ee4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8139.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8139.tmp
                  • Size 30KB
                  • SHA256 e0100320a4f63e07c77138a89ea24a1cbd69784a89fe3bf83e35576114b4ce02
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8149.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8149.tmp
                  • Size 30KB
                  • SHA256 cebe759bc4509700e3d23c6a5df8d889132a60ebc92260a74947eaa1089e2789
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab819A.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab819A.tmp
                  • Size 32KB
                  • SHA256 df3fff163924d08517b41455f2d06788ba4e49c68337d15ecf329be48cf7da2d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab819B.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab819B.tmp
                  • Size 34KB
                  • SHA256 23ccfb7206a8f77a13080998ec6ef95b59b3c3e12b72b2d2ad4e53b0b26bb8c3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab81AE.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab81AE.tmp
                  • Size 32KB
                  • SHA256 3c6f66790c543d4e9d8e0e6f476b1acadf0a5fcdd561b8484d8dddadfdf8134b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab81AF.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab81AF.tmp
                  • Size 34KB
                  • SHA256 9e46b8ba0bad6e534af33015c86396c33c5088d3ae5389217a5e90ba68252374
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab81B0.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab81B0.tmp
                  • Size 31KB
                  • SHA256 5d13f9907ac381d19f0a7552fd6d9fc07c9bd42c0f9ce017fff75587e1890375
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab81B1.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab81B1.tmp
                  • Size 30KB
                  • SHA256 434576eb1a16c2d14d666a33edde76717c896d79f45df56742afd90acb9f21ce
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab81B2.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab81B2.tmp
                  • Size 30KB
                  • SHA256 d250eb1f93b43efb7654b831b4183c9caec2d12d4efee8607fee70b9fab20730
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab81B3.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab81B3.tmp
                  • Size 30KB
                  • SHA256 7e1a90cdb2ba7f03abcb4687f0931858bf57e13552e0e4e54ec69a27325011ea
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab81B4.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab81B4.tmp
                  • Size 30KB
                  • SHA256 8077c92c66d15d7e03fbff3a48bd9576b80f698a36a44316eaba81ee8043b673
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab81FB.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab81FB.tmp
                  • Size 20KB
                  • SHA256 b217393fd2f95a11e2c594e736067870212e3c5242a212d6f9539450e8684616
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab820C.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab820C.tmp
                  • Size 300KB
                  • SHA256 3744bfa286cfcff46e51e6a68823a23f55416cd6619156b5929fed1f7778f1c7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab822D.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab822D.tmp
                  • Size 26KB
                  • SHA256 aa03afb681a76c86c1bd8902ee2bba31a644841ce6bcb913c8b5032713265578
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab823E.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab823E.tmp
                  • Size 20KB
                  • SHA256 6b1633dd765a11e7ed26f8f9a4dd45023b3e4adb903c934df3917d07a3856bff
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab823F.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab823F.tmp
                  • Size 21KB
                  • SHA256 557e0714d5536070131e7e7cdd18f0ef23fe6fb12381040812d022ec0fee7957
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8252.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8252.tmp
                  • Size 42KB
                  • SHA256 6f8ffb225f3b8c7ade31a17a02f941fc534e4f7b5ee678b21cd9060282034701
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8253.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8253.tmp
                  • Size 21KB
                  • SHA256 4a7dc4ed098e580c8d623c51b57c0bc1d601c45f40b60f39bba5f063377c3c1f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8275.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8275.tmp
                  • Size 41KB
                  • SHA256 ae0c5a2c8377dba613c576b1ff73f01ae8ef4a3a4a10b078b5752fb712b3776c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8287.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8287.tmp
                  • Size 264KB
                  • SHA256 372572dcbad590f64f5d18727757cbdf9366dde90955c79a0fcc9f536dab0384
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8298.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8298.tmp
                  • Size 23KB
                  • SHA256 298fd9dadf0acebb2aa058a09eebfae15e5d1c5a8982dee6669c63fb6119a13d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8299.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8299.tmp
                  • Size 45KB
                  • SHA256 40e9af9284ff07fdb75c33a11a794f5333712baa4a6cf82fa529fbaf5ad0fed0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab829A.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab829A.tmp
                  • Size 19KB
                  • SHA256 3ee9ae1f8dab4c498bd561d8fcc66d83e58f11b7bb4b2776df99f4cda4b850c2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab82AC.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab82AC.tmp
                  • Size 24KB
                  • SHA256 f2db1e60533f0d108d5fb1004904c1f2e8557d4493f3b251a1b3055f8f1507a3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab82D0.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab82D0.tmp
                  • Size 255KB
                  • SHA256 849e2e915aa61e2f831e54f337a745a5946467d539ccbd0214b4742f4e7e94ff
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8301.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8301.tmp
                  • Size 19KB
                  • SHA256 16c08547239e5b969041ab201eb55a3e30ead400433e926257331cb945dff094
