1568c06c0700f2d72ad9a2fe89d36c88ac30689267aab63acaadd5b5888161e4

Analysis

max time kernel
60s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1568c06c0700f2d72ad9a2fe89d36c88ac30689267aab63acaadd5b5888161e4.exe
Size 531KB
Sample261024-x3vs1swwhw
SHA256 1568c06c0700f2d72ad9a2fe89d36c88ac30689267aab63acaadd5b5888161e4
MD5 97c271be095645e39a85d83b1f8983b1
SHA1 b7132f54cc10034ec973eb2c6464135fcf715d74
SHA512 faeac13376a99e3f31f90432ee0f3e4091bf5f6eaf3e148a3985c5a76634f8b2e969d98f02fb1643d0d81257972c6956c8cc4af98256552443cb61be954fc6bf
SSDEEP 12288:L9/mGzcn7EanlQiWtYhmJFSwUBLcQZfgiN:BOkcn7NlwPUJ
TLSH
T126C40204926CD859F5BFC73789F3BFA24BF9A9671B0685C645F8B1AE3933BC00210556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3160	1.exe
2680	dControl.exe
4504	dControl.exe
5220	dControl.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1436	powershell.exe
7032	powershell.exe
6564	powershell.exe
2224	powershell.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2680-53-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4504-72-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5552-180-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1120-182-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5220-184-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5220-187-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6908-787-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/7020-789-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6816-1287-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2052-1372-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4600-1374-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4248-1946-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6264-1948-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c526-28.dat	upx
behavioral2/memory/2680-30-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4504-51-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2680-53-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4504-72-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5552-180-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1120-182-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5220-184-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5220-187-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6908-787-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/7020-789-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6816-1287-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2052-1372-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4600-1374-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4248-1946-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6264-1948-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dControl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dControl.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3972	taskkill.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2680	dControl.exe
2680	dControl.exe
2680	dControl.exe
2680	dControl.exe
2680	dControl.exe
2680	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
5220	dControl.exe
5220	dControl.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2680	dControl.exe
Token: SeIncreaseQuotaPrivilege	2680	dControl.exe
Token: 0	2680	dControl.exe
Token: SeDebugPrivilege	4504	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	4504	dControl.exe
Token: SeIncreaseQuotaPrivilege	4504	dControl.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe
5220	dControl.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 3160	2816	1568c06c0700f2d72ad9a2fe89d36c88ac30689267aab63acaadd5b5888161e4.exe	90
PID 2816 wrote to memory of 2680	2816	1568c06c0700f2d72ad9a2fe89d36c88ac30689267aab63acaadd5b5888161e4.exe	91

C:\Users\Admin\AppData\Local\Temp\1568c06c0700f2d72ad9a2fe89d36c88ac30689267aab63acaadd5b5888161e4.exe
"C:\Users\Admin\AppData\Local\Temp\1568c06c0700f2d72ad9a2fe89d36c88ac30689267aab63acaadd5b5888161e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3160
- C:\Users\Admin\AppData\Local\Temp\dControl.exe
  "C:\Users\Admin\AppData\Local\Temp\dControl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\dControl.exe
    C:\Users\Admin\AppData\Local\Temp\dControl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /TI
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5220
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|
        5⤵
        
        PID:5552
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:3968
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|1444|
        5⤵
        
        PID:1120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1436
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|
        5⤵
        
        PID:6908
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:6916
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        5⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|6900|
        5⤵
        
        PID:7020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7032
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender:
        5⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|
        5⤵
        
        PID:6816
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|
        5⤵
        
        PID:2052
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:6060
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|3736|
        5⤵
        
        PID:4600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6564
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|
        5⤵
        
        PID:4248
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:4672
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|2380|
        5⤵
        
        PID:6264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2224
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender:
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |6120|
        5⤵
        
        PID:3156

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:2432
- C:\Windows\system32\wbem\mofcomp.exe
  C:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"
  2⤵
  PID:5704
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:3972
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\5811C2DF-9734-A25F-E3A6-02CA48BBB867.man
  2⤵
  PID:4152
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\5811C2DF-9734-A25F-E3A6-02CA48BBB867.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"
  2⤵
  PID:5900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5708

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5268
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5424

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4212

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4552

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3564

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
PID:4408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4508

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5276

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5280

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:6924
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:6392
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:6492
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6616

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2072
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5168

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4512

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5840

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:2308
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:4460
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 2308 -s 2056
  2⤵
  PID:6988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1664
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6348

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6332

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4884

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4548

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:7004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6268

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:132

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 2308 -i 2308 -h 436 -j 448 -s 440 -d 0
1⤵
PID:2776

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:1424
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:6840
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4152
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6940

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2148

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5712

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9CFAEA72-0000-0000-0000-D08302000000-0.bin

Path C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\9CFAEA72-0000-0000-0000-D08302000000-0.bin
Size 312KB
SHA256 f799a4164713fbf6e62503836e4b0be21e69742763006394ac9e7496fb2bed60
MD5 5c6d18752b875c9e03fa78ac5b3ecd3a
SHA1 64f61237078ccec5f7062323ea913431a5bb569f
SHA512 4048d87b8fe6f4a8144943df1fce69daed3e995c78a4fe725ee508c44f39bcb4ca1a9358e82034334a17b01415a8a492d4f44ad7dc1baa85ca2271ee8a143f93
SSDEEP 6:FEfKwEJMQ4080H0WeN81iW1Valt1x01QXas1G1oE:FEfSB80H0WeN0iCwxcsdSoE
TLSH
T16F645E83EB2948E9D00D5238882717003B93D6AC11E1230B1A49A1093D5BD86AC79AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin
Size 28.3MB
SHA256 7c3027205d019a589fae3ba51a31118cb33167e14e231935652c0e6002352c97
MD5 8becbf915a622c2e15d5fd7f98fdfb0d
SHA1 1c94112c6cc4ea9837b8684ac2f993f4614c1b75
SHA512 c645967a0628d335abb0f893ce6a626c892bd9384a8604cd7a066452ee16101efc6035583fa54ead1e140a2e36d71203bc5f0f27cd31ebb364f5fa199fbb7dbb
SSDEEP 786432:LsAedOXideVMMeDOvVB4EjKVHcQPuS0CcXTUYTn:gAXideaV0XbOcQPl01jDT
TLSH
T10E5733BF5EFED0BCE44E85397E0934EEE7550654898190EAF433E0578666EA00CE0D7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.01

