4d3c38ecd255c30317d85bff963cd9794a76bac65425df0e340697f32f05f96f

Analysis

user interaction
yes
max time kernel
60s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FearTonight_2.exe
Size 6.9MB
Sample261024-d1dl6seb66
SHA256 4d3c38ecd255c30317d85bff963cd9794a76bac65425df0e340697f32f05f96f
MD5 a2cd24b63cf3f0b358d6fec0e1a0c995
SHA1 46ddbdfbe38ce3031d739b15ae85807055f074d3
SHA512 ac6d02fcc7debc521c0bfcd910f6428329e798c4c4c80b6224b15948bc154582da76823753d5c2b6daf8240df1c84f7ce0adab1284072f1573cf494f3d7ac4d0
SSDEEP 196608:WgxR0FpjXSDfyGgMwBdnpkYRM+8/3WJPe:VPDfDgMc69/G
TLSH
T14E762255668008DAD877A3F88C07EB20629E35EDF3534687BAB75242D8837E91C376C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation pyinstaller spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	FearTonight_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SystemHealthMonitor.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	FearTonight_2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SystemHealthMonitor.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	FearTonight_2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SystemHealthMonitor.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SystemHealthMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	FearTonight_2.exe

Executes dropped EXE 2 IoCs

pid	Process
1544	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe

Loads dropped DLL 32 IoCs

pid	Process
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
5368	FearTonight_2.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
3684	SystemHealthMonitor.exe
5368	FearTonight_2.exe
3684	SystemHealthMonitor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHealthMonitor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemHealthMonitor.exe"	FearTonight_2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHealthMonitor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemHealthMonitor.exe"	SystemHealthMonitor.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	discord.com
11	discord.com
12	discord.com
15	discord.com
16	discord.com
17	discord.com
2	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8	api.ipify.org
13	api.ipify.org
2	api.ipify.org

Uses WMI to collect hardware manufacturer information 2 TTPs 2 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
1664	WMIC.exe
4908	WMIC.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3592	tasklist.exe
5904	tasklist.exe

Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
6116	WMIC.exe
3760	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000300000000b951-65.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 46 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4192	cmd.exe
4556	cmd.exe
2140	cmd.exe
4400	cmd.exe
4744	cmd.exe
1732	cmd.exe
5224	cmd.exe
1264	cmd.exe
5416	cmd.exe
4616	cmd.exe
5872	cmd.exe
3916	cmd.exe
3352	cmd.exe
5228	cmd.exe
5100	cmd.exe
2344	cmd.exe
2888	cmd.exe
1460	cmd.exe
4580	cmd.exe
1408	cmd.exe
1628	cmd.exe
6000	cmd.exe
8	cmd.exe
3312	cmd.exe
2476	cmd.exe
1204	cmd.exe
5576	cmd.exe
2592	cmd.exe
3460	cmd.exe
2936	cmd.exe
1460	cmd.exe
3816	cmd.exe
2148	cmd.exe
2948	cmd.exe
2840	cmd.exe
748	cmd.exe
1080	cmd.exe
3076	cmd.exe
2544	cmd.exe
5584	cmd.exe
3336	cmd.exe
936	cmd.exe
5624	cmd.exe
2996	cmd.exe
1620	cmd.exe
3572	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FearTonight_2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHealthMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHealthMonitor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FearTonight_2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3352	cmd.exe
5228	cmd.exe
1356	PING.EXE
5100	cmd.exe
1460	cmd.exe
3380	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6116	netsh.exe
3572	cmd.exe
2056	netsh.exe
1628	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FearTonight_2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FearTonight_2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SystemHealthMonitor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SystemHealthMonitor.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1964	WMIC.exe
3952	WMIC.exe

