netsupport | fcd5efaa02928c1d90172d17e7c8b46115546aa25338b708c6472488006f64ea

Analysis

max time kernel
299s
max time network
295s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/11/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NexusSoftware.exe
Size 40.8MB
Sample261105-a62peass4m
SHA256 fcd5efaa02928c1d90172d17e7c8b46115546aa25338b708c6472488006f64ea
MD5 fbe9bdf299720f9574e5d0b585d4d642
SHA1 5121c0814867c4e86f4f350faaf6461dcfdb101d
SHA512 9ef01a920617be3e557efb48bd6e710c2db119197241ba02007f28abdb28ce67dcb86c4de01e01a52905f26c6a3aa1d0300c059b737a26adc107835bf627ca8a
SSDEEP 786432:3fn9MtkGFTMBGpJCroIF8bjG1XqKyA/jPoVkn6pbBd06oZ6W+A7ykq5VU6x0C5I:3vKuGFNpsdF8vG1XqKyGoVk6RBnC6W7n
TLSH
T11797336AF32B496FF04BE77C0C154A30DD69CDF8E4ED19295224F8263B3710F9926689
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery netsupport sectoprat privilege_escalation rat spyware trojan upx

Malware Config

Signatures

Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral2/memory/5080-407-0x00000223F74C0000-0x00000223F752C000-memory.dmp	family_sectoprat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	NexusSoftware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	pythonw.exe

Executes dropped EXE 6 IoCs

pid	Process
1432	pythonw.exe
2884	QVKGSYNL.exe
2580	msedgewebview.exe
5232	QVKGSYNL.exe
2220	PiM.exe
5400	PiM.exe

Loads dropped DLL 39 IoCs

pid	Process
4768	NexusSoftware.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
1432	pythonw.exe
2580	msedgewebview.exe
2580	msedgewebview.exe
2580	msedgewebview.exe
2580	msedgewebview.exe
2580	msedgewebview.exe
5232	QVKGSYNL.exe
2220	PiM.exe
2220	PiM.exe
2220	PiM.exe
2220	PiM.exe
2220	PiM.exe
2220	PiM.exe
2220	PiM.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5080	BinaryColl.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5400 set thread context of 5080	5400	PiM.exe	107

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5080-401-0x00007FF6D7590000-0x00007FF6D7A03000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NexusSoftware.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msedgewebview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msedgewebview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NexusSoftware.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pythonw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pythonw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BinaryColl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BinaryColl.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PiM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msedgewebview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QVKGSYNL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NexusSoftware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PiM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QVKGSYNL.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000_Classes\Local Settings	pythonw.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5400	PiM.exe
5080	BinaryColl.exe
5080	BinaryColl.exe
5080	BinaryColl.exe
5080	BinaryColl.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5400	PiM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2580	msedgewebview.exe
Token: SeDebugPrivilege	5080	BinaryColl.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2588	AcroRd32.exe
2580	msedgewebview.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 1432	4768	NexusSoftware.exe	87
PID 1432 wrote to memory of 2588	1432	pythonw.exe	89
PID 2588 wrote to memory of 1276	2588	AcroRd32.exe	91
PID 1276 wrote to memory of 224	1276	RdrCEF.exe	93
PID 1276 wrote to memory of 224	1276	RdrCEF.exe	93
PID 1276 wrote to memory of 2740	1276	RdrCEF.exe	94
PID 1432 wrote to memory of 2884	1432	pythonw.exe	95
PID 2884 wrote to memory of 5232	2884	QVKGSYNL.exe	98
PID 1276 wrote to memory of 3856	1276	RdrCEF.exe	99
PID 1276 wrote to memory of 3856	1276	RdrCEF.exe	99
PID 5232 wrote to memory of 2220	5232	QVKGSYNL.exe	100
PID 1276 wrote to memory of 376	1276	RdrCEF.exe	101
PID 1276 wrote to memory of 3252	1276	RdrCEF.exe	103
PID 1276 wrote to memory of 2560	1276	RdrCEF.exe	104
PID 2220 wrote to memory of 5400	2220	PiM.exe	105
PID 5400 wrote to memory of 5080	5400	PiM.exe	107
PID 5400 wrote to memory of 5080	5400	PiM.exe	107