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.01
Size 1.0MB
SHA256 b6b5667deb043c04ae9b058881696714cc2f33f18f26a1b603b8aef70c399a6a
MD5 c7becfa17272442ff28cef1ceb8a55a0
SHA1 c99e8bdc46a7de73e3d2d868b4bac45a3fc048a5
SHA512 205b3f52ca55822cd3db0c1dbebfbc6d93eb52d0d20548e218d4bf127de72d57baf937a74b316754d93cc011e72b8c5af6a32cff09e0c3f9699f2a37607de5e0
SSDEEP 24576:cUax0McaIWpOKjk8/7Zs+GYmgEfLJs+/BkW0K289s:+J8KjZujbgEfLJs9m28G
TLSH
T1D635336C0A6FFD98DCD00ECCDDC52ACE42B52D8F447A648E8C641458B7F65B6262E84F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.67

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.67
Size 29.4MB
SHA256 b6c394d72506990ba4e6c06572790165499c0d8a34b0584b598e9ea0f0df29a9
MD5 bbe66d996c2764a2ac64633729d3a2fa
SHA1 e155015fa7044414ae0304fb2a044366daf09285
SHA512 6208e9c47da789dc1b93c68b11e6905b366b10cf9a0ff7cee2b2037394f8f2b4df8672345d355c887665f68876304e0c0162d13c323191970b90ae5cb1266550
SSDEEP 393216:lqUasvUrCkWzILD+BZnCc2NcMXmmmc5jA/hmxkISW8JP83ejb/N1j:lqUakUrCwedOKmJA5mcW8Jk3e3/N1j
TLSH
T17867E00380B0B5DAE2C3B7F2B55EA7100956F03360585AAC96C54AEA4DFBCDA17CD5F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.6C

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.6C
Size 3.7MB
SHA256 83974cfaccdab59f56d87bb9e25ff611abc6fd013cff6a70588804b52251bf57
MD5 18160b945970e454de34dcbad170d691
SHA1 64b9441e59720f9f3bdd644aa07c8aba439637d1
SHA512 479fe8b860b3255e189cc77b6c58ae53c4d47fb2320644dd24c9f8c9a8fb97b92c655a5601ded8f88fbf7e3c7e4edbd93a4b3ecc372f16d5f05f89ea2fb58a3b
SSDEEP 98304:MaCxg2/u2QMd3oigdbODE5iRU5Ktz2UXPzJ:MaONZ9eZdbHiRig2Uft
TLSH
T13D066C8A35CA2A57E54BF6B8D0E5777B439ED50287978F05C4A430F6DE6238C6B32C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.7E

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.7E
Size 23.9MB
SHA256 520d8cbb0753446f48ed1ec52cf0ae0926c1e6a716d9dba6d2be6dd103473cca
MD5 a93a44703631ef9d0a3660166dfe6034
SHA1 7c33f01f2b2ce43c46f24e7ea2f60d18aa6c2f43
SHA512 574f14eac98142b140973e9e034a83f04e7c8c474e733842abb0a4abaafedc3004a9d863814939fe883e226046885cf77dec2b8742b0cae05d833c66f3012e77
SSDEEP 393216:KJSfSdVxamRwXk8DyPlhUekwDM18ayv6lukGnr00Q82R:KnMVXvDydTkwZIQnr0P8s
TLSH
T1D0478D31F9DD0F0FF45939BE465B00FB8BBAE889F741CA93A6659512E005BDC1C8AD18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.80

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.80
Size 12.3MB
SHA256 0c0394973525f745514cdb68cf71fcc74b46f47b4520066d0936a0d25936b8ea
MD5 7247c3bbdcc2ef29a295497681df3b4c
SHA1 007ff203572b3f27a0454d6cbbce709b7241fbca
SHA512 972c956ec74811a031019eebd9c949866e75801010fcb6c7edf3a8a363ae1523f239bac3a86701735f6cb01a855c09aac4c2356aa48142074e3bff3cb476c875
SSDEEP 196608:NBy/qmkhHvFk8FWTPpU3q9oZ6T6W3CIh+6J:ry/ShHvFkxTRyFOh3CIhlJ
TLSH
T172D62862BB5C5130DBAAFAF9C5CF19BCB5DF50946F1816D05431A8CFED7120C1A0A2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.87

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.87
Size 1.7MB
SHA256 99d316ed04a8aa71efa90cf74f1d5f1e6341d2a8f85682494a1892c3172208cb
MD5 9221d9fb124376fd2989b31846cb7718
SHA1 4f8ec608d0b5cf55a01118797b7f3c3d715b12db
SHA512 b91091dcd4635b0c0b6bbc9e63cc05972ee02f20f93f3e9fae55d2bde7e473141d3187438eda26d9b1aea489841cff59a8fee1d8cf58c97c13fbbaf293affa66
SSDEEP 24576:27+W2ZyVb6/h5hN3+SW16kTyHTj3tvzrgUg+Py0z0v7fYIz:278s8JjWvyHc+Py7
TLSH
T1AE85DF2D76522B79CF1703B4574F2F8283C949BC4728FA56A6936563BC312F32E01A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.DB

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.DB
Size 1.6MB
SHA256 b93579e64a0a1284674d1604d93885f17e5b3449be0125ba3d9f8d14010c9df7
MD5 3da5ca8e5738d75b3de36e6397cb3ccf
SHA1 40803d700ca5e2d9c036bbee10bfae08f1dfacd7
SHA512 80b57eb9bfe1dc6dab89cd02afabafe7d2200edb66831a57092b725410b23cef4faa2ef98e020fd17188a887f3fea4fa5d69e5b65bf58017bf6c13be9d4ff241
SSDEEP 24576:WgcAImHpnyoI6q38okoFDzSoteP9DF1Xce5FZru1yP1942eSWzrfgXWlxuLtzc6p:6WqZ0Z5Tqm9RFLf2BVPC
TLSH
T1F57533D3FB1D4BC5CC648CB353912B75263F59A8DF201B4CFD48856AC93447EABA09A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.E6