Kills process with taskkill 26 IoCs

defense_evasion

pid	Process
4172	taskkill.exe
4500	taskkill.exe
3216	taskkill.exe
6052	taskkill.exe
2184	taskkill.exe
4560	taskkill.exe
5924	taskkill.exe
4404	taskkill.exe
5096	taskkill.exe
3984	taskkill.exe
5100	taskkill.exe
3524	taskkill.exe
5260	taskkill.exe
3452	taskkill.exe
1820	taskkill.exe
3968	taskkill.exe
2144	taskkill.exe
4604	taskkill.exe
5420	taskkill.exe
4256	taskkill.exe
4912	taskkill.exe
2704	taskkill.exe
5004	taskkill.exe
920	taskkill.exe
2512	taskkill.exe
4124	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1356	PING.EXE
3380	PING.EXE

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
6116	WMIC.exe
6116	WMIC.exe
6116	WMIC.exe
6116	WMIC.exe
1664	WMIC.exe
1664	WMIC.exe
1664	WMIC.exe
1664	WMIC.exe
3760	WMIC.exe
3760	WMIC.exe
3760	WMIC.exe
3760	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
2220	WMIC.exe
2220	WMIC.exe
2220	WMIC.exe
2220	WMIC.exe
3524	WMIC.exe
3524	WMIC.exe
3524	WMIC.exe
3524	WMIC.exe
3952	WMIC.exe
3952	WMIC.exe
3952	WMIC.exe
3952	WMIC.exe
4448	WMIC.exe
4448	WMIC.exe
4448	WMIC.exe
4448	WMIC.exe
4256	WMIC.exe
4256	WMIC.exe
4256	WMIC.exe
4256	WMIC.exe
1964	WMIC.exe
1964	WMIC.exe
1964	WMIC.exe
1964	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	tasklist.exe
Token: SeIncreaseQuotaPrivilege	6116	WMIC.exe
Token: SeSecurityPrivilege	6116	WMIC.exe
Token: SeTakeOwnershipPrivilege	6116	WMIC.exe
Token: SeLoadDriverPrivilege	6116	WMIC.exe
Token: SeSystemProfilePrivilege	6116	WMIC.exe
Token: SeSystemtimePrivilege	6116	WMIC.exe
Token: SeProfSingleProcessPrivilege	6116	WMIC.exe
Token: SeIncBasePriorityPrivilege	6116	WMIC.exe
Token: SeCreatePagefilePrivilege	6116	WMIC.exe
Token: SeBackupPrivilege	6116	WMIC.exe
Token: SeRestorePrivilege	6116	WMIC.exe
Token: SeShutdownPrivilege	6116	WMIC.exe
Token: SeDebugPrivilege	6116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6116	WMIC.exe
Token: SeRemoteShutdownPrivilege	6116	WMIC.exe
Token: SeUndockPrivilege	6116	WMIC.exe
Token: SeManageVolumePrivilege	6116	WMIC.exe
Token: 33	6116	WMIC.exe
Token: 34	6116	WMIC.exe
Token: 35	6116	WMIC.exe
Token: 36	6116	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6116	WMIC.exe
Token: SeSecurityPrivilege	6116	WMIC.exe
Token: SeTakeOwnershipPrivilege	6116	WMIC.exe
Token: SeLoadDriverPrivilege	6116	WMIC.exe
Token: SeSystemProfilePrivilege	6116	WMIC.exe
Token: SeSystemtimePrivilege	6116	WMIC.exe
Token: SeProfSingleProcessPrivilege	6116	WMIC.exe
Token: SeIncBasePriorityPrivilege	6116	WMIC.exe
Token: SeCreatePagefilePrivilege	6116	WMIC.exe
Token: SeBackupPrivilege	6116	WMIC.exe
Token: SeRestorePrivilege	6116	WMIC.exe
Token: SeShutdownPrivilege	6116	WMIC.exe
Token: SeDebugPrivilege	6116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6116	WMIC.exe
Token: SeRemoteShutdownPrivilege	6116	WMIC.exe
Token: SeUndockPrivilege	6116	WMIC.exe
Token: SeManageVolumePrivilege	6116	WMIC.exe
Token: 33	6116	WMIC.exe
Token: 34	6116	WMIC.exe
Token: 35	6116	WMIC.exe
Token: 36	6116	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1664	WMIC.exe
Token: SeSecurityPrivilege	1664	WMIC.exe
Token: SeTakeOwnershipPrivilege	1664	WMIC.exe
Token: SeLoadDriverPrivilege	1664	WMIC.exe
Token: SeSystemProfilePrivilege	1664	WMIC.exe
Token: SeSystemtimePrivilege	1664	WMIC.exe
Token: SeProfSingleProcessPrivilege	1664	WMIC.exe
Token: SeIncBasePriorityPrivilege	1664	WMIC.exe
Token: SeCreatePagefilePrivilege	1664	WMIC.exe
Token: SeBackupPrivilege	1664	WMIC.exe
Token: SeRestorePrivilege	1664	WMIC.exe
Token: SeShutdownPrivilege	1664	WMIC.exe
Token: SeDebugPrivilege	1664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1664	WMIC.exe
Token: SeRemoteShutdownPrivilege	1664	WMIC.exe
Token: SeUndockPrivilege	1664	WMIC.exe
Token: SeManageVolumePrivilege	1664	WMIC.exe
