bd00dd6ac18bc257c6564a1a4ceec736081a64261e085727e5549931108d3503

Analysis

max time kernel
38s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
worker.ps1
Size 20KB
Sample261020-2yctvsys4n
SHA256 bd00dd6ac18bc257c6564a1a4ceec736081a64261e085727e5549931108d3503
MD5 36c0f4e00f490f7a08e03970252cdbfb
SHA1 1cd9c5a99929676f421f6f02f87c42f621fb56c6
SHA512 356c9e531cd84857a492dc2550ae240e82a5b1e6bdb5cc4461dab788aa6ae680502065d5e29b37e302a0bf3162f406b8355510d7dafa28b6d833e4f419e44e38
SSDEEP 384:rscO1QL/SJk6OZLXDCWxVOoisds4sFO9GHrZB8hsPlM49amY:gPySJk6OZbGWxs7O9GHrZB8hsdJ4v
TLSH
T13292F91474C0796247AB326598EB6205791F452B5C0B1930F4AC63D4EF7AF2CEBE0B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2368	PowerShell.exe
9	2368	PowerShell.exe

Executes dropped EXE 3 IoCs

pid	Process
3172	tor.exe
1736	node.exe
3496	node.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2368	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2368	PowerShell.exe
2368	PowerShell.exe
2368	PowerShell.exe
2368	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	PowerShell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2396	2368	PowerShell.exe	91
PID 2368 wrote to memory of 3172	2368	PowerShell.exe	92
PID 2368 wrote to memory of 1840	2368	PowerShell.exe	94
PID 2368 wrote to memory of 1736	2368	PowerShell.exe	95
PID 2368 wrote to memory of 3496	2368	PowerShell.exe	96

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\worker.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\tar.exe
  "C:\Windows\system32\tar.exe" xf C:\Users\Admin\AppData\Local\Temp\tunnel-rt.tar.gz -C C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh
  2⤵
  PID:2396
- C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh\tor\tor.exe
  "C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh\torrc"
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\system32\tar.exe
  "C:\Windows\system32\tar.exe" xf C:\Users\Admin\AppData\Local\Temp\rt-package.zip -C C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO --strip-components=1
  2⤵
  PID:1840
- C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node.exe
  "C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node.exe" --version
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node.exe
  "C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node.exe" -
  2⤵
  - Executes dropped EXE
  PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

geoip

Path C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh\data\geoip
Size 9.0MB
SHA256 af9ccd060a712d090ee07d5678b5d45b0038ec1573116fae724a6695a8485703
MD5 e9e0ee27f75255c81ee0d5352a0478aa
SHA1 b08bfe286dc8f11f29aaceafb6f7ef0f5c771042
SHA512 5547bc13552320720a132af6d9b122b75896f908ebeddb24d8218ef5075c38d21c7ef0ef6d5dd855b783c891c3aadd5fc362793e62974185e7eedeae47322413
SSDEEP 49152:j2qmvmL+vpS0uWjaD2X4wH2I58Ydqkztz9HkBo0podsEKopmzPrAMZARLhQIKL9Q:A
TLSH
T105A6F8A05271E9DAF3EA8797C9671C1D412BE01A222616B4F4C7F59E8D0FBC0D0B1E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip6

Path C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh\data\geoip6
Size 15.3MB
SHA256 2393124667ba2ccb4c806f226a33b2ef7a8188d1ba55831c1a5d3dca2b062514
MD5 4d1662e438f08fe4c913789c3f56d925
SHA1 9d85004fba941079cfe018f0599e6a337c4e45a1
SHA512 3fb3f440bc206a3645eb684b37606855c3d1d1d976463e45b96e7e069975aa18f4ca31ab9ed351533d56ee7e50bd7fd627b43d21d274133c5393a9b1b41905ec
SSDEEP 24576:eRqHqAVglkDRj8wHjVCpYcbwlihndEtmKco4MkQHLPTtshizhtBsNvubuw0oDL8l:Q
TLSH
T1BAF6DD7005BED7C5ABC8E1FF5690E86F4AA6F2DC361918D425B6DCB817E64074AEC203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh\tor\tor.exe
Size 9.7MB
SHA256 25760af65f16504e8b5cfe4b9c6a84a003a19d60855abeb90987cc628f05c069
MD5 d6b50e646631be5bac41eb5c79fb8380
SHA1 e61cbdcee30554270b70f1df33d15d3972ac7ae4
SHA512 50b632d78b8341e9c5d9e9098507509cd9baa91325563540e0137df8786ef0b20f92f57d22c8e4761f10e6fa25b467a39095cda44698d44951e35d90105c122a
SSDEEP 98304:N0Isa4ETc7xJ7AZoO79v4ITM/xx0ge4Km1te3AwrBjg0M+J1BqT80+u:WIsa4ETc7jZxs4z1tehL1E
TLSH
T19EA61947F27750DDD5BAC07892177223F9A13C8C81346B6B599097A22B70B68AF3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

