Overview
overview
9Static
static
3LosPollos.exe
windows10-2004-x64
9LosPollos.exe
windows11-ltsc_2024-x64
9$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
1$PLUGINSDIR/app-64.7z
windows11-ltsc_2024-x64
1LICENSE.electron.txt
windows10-2004-x64
1LICENSE.electron.txt
windows11-ltsc_2024-x64
1LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3VaxonSync.exe
windows10-2004-x64
9VaxonSync.exe
windows11-ltsc_2024-x64
9chrome_100...nt.pak
windows10-2004-x64
3chrome_100...nt.pak
windows11-ltsc_2024-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1ffmpeg.dll
windows11-ltsc_2024-x64
1icudtl.dat
windows10-2004-x64
3icudtl.dat
windows11-ltsc_2024-x64
3libEGL.dll
windows10-2004-x64
1libEGL.dll
windows11-ltsc_2024-x64
1libGLESv2.dll
windows10-2004-x64
1libGLESv2.dll
windows11-ltsc_2024-x64
1locales/tr.pak
windows10-2004-x64
3locales/tr.pak
windows11-ltsc_2024-x64
3resources.pak
windows10-2004-x64
3resources.pak
windows11-ltsc_2024-x64
3resources/app.asar
windows10-2004-x64
3resources/app.asar
windows11-ltsc_2024-x64
3resources/elevate.exe
windows10-2004-x64
3Analysis
- max time kernel
151s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LosPollos.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
LosPollos.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app-64.7z
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
LICENSE.electron.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
LICENSE.electron.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral13
Sample
VaxonSync.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral14
Sample
VaxonSync.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral15
Sample
chrome_100_percent.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
chrome_100_percent.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
ffmpeg.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
icudtl.dat
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
icudtl.dat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
libEGL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
libEGL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
libGLESv2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
libGLESv2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
locales/tr.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
locales/tr.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources.pak
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources.pak
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/app.asar
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/app.asar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/elevate.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target LosPollos.exe
- Size 59.4MB
- Sample261102-n29fcaht7x
- SHA256 70ddc6cbecc52d4341903b53cc6b24741f25d959fe2a0d1c6951df62ecd3da23
- MD5 b39bc2d2854779556aa44b437b8147ff
- SHA1 31aaa3181b0dda101c2c379788ce9053d9c57abc
- SHA512 96d118ff093063006772a0ad1b41534b39bef49856ac48b88c84916825fc75072e0d13b8cf8cffe47aee1120889fcf8ff75cb85d1b6b73443e537ccb7165759a
- SSDEEP 1572864:Ahty2M+IKxh6ZQxdU1SGOKwybBJ0N4DNwOMNRNi7:Ahc2zLh6ZQ3UMdoAqCOuRI7
- TLSH T13AD733CA8654BF4FFF75B734D7983606DAA1ADD923105032220D242FB14F0B2DA5E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest SyncAgent.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SyncAgent.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools SyncAgent.exe - Executes dropped EXE 7 IoCs
pid Process 3552 VaxonSync.exe 4504 VaxonSync.exe 5788 VaxonSync.exe 3344 VaxonSync.exe 1604 VaxonSync.exe 2360 SyncAgent.exe 4648 SyncAgent.exe - Loads dropped DLL 21 IoCs
pid Process 3364 LosPollos.exe 3364 LosPollos.exe 3364 LosPollos.exe 3552 VaxonSync.exe 4504 VaxonSync.exe 5788 VaxonSync.exe 4504 VaxonSync.exe 4504 VaxonSync.exe 4504 VaxonSync.exe 3344 VaxonSync.exe 3344 VaxonSync.exe 3344 VaxonSync.exe 3344 VaxonSync.exe 1604 VaxonSync.exe 4648 SyncAgent.exe 4648 SyncAgent.exe 4648 SyncAgent.exe 4648 SyncAgent.exe 4648 SyncAgent.exe 4648 SyncAgent.exe 4648 SyncAgent.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 8 raw.githubusercontent.com 1 raw.githubusercontent.com - Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1000 tasklist.exe 2244 tasklist.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4292 cmd.exe 5344 cmd.exe 1864 cmd.exe 2432 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname VaxonSync.