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0178FBD12B55A4E494AD5DD421C035121C0619D7.bin.E6
Size 67KB
SHA256 46038ddf0ed097ce281feedefb7639a4be8a79db87b6d861cac020d48b0ac5cf
MD5 b7e62c1922bd7f8117c2294a9a5ae1c9
SHA1 f23210c8d6bba60bb60b3ba3efd64b0f5125e988
SHA512 00b3ad78ce69c1a64aeb95656ff9c9097e1f38d9848c8a04fdc87dda3b579e17a37c7c8c8f7bf3f72576f6ba2182906b2b9b3518e554672409b7333d37a9486f
SSDEEP 96:8b2/l4qkcSlInWO81GElbh0XK57IBoP8ttAwJZQnp3+WJ:f4qkcSOWJ1GElbh0Xckk8XZo+0
TLSH
T1FE630830FF65ADA2C93CBB70B9476B0E1983518E4771360C9C5B0C28548E5EF2636A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin
Size 28.3MB
SHA256 7222fc7dba7e246f9b19036e53b1dbf2c876b7070b55f10e30160ab72087fa6a
MD5 d768ebade9aab068e1a4f9443b9b76e0
SHA1 547be0bf874a1419d193eea237fc7c3e0c0dbd71
SHA512 de70d82b0ac50370ac3a4355ffc7ae3c331e08e23df5c262bf46b109c5ea5ad0de61b1074cec9cd78d60770413776640075b3b5656888a6eb4a4479dbe62f306
SSDEEP 786432:LsAedOXids3gA4/XQ0ZW3GW0nlr446JTP+u6wmqoEl/S:gAXids3gA4/XQ0Z0h0nlV6JTAqpq
TLSH
T10B5733556CB05397B8D95862F30BD2D80DB123B0EC833D24A9313297867F7F2BA556A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.01

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.01
Size 1.0MB
SHA256 19ec3509e9be9fa0621746aad4babcf6d98dc5c61df4ac4821e55063e5506191
MD5 f11a44eef058680feec6057727be05b3
SHA1 48d834a9afd5733dbc90c4a27d764f9434c2efb7
SHA512 cebe2f7d16507244cc4209abc6288418ea69dc1ee35d0b4fd1e6035223a73076aa4060ea0435c37f158fa1969c780242d4a0072e7ded219d11ddfcd642df39c5
SSDEEP 24576:yUax0McaIWpOKjk8/7Zs+GYmgEfLIs+/BkW0K289s:4J8KjZujbgEfLIs9m28G
TLSH
T1B735336C0A6FFD98D8D00ECCDDC52ACD42B52D8F447A748E8C641458B7F65B6262E84F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.67

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.67
Size 29.4MB
SHA256 b4553e5e31fd01d163443df984439b853d232835a1654bf0827bbb98fdb40b29
MD5 8e0b3db189dff0d48a08db898cbb8aa0
SHA1 0d929b8229f80118edcb48d4317a1dc72ece1625
SHA512 3985c789e65e3bbabac71a8c5f03aa6c5f6b4129eac84453f447d158315e96e5be6f583e9d5b727dfac89354474215aa14376041ba37aacb7c834025e17b0e2e
SSDEEP 393216:5zBsbDNnTaBhm6GIzJGur0TIidonvuewXHApmxkI3TB6kbJcw09y0h:PsbRnTa2SPZLvaHQmFTB6kJcj9y0h
TLSH
T19667E00380B0A5DAE2C3F7F2B55EA7100956E033609D5AAC96C54AEA4DFBCD913CD5F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.6C

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.6C
Size 3.6MB
SHA256 dc6acc99dd67a8109e4fda2ff3f9315bc81a32cebfd6e290fcdab5ef17affce9
MD5 f0a712193a02e2ab0bb9ab38b296d198
SHA1 98ff0f13810772405c830046b104a86c42c147de
SHA512 0dcd896fb178b4e3f7f8002996e104325a3c95bc2437062eb1b6538280a6b9e1029a784bfa6615eb0d88ccb8635643ccc888bb50b1821cdce5f0090b882d32fe
SSDEEP 98304:EAQUe0wSAhIWKBz1/7lbEHN6dRNisYVNLPB:EAFd+W7Z/7sN6n9YVd5
TLSH
T1BA066B8A348A2A57E54BF6F9D0E5777B439ED5028B878F45C4A430F6DD6238C6B32C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.7C

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.7C
Size 8.1MB
SHA256 270a823e5c747bac8b4d7de037b9a2d7f5ecc425785322736df4ab01fc3267ea
MD5 8a31cde394c0f6e53d942b2c8a415ef2
SHA1 f7979751a91c3233a28f141a5fdd6e2349bc5057
SHA512 78bcb30367ffde824f573ebb60d1474df5eea3890b26f4d9c10bf1127ba556b741023207d0418e19e44734d4d4aab77d50c2124899b059aced1ce3c7e65eb7fe
SSDEEP 49152:69sfQCUCfVxIsCQHukaQGBW56cATi1k1mtYIc+NhLA9QRDuxtjIYKjqNDYGvURbE:69iQguBm6Wk1WDyKGvUq
TLSH
T1AE864A52BB5609B4F06AC3BA94936311C2F27C254AF1B30717CADD891F27394F6A37A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.7E

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.7E
Size 21.2MB
SHA256 a9c6c158a49f74a278a247cd943e44a73739fce5d35ea9b68479004b25606102
MD5 25c85a3085d31168703dc524e73feb37
SHA1 071eb1c6e220864201f3e1bd502aab9e7c7f21bf
SHA512 d0bfa55f02721cd826da2f9f9de42b7a5afa9589e1079a770e97db6b961e918206a4961f534ecd4facf21a6dfed31791d47774b6e930b5b7096db6ee08847a9b
SSDEEP 393216:FJ3sGdexLeDFXN7iHTUZSUYTJtAv/HJhXM5uUJ:l4epXNGzUZMAZhXGua
TLSH
T1CB277D31FAED0B0FF46D39FE875B04FA47BAE889B7419683A7659116D005BDC1C8AC18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.80

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.80
Size 12.1MB
SHA256 b922553ea3bb0b4d126ae750e2930817895420bd3653c6e89d45c7a4d1b24752
MD5 125f419520648e8010132d7f5466d9d3
SHA1 4a7b89568ebb8e9cd346452a87e27e4645831f16
SHA512 5bee4c6617bbf83da9fe97f37e040e44aa07a41cbe91f8237938053494f9ab41f7bd7b4698aa3ec86e39cbd845c617684e53ab5824517a7cb6be8f31da3e90eb
SSDEEP 196608:A7wABlyiGF34qdwkOkcO9wojtwGe3mB1pd9/P:MzcF34qdWk5yYq2B1pdpP
TLSH
T1BAD62861BB5C5230DBAAFAF9C5CF19BDB5DF40846F1816D05431A8DFED3220D1A0A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.83