torrc

Path C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh\torrc
Size 337B
SHA256 e54aa35e7bceda9e77df265bd576c5aa14f3b6a435fe10aea372b791a32b8f65
MD5 c9937375aa8fed270cc14e7c6110c46b
SHA1 650c52a14f1b99b9d223d8537a9c6f7575b03e52
SHA512 efb3e4156244d9ac625f9abb1fe8080f37e757b39dbec56cd8afc652eff671b985e6670fcc4395dca9dcb8dfe0e400397b60efdd617f1cec575527afeba1472c
TLSH
T19FE0260483ECDB290C04E00301B2D06CC2762545BE863A24532CC10EDFA2D08FAE7681
MD5 SHA1 SHA512 TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh\varSqs4\cached-microdescs.new
Size 9.5MB
SHA256 a3c5a8d1840cfe967711d7d2d6649e880bd8e6cf1eae59a47f193d95db5b8676
MD5 61b8ab348651792f8cb0e4acb5a7b7f8
SHA1 69c20c549a7bb537f9fe4866b87579e30cc84dcf
SHA512 b97f77699b01b693bb0b1de14d235ac94de805ccc95c5b441c2394a920d13aa923b3c50cae757eb124e495fdb271c5e3363939fb351e4e0dd330f83e03c82f20
SSDEEP 24576:imqmproHtIhUh9Q2GcqMJNJIEbXVB/yUW4VyxQLDH5EhlG10PDrZdyWEud+CFM9C:PpprMNQfYG6aVl
TLSH
T1ECA6AEDA499704C25E09E7CDEC1607C3DF244A3E0B2041A162AAF6677F3329FC65EA75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unverified-microdesc-consensus

Path C:\Users\Admin\AppData\Local\SystemSyncqY\channeleYLh\varSqs4\unverified-microdesc-consensus
Size 3.0MB
SHA256 82b2a512568dca18e14d6906ae19bb14d9c3c5a041b6f568e78937061fcdffcd
MD5 e576078f33b8ff0b34906f310457d0d9
SHA1 2c31a049cdaa0f38dc7446f4a3779f78d8650d38
SHA512 552b273271f93b3da3d178085495f65b20e6d3bed98939f244cb8f6421d1694c4519d8da0fef857dbf9589c9ec98ab9b50abfabce3fa7accd67f7806db8a22bd
SSDEEP 12288:sfaqF7Gg0fa2IBd1582y4wI0cs7MRaIX9VawAvksZj6Xa/1hvhqKU57MCbX8zTLx:sfRqftw8rHTNuXPIkH41hvAl5REo9cd
TLSH
T136E523EA97124DEED32609DBE510FB7BF33F5B25C2486B94286F88EA72050D1752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\@npmcli\query\LICENSE
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\@npmcli\run-script\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\@sigstore\sign\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

witness.js

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\@sigstore\sign\dist\witness\witness.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\ansi-styles\license
Size 1KB
SHA256 fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
MD5 b862aeb7e1d01452e0f07403591e5a55
SHA1 b8765be74fea9525d978661759be8c11bab5e60e
SHA512 885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
TLSH
T1A821961E72551363186613E069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\glob\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\glob\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\ignore-walk\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\libnpmpublish\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\npm-pick-manifest\LICENSE.md
Size 771B
SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
MD5 e9dc66f98e5f7ff720bf603fff36ebc5
SHA1 f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA512 8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
TLSH
T15F01259A62E56DF46DD19F806DF1B98D70CCF076BC47A91530A8E258C7B704F88AE414
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\path-key\license
Size 1KB
SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
MD5 5ad87d95c13094fa67f25442ff521efd
SHA1 01f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA512 7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
TLSH
T18521961D72551363186613A069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\treeverse\LICENSE
Size 771B
SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
MD5 1d7c74bcd1904d125f6aff37749dc069
SHA1 21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA512 b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
TLSH
T14801F18FB2D52A9454D19B653DA1EC8961C9F0773D43AA0530B4E248C7AB40F95BA404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\which\node_modules\isexe\LICENSE.md
Size 1KB
SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
MD5 236eea678a0baae4690b3fee5f11cd6d
SHA1 0d97e894b9fe7f7a8e74bb99619e415a65726a40
SHA512 e7e720da4ec95a289fdc5acb7d9d06fbab28b15476e1eb51155e0a131a0222d5e44794bd49088230ae602173ec3c49c789b6c2e28a3146778624f4b9244c1d8a
TLSH
T1AC31E02F665E975302D041066F43A0BFF51A457D966E02F23496905833F6B2246BB8BC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE-MIT.txt

