dcc36fcaaed37fef987afd554dd5d370fe5ab3cf0394dfa1002ac77e4a4b5740

Analysis

user interaction
yes
max time kernel
26s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Neiky Textures Free.exe
Size 30.9MB
Sample261020-ynvp5set3t
SHA256 dcc36fcaaed37fef987afd554dd5d370fe5ab3cf0394dfa1002ac77e4a4b5740
MD5 fba3bdc69738b148984bda4d6d7df3d5
SHA1 c95965040c0dcbe99ec0883751f12c5e68d86ddd
SHA512 058426e83bee753aef73f0ba9d94edee55bf1df49a77f0ca50d90eb7258643a73c0ec743f589aa95ac1d06ba7f7daa62d472574cabf80fcdf325672ffa86b1bb
SSDEEP 786432:TdbS4ce2svCkpDr4CodmUJAx/mxqj6YMc3hrgphRs+7+X:TY4f/n2JAJmEOvc3Ngprs+7+
TLSH
T19B6733AA923015FBCCC5823999A9CA57B3736E524792C4DF0B6C5B3D0D9B2E40C3C5B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 34 IoCs

pid	Process
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe
2148	Neiky Textures Free.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Discovers running processes 1 TTPs 14 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5652	tasklist.exe
1656	tasklist.exe
4752	tasklist.exe
1568	tasklist.exe
4728	tasklist.exe
236	tasklist.exe
4652	tasklist.exe
3940	tasklist.exe
3292	tasklist.exe
668	tasklist.exe
1484	tasklist.exe
708	tasklist.exe
3404	tasklist.exe
3876	tasklist.exe

