41c848c0986720c02d39b015bd2672e454a221052f6947854bc508d8765d9711

Analysis

max time kernel
151s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
opencode.exe
Size 201.9MB
Sample261024-e8gjgafx7z
SHA256 41c848c0986720c02d39b015bd2672e454a221052f6947854bc508d8765d9711
MD5 a0b62e849019baf83e362731fffe5aa7
SHA1 984601e5f239452d01a7d7f28765dca2e0dc11da
SHA512 392439c4e4036342d5da50bb76b2e5e44eec6d9651c8f8fb57a434b3ca77cb29d72fb87e8c9964af18e5359314b6e5414749715077252831e3bcbef3e57b075e
SSDEEP 1572864:AtNrZ70To/7NdTcSIsa+9taciFTHCgKrKLtHxL5a52o0fq+b6uNd8cal:RTjFeCtHx9U2o8q+bjd8cal
TLSH
T1B1A8BF5BB1E624BCC29AC4B0916B5313A735B88613189DFB618C8B703F6EDD51B3A734
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4204	rg.exe

Loads dropped DLL 2 IoCs

pid	Process
3264	opencode.exe
3264	opencode.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2808	powershell.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6036	cmd.exe
3720	cmd.exe
4992	cmd.exe
4316	cmd.exe
1056	cmd.exe
5420	cmd.exe
4144	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	opencode.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	opencode.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2808	powershell.exe
2808	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1056	3264	opencode.exe	90
PID 3264 wrote to memory of 5420	3264	opencode.exe	92
PID 3264 wrote to memory of 4144	3264	opencode.exe	94
PID 3264 wrote to memory of 6036	3264	opencode.exe	96
PID 3264 wrote to memory of 3720	3264	opencode.exe	98
PID 3264 wrote to memory of 4992	3264	opencode.exe	100
PID 3264 wrote to memory of 4316	3264	opencode.exe	102
PID 3264 wrote to memory of 2808	3264	opencode.exe	104
PID 3264 wrote to memory of 4204	3264	opencode.exe	106

C:\Users\Admin\AppData\Local\Temp\opencode.exe
"C:\Users\Admin\AppData\Local\Temp\opencode.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "npm ^"list^" ^"-g^" ^"--depth=0^""
  2⤵
  - Executes a command shell one-liner
  PID:1056
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "yarn ^"global^" ^"list^""
  2⤵
  - Executes a command shell one-liner
  PID:5420
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "pnpm ^"list^" ^"-g^" ^"--depth=0^""
  2⤵
  - Executes a command shell one-liner
  PID:4144
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "bun ^"pm^" ^"ls^" ^"-g^""
  2⤵
  - Executes a command shell one-liner
  PID:6036
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "brew ^"list^" ^"--formula^" ^"opencode^""
  2⤵
  - Executes a command shell one-liner
  PID:3720
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "scoop ^"list^" ^"opencode^""
  2⤵
  - Executes a command shell one-liner
  PID:4992
- C:\Windows\system32\cmd.exe
  cmd.exe /d /s /c "choco ^"list^" ^"--limit-output^" ^"opencode^""
  2⤵
  - Executes a command shell one-liner
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "$global:ProgressPreference = 'SilentlyContinue'; Expand-Archive -LiteralPath 'C:\Users\Admin\.cache\opencode\bin\ripgrep-15.1.0-x86_64-pc-windows-msvc.zip' -DestinationPath 'C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Users\Admin\.cache\opencode\bin\rg.exe
  C:\Users\Admin\.cache\opencode\bin\rg.exe --no-config --files --glob=!**/.git/** .
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ripgrep-15.1.0-x86_64-pc-windows-msvc.zip

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-15.1.0-x86_64-pc-windows-msvc.zip
Size 1.7MB
SHA256 124510b94b6baa3380d051fdf4650eaa80a302c876d611e9dba0b2e18d87493a
MD5 ea55c7f249c83ff49cd83652c76b0cdf
SHA1 00fabb6b4327249d54118f0ce83d5942968580c2
SHA512 3bac457b1ef56793768b8776448e3f27412deb04a22c0822f09de0d8fb978d6d7b3e438e3077387b9cbc3439e8e30e61c2bf098fb9a8b64810a619407e773785
SSDEEP 49152:ar6QmAFFNccdmaHoXLpwaOYyp/s9Yxi4aID0:KtmGFRs+taOLJlQ4aIA
TLSH
T1348533D7A064D00EDAF40370723292A089B84B6D8FA1575ED1CC678FDDF9B262577B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COPYING