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\LICENSE-MIT.txt
Size 1KB
SHA256 f996f6e050e6fc18086162b4b44e301bba345c87deca83f57a27e6d54195556e
MD5 e0be9e751faf84fbb7c61c63af745e32
SHA1 48e53e2b46d48cc6ea16f03ab1ecb69a86f5db0b
SHA512 6686277ceafd63dc89b17315c43134098cd131d16c7d42fad82cee5b7c78e4aa1f7cb199db352b9e54adb3f09dc77b1dc6665a5667c4ab8b3639fa254e20ecce
TLSH
T1D211895FB261137B1C66139069A4AC85B36B715BBDFF2384345DF244231A468D9F7C04
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
Size 17KB
SHA256 77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573
MD5 cf8f16c1aa805000c832f879529c070c
SHA1 54cc4d6c9b462ad2de246e28cd80ed030504353d
SHA512 a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a
SSDEEP 192:4uyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kIz:4ng4LYVNn8b8K+eLWD7GxusJ/DdVd5
TLSH
T1C572C0BC008846963D2DE0D4AF74EAD62A8D4B4A240CD3365F9BF83776C64F4ED994E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\SystemSyncqY\rtdO\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
Size 15KB
SHA256 5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9
MD5 9841536310d4e186a474dfa2acf558cd
SHA1 33fabbcc5e1adbe0528243eafd36e5d876aaecaa
SHA512 b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783
SSDEEP 96:49tOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++QdO:4bzTgMU4GgawCZleYwZG038i
TLSH
T10362C0B08521BE6634B2001B9D545B1FF0A8954BE962EF3797ACF19EB345131CAC36F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt-package.zip

Path C:\Users\Admin\AppData\Local\Temp\rt-package.zip
Size 34.0MB
SHA256 1177b4137ba5adaa56354ae40f1080c7450e8ae09cecb47da459d1c52ac99f97
MD5 703336100aa3f8b851c4ac0eb1d091c2
SHA1 7a436eeffd5a1ad9b3393541058a34a5461fdf86
SHA512 31b88a0df9eaad7f1b785b3d413a48cf8be43080b6415aa053224005129828ca179563471c98da171e663eab5c2d7e752ccc4e6ac359a3b3bc8d6022a9e31f8e
SSDEEP 786432:rmahgYUw5ISIZgWLwWTXQw+TU+f67J6ztGBWWpY0:rKdw5ISI2Gz0U0sCWd
TLSH
T1BB7723A490B9197BEFAF7EBBF1C1C1664ECD96C55C30AC32192C66CA8C666F003C651D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tunnel-rt.tar.gz

Path C:\Users\Admin\AppData\Local\Temp\tunnel-rt.tar.gz
Size 21.3MB
SHA256 f22b8b17cb18c9fa775dfcf68acf6a2fe788336535fe94645204ca85158aa490
MD5 47fc2acc33b2be6b3fa67ceda21d6e01
SHA1 d6fc28016c5abf2b6f91ec5dd1c49c521b216816
SHA512 4f13e563e4b474d5447db2550de2fd39500a943c7eeb257bec396f3279007e2a8962ab0bccd92a93791a72e76338dbcc240a478a4bd84f2322b8056f176236b0
SSDEEP 393216:P9r8w6YvX/ndTFenVOe68qQCx8j9ONzjMQbGTHgvVBKUiqE/ArKlFUhh+:lr8w6YvPnVaVC8qVx8OHqHgPO9ArMSr+
TLSH
T14F27332A71F0F21ADB698911C8C0B53E95335DD5FB72E0392C71699207924CDAF0DAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2368-10-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-8-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-35-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-14-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-13-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-12-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-11-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-0-0x00007FFC5270F000-0x00007FFC52710000-memory.dmp

Download

memory/2368-33-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-7-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-9-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-6-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-5-0x00000216333D0000-0x00000216333F2000-memory.dmp

Download

memory/2368-2-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-2085-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-1-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/2368-2096-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download