Token: 33	1664	WMIC.exe
Token: 34	1664	WMIC.exe
Token: 35	1664	WMIC.exe
Token: 36	1664	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 5368	5328	FearTonight_2.exe	90
PID 5368 wrote to memory of 5624	5368	FearTonight_2.exe	91
PID 5624 wrote to memory of 3592	5624	cmd.exe	93
PID 5368 wrote to memory of 1080	5368	FearTonight_2.exe	95
PID 1080 wrote to memory of 6116	1080	cmd.exe	97
PID 5368 wrote to memory of 3816	5368	FearTonight_2.exe	98
PID 3816 wrote to memory of 1664	3816	cmd.exe	100
PID 5368 wrote to memory of 1204	5368	FearTonight_2.exe	101
PID 1204 wrote to memory of 5100	1204	cmd.exe	103
PID 5368 wrote to memory of 2148	5368	FearTonight_2.exe	105
PID 2148 wrote to memory of 3524	2148	cmd.exe	166
PID 5368 wrote to memory of 4580	5368	FearTonight_2.exe	109
PID 4580 wrote to memory of 2144	4580	cmd.exe	111
PID 1544 wrote to memory of 3684	1544	SystemHealthMonitor.exe	112
PID 5368 wrote to memory of 3076	5368	FearTonight_2.exe	113
PID 3076 wrote to memory of 2184	3076	cmd.exe	115
PID 3684 wrote to memory of 2344	3684	SystemHealthMonitor.exe	116
PID 5368 wrote to memory of 2544	5368	FearTonight_2.exe	118
PID 2344 wrote to memory of 5904	2344	cmd.exe	120
PID 2544 wrote to memory of 4604	2544	cmd.exe	121
PID 5368 wrote to memory of 1264	5368	FearTonight_2.exe	122
PID 1264 wrote to memory of 5420	1264	cmd.exe	124
PID 5368 wrote to memory of 5416	5368	FearTonight_2.exe	125
PID 5416 wrote to memory of 2512	5416	cmd.exe	127
PID 5368 wrote to memory of 1408	5368	FearTonight_2.exe	128
PID 1408 wrote to memory of 5260	1408	cmd.exe	130
PID 5368 wrote to memory of 4192	5368	FearTonight_2.exe	131
PID 4192 wrote to memory of 3452	4192	cmd.exe	133
PID 5368 wrote to memory of 5584	5368	FearTonight_2.exe	134
PID 5584 wrote to memory of 4124	5584	cmd.exe	136
PID 5368 wrote to memory of 3336	5368	FearTonight_2.exe	137
PID 3336 wrote to memory of 4560	3336	cmd.exe	139
PID 5368 wrote to memory of 4616	5368	FearTonight_2.exe	140
PID 4616 wrote to memory of 4172	4616	cmd.exe	142
PID 5368 wrote to memory of 5576	5368	FearTonight_2.exe	143
PID 5576 wrote to memory of 4500	5576	cmd.exe	145
PID 3684 wrote to memory of 4556	3684	SystemHealthMonitor.exe	146
PID 4556 wrote to memory of 3760	4556	cmd.exe	148
PID 3684 wrote to memory of 5872	3684	SystemHealthMonitor.exe	149
PID 5872 wrote to memory of 4908	5872	cmd.exe	151
PID 5368 wrote to memory of 1628	5368	FearTonight_2.exe	152
PID 5368 wrote to memory of 2592	5368	FearTonight_2.exe	153
PID 3684 wrote to memory of 2140	3684	SystemHealthMonitor.exe	156
PID 2592 wrote to memory of 2220	2592	cmd.exe	158
PID 1628 wrote to memory of 6116	1628	cmd.exe	159
PID 2140 wrote to memory of 4256	2140	cmd.exe	219
PID 3684 wrote to memory of 3460	3684	SystemHealthMonitor.exe	161
PID 5368 wrote to memory of 2936	5368	FearTonight_2.exe	163
PID 3460 wrote to memory of 5924	3460	cmd.exe	165
PID 2936 wrote to memory of 3524	2936	cmd.exe	166
PID 5368 wrote to memory of 1460	5368	FearTonight_2.exe	225
PID 3684 wrote to memory of 2948	3684	SystemHealthMonitor.exe	169
PID 5368 wrote to memory of 2996	5368	FearTonight_2.exe	170
PID 2948 wrote to memory of 4912	2948	cmd.exe	173
PID 2996 wrote to memory of 3952	2996	cmd.exe	174
PID 3684 wrote to memory of 2476	3684	SystemHealthMonitor.exe	175
PID 2476 wrote to memory of 4404	2476	cmd.exe	177
PID 3684 wrote to memory of 936	3684	SystemHealthMonitor.exe	178
PID 936 wrote to memory of 2704	936	cmd.exe	180
PID 3684 wrote to memory of 6000	3684	SystemHealthMonitor.exe	181
PID 6000 wrote to memory of 3216	6000	cmd.exe	183
PID 3684 wrote to memory of 4400	3684	SystemHealthMonitor.exe	184
PID 4400 wrote to memory of 5004	4400	cmd.exe	186
PID 3684 wrote to memory of 4744	3684	SystemHealthMonitor.exe	187