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.83
Size 1.9MB
SHA256 e7616d6de2933437ff7e1bf89d1a249cab4850239d94d942e0a64ab7284d6803
MD5 8437f1dda17bd5656e2c7b3cb08c2419
SHA1 f04f7de5d626d6db42f4cd068dc330fe7a83901b
SHA512 fa72411ad598b068801e5e358352f02e43ad97da09ee7c658c9bb8d12cf23f7e1295d72644479c83d5647273baf436ac5cf9d21dc8b73b92e29ee2188441f037
SSDEEP 3072:pgb4gsFg4T4A4QDqJzgdKU8jxKZ3VXEddDkFeOAhOF7I7R9+iDinEEwXliVay4uH:9Vy9Ln8ec3
TLSH
T18495B432EBE87174F1965A315B7EC732C52AF9208B1293CF259DC0490F648D398BE627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.87

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.87
Size 1.7MB
SHA256 157faab9fe4b8c475eb4f26093557636f7faad4b050f2e24df1a4b9340e5a51b
MD5 c3d15a02a3c69c9fba753fde7f3f954e
SHA1 6a1e4aa21fe21f582b7471e63f1dcd2fc61bc728
SHA512 e0c7ac0e587fa2c21805d18b8adada9443635bc94fe9e5a1eaeeb39663569c5dc3ba98c89e098e882eef0b12a6967e82435e7fc5749d01df92fcd4479f54d3c3
SSDEEP 24576:usIv60XHYuLdHMWus20np6LxzAx2SHbrtvmgIOrFmCv1MYIw:Sz4xe1nYzASgIOrx
TLSH
T1F885DF2D76522B79CF1703B4574F2F4243C949BC4728FA56A693A563BC312F32E02A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.A0

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.A0
Size 16.9MB
SHA256 e279dc6f8e7c205bd6f2e3cebbfec6fbd41fbc8e45cb79cefc8d035d65c0a9d0
MD5 4082991948ba0b47f9be580b205f9d37
SHA1 0903a93e71deabd2030dca7c1be526398162165a
SHA512 f5feb2440b6860a95061e804458d9d907360b93f1f14a2138a4a4428f500cb2c8b093502422f11ea6aa492a77d58c9141af03d06b3671e6d3fc9c49cf6261832
SSDEEP 393216:u5BW7ppUnJnON3ccGKLP9bJeeDncHJFm/jZWEuK3ZK6SZHiO6h:uTKpUhwFGKrvpDncHJu0EhiK
TLSH
T1C30733666B3B5814F0F3E37E91BEEED95906E7961A2590B0313E2BDB130E274A053347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.DB

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.DB
Size 1.1MB
SHA256 46bf4dd7fba37c8ecf865f6a67bcc83f3cadf97649dafae119d2876e93db3f8f
MD5 4957c9a2b55a6f41f8e4bad3a9cc41c4
SHA1 35975abd4040de979f1a1138cf74ac183270ec4a
SHA512 b763c1da5b1bcebc4da269fb20acfb8d424c7d502beb539f7561d26120fc5f972522196544751895ab489dc5a8222a85aa5968a285886b07e48723c6b4900059
SSDEEP 24576:dP9DF1Xce5FZru1yP1942eSWzrfgXWlxuLtzc62BgOlPC:dZ5Tqm9RFLf2BVPC
TLSH
T1783533D3AB2D4F49CC910CB343A62E262F7F94FDDF101B489E488A2F4D3557EA6A0459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.E6

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-450F04E6DEA1374B46365B4F6F7FF3B56770EB23.bin.E6
Size 67KB
SHA256 18aef8852366a418f81a4cf46535fa867d4d594f4b9f64f1a19e3a7ca12510a1
MD5 f0e6ae38f444b3a7cd51ab9ec156949b
SHA1 c977ea3f48b7a0eca3e628f35b690ab3641c5ebd
SHA512 1a4fef0a66e02b09f77f2997801384e12dfcbc4a9d99aa9bf8b37fa1fb216b7580fd24d53de600c9fc10715cc716f0e50c223f005cdc158884e0b420ebf59562
SSDEEP 96:8WC219aEk2Sl2hWk8/QWlbB0Xi5rIBoBmtHSEJZEpp3+WJ:TaEk2SkE//QWlbB0Xk0Cm7Zm+0
TLSH
T14963F720AF65BDA2C93CBBF0B9C67E321B83514A4E7D3704585B0C38558C41F2626E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpenginedb.db

Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
Size 288KB
SHA256 d785ec79d8d70bc211f90a106d2811a567faa7bedc259e7be3ebed27d4455102
MD5 6b980e6caecd4ceda738057b068a61fd
SHA1 d292c083164d4e171416e57913a515c3d8cee430
SHA512 0c9fca5c2c7fcbcb7a98cfff907465f81d1c9a2086ae9afc832003ea0a6b64508c2cc68b4a079616a9f0062c023153310612c7053d30a86984af70cb647b647c
SSDEEP 6144:vV/3IV/3IV/3IQ/3IV/3IQ/3IV/3IQ/3IV/3IV/3IQ/3IV/3IQ/3IV/3IMT/3Iav:vlIlIlIKIlIKIlIKIlIlIKIlIKIlIMjn
TLSH
T196549E6D1EC6DF64CA21B44EE4E6B85D992B91E41CC2877B3D006B90D068D8E507FA3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MPDetection-20261024-202326.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261024-202326.log
Size 930B
SHA256 b39a6ee7d7bb5a8dedacd7f07be786b061de266c51ab3287e1d82f38fae5d548
MD5 af9f93e57e752c4958cdf61705d7e201
SHA1 21f1714430ae1a0c9749c163c54c68c1a73a3e2d
SHA512 44704d398426f37c520fcf589f4fbd3b0091ca86a3ef2ab037e6d6d32670c5f068c9a8c3771be064f5f9122b9b7a6d8da2ef6fd3beaf10bceb862a08786f5195
TLSH
T18011651D0AF41763F0A0F7478AF54613A9617882D438BF5C03D14B8A1A22D53F9A0FDE
MD5 SHA1 SHA512 TLSH