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain VaxonSync.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname VaxonSync.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain VaxonSync.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LosPollos.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SyncAgent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion SyncAgent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SyncAgent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName SyncAgent.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ SyncAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ SyncAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ SyncAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ SyncAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ SyncAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ SyncAgent.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3552 VaxonSync.exe 3552 VaxonSync.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3364 LosPollos.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeDebugPrivilege 1000 tasklist.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeDebugPrivilege 2244 tasklist.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe Token: SeCreatePagefilePrivilege 3552 VaxonSync.exe Token: SeShutdownPrivilege 3552 VaxonSync.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3364 wrote to memory of 3552 3364 LosPollos.exe 89 PID 3552 wrote to memory of 4504 3552 VaxonSync.exe 90 PID 3552 wrote to memory of 4504 3552 VaxonSync.exe 90 PID 3552 wrote to memory of 5788 3552 VaxonSync.exe 91 PID 3552 wrote to memory of 3344 3552 VaxonSync.exe 92 PID 3552 wrote to memory of 3344 3552 VaxonSync.exe 92 PID 3552 wrote to memory of 1604 3552 VaxonSync.exe 93 PID 3552 wrote to memory of 1604 3552 VaxonSync.exe 93 PID 3552 wrote to memory of 2360 3552 VaxonSync.exe 94 PID 2360 wrote to memory of 4648 2360 SyncAgent.exe 95 PID 4648 wrote to memory of 4292 4648 SyncAgent.exe 96 PID 4292 wrote to memory of 2544 4292 cmd.exe 98 PID 4648 wrote to memory of 5344 4648 SyncAgent.exe 101 PID 5344 wrote to memory of 1000 5344 cmd.exe 103 PID 4648 wrote to memory of 1864 4648 SyncAgent.exe 104 PID 1864 wrote to memory of 3292 1864 cmd.exe 106 PID 4648 wrote to memory of 2432 4648 SyncAgent.exe 107 PID 2432 wrote to memory of 2244 2432 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\LosPollos.exe"C:\Users\Admin\AppData\Local\Temp\LosPollos.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exeC:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exe"C:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\vaxon-sync-client" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1648 --field-trial-handle=1652,i,4768087827150738147,13723094056009580787,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exe"C:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\vaxon-sync-client" --mojo-platform-channel-handle=1920 --field-trial-handle=1652,i,4768087827150738147,13723094056009580787,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:33⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:5788
-
-
C:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exe"C:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\vaxon-sync-client" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2348 --field-trial-handle=1652,i,4768087827150738147,13723094056009580787,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3344
-
-
C:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exe"C:\Users\Admin\AppData\Local\Temp\3KVGVQkbnCG3mZXiqGsedexd2kP\VaxonSync.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\vaxon-sync-client" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=1740 --field-trial-handle=1652,i,4768087827150738147,13723094056009580787,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\SyncAgent.exeC:\Users\Admin\AppData\Local\Temp\SyncAgent.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\SyncAgent.exeC:\Users\Admin\AppData\Local\Temp\SyncAgent.exe4⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\getmac.exegetmac6⤵PID:2544