C:\Users\Admin\AppData\Local\Temp\FearTonight_2.exe
"C:\Users\Admin\AppData\Local\Temp\FearTonight_2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Users\Admin\AppData\Local\Temp\FearTonight_2.exe
  "C:\Users\Admin\AppData\Local\Temp\FearTonight_2.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /fo csv /nh"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\system32\tasklist.exe
      tasklist /fo csv /nh
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber,manufacturer"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber,manufacturer
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get model,manufacturer"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get model,manufacturer
      4⤵
      Uses WMI to collect hardware manufacturer information
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM fiddler
      4⤵
      Kills process with taskkill
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM regedit"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM regedit
      4⤵
      Kills process with taskkill
      PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM vboxservice"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vboxservice
      4⤵
      Kills process with taskkill
      PID:2144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      Kills process with taskkill
      PID:2184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM discord.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discord.exe
      4⤵
      Kills process with taskkill
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM discordcanary.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5416
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discordcanary.exe
      4⤵
      Kills process with taskkill
      PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM discordptb.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discordptb.exe
      4⤵
      Kills process with taskkill
      PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5584
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5576
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path softwarelicensingservice get OA3xOriginalProductKey
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where "PartialProductKey is not null" get Name,PartialProductKey /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "PartialProductKey is not null" get Name,PartialProductKey /format:csv
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd /C ping 127.0.0.1 -n 5 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\FearTonight_2.exe""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3352
  - - C:\Windows\system32\cmd.exe
      cmd /C ping 127.0.0.1 -n 5
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5228
    - - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 5
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1356