Submit Download

MPDetection-20261024-202326.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261024-202326.log
Size 344B
SHA256 f53122da43ca26fe3211dc4d0aef74f914bc89d7aecfad44ff668e2fb3c42a66
MD5 d7765dcc88684c63f50736375bbc62f8
SHA1 29c83eac5774ebb66cf3f531d2e6e781924aa46f
SHA512 876cca1c054298bf9f8e367da4fd0429e1e4d2f65cb345fe0e6617c7184ca186261591487019cd14feef80f8e7d4a3660dfcc200a9c06b62d0daffa4d3492c7a
TLSH
T184E0861D0AF81663B0A0F65746F10616B96179825438AD0C03D15A490D22D52F4A0F8F
MD5 SHA1 SHA512 TLSH

Submit Download

MPDeviceControl-20261024-202326.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20261024-202326.log
Size 6KB
SHA256 eb60571088564e5ba065d4723be5d29c767316cf4267f94c2b8bead8773a3419
MD5 05df246df2d222b58ed40f9759e843d7
SHA1 e1a5b197cc3a5339a1297b9bef200ff1f7de2b45
SHA512 433c19fd7419bd537052c0e35319528e8e6b797705dd5e6f3cddbe2760be09a0f41f02046f5215425f57f7d0d675482dabe45d94259b7e8aa666611a0bd03854
SSDEEP 96:APQvbdpa0PQ6bsM/paizQMDhDQMbPPQdbsM/pajzQtVhDQtxhPQzbsM/padzQtL+:JqxW7fSg1r
TLSH
T1F7D1BB0927F8260AF8A59BD3FEBB49136D32BDA15934EA1C21F5834D0671C54F9A0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MPDeviceControl-20261024-202326.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20261024-202326.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

MPDeviceControl-20261024-202326.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20261024-202326.log
Size 3KB
SHA256 02791f2301390feb49b02e1a4431d0154594909efd97e3bf140acf3bd2ca8d9e
MD5 6e1e8427aa3b7cc1bc5465b545100dca
SHA1 fce0d99870e69369fceca100009348ec12223616
SHA512 51fe23cca6203ae8dc49dd61373479970fad5b4d6aa42defa49ee7f0517754da2095f6b5654f2fb026c0b2c285d78e1d2c90f200f9d462a489b411b9b4f6add7
TLSH
T1BF61CA4927F8260AF8A59BD3FEBB49136C32BD915A34D91C21F5834D0671C14B960B37
MD5 SHA1 SHA512 TLSH

Submit Download

MPLog-20261024-202326.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20261024-202326.log
Size 108KB
SHA256 00d3bc68c9c531b15d85a37c4bfb7a2e988cfc0bba597318a30b7805bf72931e
MD5 feb2605c81f8de893f5c46955df13ca7
SHA1 3f7cbb1529eb83c965d897883aa53db3fb316b60
SHA512 cf617be317ec45f8b4900d8d085bc17a69449dae61049813a519c57d61877da399241f8c16e968751bb623e0db9ea5ee7d5609488c2a0dcbf4a3376ee0d95a80
SSDEEP 768:koegPGlOxzObZOsWOCT+HQvJXEH2xuTG/WmbCOp7T4XN3L1NstDS3rnadN:koeIOQvJXEH2xuTfOpG1EDS3rnw
TLSH
T171B3C60A57F41559F1B2EF4AADF785235A737D926938EA0D02C0474E09BAE00F960F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MPLog-20261024-202326.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20261024-202326.log
Size 39KB
SHA256 e3d592040707bc688f835d4884f520a53fb64a0ee0ee76d5b954bdea328338a2
MD5 8b50bea2552b699737ba355599bcd716
SHA1 28400b6e0507c0bba3dc9f5ce43c63999e7ef6c2
SHA512 d4d9f808e56a14e750945a68920dc314cfb2bbb6dcfdccf61b99bf2ceb57c03b7811e2e624c81807359b44ddabcd83bb717c9421b930baa2ecb5d9cc4721051d
SSDEEP 384:2a+zoegzyMDRXh9GlOxzObZOsWOCT+Hz2qf4vJXSH6x5D9p6/DVbjjeDTx:koegPGlOxzObZOsWOCT+HQvJXEHS
TLSH
T1CB03D60A57F91559F1B3EF4AA9F785235A337D926938EA0D02C0474E09BAA00F970F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpDiag.bin

Path C:\ProgramData\Microsoft\Windows Defender\scans\MpDiag.bin
Size 120B
SHA256 9695ebd67a7e337d1130b36a8f56570776c25cf190484997def18a16beaf4884
MD5 818b52d025742c6324755f38941e933d
SHA1 c4e54d7af8df50d99c527f077973f765f7b37b6f
SHA512 93343d7c74ca8fda51e19600034655a367a78c0df6096056fef8e8d5c69cd7bac652f89d1ec06821be5684b00b70d4bfd7093d73deee9f5dbc7d07176011ba43
MD5 SHA1 SHA512

Submit Download

1.exe

Path C:\Users\Admin\AppData\Local\Temp\1.exe
Size 64KB
SHA256 05ff8f4d09c372ef8343cd092500a9fcbcb675bd4dabea709d43dcca0b7b968d
MD5 86c6ba77bc40fd044463c773e7749f3d
SHA1 c833e8cb7c71653d80e89fc0f173113857c55343
SHA512 fd23b1aad5316b8dbbc6a7a16fd144fcd9226e7550db4f5fd99dfab582ac63d3ce8e7e84acad6663ab3e7c68117369a9f8d3e7d4770c9fc6fa63f925c8236c9b
SSDEEP 1536:EBKp7RZ5ALLmaZwDlYFnKMzZgEcXT5UbhbuXlaUI9V2QGxD:EBKhjuzZwUlFWUbhbuQr/ZGx
TLSH
T17553E608A6ACD91DF5FECBB784E1BF6153FEA1231B07C5C94AD8839D3232BC14612599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c6n8f0j.tmp