Queries system WMI classes for hardware identifiers 2 TTPs 42 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
3040	powershell.exe
3568	powershell.exe
4500	powershell.exe
2376	powershell.exe
3320	powershell.exe
4548	powershell.exe
5996	powershell.exe
996	powershell.exe
5864	powershell.exe
3272	powershell.exe
2888	powershell.exe
5116	powershell.exe
3184	powershell.exe
5628	powershell.exe
2936	powershell.exe
3216	powershell.exe
3476	powershell.exe
1820	powershell.exe
5416	powershell.exe
236	powershell.exe
1276	powershell.exe
1152	powershell.exe
5004	powershell.exe
3304	powershell.exe
3780	powershell.exe
5592	powershell.exe
2428	powershell.exe
4420	powershell.exe
3740	powershell.exe
5176	powershell.exe
5792	powershell.exe
3216	powershell.exe
1540	powershell.exe
3876	powershell.exe
5080	powershell.exe
5408	powershell.exe
1868	powershell.exe
1140	powershell.exe
472	powershell.exe
3188	powershell.exe
1752	powershell.exe
2236	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2888	powershell.exe
940	powershell.exe
1208	powershell.exe
5508	powershell.exe
1912	powershell.exe
4280	powershell.exe
5528	powershell.exe
4456	powershell.exe
3812	powershell.exe
2632	powershell.exe
2668	powershell.exe
3320	powershell.exe
1332	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Neiky Textures Free.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Neiky Textures Free.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{96FC8FA6-9787-4696-A9CC-DCD2E515B36E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
5864	powershell.exe
5864	powershell.exe
5864	powershell.exe
3568	powershell.exe
3568	powershell.exe
3568	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
2888	powershell.exe
2888	powershell.exe
2888	powershell.exe
1820	powershell.exe
1820	powershell.exe
1820	powershell.exe
3216	powershell.exe
3216	powershell.exe
3216	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
3780	powershell.exe
3780	powershell.exe
3780	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
2888	powershell.exe
2888	powershell.exe
2888	powershell.exe
3812	powershell.exe
3812	powershell.exe
3812	powershell.exe
1140	powershell.exe
1140	powershell.exe
1140	powershell.exe
5592	powershell.exe
5592	powershell.exe
5592	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
940	powershell.exe
940	powershell.exe
940	powershell.exe
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
2376	powershell.exe
2376	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	tasklist.exe
Token: SeDebugPrivilege	5864	powershell.exe
Token: SeIncreaseQuotaPrivilege	5864	powershell.exe
Token: SeSecurityPrivilege	5864	powershell.exe
Token: SeTakeOwnershipPrivilege	5864	powershell.exe
Token: SeLoadDriverPrivilege	5864	powershell.exe
Token: SeSystemProfilePrivilege	5864	powershell.exe
Token: SeSystemtimePrivilege	5864	powershell.exe
Token: SeProfSingleProcessPrivilege	5864	powershell.exe
Token: SeIncBasePriorityPrivilege	5864	powershell.exe
Token: SeCreatePagefilePrivilege	5864	powershell.exe
Token: SeBackupPrivilege	5864	powershell.exe
Token: SeRestorePrivilege	5864	powershell.exe
Token: SeShutdownPrivilege	5864	powershell.exe
Token: SeDebugPrivilege	5864	powershell.exe
Token: SeSystemEnvironmentPrivilege	5864	powershell.exe
Token: SeRemoteShutdownPrivilege	5864	powershell.exe
Token: SeUndockPrivilege	5864	powershell.exe
Token: SeManageVolumePrivilege	5864	powershell.exe
Token: 33	5864	powershell.exe
Token: 34	5864	powershell.exe
Token: 35	5864	powershell.exe
Token: 36	5864	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeIncreaseQuotaPrivilege	3568	powershell.exe
Token: SeSecurityPrivilege	3568	powershell.exe
Token: SeTakeOwnershipPrivilege	3568	powershell.exe
Token: SeLoadDriverPrivilege	3568	powershell.exe
Token: SeSystemProfilePrivilege	3568	powershell.exe
Token: SeSystemtimePrivilege	3568	powershell.exe
Token: SeProfSingleProcessPrivilege	3568	powershell.exe
Token: SeIncBasePriorityPrivilege	3568	powershell.exe
Token: SeCreatePagefilePrivilege	3568	powershell.exe
Token: SeBackupPrivilege	3568	powershell.exe
Token: SeRestorePrivilege	3568	powershell.exe
Token: SeShutdownPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeSystemEnvironmentPrivilege	3568	powershell.exe
Token: SeRemoteShutdownPrivilege	3568	powershell.exe
Token: SeUndockPrivilege	3568	powershell.exe
Token: SeManageVolumePrivilege	3568	powershell.exe
Token: 33	3568	powershell.exe
Token: 34	3568	powershell.exe
Token: 35	3568	powershell.exe
Token: 36	3568	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeIncreaseQuotaPrivilege	3476	powershell.exe
Token: SeSecurityPrivilege	3476	powershell.exe
Token: SeTakeOwnershipPrivilege	3476	powershell.exe
Token: SeLoadDriverPrivilege	3476	powershell.exe
Token: SeSystemProfilePrivilege	3476	powershell.exe
Token: SeSystemtimePrivilege	3476	powershell.exe
Token: SeProfSingleProcessPrivilege	3476	powershell.exe
Token: SeIncBasePriorityPrivilege	3476	powershell.exe
Token: SeCreatePagefilePrivilege	3476	powershell.exe
Token: SeBackupPrivilege	3476	powershell.exe
Token: SeRestorePrivilege	3476	powershell.exe
Token: SeShutdownPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeSystemEnvironmentPrivilege	3476	powershell.exe
Token: SeRemoteShutdownPrivilege	3476	powershell.exe
Token: SeUndockPrivilege	3476	powershell.exe
Token: SeManageVolumePrivilege	3476	powershell.exe
Token: 33	3476	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2148	2588	Neiky Textures Free.exe	90
PID 2148 wrote to memory of 5872	2148	Neiky Textures Free.exe	92
PID 5872 wrote to memory of 3824	5872	msedge.exe	93
PID 5872 wrote to memory of 4024	5872	msedge.exe	94
PID 5872 wrote to memory of 464	5872	msedge.exe	95
PID 5872 wrote to memory of 464	5872	msedge.exe	95
PID 5872 wrote to memory of 464	5872	msedge.exe	95
PID 5872 wrote to memory of 4308	5872	msedge.exe	96
PID 5872 wrote to memory of 4308	5872	msedge.exe	96
PID 5872 wrote to memory of 3292	5872	msedge.exe	97
PID 5872 wrote to memory of 2320	5872	msedge.exe	98
PID 5872 wrote to memory of 3292	5872	msedge.exe	97
PID 5872 wrote to memory of 3292	5872	msedge.exe	97
PID 5872 wrote to memory of 2320	5872	msedge.exe	98
PID 5872 wrote to memory of 2320	5872	msedge.exe	98
PID 5872 wrote to memory of 2016	5872	msedge.exe	99
PID 5872 wrote to memory of 3188	5872	msedge.exe	100
PID 5872 wrote to memory of 2552	5872	msedge.exe	101
PID 5872 wrote to memory of 2016	5872	msedge.exe	99
PID 5872 wrote to memory of 2016	5872	msedge.exe	99
PID 5872 wrote to memory of 3184	5872	msedge.exe	102
PID 5872 wrote to memory of 4996	5872	msedge.exe	103
PID 5872 wrote to memory of 3656	5872	msedge.exe	104
PID 5872 wrote to memory of 3188	5872	msedge.exe	100
PID 5872 wrote to memory of 3188	5872	msedge.exe	100
PID 5872 wrote to memory of 2552	5872	msedge.exe	101
PID 5872 wrote to memory of 2552	5872	msedge.exe	101
PID 5872 wrote to memory of 5652	5872	msedge.exe	105
PID 5872 wrote to memory of 2624	5872	msedge.exe	106
PID 5872 wrote to memory of 3184	5872	msedge.exe	102
PID 5872 wrote to memory of 3184	5872	msedge.exe	102
PID 5872 wrote to memory of 2936	5872	msedge.exe	107
PID 5872 wrote to memory of 1084	5872	msedge.exe	108
PID 5872 wrote to memory of 4996	5872	msedge.exe	103
PID 5872 wrote to memory of 4996	5872	msedge.exe	103
PID 5872 wrote to memory of 3656	5872	msedge.exe	104
PID 5872 wrote to memory of 3656	5872	msedge.exe	104
PID 5872 wrote to memory of 5652	5872	msedge.exe	105
PID 5872 wrote to memory of 5652	5872	msedge.exe	105
PID 5872 wrote to memory of 2624	5872	msedge.exe	106
PID 5872 wrote to memory of 2624	5872	msedge.exe	106
PID 5872 wrote to memory of 2936	5872	msedge.exe	107
PID 5872 wrote to memory of 2936	5872	msedge.exe	107
PID 5872 wrote to memory of 1084	5872	msedge.exe	108
PID 5872 wrote to memory of 1084	5872	msedge.exe	108
PID 5872 wrote to memory of 5800	5872	msedge.exe	109
PID 5872 wrote to memory of 5800	5872	msedge.exe	109
PID 2148 wrote to memory of 4752	2148	Neiky Textures Free.exe	110
PID 2148 wrote to memory of 5864	2148	Neiky Textures Free.exe	113
PID 2148 wrote to memory of 3568	2148	Neiky Textures Free.exe	115
PID 5872 wrote to memory of 3020	5872	msedge.exe	117
PID 5872 wrote to memory of 3020	5872	msedge.exe	117
PID 5872 wrote to memory of 1656	5872	msedge.exe	118
PID 5872 wrote to memory of 1656	5872	msedge.exe	118
PID 5872 wrote to memory of 1484	5872	msedge.exe	120
PID 5872 wrote to memory of 3416	5872	msedge.exe	121
PID 5872 wrote to memory of 3416	5872	msedge.exe	121
PID 5872 wrote to memory of 1848	5872	msedge.exe	122
PID 5872 wrote to memory of 1848	5872	msedge.exe	122
PID 5872 wrote to memory of 4260	5872	msedge.exe	123
PID 5872 wrote to memory of 4260	5872	msedge.exe	123
PID 5872 wrote to memory of 1036	5872	msedge.exe	124
PID 5872 wrote to memory of 1036	5872	msedge.exe	124
PID 2148 wrote to memory of 3476	2148	Neiky Textures Free.exe	125