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealthMonitor.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealthMonitor.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealthMonitor.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealthMonitor.exe
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /fo csv /nh"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\system32\tasklist.exe
      tasklist /fo csv /nh
      4⤵
      Discovers running processes
      PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber,manufacturer"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber,manufacturer
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get model,manufacturer"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get model,manufacturer
      4⤵
      Uses WMI to collect hardware manufacturer information
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM fiddler
      4⤵
      Kills process with taskkill
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM regedit"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM regedit
      4⤵
      Kills process with taskkill
      PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM vboxservice"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vboxservice
      4⤵
      Kills process with taskkill
      PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      Kills process with taskkill
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM discord.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discord.exe
      4⤵
      Kills process with taskkill
      PID:3216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM discordcanary.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discordcanary.exe
      4⤵
      Kills process with taskkill
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM discordptb.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4744
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discordptb.exe
      4⤵
      Kills process with taskkill
      PID:6052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2888
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:8
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1620
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3916
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2840
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3572
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
    3⤵
    - Executes a command shell one-liner
    PID:1732
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path softwarelicensingservice get OA3xOriginalProductKey
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where "PartialProductKey is not null" get Name,PartialProductKey /format:csv"
    3⤵
    - Executes a command shell one-liner
    PID:5224
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "PartialProductKey is not null" get Name,PartialProductKey /format:csv
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:748
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:1964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd /C ping 127.0.0.1 -n 5 > nul & del /f /q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealthMonitor.exe""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5100
  - - C:\Windows\system32\cmd.exe
      cmd /C ping 127.0.0.1 -n 5
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1460
    - - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 5
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_bz2.pyd
Size 81KB
SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
MD5 86d1b2a9070cd7d52124126a357ff067
SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
SSDEEP 1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
TLSH
T160838D92B3A458B5F05BA27955B10357E371F90D03A0D3EFB758826B2F03B826D6432E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_ctypes.pyd