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8303.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8303.tmp
                  • Size 21KB
                  • SHA256 e555a610a61db4f45a29a7fb196a9726c25772594252ad534453e69f05345283
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8315.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8315.tmp
                  • Size 270KB
                  • SHA256 b4bc3cd34bd328aaf68289cc0ed4d5cf8167f1ee1d7be20232ed4747ff96a80a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8326.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8326.tmp
                  • Size 22KB
                  • SHA256 345aa5ca2496f975b7e33c182d5e57377f8b740f23e9a55f4b2b446723947b72
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8338.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8338.tmp
                  • Size 21KB
                  • SHA256 5c70dd1551eb8b9b13efafeeaf70f08b307e110caee75ad9908a6a42bbccb07e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8339.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8339.tmp
                  • Size 21KB
                  • SHA256 773ac516c9b9b28058128ec9be099f817f3f90211ac70dc68077599929683d6f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab85FB.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab85FB.tmp
                  • Size 2.5MB
                  • SHA256 a44166f5c9f2553555a43586ba5db1c1de54d72d308a48268f27c6a00076b1ca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab85FC.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab85FC.tmp
                  • Size 681KB
                  • SHA256 3732eb6166945db2bf792da04199b5c4a0fb3c96621ecbfdeaf2ea1699ba88ee
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab85FD.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab85FD.tmp
                  • Size 288KB
                  • SHA256 6cb03cebab2c28bf5318b13eeee49fbed8dcedaf771de78126d1bfe9bd81c674
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab85FE.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab85FE.tmp
                  • Size 706KB
                  • SHA256 9af92b1671772e8e781b58217dab481f0afbcf646de36bc1bffc7d411d14e351
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab85FF.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab85FF.tmp
                  • Size 217KB
                  • SHA256 217ec1b6e00a24583b166026dec480d447fb564cf3bca81984684648c272f767
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8600.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8600.tmp
                  • Size 20KB
                  • SHA256 1cf5c2d0f6188ffff117932c424cc55d1459e0852564c09d7779263abd116118
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8601.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8601.tmp
                  • Size 18KB
                  • SHA256 e3be3f1e341c0fa5e9cb79e2739cf0565c6ea6c189ea3e53acf04320459a7070
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8602.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8602.tmp
                  • Size 1.0MB
                  • SHA256 4c3b008e0eb10a722d8fedb325bfb97edaa609b1e901295f224dd4cb4df5fc26
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8603.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8603.tmp
                  • Size 537KB
                  • SHA256 4e2e93ebac4ad3f8690b020040d1ae3f8e7905ab7286fc25671e07aa0282cac0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8604.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8604.tmp
                  • Size 1.0MB
                  • SHA256 69b2675e47917a9469f771d0c634bd62b2dfa0f5d4af3fd7afe9196bf889c19e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab86BB.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab86BB.tmp
                  • Size 225KB
                  • SHA256 6a3801c1d4cf0c19a990282d93ac16007f6cacb645f0e0684ef2edac02647833
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab871B.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab871B.tmp
                  • Size 19KB
                  • SHA256 93a2f873acf5bead4bc0d1cc17b5e89a928d63619f70a1918b29e5230abead8e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab873C.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab873C.tmp
                  • Size 931KB
                  • SHA256 8b0631da4dc79e036251379a0a68c3ba977f14bcc797ba0eb9692f8bb90ddb4d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab87BB.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab87BB.tmp
                  • Size 1.2MB
                  • SHA256 ada7eff0676d9cce1935d5485f3dde35c594d343658fb1da42cb5a48fc3fc16a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8992.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8992.tmp
                  • Size 1.7MB
                  • SHA256 640ad075b555d4a2143f909eafd91f54076f5dde42a2b11cd897bc564b5d7ff7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8A4F.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8A4F.tmp
                  • Size 3.1MB
                  • SHA256 42323dd1d3e88c3207e16e0c95ca1048f2e4cd66183ad23b90171da381d37b58
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8AAF.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8AAF.tmp
                  • Size 2.4MB
                  • SHA256 ad26761d59f1fa9783c2f49184a2e8fe55fcd46cd3c49ffc099c02310649dc67
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8DAE.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8DAE.tmp
                  • Size 3.3MB
                  • SHA256 f2d2df37366f8e49106980377d2448080879027c380d90d5a25da3bdad771f8c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cab8DC0.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\cab8DC0.tmp
                  • Size 1.8MB
                  • SHA256 8af4c7cac47d2b9c7adeadf276edae830b4cc5ffe7e765e3c3d7b3fadcb5f273
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.dat
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                  • Size 267B
                  • SHA256 58193b0edb6700e302c5b0e7e4e8179abb7f032776dfb67dcd7d78ff7e744f7a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ExcludeDictionaryEN0409.lex
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
                  • Size 2B
                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                  • MD5 SHA1 SHA512
                  Submit Download