C:\Users\Admin\AppData\Local\Temp\Neiky Textures Free.exe
"C:\Users\Admin\AppData\Local\Temp\Neiky Textures Free.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\Neiky Textures Free.exe
  "C:\Users\Admin\AppData\Local\Temp\Neiky Textures Free.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --app=http://127.0.0.1:8742 --window-size=1180,860 --user-data-dir=C:\Users\Admin\AppData\Local\NeikyTextures\win --no-first-run --no-default-browser-check --disable-features=Translate,FirstRunExperience
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\NeikyTextures\win /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\NeikyTextures\win\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x234,0x7ffed576c188,0x7ffed576c194,0x7ffed576c1a0
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,11034559661238296802,9796638762331422456,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
      4⤵
      System Time Discovery
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,6291624310990392848,16437012819506056271,262144 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,17579661772195122273,6411297502728055533,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,7239225760423472585,13799555714044937219,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,10193999234135240531,10060461962374097949,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,581218273788909117,13215226076967968065,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,3165843590101601724,8901726739236618414,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4364,i,7657696878448266006,17902066128167585099,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4360,i,15217861546022150930,1378085420777532269,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:9
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4412,i,12593878239729099165,4872999735106956188,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4476,i,7324811461155120447,16511199296460324466,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:9
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4492,i,10007888370819618926,15483695398749662762,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4640,i,9253713392206621988,6863717981026141871,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4672,i,8574040086441364770,8791521442600792658,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:9
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4584,i,11338074480517088207,918663830073949978,2097152 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:9
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,4781331044940236572,10631890650853063679,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,3090771193422676251,3230107830925009516,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,16005789632470739474,9009722544593032752,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,13690740714733011301,3877719227996741539,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
      4⤵
      PID:360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,13690740714733011301,3877719227996741539,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,4132432383719627741,14299302586498086717,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,8767417821289797274,15637052221549181495,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:14
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,13794466664181817697,13153530586524916736,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,13856057778900815678,4134259697932761208,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:14
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7624,i,17638197035372488261,5596559861245377477,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:14
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,12109386530910832436,8381282189937148907,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1376,i,17403797552187953076,4140806724529718251,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=1360 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\NeikyTextures\win" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,9038881861156578337,15855394232553923312,524288 --field-trial-handle=2540,i,530381901581531083,12477574163881690311,262144 --disable-features=FirstRunExperience,Translate --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
      4⤵
      PID:1180
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2888
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:3292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:1820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:3216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:1540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4456
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:3780
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:3272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:2888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3812
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:1568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:5592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:4500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3272
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:1484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:4420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    PID:2376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1208
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:3320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:3740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:5416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2632
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:236
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:3876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:3040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2668
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:5116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:4548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:5176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5508
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3812
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:3404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:3184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:3188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3320
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:3876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:5792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:5628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:5996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1912
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:5652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:1276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:3216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4280
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:1656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:2236
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:1152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5528
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:4652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:1752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:5408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").VolumeSerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1332
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Stumble Guys.exe"
    3⤵
    - Discovers running processes
    PID:3940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).ProcessorId"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:5004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
    3⤵
    - Queries system WMI classes for hardware identifiers
    PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f916075ccf4073a18383b78278ce7314465bfca8b1a3e536e423e33a8f791c16
MD5 5d498fa4aa3c42d31dbff1bb5838ffad
SHA1 551cff960c3dc385c3ee185c2024fb03d47d8d78
SHA512 75c96b82a7a49feeceb1869e5f972192257f95290dd65dd9c92d6132175ad077b7d9305f35061bf2748cb7069e5ce40fa7e152befbaa5800e0180c416ffb9dc6
TLSH
T15D219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

2769601a-3cc8-4d5c-a3eb-90bcf91fcbc0.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\2769601a-3cc8-4d5c-a3eb-90bcf91fcbc0.tmp
Size 3KB
SHA256 836b52f0cb03533005ca0bfa878f1f22f29fa90463d94ac703ffe558489a5811
MD5 a4730cecec6f4ccfb799c0e1ea9db4f2
SHA1 8f3ee801ccc13b0a0c89490541b7f3e9a6d53666
SHA512 ae3a618ec38840f14e571d0c2e10733d266b7923e60ea577c97560d0f4361dd53b2329eaea809b76e6689b39aa0178c912577edf187039addcc6783f16f5e9d3
TLSH
T18E81A8716429ED3355EA6D04B5D926D39EB471B3E856EF44F6C8131800EB24C3B49C27
MD5 SHA1 SHA512 TLSH

Submit Download

540c9226-0291-4de8-8b26-bea2ce818303.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\540c9226-0291-4de8-8b26-bea2ce818303.tmp
Size 13KB
SHA256 4655633879809d5ec7f385a9a85364d3aa38c2624b0c96d35189d7c8c3eb6221
MD5 bddaacaf64416f8acb85f0b5eea427b7
SHA1 74b32d2b1ed2d3d5ab7e9717d648158551082fd5
SHA512 e7f54a575da2253ac323ef934971c68eef01080b7540d8ec4d658bb352a4381adb241b44e710c6ec77997cba065c70653d43cbd2d5b52877b43dfb947e0c1445
SSDEEP 192:uuyzULHcP1cZLxRm88SvjiVg8N6CYcy6McooDUu0wlAZD76q7atljja6eHJIh6lb:ntQkUSvD8N6Cy6fX2t9IIlb
TLSH
T1E7525B712835AE2785BB9901F28D36D39FB4A077E895AF94E9C85B1800DB2CE3747C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

666c9615-3ee4-435a-9840-825e0a9b34ef.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\666c9615-3ee4-435a-9840-825e0a9b34ef.tmp
Size 4KB
SHA256 d2a4e1d0185a8e6a0c92852a3f3a2411e18a2fd8b6d2ca66aaa8a3dcc16d3b9e
MD5 f879a1054f088209e6cfbd327d15baac
SHA1 c29bd7a2643dfddf778224abd46049428db36de7
SHA512 03cb2eb109ba5aac4816c6dc0a5826d43cce1236029213aa40111a9f6295f83fc8c51297e872652eca569e48119e631a4b5366e78cc18e9d06238f415a70209e
SSDEEP 96:nqGNkYQsFfHyjV58Frh/cInURoDotovZ0DTBcZvYcKq60eUnqfq4a:qGNUGyQooDUwcNcKq6qL
TLSH
T1D7A1D9716438EC274AE6AD04B5C63793AFE47173E885FF88E6D81A1C00E7388274AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Crashpad\settings.dat
Size 280B
SHA256 98e3a47845849466433661be0dcad1cc36d5f17ed062c942466b254402231fb4
MD5 16f4cf65369dad27c197a4459bf65281
SHA1 fc4aed0fe3468d1c351e43b97717b1ec9393ca25
SHA512 6785718e8b36075efee1520b18f4517440dcfb74ebe4a69b6ad708562e31495cdb8db6912e2a8a338cf36c497fc97488e539895da950bf2b69d474cb250bad81
TLSH
T15CD02230FB288233C828A2322828CB020008CEC23A2BB3802FA3003C3CA00C00C32083
MD5 SHA1 SHA512 TLSH