Size 120KB
SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
MD5 1635a0c5a72df5ae64072cbb0065aebe
SHA1 c975865208b3369e71e3464bbcc87b65718b2b1f
SHA512 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99
SSDEEP 3072:0OEESRiaiH6lU1vxqfrId0sx3gVILLPykxA:hj+I1vAfrIRx3gN
TLSH
T10BC36C0B2358109AEB674078C5B35E47DB71B859171087CF0264C69E2F63BA36E7F716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_decimal.pyd
Size 248KB
SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
MD5 20c77203ddf9ff2ff96d6d11dea2edcf
SHA1 0d660b8d1161e72c993c6e2ab0292a409f6379a5
SHA512 2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca
SSDEEP 6144:3LT2sto29vTlN5cdIKdo4/3VaV8FlBa9qWMa3pLW1A/T8O51j4iab9M:H2s/9vTlPcdk4vVtFU98iIu
TLSH
T10B446C66A2490CA4DE77807498974B57F7B278944320D3CF43A4CAA73F576A323BD748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_hashlib.pyd
Size 63KB
SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
MD5 d4674750c732f0db4c4dd6a83a9124fe
SHA1 fd8d76817abc847bb8359a7c268acada9d26bfd5
SHA512 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e
SSDEEP 1536:/smKJPganCspF1dqZAC2QjP2RILOIld7SyEPxDF:/smKpgNoF1dqZDnjP2RILOIv2xB
TLSH
T1A8537C06A78440A5C467837DD9D30EABE272F4405751A7EF4368C28E2F237C3A7B67A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_lzma.pyd
Size 154KB
SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
MD5 7447efd8d71e8a1929be0fac722b42dc
SHA1 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6
SHA512 c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de
SSDEEP 3072:j0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1GIxq:j0kiXjD9v8X7Euk4wYOFTafxn
TLSH
T171F32992A394F0E6F3628C78D6624F57D6F57809031092DA02CC976D2B1FB759E2E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_multiprocessing.pyd
Size 33KB
SHA256 7581edea33c1db0a49b8361e51e6291688601640e57d75909fb2007b2104fa4c
MD5 a9a0588711147e01eed59be23c7944a9
SHA1 122494f75e8bb083ddb6545740c4fae1f83970c9
SHA512 6b580f5c53000db5954deb5b2400c14cb07f5f8bbcfc069b58c2481719a0f22f0d40854ca640ef8425c498fbae98c9de156b5cc04b168577f0da0c6b13846a88
SSDEEP 768:eZt56pxGyC572edLMILWt3u5YiSyvCVPxWElj:eL5PyC572edLMILWt3E7SyqPx3
TLSH
T18AF27E139B581C5AE833C675D4D35E25E632FA564B5082DF2318C2CE1F313826EEA76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_queue.pyd
Size 30KB
SHA256 925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14
MD5 d8c1b81bbc125b6ad1f48a172181336e
SHA1 3ff1d8dcec04ce16e97e12263b9233fbf982340c
SHA512 ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772
SSDEEP 768:bxrUGCpa6rIxdK/rAwVILQU85YiSyvz5PxWEaAc:trUZIzYrAwVILQUG7SydPxDc
TLSH
T184E2AF825A545C86D473C57594E35D24FA31FA52871082DF221DC2AE2F323827BB676E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_socket.pyd
Size 77KB
SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
MD5 819166054fec07efcd1062f13c2147ee
SHA1 93868ebcd6e013fda9cd96d8065a1d70a66a2a26
SHA512 da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666
SSDEEP 1536:ZmtvsXhgzrojAs9/s+S+pGLypbyxk/DDTBVILLwX7SyiPx9:c56OzyAs9/sT+pGLypb+k/XFVILLwX4f
TLSH
T137736B12A69050A9D27380BAC5635F63F770F48057D593CF1264CA6E1F23782AE7EBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_sqlite3.pyd
Size 96KB
SHA256 b298a44af162be7107fd187f04b63fb3827f1374594e22910ec38829da7a12dc
MD5 5279d497eee4cf269d7b4059c72b14c2
SHA1 aff2f5de807ae03e599979a1a5c605fc4bad986e
SHA512 20726fc5b46a6d07a3e58cdf1bed821db57ce2d9f5bee8cfd59fce779c8d5c4b517d3eb70cd2a0505e48e465d628a674d18030a909f5b73188d07cc80dcda925
SSDEEP 1536:jWlym6NVj508Vp22J8Ck+sOwpI5NbTAWac4LdyR+KSSRILOQd7SywcPxC:f5p/mCk+sQvb0dc2o2SRILOQdWMxC
TLSH
T12EA34A5A625010A8F56B81B8C4634F52EB72F8565B3153CF42A0C64E2F337C36F7AE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\_ssl.pyd
Size 156KB
SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
MD5 7910fb2af40e81bee211182cffec0a06
SHA1 251482ed44840b3c75426dd8e3280059d2ca06c6