Path C:\Users\Admin\AppData\Local\Temp\2c6n8f0j.tmp
Size 37KB
SHA256 a3d7de3d70c7673e8af7275eede44c1596156b6503a9614c47bad2c8e5fa3f79
MD5 3bc9acd9c4b8384fb7ce6c08db87df6d
SHA1 936c93e3a01d5ae30d05711a97bbf3dfa5e0921f
SHA512 f8508376d9fb001bce10a8cc56da5c67b31ff220afd01fb57e736e961f3a563731e84d6a6c046123e1a5c16d31f39d9b07528b64a8f432eac7baa433e1d23375
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

dControl.exe

Path C:\Users\Admin\AppData\Local\Temp\dControl.exe
Size 447KB
SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
MD5 58008524a6473bdf86c1040a9a9e39c3
SHA1 cb704d2e8df80fd3500a5b817966dc262d80ddb8
SHA512 8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
SSDEEP 6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
TLSH
T1EBA42292D5045CD2D5174339DF7B7FF38EB6ADEE29180A8344B8387B3C3A9922158A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dControl.ini

Path C:\Users\Admin\AppData\Local\Temp\dControl.ini
Size 2KB
SHA256 5b78d4eb42adfcfe6409851503b7243c3438f89986e51720ebee0dee31fbac5c
MD5 82370d9ea980bd5c6df4ec822f18c0ff
SHA1 f20237c5c3d0e9848e8e80a8d34a82a42eb9dfda
SHA512 15d20278e316422f50608f487859d594235a8f009975f40b0fd665f0852ab7002cfa11a3c966a5dbb3a5a9d5b0214eda3768f3ea3c924c460948d6d4c73c6468
TLSH
T1B2418D1653F96209F2F6AB64E6B40A324B33BC95A83CD54C0AD44C8D0DF4F108422BF7
MD5 SHA1 SHA512 TLSH

Submit Download

Registry.pol

Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Size 160B
SHA256 6509c7fc4fa70391399831bbc3d66206d3f6f8f2bb20ffcac4e04844861d733a
MD5 58f8eb09a822c09fc11f5a42baae36f1
SHA1 9e7063eeee62c8588e0020bef3a116e9379966aa
SHA512 53806780934bd86bb032ee4a515dfc0e8464a5ecc5f4c8c593304fcd969c1058d443bdec54e7ae21469adb942b16693cc9eaf997217adc69d3618ab0ec99dc1e
TLSH
T1F0C0480007F82714FAFF4E351A732948683A782AAA00D88C0168494D8876E34CB2332B
MD5 SHA1 SHA512 TLSH

Submit Download

Registry.pol

Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Size 8B
SHA256 5bb1f21f806938a043563024b13b33d74a2b95b767c5f81bde8456e9d0413a89
MD5 8e1b08222f20e45a3e8db04c569f9cb7
SHA1 a6ac68fbadf96faba3af7000a7514790157f930f
SHA512 414d30dec0fce6b4e3ab52c50f064262e0df00cf9dbbeacca271a0991555371a37cfffdd0486c07a9096838942a69cdbefea4a4399ef2848139678daff589c31
MD5 SHA1 SHA512

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 233B
SHA256 1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c
MD5 cd4326a6fd01cd3ca77cfd8d0f53821b
SHA1 a1030414d1f8e5d5a6e89d5a309921b8920856f9
SHA512 29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67
TLSH
T1F4D0955244C01530C01D9103C0FD113C865D1908D1E048FFC2B7D15E11A3526FC3DF11
MD5 SHA1 SHA512 TLSH

Submit Download

5811C2DF-9734-A25F-E3A6-02CA48BBB867.man

Path C:\Windows\SystemTemp\5811C2DF-9734-A25F-E3A6-02CA48BBB867.man
Size 74KB
SHA256 1114198d6d76348ef6a7b6ae528c77e06f51369802af24ba9ad5f56fc73cb63d
MD5 f2cc8125493496245b6ec1297ac2a502
SHA1 0424a8430eda346ad6e627e7fd41710e28b541da
SHA512 77aadcada3ca13f4a420565e0c41695cbebc8b0132f4f1ff33b3c090c5234ae143ef7f56cba8be8b946ccad88407a2fc3dc84df8493066346c83adfa622daa98
SSDEEP 384:gdejk8/WmmU3LHzdphANk2s5p5BIyJDHEhJjNQrAUOmpd5+ofhyIyG42VtclEltK:g8kXmmMu6S3KNi
TLSH
T1A473E390F458ACE14D08376B59FC9904153EFEBA47E820AB7CE4A977A75B70437B0B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpCmdRun.log

Path C:\Windows\SystemTemp\MpCmdRun.log
Size 3KB
SHA256 2ffb594025f014a8db3169e0a48cdfb6e614a8f87c7cc8d9b1e42f160b49072a
MD5 b0220beee783578ba396014650e3baa1
SHA1 ef60cd1177a26193f88edc34ab3396630805be5d
SHA512 d84593a4cae41f65f01ec63bf6ce360885b19f2bcd90c4c71c7feadcfc1c9f8d665c1343db5242587d9ddb7ed6c9f4b0ee4649439e606352e43d5b97d779d261
TLSH
T17661A20266ED1E19B1B267A1AEF3C022CA377CD69538DF0E1780925E09ECA40DC15FB3
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.log

Path C:\Windows\SystemTemp\MpCmdRun.log
Size 4KB
SHA256 33f8de846b00f9d655a88976a4f208d59865d2e5ffa8a8a9c74ac27ec45b49b2
MD5 3e2a48e5b867c4013d6fb4f3227bf032
SHA1 5cacef08a5adeb184e167790f235152c7dc3a916
SHA512 49b412eec716afa9a35e660452bca81760dbf7f384dd01373c450706c62e2f0babf7411bac88213a36c2b294bc80bd5ae7a683a6fb75ecd593de948fc8b64a9a
SSDEEP 96:TEQ+AkdLykYly+AiG4p3rzl6+AiG4p3rt:Tb+b40+Kqbz8+Kqbt
TLSH
T1BAA18E1266ED1E19B5F2A7A19EF3C122CA377CD69438DF0D1780925E09ECA409C15FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpCmdRun.log

Path C:\Windows\SystemTemp\MpCmdRun.log
Size 5KB
SHA256 deb1b31400dd23215586945d54e9784fe25174ecca933e0be3f261ba426dff97
MD5 f3a4a94b9b510d1e416b693c753d554e
SHA1 53c95fec01c3a6f09adc550ca0caf09fc25f91b7
SHA512 f98fc925fb23337274ec9c4b5bf78b29e909d4d48b0b0bcf8de0c155720686c589ba5312cb71bd199de1d0b631a0498a7aa9bca316dd44f775bdf6b5d8808cf3
SSDEEP 96:TEQ+AkdLykYly+AiG4p3rzl6+AiG4p3rJci+AO:Tb+b40+Kqbz8+KqbJl+n
TLSH
T1C7B15A0266E91E19B5F2ABA15EF3C122CA377CD65438DF0D1780925E09ECA40EC15FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kmfbnnna.wzs.psm1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_kmfbnnna.wzs.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aut1B10.tmp