Submit Download

2af04abd-fd86-424f-b174-b9876de8f063.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\2af04abd-fd86-424f-b174-b9876de8f063.tmp
Size 29KB
SHA256 7fbaf4900894b11746e20e8769d51b02fad09c8fc201845442a6c839f3147f06
MD5 3e8cbf8c97a322672d1a60b334916e7c
SHA1 5b2bfb8e32d0e90bef5705641e6c06447945fb9d
SHA512 cfc5d706f82496c5488f12b6dacadcb896df045f0966fe4766a18dcd7e1efc26454a95fe64648381c73e22696cac6bc5d8157985959bb4ff8effefe19bef315a
SSDEEP 768:8jqi6z7pLuLjTTWDZ7f/r8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/ImNFVUrogVY:8jqi6lEjTTWDZ7f/ru1jaEImjV/wY
TLSH
T15AD2FA7B640CCB7E4F804ADDE81A7EDE6DAC018BA698CD4487F9941C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64304faf-dc9a-429a-ac27-958cebb76142.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\64304faf-dc9a-429a-ac27-958cebb76142.tmp
Size 9KB
SHA256 90cdb24478dac3d29d9d4c93e04f0bb5c275078c1a9f6240b4352bf529857a8c
MD5 6a45de36aecb5d36f83d60df8082a7be
SHA1 3b573f1ef801411454dfa693c9b36df9c3f1a1a1
SHA512 1f7c30a77a054f0951bbd31b76ce8e37468805a2855c59badaddfce8d57827bf012ed2a240b9a89f34ad6cfc690941729427a77313df9b824f664c0761173183
SSDEEP 192:sxRJRI0/fcsERHhIdpw4/gb+WNqomD/dV/fM+rhgJJ:sxRJC0/fcsEBKF/cqt/87z
TLSH
T11112D955AE28A97B4CCBE60EBA75BB53E6F55021A0D54E44E6FCC61C04E76CC230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Code Cache\js\index-dir\temp-index
Size 408B
SHA256 91973f3ad5b9c4439768fe58d49b3ca0dd1c440482f51f07c99f55870d1e3597
MD5 d8f61e7b4e313710ff738a27323a0d22
SHA1 f2f5f389ffb842638ccaf4e191031880515d5523
SHA512 a4da65baa6e98f3652b11fe8f068e246bd4b1ab0a2844da0a46eff9724bd5e40ea1fa0ce5f21eab9accab1ec996f07e4799aec83f330c0471930c809cef81b20
TLSH
T1A1E02E80F0C2A090CF27E7B340848EDC310A806EB48E639BA0C6319AE8232F22100C8A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 95ce9ae87a67d3cd5642827335024892638715a2f49edece77d547bbb99cff81
MD5 2d5c6aa2fee8934c4366d6e0c738cb2c
SHA1 880826b0e134aaed9e94e0e161f64aa38475f986
SHA512 654f3b24f91d2676d898ff090aea080600a2f46012cad68cfa347694724bcd4b553e830672b46ff96d0ef293ef057186b60d73d83a89364f51fcd850c44ea2b9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

96b8af1f-7cdc-443c-95ce-8d88e96d060e.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\DualEngine\96b8af1f-7cdc-443c-95ce-8d88e96d060e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Preferences
Size 9KB
SHA256 16f3827853449819123b3c4e1d348dc1a23fb1f2db41e14afe290fcd94f3a5ff
MD5 0b0367a721031f3cd5b7836f7237e492
SHA1 052c8ba61ce96e162bc9bd65298fc61cfb227792
SHA512 fa747c09d243566d20b010f6fe6fa17b92d169e095279da911a05b66edf12f59b8f6bba436fb34646d3d58a727e7ead2bbd89f7f80c58d4e57c54c4902a021bc
SSDEEP 192:sxRJRI0/fcsLRHhIdpw4/gb+WNqomD/dV/XM+rhg7J:sxRJC0/fcsLBKF/cqt/E7N
TLSH
T13D22D855AE28697B4CCBE60EBA757B53E6F55022A0C54E48E7FCCA1C04E76CD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Preferences
Size 9KB
SHA256 b0f923a18ed48d40dc4001fca9468e827f8743366c657b269ed2a4456cb20e55
MD5 010d3b15fcfc9595e80389a8186c900f
SHA1 4230cc5af6eced1a0eacf0f8cad0d892ee327aab
SHA512 7440f6a61d66abe03e128df637faaf9a6919dc6cfa46e5b17a0b5a3f42f4aa893e58a4cbbd16788fe2e61315f1929b0c066208fdeba8b232e6d487535745ae9f
SSDEEP 192:sxRJRI0/fcscRHhIdpw4/gb+WNqomD/dV/fM+rhgJJ:sxRJC0/fcscBKF/cqt/87z
TLSH
T1E512E955AE28A97B4CCBE60EBA75BB53E6F55021A0C54E44E6FCC61C04EB6CC230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 54fac85e067e1194d33b1eb3f9b914e6028ba8c433a0aaf8727d2fd29d375421
MD5 c5b22da106995d62c762aa06b3061dcd
SHA1 222a9d89a8850314dfb9bf34985fd59c072ac984
SHA512 14c0370fa1fe43672c51a835b9811b12ba29a8b8f3eceb17b5688f6f9cc816533f548182fed35cbb8940357637a8a6fd5d8e032653600f9ac2548b55b58c4f6a
TLSH
T17DA0026015C58502CD0343B2128245E876204C19D20FC30742E1549FEC537F04211400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 33f62a4b28441311cad3cac2a4181cfed7c9246f5f15fc0f642ed4a3c0fb3150
MD5 29ca955f07c57a121a0156d45381ff75
SHA1 b9f23295c03c2d246e2a5a66bbcc65a553e05a77
SHA512 7b2f107354587dd6cbcaf178777dacd616dfe4257d16ac57cf5b8d5ab1ab347f42119c96c6e276dfb9633a660b0a600cde952d3530f24bdee8d7cc1c318b84b5
MD5 SHA1 SHA512

Submit Download

597b3a4a-1318-491e-94fa-70c87f5e0aae.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\597b3a4a-1318-491e-94fa-70c87f5e0aae.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

febefaa3-3864-4734-bad5-27c6efbd168d.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\febefaa3-3864-4734-bad5-27c6efbd168d.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\Local State
Size 1KB
SHA256 6e7e058e3465bbea7517ebfefdf787bc0283ef1deb878601c906e25a9614ef78
MD5 acfe064a73066fba2e60ed36ee16ae7b
SHA1 796f5e18ad557591cec5b8d0b1f67a31026009cb
SHA512 ae2f29da3129009172f2608747ca860ad8e54b82d5fd15165c0790a875526147bcbe86be33fb421231f13f13be7924a323bee8ea16f4068f0690e26f42e1429c
TLSH
T1713195B0B8A82D73E4A64A05A389BF970F346171A161AA8CE6DC051C15E76CC621AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