SHA512 bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27
SSDEEP 3072:OwYiZ+PtocHnVXhLlasuvMETxoEBA+nbUtGnBSonJCNI5ILC7Gax1:FYk+PtocHVxx/uvPCEwhGJ
TLSH
T11BF38D47F28429ABE813E4BDC6634912EBB5F045231187CE45D6C68A0F13746AF7AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\base_library.zip
Size 742KB
SHA256 894a1943b8719b093472b5e08ea70edb8ad4f54732e575ac78d58f69ae4309bb
MD5 d04526ac115e428ab7baf027f961aee8
SHA1 10d6348c59ad3096f3d282bbe1b7b9a75e6b70c2
SHA512 3feaee96e0bf3c9c8c94ced481784357746cdc52153216f4804e6af9b69967cc3f8983b87c36aca389af474456aae05596d59a8ace9d9c2d33f73b1bd1363192
SSDEEP 12288:WKnL+Lp/Nw+ofEEVwcV0yjgZ1KFZ9bOX4a2YajVL1:WKnL+L1NafEEVwcV0yjgkCoa23F1
TLSH
T17FF4E7C06D951DCBFD09F27981678E3C0A96B334DFC9D943AA47D2CAAC4B2D42D85A4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\libcrypto-1_1.dll
Size 3.3MB
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
SSDEEP 98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
TLSH
T1CEF58C5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF18B681780F13BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\libssl-1_1.dll
Size 688KB
SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
MD5 bec0f86f9da765e2a02c9237259a7898
SHA1 3caa604c3fff88e71f489977e4293a488fb5671c
SHA512 ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4
SSDEEP 12288:WhO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0TGqwfU2lvz2:2is/POtrzbLp5dQ0TGqcU2lvz2
TLSH
T197E44B95ABB51498D5E6C17C8A534A33E3BBF4141330AFCB06A5893E0F177C92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\pyexpat.pyd
Size 194KB
SHA256 4a2d59993bce76790c6d923af81bf404f8e2cb73552e320113663b14cf78748c
MD5 1118c1329f82ce9072d908cbd87e197c
SHA1 c59382178fe695c2c5576dca47c96b6de4bbcffd
SHA512 29f1b74e96a95b0b777ef00448da8bd0844e2f1d8248788a284ec868ae098c774a694d234a00bd991b2d22c2372c34f762cdbd9ec523234861e39c0ca752dcaa
SSDEEP 3072:13BAJzkk5dT6F62eqf2A3zVnjIHdAPKReewMP12yGUfT0+SYyWgOmrpjAxvwnVIq:FQg4dT6N5OA3zVnjNed4yGKTKR/
TLSH
T18B147D5B71A5C0EBE8938038D6D78B0BDB71B8A5039097CF1284E77D5F27B523A68319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\python310.dll
Size 4.3MB
SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
MD5 63a1fa9259a35eaeac04174cecb90048
SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
SSDEEP 49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbH3:Uw5tVBlicWdvoDkHUMF7Ph/qe
TLSH
T102267C26A36401A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\select.pyd
Size 29KB
SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
MD5 a653f35d05d2f6debc5d34daddd3dfa1
SHA1 1a2ceec28ea44388f412420425665c3781af2435
SHA512 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9
SSDEEP 768:gUC2hwhVHqOmEVILQG35YiSyvrYPxWEl6:FC2ehVKOmEVILQGp7SyEPxe
TLSH
T1FED2AF47AB506C42D8238572A4D68E16E935B6A14B20C3DF332DC26D1F227C277BB36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\sqlite3.dll
Size 1.4MB
SHA256 fbd8832b5bc7e5c9adcf7320c051a67ee1c33fd198105283058533d132785ab4
MD5 914925249a488bd62d16455d156bd30d
SHA1 7e66ba53f3512f81c9014d322fcb7dd895f62c55
SHA512 21a468929b15b76b313b32be65cfc50cad8f03c3b2e9bf11ca3b02c88a0482b7bc15646ce40df7fb42fbc96bd12362a54cffe0563c4ddc3fc78622622c699186
SSDEEP 24576:QS54zkxnH4R0YnZRF4gLDafM9WJeQ6dS6BgMkPilAHmXf2arqTlTKQAHE4P2:JAm4R0CZRF4gLDafgWJR7e3k4l+aruPB
TLSH
T198658D4BB2B800ADD0A7C17ACA1B5707EBB2740517749BDF55D4CA692F13FE216BA320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000014d02\unicodedata.pyd
Size 1.1MB
SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
MD5 81d62ad36cbddb4e57a91018f3c0816e
SHA1 fe4a4fc35df240b50db22b35824e4826059a807b
SHA512 7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d
SSDEEP 12288:6mwlRMmuZ63NTQCb5Pfhnzr0ql8L8kcM7IRG5eeme6VZyrIBHdQLhfFE+uQfk:ulRuUZV0m8UMMREtV6Vo4uYQfk
TLSH
T16E355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bl_Chrome_Default_af.db