Path C:\Windows\Temp\aut1B10.tmp
Size 14KB
SHA256 8f5bbcc572bc62feb13a669f856d21886a61888fd6288afd066272a27ea79bb3
MD5 9d5a0ef18cc4bb492930582064c5330f
SHA1 2ec4168fd3c5ea9f2b0ab6acd676a5b4a95848c8
SHA512 1dc3387790b051c3291692607312819f0967848961bc075799b5a2353efadd65f54db54ddf47c296bb6a9f48e94ec83086a4f8bf7200c64329a73fc7ec4340a4
SSDEEP 384:Lc+oi65hxQuuaeawNT9vyk+8fYkjeXGsuojMExHixvLiH:Lvqxpkaw9oD0Jje2sZPxCxvGH
TLSH
T1A162BE8D3D193109F2A2A4D14B7197A06E1FCBD0794C67285F90C9366E72FB1B2E3227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aut1B11.tmp

Path C:\Windows\Temp\aut1B11.tmp
Size 12KB
SHA256 5ea3b26c6b1b71edaef17ce365d50be963ae9f4cb79b39ec723fe6e9e4054366
MD5 efe44d9f6e4426a05e39f99ad407d3e7
SHA1 637c531222ee6a56780a7fdcd2b5078467b6e036
SHA512 8014b60cef62ff5c94bf6338ee3385962cfc62aaa6c101a607c592ba00aea2d860f52e5f52be2a2a3b35310f135548e8d0b00211bfcf32d6b71198f5d3046b63
SSDEEP 384:cIbUPrMe4JQrf/GvefQ9Ruiwwyeq62BYZ:l+getDi9Cq2yZ
TLSH
T1EC42D1506C29AD2E63768D9D93A9E701ADB107D11140CD52B24337FA9E4A8CAF349C3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aut1B12.tmp

Path C:\Windows\Temp\aut1B12.tmp
Size 7KB
SHA256 9874ab363b07dcc7e9cd6022a380a64102c1814343642295239a9f120cb941c5
MD5 ecffd3e81c5f2e3c62bcdc122442b5f2
SHA1 d41567acbbb0107361c6ee1715fe41b416663f40
SHA512 7f84899b77e3e2c0a35fb4973f4cd57f170f7a22f862b08f01938cf7537c8af7c442ef2ae6e561739023f6c9928f93a59b50d463af6373ed344f68260bc47c76
SSDEEP 192:IsyIiAhPheSUbYWJ/sktA3qM9snQWjljZ1hkDjuQ0C1yW:IBXAhPheSaYCEGAHaQWdmxrkW
TLSH
T1FDF1AE1C4A7099792F10A6273A9BD71921FF8EE74397E0A39450A79AF0E2389C648F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85303463c44fb5d12c78e6b8dae4f4b4e41e1d3525b109f50db56492d4557634
MD5 5ed6004f5bbbc1c0c8d736a15bbf9f96
SHA1 fc5a93ccdad53f3f9dfc649845c01a739eb90b70
SHA512 b04e86de2dbe14ab5db76a0322540cf40171c945b0c859d6c8fc8262093545c28b25a7b37a134b67377c4202a87778308283bf2d0f54fc0ec5fb2d0d7ae80a8e
TLSH
T16F216833B3DD8625C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f424b79debac245414c631083442046209fd30955fd99f0e901df4af2a631673
MD5 7c894f85ac5f4c40bdb63635fa3db52d
SHA1 53fe3a4268cda9671739252daf7f766b42f391b2
SHA512 f9cffcd48e4c2eb916278b433059dbcd30f4aae64a6cb297ff17d67e2be93bfbb6893537137a9cb1af8a63b2aa6f629829402a5c7a0e51b5fce900660512ee3f
TLSH
T118216837F3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1120-182-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/1436-195-0x000001B4B91A0000-0x000001B4B9252000-memory.dmp

Download

memory/1436-196-0x000001B4B9080000-0x000001B4B908A000-memory.dmp

Download

memory/1436-191-0x000001B4B8FD0000-0x000001B4B8FF2000-memory.dmp

Download

memory/1436-194-0x000001B4B9060000-0x000001B4B907E000-memory.dmp

Download

memory/2052-1372-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/2224-1951-0x0000025773830000-0x00000257738E2000-memory.dmp