a9c171d5-192b-40f0-af88-09f39c991042.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\a9c171d5-192b-40f0-af88-09f39c991042.tmp
Size 13KB
SHA256 d1d9d27d2dae842a79170b0e7cc479b48fa55393391a78a3d7cf2be7d34c1b09
MD5 e8853139a1d5ffd11b3226b427b7c3fe
SHA1 d2ef5152b4c8e55ba50187837dbc6b9b8ce71f0e
SHA512 313679e5fdd036dbaa666679b4584c996b5363555bdf829e55e9e04ef172f981c74122766ec16f6a9e1d40e8fec6ef475d605400ea4e0d6d6ab133830eb4d2a5
SSDEEP 192:uuzzULHcP1cZLxRm88SvjiVg8N6CYLy6McooDUu0wlAZD76q7atljja6eHJIh6lb:nUQkUSvD8N6Cz6fX2t9IIlb
TLSH
T12A525B712835AE2785BB9901F28C36D29FB4A077E8959F94EAC85B1C00D62CE3747D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c54bfbb0-1288-457c-b4d6-dfa6828a7eac.tmp

Path C:\Users\Admin\AppData\Local\NeikyTextures\win\extensions_crx_cache\c54bfbb0-1288-457c-b4d6-dfa6828a7eac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4edf6b80-73a9-4f1b-8998-b958bf6060ef.tmp

Path C:\Users\Admin\AppData\Local\Temp\4edf6b80-73a9-4f1b-8998-b958bf6060ef.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f72c5ea-e20d-476a-94ce-e0598f0896b4.tmp

Path C:\Users\Admin\AppData\Local\Temp\6f72c5ea-e20d-476a-94ce-e0598f0896b4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