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\COPYING
Size 129B
SHA256 dfe7d0a6134a17d3de7409762e08dc02133303912875cab40a74ba07a390f85a
MD5 5b900af8828f361df669c1ccca9299ce
SHA1 12bf26cb805dd31b4e93503406ccefa72d904f6d
SHA512 df85ca0cfe8b02b314ca525a7b95074dfa103e02e77a0108c76219e6e014bbc743f71d46ed7933ca6fb3dc946ccdd3d5daa21d8960908a450c9415b7dcd37c46
TLSH
T1FCB09B165346895257E104B54E07ED5FD10D1275141F4961258105595771166C9D43A5
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE-MIT

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\LICENSE-MIT
Size 1KB
SHA256 970813655a1bf777d2ead189cef71ab73ab92ce04dc864027d61a45de03e6728
MD5 cf19484056a1c1c69da0b7d55995469e
SHA1 e837a7c06c80eb003b5b329c0e3709ec08779f13
SHA512 2e06c3afa83afe5f99ad6521955af1029aeb0660b220e6edd1a573f753411d44b6ae0d9c495d46555255c9993067c0947976b32fc2b04ef924ad5895dc635996
TLSH
T19311B61E739603632852536105A9ECC4F12BB14E7EAF1A84342EF2081326048C9FFC58
MD5 SHA1 SHA512 TLSH

Submit Download

README.md

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\README.md
Size 21KB
SHA256 24c3effdbd5c493ceedce5bdcd955ee95c4a1b9acb4c431488c482a9ab0daaa0
MD5 9dbe27fc87a075df8cbbb5d2b5e0939f
SHA1 839a39f3cf18753265f92e5ce1d8dc5c8a8b8eb8
SHA512 14c590ce51966da536f433f2f2912e61e9ab223a90511e93458feb3c0b3f81ddcf02e517405da8739c713e4daec5292e9a39da9c0e3c31241f99aba7a08f4c65
SSDEEP 384:8+jLwJIg8B/W4CXrZPuTh2/zf4uQN325P309nW72VZuOGK+Vo:8+j0JICB6k/zfqq3inWKVZSK+e
TLSH
T166A2B6AB9244CE7F2FB113B2B117654AF717202CBED79055F4AA4364702387291BF4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UNLICENSE

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\UNLICENSE
Size 1KB
SHA256 640514163b17f977adc997cb16f51871122cfb0555ebad1a3f01e167b7ba8857
MD5 4cc4493565e07891a65c04aede0ebe1c
SHA1 8d4a0b6ddf7ee67b0fec91bae4e8c8aadb7f3436
SHA512 c4853cec286a768a4aaeda6cc6b10d4cab74e8a87863669481b935fde589c01fbaa6c4c46f708366436ade41bb99b05fb3b3f46a10f22fd346fa7e8ed40fe663
TLSH
T16F218447B28107202D8513A3785174CDF34BD49E7C3B26843466A258031F8ACE2FFA2C
MD5 SHA1 SHA512 TLSH

Submit Download

_rg

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\complete\_rg
Size 32KB
SHA256 24038494de2bd87d4fa68ce1f96b3612e8b63430f1688f5bff50b65824e5e316
MD5 1ae61c2042fc17dd1183df4ff05e1a56
SHA1 f32a5e6aabede4ba5f9d5e2ec19ae23c543169ce
SHA512 8aeb2ec7265f7f64f4de8443da35a75fc7a9f664ffd1f0000c71f8fcf8080f5c16fb63b905e4241e55e2375c435220ce52b26c203d3d11309f7b2d30184cc964
SSDEEP 768:pN6WMnXCvc53DHJp0bzfEV9pFfoE5gXF9WwXdiBJxzTBvfM:CnXv3DHQbk9pFgRXPlcxzNnM
TLSH
T1A4E2F8225E46131223F3D19A6BCEF145F721C12B2B578905F8DC42481BB562BA1FF5BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rg.ps1

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\complete\_rg.ps1
Size 25KB
SHA256 053309e2043ed4b5ef2a718a34602592f98573f1a166469ae2fd532cc98b05e6
MD5 97cffabff246a95e7dd99d1962667f0e
SHA1 1ec74756b4b60dff2c998e2f871196c7804f7ada
SHA512 d8d744b3cdb747b87f734d5c2be32ed746acea90a4d266e154302a15fffa6ac7aef79b836fded1b360d2a477a2e2221aaa23a8dd827b9e486aeb74a36bf19746
SSDEEP 384:xhDtHWj5PwUneRV+OhANGvohKfCh1td0BLZYK:xhDtHWj55nzNGoh1tmF
TLSH
T19BC23865274BC28A1343439CD39F90796CF991B667BF150A79EC8718436BF36E00A6F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rg.bash

