ratonrat | 36baceb78fcf6aa37b3340bdf9c52fb9ddd848c8ea334c7d75ca03193f4e6116

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/10/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EldoradoLauncher.exe
Size 73.4MB
Sample261025-dpy4qsft4p
SHA256 36baceb78fcf6aa37b3340bdf9c52fb9ddd848c8ea334c7d75ca03193f4e6116
MD5 5651caca5fb4106f2261677ec11ae58f
SHA1 d9afac3be65fe12378c8243f8a14db33a0cc7745
SHA512 d9dcf933dc1640b6d5a0db0bbc9a4c093708c5dbc0c17b55ee9f79dc951e64e717d45685fdaf724cb5e3cfb0b65590eaacbca5fbdad70d0a0c150b60dcf2926d
SSDEEP 1572864:sbwJrNSakN74Ut8xpeotJL2Fx/k3uQIOTX55PWoEr/GUECI/JCc:sybkNXAEotd6xs3lD5U/0lBCc
TLSH
T1C2F7339A822E4121D64733BF923810B7491CF2B5E907B5BE91D08F554A7221E0FFDB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

https://pastebin.com/raw/5qULffW2:1605
83.38.28.160:1605

Mutex

VyiOiTj2mTosKEAj

Attributes

Install_directory
%AppData%
install_file
notepads.exe
pastebin_url
https://pastebin.com/raw/5qULffW2,83.38.28.160

aes.plain

Extracted

Family

ratonrat

Version

Free

83.38.28.160:1603

Mutex

xNUBYqpnNgoYPPFcePE12Yh

Attributes

assist
true
box
false
box_icon
No icon
box_msg
empty
box_title
empty
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
raw
https://txt-share-taupe.vercel.app/raw/Nuevo_Documento_de_texto.txt
reconnect
3
startup
true
tag
Infected
uac
true
vm
false
website
https://t.me/sillyisafed

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244a6-38.dat	family_xworm
behavioral1/memory/1484-48-0x0000000000460000-0x0000000000470000-memory.dmp	family_xworm

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244ae-104.dat	family_ratonrat
behavioral1/memory/4968-114-0x00000286EBB80000-0x00000286EBE56000-memory.dmp	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4044	powershell.exe
3336	powershell.exe
4080	powershell.exe
4524	powershell.exe
4044	powershell.exe
4624	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	EldoradoLauncher.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepads.lnk	notepads.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepads.lnk	notepads.exe