C:\Users\Admin\AppData\Local\Temp\NexusSoftware.exe
"C:\Users\Admin\AppData\Local\Temp\NexusSoftware.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\pythonw.exe
  "C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\pythonw.exe" -x "C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\policies\waterfinder.txt"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ntba_broker_carrier_agreement.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=10F2FCEFC873B5828C6DEBB64C1DCCF1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=10F2FCEFC873B5828C6DEBB64C1DCCF1 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:224
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B97B75606586E4DB611C15CFE584B5DC --mojo-platform-channel-handle=1824 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0BB9A88A6A5B2689D07A7F6FB461D5DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0BB9A88A6A5B2689D07A7F6FB461D5DD --renderer-client-id=4 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=74DFFDCDEC3EF62587EC520024655A64 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:376
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=83ECAB0AD642A00062D0565FBF61B05A --mojo-platform-channel-handle=2696 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C1B595814B1A7C8D917131867FB07F54 --mojo-platform-channel-handle=2796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
- - C:\Users\Admin\AppData\Local\Temp\QVKGSYNL.exe
    "C:\Users\Admin\AppData\Local\Temp\QVKGSYNL.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\Temp\{F5C0BC3D-A5D9-4ED2-952E-CDEF9FE83F64}\.cr\QVKGSYNL.exe
      "C:\Windows\Temp\{F5C0BC3D-A5D9-4ED2-952E-CDEF9FE83F64}\.cr\QVKGSYNL.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\QVKGSYNL.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5232
    - - C:\Windows\Temp\{7844701F-9E4A-4DC0-829D-0D62C575FA73}\.ba\PiM.exe
        
        "C:\Windows\Temp\{7844701F-9E4A-4DC0-829D-0D62C575FA73}\.ba\PiM.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2220
      - C:\ProgramData\kubernetes_prompt\PiM.exe
        
        C:\ProgramData\kubernetes_prompt\PiM.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\BinaryColl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BinaryColl.exe"
        7⤵
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080

C:\Users\Admin\AppData\Local\Temp\test2\msedgewebview.exe
C:\Users\Admin\AppData\Local\Temp\test2\msedgewebview.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 da80ded5376b1d8ba544d832141fd10766675c136fc7e2ba01444479411127c9
MD5 f73df645d4926b4027678afeba5d2596
SHA1 3d0e2999a1ed504bb0087aeeaf6028d624df6f66
SHA512 a357c341150470b0ea87c0ea82073e10c41c3cc429cbf4cd98b4841cf70b3fd546e82dd6b13e1e705d0a24878bd0e555691463942a465178323b1da3fd5b6a52
SSDEEP 384:yewdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:j+eUZsLQCZsL3hUS4
TLSH
T12653CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

document.pak

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\document.pak
Size 32KB
SHA256 5d0bede441db72b9f3b6d03c79107352be8881682227f53d22320141a7e3d403
MD5 5f09a1347f79c30d0bec72591fe6d216
SHA1 8e0aa478c95442c0cc282f2848df04c13283cf42
SHA512 04ec3908c14946c4405cd09d388e6f07097c9182c6f7fed8e8e9232721612082a7e403501f06a90bae0965a1c258595956806e8b7fe6abfa67e05add24a039e5
SSDEEP 768:tVMvuKgXLc3TJy0hCyC0V9E5ZhxIio7x4MwqL/ChZqmqR:/MGKgXLcDAAPVy5faioNd+Xq7R
TLSH
T18DE20285F4AFBC845A8D309564AFA4B97F91D43EC80A91360402B694C3ADB1933D3EF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\install.ini
Size 107B
SHA256 e5573806c67843710778b7bab43d96e935bacc4a12efb17996ecbf22ea687f4a
MD5 e08f2b1bc360e3a29dd7a336402f2072
SHA1 9ab228b68c53d7a6e5f776438c4bd15288483e6f
SHA512 99d20ea1cb5517ca3f0e9d0cb8d573b1a4a842e7fb0ee71e1c5dc170ff3e00a9d4c4d0dac136d3a80193a3b546c9b17b487d0e240bba6e7a9657da6dead9c916
TLSH
T111B0126518A0417519155B94A5139341F8719B39217D30841087B8B42862E510B038AF
MD5 SHA1 SHA512 TLSH