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\complete\rg.bash
Size 20KB
SHA256 9fd807931c6d350d50e0bb6819629b6cc83e6253528342e95bbaeef81241d0e3
MD5 9c5e1557f111bf0c613463399de94b98
SHA1 a773fddbadb08a73e28fab3c85fb849a78023526
SHA512 ac931ec3b4bea219246cffb8c99033946bbaa9d665fd56c133d88bfdf112f974288771dbaf235437197b51110a516eb083223aab40ba0fe83120856ac8ef036a
SSDEEP 96:E0al+5hwKXYN2odrBhfSaqgCPSfobG0feHGBZBo4Y01Ub5U1uWK8BhP:EHghwKroLRaPSfobG0fq74YvUMy
TLSH
T124A2EFB2AD4A61B1C757E12D2BC26507F3396E73909BA970F3CE87A45F72530D1A80D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rg.fish

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\complete\rg.fish
Size 14KB
SHA256 b63b76a059be13e041104d2576e2594067c15f29cd56cb339a021dca9cb1a656
MD5 9ca0b7b7a22c3e85318ba07ac837bae6
SHA1 30732e36c5111d8eaebd0bac39ad683fd1dec23e
SHA512 674d895839f5a0be7feef890fc86f116f169dbe4ee1e945de16f30092e725eeb15176442e0cf852cc585a5577b52aad93c1424e96103a566ab409f650a1e0f0a
SSDEEP 192:gd/0NxhQFyVqHzYTdMmr9eKnFrTDwdwXs2qNgyreLYh+lEc8j:0sjhQFyV1TKmrQKnF3FstrYYh+ld8j
TLSH
T1B862D0331766B13743A5C9ECF324E8A4EF2180ED67D43044F669DA582249EB4E3AC5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CHANGELOG.md

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\doc\CHANGELOG.md
Size 88KB
SHA256 7f720bf9e53ade51a48a3a7afc22c05c60a8abe806775569971e4e59a2a009a5
MD5 f5a64bc823110d0428de0a3591bf8e85
SHA1 2b0fe8b8f61ac71d7b47e201d7bc4750ca3d3887
SHA512 d4e386c9f91581cf3a4959d1c113e7b8b177ad5f0528eb0d5a76c49ebc697d8993a0e5cef6ded960ec795cf6a0b62a47b284a43e3b1ee3a69a48fba66275f27d
SSDEEP 768:6AkKWJ4+W1AHcdAI5AVsLRyLxVOPTXWrXZLccMQNJhDLdbwYoClDcNxu/dCd9OUS:61KWJjO5oJJ7DlNoMD6xu1Cd07
TLSH
T14E9364DB8E441E6B0F301CF75E79704A772B671FAEC7EAD6E170062491160B553EB888
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FAQ.md

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\doc\FAQ.md
Size 42KB
SHA256 3cc08f312b63aec68ea4063067f528613331d6ca229fbcf448fc18a1045fd748
MD5 c7590e2d00405451eb05633988dc9331
SHA1 acf64bd6482e9ea5798860099ae9f86a8db35dba
SHA512 c7e454ee3e4431c6dc086798bc012f841301ddf671b172ab822897cf6f3666fceb004048cd7def86f3974f1299ab62c018bbd072f391fb8ef1694a7dc1a54e89
SSDEEP 768:LasQ27n4iIGI7O6T8oJ3C+VZKvHv1sp6YEMVqzCCvQ0TN0Uxz9Kl6UM/b:LasQ274iI9LY+VZSP1CmDzoqxzYQD
TLSH
T1BB13E72B9245DB3B0FB21175B35EF195F30B807C57AB9260B8AD83AC3116C66427B5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GUIDE.md

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\doc\GUIDE.md
Size 40KB
SHA256 2ff96d78612fa939280fa9e17387d3f6bac8e489ee9d81ec22b3a5984f14a7b5
MD5 54647e8f5135507b03d2093f35feed1b
SHA1 c7a45fa27880ecf58053a2837b1403676caa0905
SHA512 d41a747993127fadda94d222c2807d6f852be1eca6ecb1742d243afcf9529052c67060459fd7aa71807c9bb871995461ecf4f926925466bec365d9d469eb5f84
SSDEEP 768:czU09T8xRqbyTs9joN3OQyz3Mm+xNoCMG4j1J0nbRfyDRSYNK2Cvv707:BmgxRFGoNryz3Mm+xNonG4j1JwRfI/KM
TLSH
T19713D9176A8597770BB210A6631EB095F717807C2BA7A120B86C937C332BC7581FA5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rg.1