Executes dropped EXE 10 IoCs

pid	Process
3872	notepadu.exe
1484	notepads.exe
3868	notepadu.exe
2332	notepads.exe
996	schost.exe
4104	schost.exe
4968	ondrive.exe
1448	ondrive.exe
4408	ondrive.exe
4512	ondrive.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ondrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ondrive.exe"	EldoradoLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepadu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\notepadu.exe"	EldoradoLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepads = "C:\\Users\\Admin\\AppData\\Local\\Temp\\notepads.exe"	EldoradoLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\schost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\schost.exe"	EldoradoLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4708	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	notepadu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	notepadu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	notepads.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	notepads.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ondrive.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ondrive.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	notepadu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	notepadu.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepadu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepadu.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1436	timeout.exe
4548	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3272	schtasks.exe
4852	schtasks.exe
760	schtasks.exe
3888	schtasks.exe
1960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4624	powershell.exe
4624	powershell.exe
3336	powershell.exe
3336	powershell.exe
4080	powershell.exe
4080	powershell.exe
4524	powershell.exe
4524	powershell.exe
4044	powershell.exe
4044	powershell.exe
4408	ondrive.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	1484	notepads.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	2332	notepads.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	1484	notepads.exe
Token: SeDebugPrivilege	4408	ondrive.exe
Token: SeDebugPrivilege	4408	ondrive.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	3872	notepadu.exe
Token: SeDebugPrivilege	3868	notepadu.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1364	1776	EldoradoLauncher.exe	85
PID 1776 wrote to memory of 4624	1776	EldoradoLauncher.exe	86
PID 1776 wrote to memory of 3272	1776	EldoradoLauncher.exe	90
PID 1776 wrote to memory of 3872	1776	EldoradoLauncher.exe	92
PID 1776 wrote to memory of 3336	1776	EldoradoLauncher.exe	93
PID 1776 wrote to memory of 4852	1776	EldoradoLauncher.exe	95
PID 1776 wrote to memory of 1484	1776	EldoradoLauncher.exe	97
PID 1776 wrote to memory of 4080	1776	EldoradoLauncher.exe	98
PID 1776 wrote to memory of 760	1776	EldoradoLauncher.exe	104
PID 1776 wrote to memory of 996	1776	EldoradoLauncher.exe	107
PID 1776 wrote to memory of 4524	1776	EldoradoLauncher.exe	108
PID 1776 wrote to memory of 3888	1776	EldoradoLauncher.exe	111
PID 1776 wrote to memory of 4968	1776	EldoradoLauncher.exe	115
PID 4968 wrote to memory of 4708	4968	ondrive.exe	117
PID 4708 wrote to memory of 648	4708	cmd.exe	120
PID 4708 wrote to memory of 1436	4708	cmd.exe	121
PID 4708 wrote to memory of 4408	4708	cmd.exe	123
PID 4708 wrote to memory of 4548	4708	cmd.exe	124
PID 4408 wrote to memory of 4044	4408	ondrive.exe	125
PID 4408 wrote to memory of 1960	4408	ondrive.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EldoradoLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\EldoradoLauncher.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\EldoradoLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\EldoradoLauncher.exe"
  2⤵
  PID:1364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\notepadu.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "notepadu" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\notepadu.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3272
- C:\Users\Admin\AppData\Local\Temp\notepadu.exe
  "C:\Users\Admin\AppData\Local\Temp\notepadu.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\notepads.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3336
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "notepads" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\notepads.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\notepads.exe
  "C:\Users\Admin\AppData\Local\Temp\notepads.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\schost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "schost" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\schost.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:760
- C:\Users\Admin\AppData\Local\Temp\schost.exe
  "C:\Users\Admin\AppData\Local\Temp\schost.exe"
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ondrive.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "ondrive" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\ondrive.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3888
- C:\Users\Admin\AppData\Local\Temp\ondrive.exe
  "C:\Users\Admin\AppData\Local\Temp\ondrive.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_4g7ls1LX9fEOVxvEE7ciF0Xlx44yvV.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:648
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1436
  - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe
      "C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ondrive" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe\"" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1960
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4548

C:\Users\Admin\AppData\Local\Temp\notepadu.exe
C:\Users\Admin\AppData\Local\Temp\notepadu.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Users\Admin\AppData\Local\Temp\notepads.exe
C:\Users\Admin\AppData\Local\Temp\notepads.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Users\Admin\AppData\Local\Temp\schost.exe
C:\Users\Admin\AppData\Local\Temp\schost.exe
1⤵
- Executes dropped EXE
PID:4104

C:\Users\Admin\AppData\Local\Temp\ondrive.exe
C:\Users\Admin\AppData\Local\Temp\ondrive.exe
1⤵
- Executes dropped EXE
PID:1448

C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe"
1⤵
- Executes dropped EXE
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EldoradoLauncher.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\EldoradoLauncher.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
TLSH
T1D9F0DD242221E1C489127F111C0D2A4452BF4797B760EE0C7554529FD8312275F203E7
MD5 SHA1 SHA512 TLSH