Submit Download

waterfinder.txt

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\policies\waterfinder.txt
Size 4KB
SHA256 7f0367d5da07bf91bf0063a86031f7443fce73c9b0d3ee87b52c7f2c2061e152
MD5 6572d65714e392a122629e24c4f9497a
SHA1 84b539cd1a45818239db6df9c3e33eff7833ec45
SHA512 6b91eb41453c600071b8fd36b80ced5fc9caee62c1382bcdad56dd01170301650f9e965daca0e12b3c0ab48a23343a0df5c851b3be6a0e5607b0c305daebac3d
SSDEEP 96:ZpJS5NMaHTKx3qTHyxSJl8msMflAn5QFLsPpXK2ER:Z+cazkq7duy7ZR
TLSH
T1739121315584FDE119BE0EC265203D117D34AC3BEF2052B8EEC5068B71EA150EF6A9F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\VCRUNTIME140.dll
Size 88KB
SHA256 bf33857f46e56ea7930c1eea25c5f7175a6aaa3df36bf8301a785e6ca726a0b9
MD5 c33386a6e67be415a24d9c431ffd42ac
SHA1 f2f23860916471bdc332b3bd3e88deef64d4432b
SHA512 bc6d5e908bfaa7a35a8f2e01912412b9460604ea19fd27ee5c6f1a05eb0180a07bf7bc26d430326afc9b81d7f19fb1899e6245196a37710c3e5346d0bc2b4c98
SSDEEP 1536:EbiyVUrqIQsn1xtg6RxkkBGCGHDWbWXaecbGasQLvBrzU6LzNa:eiyLyt/xcRjWaXaecbGzurJBa
TLSH
T100937E5235E482B2DDAF04F0D97AEB076A3DA6900FF129F76B949949DE617C0D73020B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\_bz2.pyd
Size 81KB
SHA256 f68d891272ccce56b03377b00758af56ad1a9d2da3f996f4b0131e9be30db4ec
MD5 f61aec7703cbc30b0ca0e46453c36ab5
SHA1 f04b14f6c5a60b9c4e73ec7e790934ace8c1c788
SHA512 18836c0944bf0dd9e352a2a9c271900aab11c3050b25bc38846d980244a1f12d6a7b2c76e67786f7c339366b550570040ca98fda41884e63024dd06dad59a5b5
SSDEEP 1536:shKo7p9om0AJfDf1e+XkX38PkPapI+LV7ycA89PfIbHpvG0:Yp9D1DfPQsPwapI+LVIT00
TLSH
T17C839FC0F9C64BDDE72A7B7043C6F12AA13CD265CB60D8D7E696AC242B893B75131216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\_ctypes.pyd
Size 118KB
SHA256 aaa965e1320f699b3c72f4aea08358d8e4c4abd0c001e4c24ebf255c7444df6e
MD5 0dad6b4803db855145bf05d4bfe0c2fd
SHA1 d87f1b604cc82fece9546d0ceab69448968a3d3e
SHA512 38017ca78b30a22496e70eb1a50f1565777c4211e186a14ac4e6b4d5f8fb2ff582a679bd7a2b22556116476d9f2ec16d1410211091571b07582ecb18ccd7e527
SSDEEP 3072:yZwNeZxbbP2dlh/gy3eIEbCMvV/Y5f56xx+olI+yPrsqTo:yceZxbbPkl3Di/Y5Yxgovqo
TLSH
T13EC36D07B50AC062F6D9207DD6B858B2692F34758FF6C4E358A52CB496B02E37F39346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\_hashlib.pyd
Size 53KB
SHA256 e5440b63e0bf75f7079c722cfe957a76a23960b23c1be84afcee958ce381c2a1
MD5 2bee4cf80ff2a0e237038b8a181d2d57
SHA1 ae3287000e922de7d50f06d11dc4f723e11bd12b
SHA512 b18caaeb86bff61c2a0047e3e04a2d94e2c414648f80f74844433f1f8e2c8b0ef56b0c31ae696e22785aea524ccdbeb2b11fec9e0b1057905fba700ce23c8c88
SSDEEP 1536:2g2SVk8r55akpxjOdUhIhI+vICFycA89gfIkYEVRS:4SW8r55SUhIhI+vIewRS
TLSH
T175334B45A4400067EBFB41B476E49F6EA83CD65143E431E3BA9B88D50B223E3E77635B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\_lzma.pyd