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\doc\rg.1
Size 84KB
SHA256 35c844073303dc14289cf3661bc4371af7cb455754da8fde103f4dcda4dd91b1
MD5 354fa8ececa322b1ed5622702aa1eb6f
SHA1 26bfa20b2c6b45d169743751d8bd902c830bd771
SHA512 01e63308bc16bf8f85f3d3162b2ea55b2fba19e442a23ac8c9e5d6645aef65a8337b3893d84c779f9875b821b2245ea5a69e834c6c1eaf6b3d5697a2bc23f0f5
SSDEEP 1536:eh2KBwvD5io5Iz0A8HlZNdKJbKMWF9bSF0:s2KBm5i9wA8rNdiWF9g0
TLSH
T1BD83C92363A8677B0E5310A5B73D9495BB5AC0BD13B6A2A0F85C42EC31064FE45F2EF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rg.exe

Path C:\Users\Admin\.cache\opencode\bin\ripgrep-4xvbEG\ripgrep-15.1.0-x86_64-pc-windows-msvc\rg.exe
Size 4.1MB
SHA256 decdd4992f3f1b9a5ef9898f1b40ab16886d579d6516b4efd3d5eaa19364e408
MD5 309515d04b3847fd87b1975dc7498e9d
SHA1 05f46d32f55be4491d3dc4d6ac0dccba2cb31e2a
SHA512 3d6aa36570da59cf2d052a8765d18fd652c7fd748edf079f46984de1d21a099aea4e00619fe06c8e4f1e9c7b4ea16f4c99acaa2dac20452358a881e6f4c5e7ef
SSDEEP 49152:cvejLH6sn+d8d0CdvkYRh1Y9Puo9zoy9jlRX2CXu4RTFXQ96styCIl9ztghSAZ31:Ku911o9z9VldJ4Hj/Z3X3
TLSH
T16C163A47FAA351E8C569C034835A7233FB72B88D47357AEB5AD447313E52AA01E7CB48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

models.json

Path C:\Users\Admin\.cache\opencode\models.json
Size 5.6MB
SHA256 34287379c34c05e0058b7d452dd355279268ba7598da242515e28db871c4b067
MD5 d322f9b0da15c3fffa98779ad5e7582d
SHA1 32bfac26b8a5e0692c53b2754677326b1d293ece
SHA512 79f701f318c66a30c3e7bf53167378238f9c3b1733ab7b84e71bd2efc5c7ac4e4421bdea9aa617d474a7826a1a3111a50b914f44f7e4fecbc23e6ee3d60e2021
SSDEEP 49152:LsRIwVno0U0okIk2m1IFVnksFajdYv2L8EIkuUqNIlVnNwfyFybFTxyR7VIjVnQP:K
TLSH
T18E563225C560B97A97AD03F2B8887DDB1D787367E2449C5537CCCA6841EE2AB073260F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.bun-1534026329-3cba9b8dc4fa4e45.node

Path C:\Users\Admin\AppData\Local\Temp\.bun-1534026329-3cba9b8dc4fa4e45.node
Size 506KB
SHA256 a8199cf7b6c5102267a5889f80321a4cc92e631d7504c474d32a35b4d440f315
MD5 34581748f55c388cd744f152e065bd0c
SHA1 95c5394ad0a174184b808c17d1eb5fc71593d7de
SHA512 b5b8ab91947a2b06bd7ef097855b0cf19dfbf3b9e93b33d02b57cbdac4ed0b7d82004665123a1ee6c5a880b80d7cd9df9ad202fa179731b2045b0ae11e1c69f3
SSDEEP 6144:jk4bH+DHWwaMfPvMpRIO8kM4dac5mlMH1BVLI6vuLlKIdM1sj3vy8BK:N+rWgcc6hdac5mSrVLIUuLlzqsDpU
TLSH
T19BB47D6AA2A803B8D4ABD17CCA574903F77578460761DBDF03E086761F27BE15A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.bun-1534026329-efb4802116a9c3ef.dll