_imaging.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\PIL\_imaging.cp314-win_amd64.pyd
Size 2.5MB
SHA256 d823c0e3b54035d08703bb427c553c956c2607b79395f2952e17a5447c5f1105
MD5 c3b635739ab73615e5f25b5be8740ba0
SHA1 1ff4078c87e91b32fa4f91cf127b2e7b1bbe7996
SHA512 0717462a639b6b21eafb20e190f4fd704d22c617dd0ca39392f2cf7aedb0bd6ca159ec86b00aa47ffd74f99b100b76e6133f6d4dc13b641c7d8310c7a73b537a
SSDEEP 49152:sltY4byAqCcu9833XDqGTsz3zVJxS75tbTtE4mxEH:CyAqCcnXuGGLOR
TLSH
T17AC57C42F5915899DA724034CDAAD622E3B1780D1BF186F7B684A7F93A33BD03937385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imagingft.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\PIL\_imagingft.cp314-win_amd64.pyd
Size 2.1MB
SHA256 93c3ca5a3e7119897be9825a0a4228d485410fc8f1e42257edf7e89052c79bce
MD5 2731036b349c5edcccfd90de105edc12
SHA1 3e7dc528d9f8f04f4a21da1781398c2ecc8a0aec
SHA512 f8b0903471b65bf905db57a8230e6de4f60e41e6d654e6f70631b79c80a4b6ecf43a84f2d811ee4741335aecec281c4964688b796a01fa3bd3ce59d1d06ef453
SSDEEP 24576:WhPxaDYIKlewlwk3VK+9Cle6JnbadSVwJNKiRjfIjTG2vSzGZHAGCl4tmeg5i5+:apqVw2MZ+rRiKQIQ74tm5i8
TLSH
T14BA5BF42E29641E8D93BC174C657961BE772B40413089BEB59D05A99BF23FF22BFE310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityPyBoost.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\UnityPy\UnityPyBoost.cp314-win_amd64.pyd
Size 110KB
SHA256 e513939e4d899ce32a27971530eac1f40a34f9b5d39565519fbe490eceadfed5
MD5 af23540baffaa66869f51aba43d2d75c
SHA1 c2ec11c28932c2452b98b52fa04d6a4f558f39c2
SHA512 d33d51448ab803f3322e70e7b7499b67c644d7a198aaa2e9ee9df02034992260d4351152dcf20632e0cd1fd6f8c764c4533ff40327e248aa51d5d4449db540ff
SSDEEP 1536:vTQD+OPDQOH2uue/ACjZlEsVR4TD/oZKl79s5GHogHh7rTtVNcnMNrnSDdg:EDPptRVmTsZoZRtVuMNrnSD
TLSH
T12FB33D1BBA56507ED21695B8CA134C43CB62B84647A16FCF07908DE70F17AE8BF7E910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_asyncio.pyd
Size 76KB
SHA256 13b374175108c266f4a5bdf907f990d0ccd5b486d0313856e08a60ba9bf856cf
MD5 7c068accfe6b0c30d60c1873889a755f
SHA1 6e4aafbe3bb0622ba08fb210d1fb5d9d9dd9fdcd
SHA512 c86e038d8a6ee0379b9048c51bb30e1159c4f61f35a3cf3311a072894ee9dca69988522af85b0ad9f1a7b7defb3331fb9c6f967cb36df649233dabefeffcc653
SSDEEP 1536:ePrgCA7vEAQ8mCo30GoIADnx0y7NsR9CfIbHMvM:eNcEAQ8Zo31oIADn8T5
TLSH
T17D736C8792A44086EEF79174CE536FC3FBB1F1915904539F51A4C18E2F533A08BBA726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_bz2.pyd
Size 85KB
SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
MD5 98aa4ec9b691267912bcb3336fc7cafc
SHA1 8955d7e923c4bf05d84a03666ec8cdb4fab2f616
SHA512 62084c7077ed896b92055e5a278651d6eeca65622321e389e551e8a331b51c9fe2a5eb1b903eaed41117a7a8efce514b9d62acf2b62985d1535812ab59011387
SSDEEP 1536:w1sxz74jpCk2wWdyOeR3RYZvksL8DdRbEvtwIA3V4y7NsR9KfIkWO:GsxzsIdtYOeRuZcsYZlitwIA3VU
TLSH
T162838D82E3A462B7F59F91B4D7810753F730FF560710A3AFB25482863F12B91AE58366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_ctypes.pyd
Size 139KB
SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
MD5 409e2c98beb0554395f65fc8b55951c7
SHA1 f7e25afa8bd80fa8ed709aed8ced4374c0f1ed93
SHA512 8babb6fe295975868c1aa57c63dcab6f2cd151ba7074848dc7da27de2ea46a886496754b7c7e09b043ec5dc2813d30cbdbaa136f0f26302a1b7246a5da7962a7
SSDEEP 3072:5Dpx2Lp7KR+FrkdOJWWcovIXBzTKRFyxpMIAGPwuTkY:tpxCtKUr8WDvIXBnU8xppkY
TLSH
T1DDD38E4B736840A6DA678138C6739E47EBB1F4521A1087CF4264C99B1F633A2AF3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_decimal.pyd
Size 284KB
SHA256 1f4a8ca9814508d3597992173fdf4db312f3b970f6baeb053b9d8c3087f907e7
MD5 d0cc4eb1597b0d0e851761ad781002bb
SHA1 606a80e9417cca5699fe48e1eb2e6d22f67bd82f
SHA512 4ae19bd6e2bb22697727bec6369725a7a1bc718b28c5a74c1f4bffd1508091714dfe5db644a1b8bfa34d30235ba36111449df72741d61b80415a42442a35bd45
SSDEEP 6144:R/wuhmr5uFGZvFvvpYXqOYv3wGqqM43fIWeAHmMVuq6:lmVuFGZvtmXMntVW
TLSH
T1CE546D96A3490CA4EF738434CA879A57F7B278414360D78F43A48A972F933A3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_hashlib.pyd
Size 67KB
SHA256 58c5c9ff93f989e2a233b8c5e06420ea73dd6c013e1f08d996fb0f2828eba0aa
MD5 c435a8d2988b2b248664a45ac26b8b14
SHA1 224adc85a39374e72de0383810aa747a7bc89705
SHA512 480a76ad73ce1942751af83fca8913e3a36961876b15341035162a121b71aa0a86e992d3b6ca54a8a7ae7d43efc24fe8a824819f833c539a2abd30c41257d62c
SSDEEP 1536:2qCcJ6CJ2GEioPMc5Wv52ztK4oIADIJy7NsR9BfIkH:xCcEyG1X5Wv52zBoIADI4
TLSH
T1F3636C46A6984092D62382B5C9E34E43FA74F6512B1197CFA239C1CD2F233C3677B75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_lzma.pyd
Size 157KB
SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
MD5 d5e9416137026497171e131dff6e569f
SHA1 16de80a710940e38537d1d2aea22bc33d5948591
SHA512 e7cb2a3c68e7f5129a4712b38b81fc84fc57881bd1d087c755ba16ee6d892be7ec0708a30465d2a28fe9b587226f233e02a2f512f861ad58012b5b80fe7c1927
SSDEEP 3072:QJ66gwnM5uNIJfuPdX+ENYQrHznfx9mNopUpdgwIAI1ho:QURwnNIk1XrBrTpYOQgL
TLSH
T11AF35C86B794F0E6F3628C38D6624F57E6F578190320929A01CC976D2B1FB759A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_overlapped.pyd
Size 56KB
SHA256 43b9e0bdc41646fc363f144bf050600dab647ce9e7c251a2b6d0e75358cb10cf
MD5 ab8858a46a7be17fac60533920888a44
SHA1 b01429e86b7e994d1952c5c3f8012b44731706fe
SHA512 c439c30a700e3b0b7f199b8bd3adffd1371839215fea569cee31b1de0d7aea71855052bcc60ef6fd77c957fdb1e1e8bee6b31380ebb30102242a8c8d8606d6fb
SSDEEP 1536:4CyjKf/t3jM2POqg4uGsLkIACtTy7NsR9U5MfIks:41qgxGGkIACtu
TLSH
T19C437C496B9401DAED73D579C2A79E03FB74B2D30601931F60A8D28A1F73792A72F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_queue.pyd
Size 35KB
SHA256 2a7bb0a53e86ae4982a6f64e2570137829a0be66537bb1c166913af273edbf0c
MD5 ca3c81d27c1baf30131d62f290d69057
SHA1 d8c637b974f7c6d5a8761b02e145f8a1c3b5538c
SHA512 684111ef143ef891701e209857486e3172e6f1d02fd50236e591e231748ba7acee31cffb840a5cb56ba57e92c57654e461cf479cace7bfc3fabcd42442911b7e
SSDEEP 768:ZlBxk6rOVBBmMIARUb6hy5RNLaRYT2Ip4DaTxf1ml9dH3jL:ZjSBBmMIARUbmy7NsR9GfIbH3v
TLSH
T128F28DC66A689097E6A3C970C2E2DE53F575F793170086DF2169828E1F273C2A33635D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_socket.pyd
Size 85KB
SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
MD5 8a8a372bee9f3b313e44bf441fd5dd61
SHA1 802cc8454b2c5ca4c8a7754821b756d3ca248058
SHA512 bbf0362e306e0679937158647f402bd93a23f7f4270f90eff524b44b0f0af114456f8681b933424a50e3fa764b2ea5aabc67e385a02da2427c340163bf6ed739
SSDEEP 1536:ecVuncT0XH3XAJtZypxQ7XP+66wSz2/jAjI/Lb6NsQ3cs8PgMrMIAGwsy7NsR9dB:nEny2+jypxQ7XPz6wSz2/jAjQOsQssVG
TLSH
T1C5835B01AA6040F6EB72C172C2639E63FB74B5C012D4A75F5466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_ssl.pyd
Size 180KB
SHA256 06f51fbe150c831af619890eea2d9fca9ce8b49758bfe3f382883551c592e6b3
MD5 372d2752bed978ad699a22fe125fe285
SHA1 9600c5fc4f904f65b29fb523cf9aadc9f109716e
SHA512 87c0a1385e624acfdeec9194a20d02475aac5cc965f558b40a932d955b49e70517f4691c142e8718bec283b3ab5d7671b886084792f47a236759000308716414
SSDEEP 3072:2Lj0a+17gAx5pW3kfh6CM6qMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/Uo:4+17gAA3Qh6CM33bLOUBD
TLSH
T147048C47B1946EF7D913E8B9C2234443EBB4F145332287DE48D6D6860F03746AE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_uuid.pyd
Size 27KB
SHA256 35f26f7f55ded30da92ed30258fb9624a7398ba3eadee134813133c560fcbbae
MD5 f422a29fd0cf366bbf400691c3edbf8d
SHA1 8df1f6f480e916f2ada3d7f90e1f1cbe64f8b781
SHA512 e5388352d230aa5a278cc833583940d4711b5126fe4efd3c225812bcfa8df57ee7cafda7a2975e7bce6882886e325f6b1f1cce4f1d7a588a9f854752d2d3bd69
SSDEEP 768:WPn15cwIAIwjhy5RNLaRYT2Ip4DTxf1mlIJnl:WPn15cwIAIwdy7NsR9BfIkn
TLSH
T1A3D27E8A9A784047FE935B70D1F6DE43B939BBD31A11865B317A81C50E133C1B32B26E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_wmi.pyd
Size 39KB
SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
MD5 495460dff020ae1b0ed769ca066d2635
SHA1 04dff00adde1f80ed9a367a0d7221af1968afa17
SHA512 d3171934fad631f51edd02526e6f05e43986c1bf8bc16d02877077d39bd7aa27f83efb2f27ada23e792c2a1bad8ce17bc2f0801e308f425c21d3bbae99ace5c8
SSDEEP 768:D2/EEqrVmjsyu2OQMVwIA3ilhy5RNLaRYT2Ip4ETxf1ml9dHMjL:OE9BEe2OQMVwIA3iTy7NsR9YfIbHMv
TLSH
T1A0038E89E6680092FB67DA70C5A6CE53F575B7931712838F326582990F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\_zstd.pyd
Size 491KB
SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
MD5 a75e9eb46c217f915fb8db1deed6dbb3
SHA1 b7e1bb9e18856a93b405c8adff3a198695b37d50
SHA512 c160a4681d9e5ecbeaa9416e294883fae9a212e28a8fdee5b86181f7e1cb35b9f1352e2af7894ae1023fb839e75d4fcaa4c5bc61024bd7cf0e261e21edb02cfb
SSDEEP 6144:dZ87M+EgY9pB2l1eUVcnmw3Vh4S+zKhThruVxzeeO07WEz9LKE+UIHHHRToSH2l4:vNcumw3vT8eeOyWEz8xHnRTrWl93R9D
TLSH
T17AB48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