Path C:\Users\Admin\AppData\Local\Temp\bl_Chrome_Default_af.db
Size 138KB
SHA256 c6a8cae9fe7cd0c2c09301e7241b4a6fa28008042e7cb9f2851dfc37211fe5fe
MD5 81ac93f4e2091cb53b5dda013b901690
SHA1 3502890a409819d234ea3c67729cf1e11e9863c6
SHA512 9551620cbddfe45dee39197ff64f913ef89f89c95269b22cd0347893f32a4c3d27375e5f548be525585770928a9b17cece08710e0ca7b4ddd35f620846b8978e
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O921lmVumd6n27:FnbZeMrv/hGt921/n27
TLSH
T1C5D3974B3A743002EDE59A721CE050BB5E3C716D4F55A5D428B620688EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bl_Chrome_Default_hist.db

Path C:\Users\Admin\AppData\Local\Temp\bl_Chrome_Default_hist.db
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bl_Chrome_Default_ld.db

Path C:\Users\Admin\AppData\Local\Temp\bl_Chrome_Default_ld.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bl_Chrome_Default_rblx.db

Path C:\Users\Admin\AppData\Local\Temp\bl_Chrome_Default_rblx.db
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bl_Edge_Default_af.db

Path C:\Users\Admin\AppData\Local\Temp\bl_Edge_Default_af.db
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bl_Edge_Default_hist.db

Path C:\Users\Admin\AppData\Local\Temp\bl_Edge_Default_hist.db
Size 224KB
SHA256 0b47e674065ce007a0cf1fa61a21c97f12dda5ca8415931aa1e5cea7a768869a
MD5 d78ba4aa1a4feb90d764dda0bd38d6e9
SHA1 4f887ee4bbe0f8223fb7d25601edd40b8dae61e2
SHA512 f4576ab8d7af20e937f35de53a1e5abcc916e366b2b829875c3de25e9f96c32f373e973b2a8f3b118da0b1313594660781de1da9c4b8b6346d3635e03b39b8bf
SSDEEP 96:b93FtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:bYH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T1BE24DE4E5F343722CDBD913669E744A35C6CF03FCB5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bl_Edge_Default_ld.db

Path C:\Users\Admin\AppData\Local\Temp\bl_Edge_Default_ld.db
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bl_Edge_Default_rblx.db

Path C:\Users\Admin\AppData\Local\Temp\bl_Edge_Default_rblx.db
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bl_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bl_debug.log
Size 668B
SHA256 267261db8ee7fae3da9c5ccf2b716423e08e933ed9a96af585c2abca0345e34c
MD5 06af05ef8e550e83be92d087266c1d1a
SHA1 010fbad13c96885f3231438fd65e6ca099c5ae39
SHA512 ae0c1aba99de694eb97877da25a218e63b8e3ee13299a1aaac03e2c8434c481860f714b23a1370df80777e57f50c336cb89e6cb9afd83a1fbfdffd69f2b80146
TLSH
T1DD01868919C62A0694A6EE83D39544C8118E55EE1F4671F14036CF6F5703137E466EA5
MD5 SHA1 SHA512 TLSH

Submit Download

bl_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bl_debug.log
Size 334B
SHA256 d5ae2e61bcd60be000a0007e2c7445c97a95f2c978cdad02dacdf4fe298024a5
MD5 bf5a398a08b826908b40f8e5ad0c33f1
SHA1 a6c8cc798ef6c743e050aef79f2995f796618c1a
SHA512 cf5eec138723a86a2d5c287ec03ce6c2f4b4d9e08dda9ec18d1117bf5a71d1e3203b8b08d8fa9ab1468890b4aebe3eb93203fc8096e7eaa8b57c0457bf4f35ce
TLSH
T16CE04F8509C62A41E4A4ED439390408D15CD78A91F0231F18036CF7F1803126C466FA5
MD5 SHA1 SHA512 TLSH

Submit Download

SystemHealthMonitor.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemHealthMonitor.exe
Size 6.9MB
SHA256 4d3c38ecd255c30317d85bff963cd9794a76bac65425df0e340697f32f05f96f
MD5 a2cd24b63cf3f0b358d6fec0e1a0c995
SHA1 46ddbdfbe38ce3031d739b15ae85807055f074d3
SHA512 ac6d02fcc7debc521c0bfcd910f6428329e798c4c4c80b6224b15948bc154582da76823753d5c2b6daf8240df1c84f7ce0adab1284072f1573cf494f3d7ac4d0
SSDEEP 196608:WgxR0FpjXSDfyGgMwBdnpkYRM+8/3WJPe:VPDfDgMc69/G
TLSH
T14E762255668008DAD877A3F88C07EB20629E35EDF3534687BAB75242D8837E91C376C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download