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /NH /FO CSV"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\system32\tasklist.exetasklist /NH /FO CSV6⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\system32\getmac.exegetmac6⤵PID:3292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /NH /FO CSV"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\system32\tasklist.exetasklist /NH /FO CSV6⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\SyncAgent.exe
- Size 6.6MB
- SHA256 afc3755e13cb18059c0e9026b97f607650042f296b0255cb93e265f447284c82
- MD5 4fa22e53805959efbd27e91a9735cba0
- SHA1 b6b402fb918c6fa0499f3edcc2216134fccea13f
- SHA512 14fe0757acea02be5365d7d0e235060057d5f9d103b2d414d919ba4fbb08c6fac4b2b07fdb771c85be1959906e5d2a2c7b3b109c9ba7476d0610f8c3529d1468
- SSDEEP 98304:/3hnQ4PBe3XGTgYKI6fJUzYoxzhX/kFcWh81Fsva2v0m1dlPEVkqRAe9cTqmlLS2:PJPBeHG96xCF/ktmuva2f17C37qraM
- TLSH T1D866336DD4A2A4DDC6AFA6B0E1C61CE332B1FD140724A51F42E9E1B27B5F9900D343E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- TLSH T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\chrome_100_percent.pak
- Size 150KB
- SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
- MD5 b1bccf31fa5710207026d373edd96161
- SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
- SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
- SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
- TLSH T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
- MD5 8f3d89744ae11b0925faf4b64890d0d7
- SHA1 6a8f744be1f76e9ad28287d969d8d24f5f1e7623
- SHA512 250c06e70276c08d3d8a63744af6c570b6288e1d8fed8deed915c79bf0a80c3cd0a7e64c55a16fcbc50ccbcbc9910b26f87983ceeea8ed28a75c1b8ec22db53f
- SSDEEP 49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
- TLSH T138D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
- MD5 74bded81ce10a426df54da39cfa132ff
- SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
- SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
- SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
- TLSH T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
- MD5 f1fe23058e7eece1de389a0c882bc1ad
- SHA1 e83b15d2bbcb6fb2867651a2a9797ed3b6827947
- SHA512 d7d51fcb05542fa81e871dd9f1dd960c363107d1c25311dcbf81e440d1275054c121a788def8dbae47c129e95fd990042e2d39e6ef2bdfb253a114146eb33973
- SSDEEP 3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
- TLSH T1A1A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
- MD5 76141455cd2705897d38e9785117e405
- SHA1 ee091646b6273bf006cfcd84fd54384b0a9d0e0f
- SHA512 551b79aaffdc469448477aa72554458235f118559eecc567c232599a4193b2639c14eafacad533485089af58701aeabee690b43f36e41342f928d4973efc02e1
- SSDEEP 98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
- TLSH T1F9767B03F29A40D9D05DD2B59B4B8123FA31B8855724B6DF266413253F7BBE0AB3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\locales\tr.pak
- Size 523KB
- SHA256 0fd794b314d12652ca5c1986795a00bd0116b44a3163d2ea0b26560e3ad23eee
- MD5 04d37b8e9db287042e86d0623063f9ca
- SHA1 c6c3c32350737efbc938f59a12d1d4a1c2aca736
- SHA512 38756868fdd0045aa3e10d26e89f923759aff7fb4c984cae2fc46091d737e6c9b5edd924948671abe4b9991e150dcb0068143618911595f021332a5dba7ad912
- SSDEEP 6144:KErTapWZp08qQdrdwZiRDhzXkKxv8CXHXki4wge75MW/2+qi1nEedGAMYw/KFT6Q:KECph8qeoi7zBkiN5MW/B
- TLSH T15EB4E98178EF381C8BB9278FD7E90666F89F0766B331E4469A16863A774535303E760C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\resources.pak
- Size 5.0MB
- SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
- MD5 54790975c932460ffa375cd0f0f8fff0
- SHA1 05b72ff82abb8ddac1a92471f765b87b7ff1e9fd
- SHA512 d74627207caa35602e68ad6c08a0ebf55fe062e191a1885eb38226755d382dd3407dea883e4337c5cff23c1f724d64e5598edf7a5ce93d4cc1ea6ea10c41aa0e
- SSDEEP 98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
- TLSH T1103633C77AB4443EE905633B401D4B752F29F2C61B612036705CB59DBF3A6ACAE9407E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\resources\app.asar
- Size 4KB
- SHA256 5197b573d45d16ff2a21e4234cd4dc1ee93dd128c81c437df110277150543cf8
- MD5 df59d9723bede07667e279afc5efe6b5
- SHA1 7ebac46b367d4550472f52d4562bbf1a1ed806a8
- SHA512 7dbdf12b293c4bd70def2239e8e90cf46bdf7cbf332d90e7a2718e958fe4614ee002f2f756f920c55e324d69d9757eb8c4962f991fcc1b1110408d560fc1f50f
- SSDEEP 96:0kYEf/OCb/mAPY8HZpjMXJzNQWjoT2c5csytX:0k3OCqAw8HZpjaJzS2c5Z0X
- TLSH T10F812A960BA443B9A130729F6583403F022279473221FACEF52CDA845F972B9A0FB35D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\resources\elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\snapshot_blob.bin
- Size 299KB