Path C:\Users\Admin\AppData\Local\Temp\.bun-1534026329-efb4802116a9c3ef.dll
Size 3.6MB
SHA256 9e67de8d49a028df5d26799cf2e40276898544b578194261794f961ebb82a86a
MD5 91789472dc511e814a938c77da154eb0
SHA1 87152a8056bd3dd7f7b8a9a61d03187bb4656a31
SHA512 fb2d923fbaa7cea604d320b3e13f036b971b194f41e55ce70fb0407b1bb94055d5d8706b723b8fa0af4bed62bb3b412eb8dcd8baf0079263585f8d1b240ac966
SSDEEP 49152:QhL//zPF32Bw0/D591aUjcN6eCMsqhihqrL0N:Qxp0/D591aUjW6osyrc
TLSH
T17D063A47F3A2A9BAD01E8070519797A2D3BDF8490200EFBF51D059382E879F31F756A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_iw1mrptz.ctw.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iw1mrptz.ctw.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2b5d7a7c407d85d746baa0f5c9388a333e35a717a8a0a81943daa6cb1364

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\04\5a\2b5d7a7c407d85d746baa0f5c9388a333e35a717a8a0a81943daa6cb1364
Size 685B
SHA256 178068fe08324309bbd543958dee11e6c2a5da6b04a4a0bff2a1cee0a9c7d96a
MD5 66ca1e23458b512584e9e39f8346aba2
SHA1 5c432c11b061f641f0d3feaf89b7527a1189f38d
SHA512 308e5f2bcc8588db455f505b174f7e677a1db43b2627d425965ce7389ca1356ed0ad0f40094e99fd0afa70aa0b4f5378c215826f1758e5385e635d7b3efbabe2
TLSH
T16401F4E16D611AF2BB83D5DB8D4CEE510257C01FCA405067E94EACCC81D40E4214703D
MD5 SHA1 SHA512 TLSH

Submit Download

a14a3cd7312978b6c877cafb0f3900a6bc17e40561269c5bb61a96ac5791

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\37\c8\a14a3cd7312978b6c877cafb0f3900a6bc17e40561269c5bb61a96ac5791
Size 722B
SHA256 9590ad0ce324d0fcb32b2916cf4ab968bff7d24abe17bdef6e0c376c0e4a01a0
MD5 67848e89f09d361cbe3ed128763796b9
SHA1 481da6bb88972ebc77e79eac4e230fb1057e78b8
SHA512 7e6250acdb79be6dbcd846a78f0c01311f77980c9d6d6c48c11b6688502d57bf41049be06486cf68dc9bbfc233f71abd6699edc10cd336718a0b22be68dc5d87
TLSH
T1D001D0F17E12ADB1AFE2E5D9C94DDF48850B604B85401935BA8974CC41D099C604343D
MD5 SHA1 SHA512 TLSH

Submit Download

e1e3c41b7711bf3e544145c0dd4db0049d2a50214c7dd7126b7c7ff6f1b0

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\b3\88\e1e3c41b7711bf3e544145c0dd4db0049d2a50214c7dd7126b7c7ff6f1b0
Size 685B
SHA256 931778657d2aeb13a578aa086361caeee74361979898dd684b9f55c6852da0b4
MD5 757df0a96f12d1d296707ba2f54e4782
SHA1 0f7a9f9ab681dfc3b90357789d688b67a974b4bd
SHA512 eedcb5464031e39355ba035a87554b66be3d77ea18b1315f35856be0858653dc5a86db155d75e8e2e25b19acce3be0cbc3e4dfe5074ee04db9e34d539949124b
TLSH
T19901C0F17F914DB2BBC2D5CBAC5DFE61428280268E005423FC4565CD40C15AAA54BA3A
MD5 SHA1 SHA512 TLSH

Submit Download

3c415c86-7727-4f41-841c-553fece5bbba

Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\tmp\3c415c86-7727-4f41-841c-553fece5bbba
Size 692B
SHA256 2face544f1ea3281bc176e9305dbb5cd63d827918fbbefaf445274e8cbaf6495
MD5 99c04c264f2774de023b025ec25f7147
SHA1 282ebae75281149856f0f3d1bf9bad580f6e0313
SHA512 889fe81011cbfab60af276f1229102c7e9acb38eb80ed3bd887c29f11548b8bcdec1ca09b2eb8117495a5506cac9dc1025b7cc85e5dec7912a851c095f319b35
TLSH
T1E60144E32D106CB2AFD3A4CE8E4CEE4043D7802AC68014ABFE5D748C80C8199518B02B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2808-38-0x000001D361190000-0x000001D36119A000-memory.dmp

Download

memory/2808-32-0x000001D361270000-0x000001D36127A000-memory.dmp

Download

memory/2808-37-0x000001D361270000-0x000001D361282000-memory.dmp

Download

memory/2808-30-0x000001D361190000-0x000001D3611AE000-memory.dmp

Download

memory/2808-31-0x000001D3611B0000-0x000001D361262000-memory.dmp

Download

memory/2808-25-0x000001D3610E0000-0x000001D361102000-memory.dmp

Download