entry_points.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\archspec-0.2.6.dist-info\entry_points.txt
Size 46B
SHA256 bfaba68aee5e4120fad3cf158b2be48e573559548728ad0b00331aeeb329366e
MD5 cf9bfa258a0bf957b1061ed745f8d6e2
SHA1 924cccc473e5545ce5262636a2c4dc9bab9a99d4
SHA512 68fffc05d9e271b0c46d092a9af374a35e5dfd774eacbaa03e02cba6cc7b10db541fc05f946042a5952c11df3c214f2818beb3a0e4f82e249e72b7c90b53596d
MD5 SHA1 SHA512

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\base_library.zip
Size 1.3MB
SHA256 6978dace154a3ec6dd020f3fa8a48dd1f799c240c71d6ae77fcff54ac014a79d
MD5 e0765974a5ab7cf32715addf6ece4798
SHA1 569ce3561de21f32b5f5b9168347e576c5acfb42
SHA512 26e7f599e8d2718a2212a684da057c13ced1e29807304d17fa501167775e76ad5bc756be5c7580adefd364fc5ed74e0388c97bc1f9e22c6d180f7265e44b98ba
SSDEEP 24576:He3RpNauUFhvdz3+LVlbVNQeOdP2m2dfNk:yRmuUFhvdz30/y
TLSH
T1D3552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\click-8.4.2.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

entry_points.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\flask-3.1.3.dist-info\entry_points.txt
Size 40B
SHA256 6c13fb853392e5fcfdccbb42eec3e87c164094c904bc1c6eecaa92ea5e65bdce
MD5 8feddca68819b423f57dfb59ce8ee3bd
SHA1 27e3e9826bf26dc90d10d5d2710091ad9c9a7a06
SHA512 4ac00f7cc4100eee89074fd9a4eb6910e46654dd2475bcd1a560456cbf0d2b6cfbf7f88420b1ffc7b0ed9589f1e553d77604d742793bccc172f1795826928459
MD5 SHA1 SHA512