                  fb3b0dbfee58fac8.customDestinations-ms
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
                  • Size 2KB
                  • SHA256 7fc23bcc69a0aa7cc30adf87899e79cd932f2761257e3a7269a10e2e5b3f9f08
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1008B
                  • SHA256 383ee25922f2fc103f0bc6b15d4c8aa0bd87eccc653a3e234ffe2d22d976858f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1KB
                  • SHA256 61c382bd417fe3b5385deca5954aa7ad3b60f74d197557c12f0fa1413928e453
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1KB
                  • SHA256 ed0b802a02aeacb491106f7d71171f91c96d2f0202a548f6402e63d08f7efce4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1KB
                  • SHA256 84329c3f27acac31a8367de23bd1f89007c4bb91d960036aadc472b5b93cbf01
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1KB
                  • SHA256 bc1cf300053e3da2eab31e84ff522945df3b77ebc53a592db3f9cb38795fe252
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1KB
                  • SHA256 40648072e839a2736e24871c2f18b4e644aae834835cff4419680c89ef95edc2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1KB
                  • SHA256 7466b772268415bc506a00e7bf556863d87da672be01a2595e6661a0e20d8f28
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1KB
                  • SHA256 dfbfb569439e3e5235decbb4cdbe74d72d43df18bb1c68967dac147e887d84ed
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1KB
                  • SHA256 cd92a039fe07440fdc3b8b63ba2dee2789eca00b541b118b6e66665dd0830d81
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 1KB
                  • SHA256 a2db87a81b4aa6aff0026395b5c7231012fe6c0df376f2ebb28fc77737928994
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 eda602f3b363f58e574e44fe1a5efc3b7d63db15aca3cb6fa1742a76b67e5aa9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 d9e0b0c648bc115d924bed6fc2c8ba6b05302a57dd1caf9a1f56e0392b882c50
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 b576aba681008dc0944f07a32e9e5f05f915fa5c95ec424821342bbff5a22bab
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 5dfc3e2e696968beeb309123182193c762357ed43955fc844cfff913328f561a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 a287ee85c531c1f2be1ba72500c0fefd1f8408ebb1663d15132adc5fba9a0d11
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 b68eb37b349b82ddadd1edbdf80e91e5fc514d9e96108db45df8bda0fcff1b95
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 2db8caa0b748cda00e17dcf8724aab12c7d37cfbe1333cca87aefe941e227589
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 e7ab15071be1667e6436dbecb577759c8de799ef63bea05e84c619bbac5a9429
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 c99dc52a19cdecc497fbca9f6f8de83ebf7e9df9c27ba08670df929dad805b50
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 d456b7128b52a196b931b910dd2c32c7be7b18992fc38bfa6509e2587ed5c18a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 19c3baf36e3e3beeb1178f82a2936c28f7b712133820108975ecc09ec6d67031
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 e9fa263f68fcb2d748e6736135be8149ef2058b197b622b880eb3ca702cced8f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 2KB
                  • SHA256 981e2b16ad90e0467b867406dfd8b0d0c5af3afa1b0f994c3d9c1dd649cef109
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 3KB
                  • SHA256 0b2ce7def0313fd1b02b4ffbae77e1a29330c14a13401ad7d41daf8424107794
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 3KB
                  • SHA256 a64e641b6fd7022fc8b55b2600849b9f379894cea49a1b4a3a6172a4e7882f2e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 3KB
                  • SHA256 a4352c6bb589ad1fced03a93c32d6f21dd7e6eed0356e1f5b95e4f575e296f6d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ThemeCache.txt
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
                  • Size 4KB
                  • SHA256 426ce79a44a4315de8c5de0b3456421ea63e581d68193e7abac8d0553683031c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/2748-258-0x000002627BE30000-0x000002627BE31000-memory.dmp
                  Download

                  memory/4464-302-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/4464-303-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/4464-304-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/4464-305-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/4464-308-0x00007FF8F56F0000-0x00007FF8F5700000-memory.dmp
                  Download

                  memory/4464-306-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/4464-307-0x00007FF8F56F0000-0x00007FF8F5700000-memory.dmp
                  Download

                  memory/5228-208-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/5228-211-0x00007FF8F56F0000-0x00007FF8F5700000-memory.dmp
                  Download

                  memory/5228-210-0x00007FF8F56F0000-0x00007FF8F5700000-memory.dmp
                  Download

                  memory/5228-209-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/5228-207-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/5228-230-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/5228-206-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/5228-205-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/5228-231-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/5228-232-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/5228-233-0x00007FF8F7A60000-0x00007FF8F7A70000-memory.dmp
                  Download

                  memory/5752-259-0x000002391BA70000-0x000002391BA71000-memory.dmp
                  Download