Download

memory/2432-224-0x0000027249FD0000-0x0000027249FD4000-memory.dmp

Download

memory/2432-240-0x0000027248F10000-0x0000027248F14000-memory.dmp

Download

memory/2432-231-0x0000027248E70000-0x0000027248E74000-memory.dmp

Download

memory/2432-230-0x0000027248E60000-0x0000027248E64000-memory.dmp

Download

memory/2432-246-0x0000027248F70000-0x0000027248FE0000-memory.dmp

Download

memory/2432-248-0x0000027249050000-0x0000027249051000-memory.dmp

Download

memory/2432-247-0x0000027248FE0000-0x0000027249048000-memory.dmp

Download

memory/2432-229-0x0000027248E50000-0x0000027248E54000-memory.dmp

Download

memory/2432-281-0x000002725B6D0000-0x000002725B6D1000-memory.dmp

Download

memory/2432-280-0x000002725B6C0000-0x000002725B6C1000-memory.dmp

Download

memory/2432-279-0x000002725B6B0000-0x000002725B6B1000-memory.dmp

Download

memory/2432-278-0x000002725B6A0000-0x000002725B6A1000-memory.dmp

Download

memory/2432-277-0x000002725B690000-0x000002725B691000-memory.dmp

Download

memory/2432-276-0x000002725B680000-0x000002725B681000-memory.dmp

Download

memory/2432-275-0x000002725B670000-0x000002725B671000-memory.dmp

Download

memory/2432-274-0x000002725B660000-0x000002725B661000-memory.dmp

Download

memory/2432-273-0x000002725B650000-0x000002725B651000-memory.dmp

Download

memory/2432-272-0x000002725B640000-0x000002725B641000-memory.dmp

Download

memory/2432-271-0x000002725B630000-0x000002725B631000-memory.dmp

Download

memory/2432-270-0x000002725B620000-0x000002725B621000-memory.dmp

Download

memory/2432-222-0x00000272355E0000-0x00000272355E4000-memory.dmp

Download

memory/2432-268-0x000002725B600000-0x000002725B601000-memory.dmp

Download

memory/2432-267-0x000002725B5F0000-0x000002725B5F1000-memory.dmp

Download

memory/2432-266-0x000002725B5E0000-0x000002725B5E1000-memory.dmp

Download

memory/2432-265-0x000002725B5D0000-0x000002725B5D1000-memory.dmp

Download

memory/2432-264-0x000002725B5C0000-0x000002725B5C1000-memory.dmp

Download

memory/2432-263-0x000002725B5B0000-0x000002725B5B1000-memory.dmp

Download

memory/2432-262-0x000002725B5A0000-0x000002725B5A1000-memory.dmp

Download

memory/2432-261-0x0000027246620000-0x0000027246621000-memory.dmp

Download

memory/2432-260-0x0000027246510000-0x0000027246511000-memory.dmp

Download

memory/2432-259-0x0000027246440000-0x0000027246441000-memory.dmp

Download

memory/2432-258-0x0000027235C70000-0x0000027235C71000-memory.dmp

Download

memory/2432-257-0x0000027235B60000-0x0000027235B61000-memory.dmp

Download

memory/2432-256-0x0000027235B10000-0x0000027235B11000-memory.dmp

Download

memory/2432-255-0x00000272359C0000-0x00000272359C1000-memory.dmp

Download

memory/2432-254-0x0000027235930000-0x0000027235931000-memory.dmp

Download

memory/2432-253-0x0000027235820000-0x0000027235821000-memory.dmp

Download

memory/2432-252-0x0000027235790000-0x0000027235791000-memory.dmp

Download

memory/2432-251-0x0000027235740000-0x0000027235741000-memory.dmp

Download

memory/2432-250-0x0000027235630000-0x0000027235631000-memory.dmp

Download

memory/2432-249-0x000002725C160000-0x000002725C226000-memory.dmp

Download

memory/2432-228-0x0000027255FF0000-0x0000027255FF4000-memory.dmp

Download

memory/2432-227-0x0000027255FE0000-0x0000027255FE4000-memory.dmp

Download

memory/2432-226-0x0000027249FF0000-0x0000027249FF4000-memory.dmp

Download

memory/2432-225-0x0000027249FE0000-0x0000027249FE4000-memory.dmp

Download

memory/2432-239-0x0000027248F00000-0x0000027248F04000-memory.dmp

Download

memory/2432-232-0x0000027248E90000-0x0000027248E94000-memory.dmp

Download

memory/2432-223-0x0000027246FF0000-0x0000027246FF4000-memory.dmp

Download

memory/2432-269-0x000002725B610000-0x000002725B611000-memory.dmp

Download

memory/2432-241-0x0000027248F20000-0x0000027248F24000-memory.dmp

Download

memory/2432-242-0x0000027248F30000-0x0000027248F34000-memory.dmp

Download

memory/2432-243-0x0000027248F40000-0x0000027248F44000-memory.dmp

Download

memory/2432-244-0x0000027248F50000-0x0000027248F54000-memory.dmp

Download

memory/2432-245-0x0000027248F60000-0x0000027248F64000-memory.dmp

Download

memory/2432-237-0x0000027248EE0000-0x0000027248EE4000-memory.dmp

Download

memory/2432-220-0x0000027248740000-0x0000027248E10000-memory.dmp

Download

memory/2432-221-0x0000027248E80000-0x0000027248E81000-memory.dmp

Download

memory/2432-219-0x0000027248110000-0x0000027248657000-memory.dmp

Download

memory/2432-233-0x0000027248EA0000-0x0000027248EA4000-memory.dmp

Download

memory/2432-238-0x0000027248EF0000-0x0000027248EF4000-memory.dmp

Download

memory/2432-234-0x0000027248EB0000-0x0000027248EB4000-memory.dmp

Download

memory/2432-235-0x0000027248EC0000-0x0000027248EC4000-memory.dmp

Download

memory/2432-236-0x0000027248ED0000-0x0000027248ED4000-memory.dmp

Download

memory/2680-53-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/2680-30-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/2680-32-0x00000000004CC000-0x00000000004CD000-memory.dmp

Download

memory/2816-7-0x000000001CC00000-0x000000001CC4C000-memory.dmp

Download

memory/2816-2-0x000000001C4F0000-0x000000001C9BE000-memory.dmp

Download

memory/2816-4-0x000000001CAA0000-0x000000001CB3C000-memory.dmp

Download

memory/2816-5-0x00007FFD16020000-0x00007FFD16A58000-memory.dmp

Download

memory/2816-3-0x00007FFD16020000-0x00007FFD16A58000-memory.dmp

Download

memory/2816-13-0x00007FFD16020000-0x00007FFD16A58000-memory.dmp

Download

memory/2816-33-0x00007FFD16020000-0x00007FFD16A58000-memory.dmp

Download

memory/2816-0-0x00007FFD1631A000-0x00007FFD1631B000-memory.dmp

Download

memory/2816-6-0x0000000001960000-0x0000000001968000-memory.dmp

Download

memory/2816-8-0x00007FFD16020000-0x00007FFD16A58000-memory.dmp

Download

memory/2816-9-0x00007FFD16020000-0x00007FFD16A58000-memory.dmp

Download

memory/2816-1-0x000000001BF40000-0x000000001BFE6000-memory.dmp

Download

memory/2816-10-0x00007FFD16020000-0x00007FFD16A58000-memory.dmp

Download

memory/2816-14-0x00007FFD16020000-0x00007FFD16A58000-memory.dmp

Download

memory/3160-31-0x0000000074E32000-0x0000000074E33000-memory.dmp

Download

memory/3160-29-0x0000000000DC0000-0x0000000000DD6000-memory.dmp

Download

memory/4248-1946-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/4504-51-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/4504-72-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/4600-1374-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/5220-184-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/5220-187-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/5552-180-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/6264-1948-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/6564-1381-0x000001B66EC50000-0x000001B66ED02000-memory.dmp

Download

memory/6816-1287-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/6908-787-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/7020-789-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/7032-792-0x0000026B50B30000-0x0000026B50BE2000-memory.dmp

Download