Submit Download

ondrive.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ondrive.exe.log
Size 660B
SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
MD5 1c5e1d0ff3381486370760b0f2eb656b
SHA1 f9df6be8804ef611063f1ff277e323b1215372de
SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
TLSH
T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8928226805a92acd76d21e1a276176d9af3ca1ec31f14e45a2b4b88f4722cad5
MD5 da185fddf7e751e39023edde12930f37
SHA1 657fcb7fda401b69d3bb97e7b6abf126ac36d4b2
SHA512 db7bc02a1bd86d587840a56334dee9cb80aa0a8635cd2eb1c490bc5466659350de4d625f320731e34fac235016515d0dddc05a6081149dc6c2e82c262be6b975
TLSH
T11A112227F38C8920CC961539509DAC5572B586CB81EFDF9F7BC0C210A5BF584CB611D4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae
MD5 555e68af1b8e33f84346bf2335e6191a
SHA1 fa078ed3a608f05ae2dd2db8ed52d6bafe8d510e
SHA512 6f3d5be098271b844d0cbd21d902e68ce80f0bcfa67e3fb507d11bacf15227d3e66397fec2691d7f3333194d4d2067ea416bcbb1d9739f661db3bab0259af44e
TLSH
T10C112223F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0c71a0e5ff5aa9668447be911686edde65a51498c3c8f4c064c100758b14c6c6
MD5 4402048e9377e84bad040e1b0de62678
SHA1 627a02a24da9f1a16226209665309d4774a7ad31
SHA512 252ad4d56224b6814fe49beb3d6e030f08b621156388dbbe4de5bc9b4069c7b20ae53ce4e2eb2b1e3227407e5d08efdb8f297f3fa62d7541b8315b5c6e442f76
TLSH
T1EE112227F38C8960CC961539509DAC5176B586CB81EFDE9F7BC0C210A1BF584CB611D4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab
MD5 5cfe303e798d1cc6c1dab341e7265c15
SHA1 cd2834e05191a24e28a100f3f8114d5a7708dc7c
SHA512 ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e
TLSH
T193112223F38C8921CC961539509DAC5172B586CB81AFDE9F7FC0D210A5BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpDC71.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpDC71.tmp
Size 2KB
SHA256 d9891619114bdc9c06f0c6708672f16abe55473b33d3d4d2f46984c12471a536
MD5 6d7d21c9a96cab015c1894e4d339cc47
SHA1 c6680801ba63293af20a3e6b49644cf4a422e533
SHA512 d92a61430cd2bc658f231104de9681e146fbf274817effc884aed0a7364f833df42a9b4fa07c018899eb791e566865e121cbf8f6823d16638ca35f2e2e9db665
TLSH
T124413D0BF1FA5705F18CDE6328DC0E990668FFC9A9E6414EE47704641D72B2154AC117
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_13nqm5zy.2kr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_13nqm5zy.2kr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

notepads.exe

Path C:\Users\Admin\AppData\Local\Temp\notepads.exe
Size 35KB
SHA256 ab07f5ebfa8343c9bb94eb4ee8375a117e475977458961912c02cbfe93ba6088
MD5 f6ee562827adda68e627178ebfa91305
SHA1 48faac89a2ff645765e402deb0d5868ebeeabc7b
SHA512 4b59968772a3f2dd7494fb47c5c75f90a2b0bfc8e7f2c00b00d8a5b55f0781c7cfc7db9605230dd8d4e9c5de2f61d2aa1df3dea6685fc4e00e472700b8eec248
SSDEEP 384:cmE7OF/kyRnX/DuZY+mLwQViurQUjeBVz58pkFyHBLTnZwYGoVvw9IkcisHuFxOm:3RVX/SwwQzQE+1VFya9F1OjhZysMr3
TLSH
T1D1F25C48B7A00216D9FEAFF16AB355064275E70BD513EB4E0CD585DA6B77AC08E013E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notepadu.exe

Path C:\Users\Admin\AppData\Local\Temp\notepadu.exe
Size 321KB
SHA256 acc0d4696d3e0f14eb7d0be7a3827e4572827163326d77c152154ed7b30717ac
MD5 f28f523457af134e016685d545dc24ee
SHA1 767b680b7ffa3c72dccd6530eee1fa1f72d53f78
SHA512 cb5fe0617882b3db70976a92589e903a2d92be1655c5e18e0afc5dd9b94b2846b7031bfd9129dd3c0a24cd22291a5ad583b3a1ba4bb6cad55efe8d5f9e0f229e
SSDEEP 6144:nY25mxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:1pu3TCIyESY+z8WHH
TLSH
T10A648D5823ED8A26E6FE62B5E43D040D47F6B51A612EFB4F199420FD6C13F8489017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ondrive.exe