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\libcrypto-3.dll
Size 5.0MB
SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
MD5 7e8a8461fcd43c82841a99a2054711f1
SHA1 a931808c56e3a117795491965cb3f679cdc05886
SHA512 023c34e26b7dc7240d4571f8f808bdd0b749bd6e924948c3db9c5bb4f7acf24557d3a94bfe6ff82697f9747b35c13a73b94482dff3568e1dadb8fe08b598bc61
SSDEEP 98304:on+c+4Vp8XhjqO58Pw1CPwDvt3uFlDCQ9p:mPTVpghjqO5841CPwDvt3uFlDCQ/
TLSH
T147367B6AA7A80189E4BAC13CC9534617D2B1F81A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\libssl-3.dll
Size 776KB
SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
MD5 299335af4f92df8a446d5f98d6e9cfc4
SHA1 75ddcd4863ffde24d22914946ce4e085722dcdbe
SHA512 2da67c01775d71122e6bb951b7e5e7462e8725f79b513551478cd262dae2d97e108427241d13f4fd6ef1d35b739d34fb9c999ca4a6d50271ceda8e0c3dab313c
SSDEEP 12288:8VJ6zW/kDXMeI0niRBRKZk60STGaFc4rldFe9XbC:JDXMeI0iRBRKZN08GaFFe9XbC
TLSH
T1D3F44CADB37C05DDD8B6C17986934623E3B6F4162330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_version.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\lz4\_version.cp314-win_amd64.pyd
Size 11KB
SHA256 9a2523299ae183c3ada536de68e9cf6a033a68e76032c723b40640ef55a5cac5
MD5 86b68a25d8d4ef7d75e5b089f3a2a31b
SHA1 fac04a4db87200dc7cded9c4fd9478ebf7cfa9a6
SHA512 bbb0c490551389ce78fddb1986513a60f138e86abf490c8a596f0f70c9722bf2712082e0ca0051dd1bbf16f8c5e989ea24e1cdca3e16dddf92e8ed1767e8c872
SSDEEP 96:zFC+3IvXGklmoIlX3a2u34ZQ7f7W5lhJZUEWGk6WxHtb/L7Cgv8/DSE5Sn7lawvL:tY7lmoIZ3acF/pWxHBXCgIDL58AwvL
TLSH
T1FC320908FE5184BBD9A582B4C8174F85E236FB61679327CF1378911E5FA23D265382C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_frame.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\lz4\frame\_frame.cp314-win_amd64.pyd
Size 113KB
SHA256 54affd658881ed21dcb4d0fa1ed01c528a7173f0bd4d07c351439b0cf51c73e6
MD5 399e7427435fba369ca1a2b86fca57a3
SHA1 5cd3f821d0f86d472806c935bc4fafb88a22f354
SHA512 4907cb31d458352b4b4a1f0c37efc57e0a06fe45da4d200c42adde1acc4cdfe77348a5ffbbfc49b606f2ee421a1728b8b162e291bd82ab4fbed23c45582e8a88
SSDEEP 1536:OMEsAor5WNNj2GjJCdQEF7uksYIh6hA10XDkQH78GrBDBXByXRvChltJ7Ec:pWN0E+eLfegGVDB0pCntJ7
TLSH
T133B35B17F6E5517CC16790B98A164607EB2279486311ABE3F3ADCE363F07E906E32319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_speedups.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\markupsafe\_speedups.cp314-win_amd64.pyd
Size 13KB
SHA256 6333da2f431abb0d75a6488ff457efb7bc9e33b6afc1ce5ad48475fce2ef5838
MD5 66a3b8535f0022324b25d1130ce719c7
SHA1 e497021cc67a0756c50127ee115d35c8561599c8
SHA512 8e908564efaa8e79c922e094b4c514a0bf0a18c903cbdbdc0da648503cf51a31d5bf223327418879bec16928dcdbb90a065fb9ad2761f3558c837d3d91fbe7a3
SSDEEP 192:CzMI6+TDmffks+TtCvxuoFZC+2fEuYm5L58ANC:C4Ez0hurH8Aw
TLSH
T1A252F84AFBA94AFFD86B81B488334D0A97B6B654270237CB537059990E333C1353B6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 628KB
SHA256 fd427d8a9a48236f0a1183946c90d5cab4c13fac9515ec3078dd123c36a3dc35
MD5 de336a8813f5ced297e1d573f5b6446f
SHA1 0d4f0348c42f11e6592c9815e4bf99f080d374cb
SHA512 5e4017a4d7ef953b7ab121d69eed83787eeaf4645c531b43ce0355658e2958eb8d161c8ecd6d33d15249a0e7ba4921025e3deb400a6004f343fd8c4048e2098f
SSDEEP 6144:qXMbajDtZ5mstN75wc3tZVdcte7fUoPJeQy57mBTIK24vNJPvjKAugO2nEcPuVZ9:tbGZ51t95wc9TdcQ7fUoP8zsnRnE7Fv
TLSH
T13FD4184BE1FA14D0E6B6E17C078BF2337C3ABA588160775B355CD3A627D0A5212E5F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\python3.DLL
Size 72KB
SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
MD5 33282f049faffb54e4b5604f18bcb4f7
SHA1 3406bdbd09a8968816f303f5c6e8e220a9336807
SHA512 6a8754ed4a24748d60002f2a02c0cc193a4d2185edba7c834572a6815b1aa1bea4733708460dbd2780cc3a6c856ce8aba0d2f55cd1a65c164599267784e0d2a6
SSDEEP 768:PQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKI1:ebTrnXngXMjMIAG0Yy7NsR9/fIbHgv
TLSH
T110734B5E6B54F8A2D6F629FC78D199CE242B12FC4F2984DFA47DD3920D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\python314.dll
Size 6.5MB
SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
MD5 e823b990ba85afa143b799c291058dce
SHA1 3e53a71a5c72c3011bee19a792a6552a0d702671
SHA512 fc9b0a6795993e1c4519622726647c33c415a9aa9983daa52d1f9f371c58fb74067599052f5b9c25f5acc08ed15021221dc524543a4de87b5705bba145a1b622
SSDEEP 98304:6PEfNNEwwP1Fyh4NIyDB7Qfo7wavAHDMiEuGC:tfXEwM1Eh4ayDpji1
TLSH
T180669E26737401A5D9BB8035CA074647DBB1BC00AB30D34B59A47ADA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\select.pyd
Size 32KB
SHA256 56441c3148743a0890986ccdf93fea8174155b0ee84db2493151f075d8e7c51a
MD5 220234862600483073f18e48a7860bc5
SHA1 fd000174506afa55ffe67f72b45f8bb9e572ad6c
SHA512 c4b7f64f8934c9892763487fcd0eaf4c8087679082d0bb250cc264bdabaf88fb7245ec5b54abbe412a05c397abe56729f297bff98a956f9d4d8f98310ecbfcde
SSDEEP 768:oB7YoHf8aqFMIARGLhy5RNLaRYT2Ip4zTxf1ml9dH7DjLkB:oB71/8aqFMIARG1y7NsR9RfIbHHv
TLSH
T126E27DCAAB745047E6A3CA7186A2CE43F939B7A35651829F31B991C90E173C1F337319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25882\unicodedata.pyd
Size 740KB
SHA256 58013696b4f08717aee2885aefa24031f4b18b3e62faa8125248cc3e0a86af2a
MD5 89acf0e666a540a8e22cac1a09f15ff7
SHA1 e11e74df8f7b7448c79f31fafd6a9ef5f1a393d3
SHA512 26c9958de86384a1bfab493f2f733e087de887f3f0c7532bf30fb3de2dd32b5942ac806b8bee1370e2f9ae67b5df7fba65fc43aa88dab78f8408c09d1c769a28
SSDEEP 12288:PPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNi:PPY05ZmDPqO54lDJPTMNi
TLSH
T1CDF4E5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zdoaseox.xcx.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zdoaseox.xcx.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a9ea2529-680e-4680-9f97-91ab6fca7091.tmp

Path C:\Users\Admin\AppData\Local\Temp\a9ea2529-680e-4680-9f97-91ab6fca7091.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5872_1974714439\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5872_628970388\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCW1S2L9ADGO5IGVUSR8.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PCW1S2L9ADGO5IGVUSR8.temp
Size 4KB
SHA256 76726df9b5391d30939870349ab4789544dba9a9777988112a76cf87eeddc1d9
MD5 06ad9f6d10a668e0a50ae4d85a103614
SHA1 e7d80ef4e7859e8a9b0fd2c2d76de3e271ac0c72
SHA512 8a96931672f4ea9f5a793e3846fe78e709ceab43fe8fee5c0e09f52ca61857972ac74dd4af01abe6161f3ab07e2e1bf89ff319ddd3f32c93f0612ce102ae52c5
SSDEEP 48:i13dO8fdPxS42J9zCNYllrdLXuHbypr83dO8fdPxS42J9zvYllAgdLXuHbh2o:iFkJoIHu7yF8kJvIqIu7v
TLSH
T13791DF105BE22D59F2F3FD7255736B05AA3BBA445D084F4E408546184C32B48DAAAFF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2148-932-0x0000000063300000-0x00000000633AB000-memory.dmp

Download

memory/5864-623-0x000001D7F6990000-0x000001D7F69B4000-memory.dmp

Download

memory/5864-622-0x000001D7F6990000-0x000001D7F69BA000-memory.dmp

Download

memory/5864-621-0x000001D7F6420000-0x000001D7F642A000-memory.dmp

Download

memory/5864-620-0x000001D7F6650000-0x000001D7F6702000-memory.dmp

Download

memory/5864-619-0x000001D7F6400000-0x000001D7F641E000-memory.dmp

Download

memory/5864-616-0x000001D7F63B0000-0x000001D7F63D2000-memory.dmp

Download