- SHA256 c1da41052abe31791ae90a9dbe54442a641e1ecbb018ef35c44e7aed05b8f72e
- MD5 aedd1b80a8140b94c00db3c0b9485772
- SHA1 2dc8444e599438ed37a31ebfe7f8859af7fac631
- SHA512 3e06cb550f46285d8dc81d1f082732c07e9c9d81abe931e859262c7ba699d4eb9737581f5a5c5174e09bb0fc0561a9de46298714ced38f453f922f9536c67d0c
- SSDEEP 3072:ogusbBDoCIdRSt25iD1Z3yAcCLi9wfuwWMvDdkbMzaQ:ogus9oCM9OUYffnWYWbIF
- TLSH T107548746F646EA07C53435738CFFB5996924B8E96F164B0B3748933D7CBA2293B0214E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\v8_context_snapshot.bin
- Size 663KB
- SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
- MD5 0c259ecbb12e6f3f0e076e6200221489
- SHA1 3de53dcafdce24c151dd1812769b46acea77c90c
- SHA512 6ef39ee8b7d40c5e6c0e79f8c4e846d431a6a87711d025122e2e7f060c5754fff917771d5ede6adec3be909fb5ce0e8eb1df5e18142ecdb6339bdde8ce2c8398
- SSDEEP 6144:m/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPbIgTtLAkW/cB2Z0JZkQXEzBO+lZ:myMSZu/Bg90BuCzIP/+2ZGZazJlZ
- TLSH T191E46F53F749EE03C66939B389FAE9517674B8C8AF06471B7798533E3A3A3252E0005D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\7z-out\vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc6113.tmp\nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_2360_249055_98ZDlcX4olI\VCRUNTIME140.dll
- Size 116KB
- SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
- MD5 be8dbe2dc77ebe7f88f910c61aec691a
- SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
- SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
- SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
- TLSH T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_2360_249055_98ZDlcX4olI\_ctypes.pyd
- Size 121KB
- SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
- MD5 565d011ce1cee4d48e722c7421300090
- SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
- SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
- SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
- TLSH T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_2360_249055_98ZDlcX4olI\_socket.pyd
- Size 77KB
- SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
- MD5 b77017baa2004833ef3847a3a3141280
- SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
- SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
- SSDEEP 1536:kHan8OG4wAM/Hh2JO9/s+S+pzpTzVs/tiTFVf77neJIYLw47Syt6xr:8an8OAF2JO9/sT+pzVVs/tYFVT7neJIh
- TLSH T1BE736B11A69011AAD2B3C07AC5634F23F774F4C1179597CF1264CA6E5F23782EE7AB82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_2360_249055_98ZDlcX4olI\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_2360_249055_98ZDlcX4olI\python311.dll
- Size 5.5MB
- SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
- MD5 387bb2c1e40bde1517f06b46313766be
- SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
- SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
- SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
- TLSH T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_2360_249055_98ZDlcX4olI\select.pyd
- Size 29KB
- SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
- MD5 e4ab524f78a4cf31099b43b35d2faec3
- SHA1 a9702669ef49b3a043ca5550383826d075167291
- SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
- SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
- TLSH T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_2360_249055_98ZDlcX4olI\stub.dll
- Size 8.1MB
- SHA256 127f5424f436bf1b79f3571f973ce7ba296d3265ef28882c240a27b290b6224a
- MD5 4e035c90e0e57a7376b426ae0b488417
- SHA1 4d7b078d12e71ce97c46f18df4e0c8ed8c6c0492
- SHA512 8701f43b03092630fbaaba24010b73530c503f88ca80d73181ddec9e1aeeda8fb83f0ce2ceb540a319147c6cec7b93b3fb10c7061c454af0e08854f42da97cff
- SSDEEP 98304:T60wSMxmar/1oDVC7Z2DSJrf7HcuZeAV8u0+8NyoHJU1:TfA1o8F2DS2a
- TLSH T1D28639827A91C5BBF855F3B580161517B320F8FAB320D7133A9EC06A6F97B606D258DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\x_ha1gK4\runner.js
- Size 4KB
- SHA256 0a58bd8231fbf542c24ddcbb9d8236a26311b72e571523cda860a57b0b14bdb8
- MD5 064daca49e46d3b73e37b7bbb84e72f9
- SHA1 67c2a28152eb1bd28361203d95039f03e0b64a3c
- SHA512 2091c6a3a3d65be7c5e300c7f85c510d02e7916b0d74a1277538d125e8c25b2c5633461e17009acb9f2f1a3f61c582cf42c2bbc025619d19f5f36469bf74d60b
- SSDEEP 96:n5kxNL4DAD2DGDJVqCvPjly6gAf6M/MhuJKdUcudd5csGiQi1IefVDVsE2XhXtl2:n+N0cKy9VXlDiM/Eu6rkdeNiQix9mF/+
- TLSH T1AAA14E5923C43615279B5FE7361B38D4E00A894E39CC8497D110B4E8FE6C366C3E1E36
- MD5 SHA1 SHA512 SSDEEP TLSH