Path C:\Users\Admin\AppData\Local\Temp\ondrive.exe
Size 2.8MB
SHA256 11a6705b615bf13f7532a2cb64023ef5ec1cffc58eb3956abb503b00b7265ba4
MD5 b64630c7c3a4a36a8b8341ab8dcc0aad
SHA1 f83a70e14bd43f51c4d729082c8a69f5ba9a67e6
SHA512 974698e2cbee0204e3f0b17af2c199e59689e20bd1a0370e92fbc59a47465ea7e6d5a4e66786b09742948a3f3e97c99b25389bbced60702b10c736f9a928faab
SSDEEP 49152:GgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4A6WZ:GgVUuHjkDGjzqpgmwQ1GuRxzew
TLSH
T1E5D5121C33FACB18F2AF4BB4A87189664371FD578D62D76C5891399E04B6F48BA10B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schost.exe

Path C:\Users\Admin\AppData\Local\Temp\schost.exe
Size 17KB
SHA256 c4f434ab68be9037f37fcc428fbd0c29d404a35fc44cd08682fd95b05ffd10f1
MD5 9b6bc54871d75b0c7eddce1950fc3562
SHA1 997817706c5d2e65771e61211b6e882eff74d621
SHA512 91bd274811a97ed6beac92acce4c54d1fafdfb34de7b733adddf73af34a1081522b8dcf0e93bad918151839862f48e97c59458c316be3510207478cff7da7d75
SSDEEP 192:r7qO/yJuIOj9nSHLPZTnd4NRMnu2HLJ2x+cO0OQmDaevnmC10u7yl6nBUr:rAjOdSHL9dKMu2HLJd0EDprPOaBUr
TLSH
T1D972B30B73D658E9E0A7E7B885FA97315975FDA25D7AC30C0A30E2591E20EA05E25333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_4g7ls1LX9fEOVxvEE7ciF0Xlx44yvV.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_4g7ls1LX9fEOVxvEE7ciF0Xlx44yvV.bat
Size 530B
SHA256 254713278c6cc4949fc77ef202a6d35e41d578cacadf520a5190543955851ce3
MD5 b168cab0d32b585cb56b8513df6b9948
SHA1 9c9e2021d481ee94e17b2d5889b477c8d7172fb8
SHA512 49793606dbb653cb3e7c4672f116de6cec568ec1674aa1ba809a7bf98ea2c89a69150b3b9efac2a6edf97db21182d6df52c68a0173d591d203a4f16ec66d1f86
TLSH
T1DBF05902228E8709543090770EB7318CF0D5886B3FC67641BB10C05A27D341FA6C7BE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/996-217-0x00007FF61BA30000-0x00007FF61BA3D000-memory.dmp

Download

memory/1484-48-0x0000000000460000-0x0000000000470000-memory.dmp

Download

memory/1776-0-0x0000000000620000-0x0000000004F96000-memory.dmp

Download

memory/1776-1-0x0000000006FB0000-0x0000000006FC0000-memory.dmp

Download

memory/3872-207-0x00000000051D0000-0x0000000005236000-memory.dmp

Download

memory/3872-215-0x0000000006410000-0x00000000069B4000-memory.dmp

Download

memory/3872-214-0x0000000005DC0000-0x0000000005E52000-memory.dmp

Download

memory/3872-34-0x0000000004CE0000-0x0000000004D2C000-memory.dmp

Download

memory/3872-32-0x00000000026A0000-0x00000000026B8000-memory.dmp

Download

memory/3872-31-0x0000000000460000-0x00000000004B4000-memory.dmp

Download

memory/4080-70-0x0000016A53DC0000-0x0000016A53FDC000-memory.dmp

Download

memory/4104-218-0x00007FF61BA30000-0x00007FF61BA3D000-memory.dmp

Download

memory/4408-212-0x000002423C380000-0x000002423C3B2000-memory.dmp

Download

memory/4408-213-0x000002423C340000-0x000002423C35A000-memory.dmp

Download

memory/4408-211-0x000002423C200000-0x000002423C20A000-memory.dmp

Download

memory/4408-210-0x000002423C280000-0x000002423C334000-memory.dmp

Download

memory/4624-11-0x00000160FF790000-0x00000160FF7B2000-memory.dmp

Download

memory/4624-2-0x0000016098820000-0x0000016098830000-memory.dmp

Download

memory/4624-3-0x0000016098820000-0x0000016098830000-memory.dmp

Download

memory/4968-114-0x00000286EBB80000-0x00000286EBE56000-memory.dmp

Download

memory/4968-163-0x00000286EE520000-0x00000286EE52A000-memory.dmp

Download