Size 144KB
SHA256 3a2f674aca8e1e49fb8f37a5adb0e74944021b69c26c5c455039005784309b35
MD5 ec6484b838ad6cf554bf601c54ce14ef
SHA1 1a1e93311c0bfcf71f01700a2a720161f3c6f290
SHA512 ce8e3899b3c866cd50390a1463da028bd6373d4f474a1497a36a1ec47c04b6b6d0eb99f44a5aaaad9e714c77d20f12626de493f732f72971d32c20a0d1c99630
SSDEEP 3072:HG18x04NoAZg0CTGx2inhjOjrTHuAdC1RHc93XHf09mNomQGppI+01Fc:H04DcIn12djsYOmtpT
TLSH
T18EE34992A506F1E2F2A40C78D2B99F7789FD1548036441D7A1DC1BAC827F7F2A63A743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\_socket.pyd
Size 74KB
SHA256 1893cfbe076050d7ac06a7b216e3206aa918ac925967742088d150ee0770a933
MD5 2ff117164d50250742b04df1de57db18
SHA1 1056e04bdc83b586f70cbf587b1636159221dc98
SHA512 ffdfce868dd9bb72f1849c3ce98d30852a66634ca0be818181f8edd50d72aa19a270f0267bed5327d93a5a6cd92a5af9157732d50be1dfbf63f664ef5fb26fa6
SSDEEP 1536:ItsEcSTHqHcUskA61ycMBQlCp+NenzQDn3vesIylI+ywKF63ycA898fIk0EVOaw:o7cS+8A1ycMBQlCp8enzCn3LNlI+ywKE
TLSH
T134734A00E5219177F7E10C7075A19FD37E38A7A123A494D36F9B9C9905366E3FA39382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\_ssl.pyd
Size 158KB
SHA256 bdb98c537c92a2ab82679c2343d492a4197bf64937ac6759707c2d3bf3ff2d7f
MD5 5c654545b0c10e0c5394bdcc0869fbcb
SHA1 60b55c1593d544aff7f053b495a51482684ade75
SHA512 37eb1ea4405108025598efb90e03b2bf678dbdf653bef8901e5c47e40fe341a64e518964f9ba4223a661bb037f8e9543f9bc2dae41fd2e153495702efec82fe3
SSDEEP 3072:j5kcxH1FAoujja67m96vPso6Kou9BXpI+L71OsdiCOK:j5k2H1t8896vPLXou3X8kizK
TLSH
T12AF37D05B51649E3F8DD94F8A36443A3AFA89111F3DE51E399E36CD10A387C25E38B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\libcrypto-3.dll
Size 3.3MB
SHA256 64a65ca297a879839e436269d1f8a257b7411d667c0988a4fbcd56729543d632
MD5 d8f2f3239154652f8da2427bed77cd00
SHA1 10af07cfd716c55bb204a495f638d2ebc997bf4a
SHA512 0edd1100884705643a7a6202b9439196f09971c6dd386049837a9f08c346f90989bfc62db8af062239435c714518ecde2c7664334752ca84d69da4853d8b7df6
SSDEEP 49152:PjLIqjUqLpLHVCInn8mxXF5UQIgBbp3Zv8Szt4+DLS1CPwDvt3uFlDCBD52ebh:PfIGfLxIg6o4+S1CPwDvt3uFlDCB
TLSH
T1F4F59E06FBA36692E9CF827D12EB637F0E391714D72489D38E622499C8355D1763F3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\libffi-8.dll
Size 34KB
SHA256 b982741576a050860c3f3608c7b269dbd35ab296429192b8afa53f1f190069c0
MD5 74d2b5e0120a6faae57042a9894c4430
SHA1 592f115016a964b7eb42860b589ed988e9fff314
SHA512 f3c62f270488d224e24e29a078439736fa51c9ac7b0378dd8ac1b6987c8b8942a0131062bd117977a37046d4b1488f0f719f355039692bc21418fdfbb182e231
SSDEEP 768:J4QHHH1n906QVjoPX2onHfQX5YiSyv7JPxWE1f:JDHHH1n28fJU7SyNPxj
TLSH
T18EF29F025F404CA6DEDE993574AA9739CB397B441BD081E3133AE8B50F116E2F5B81DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\libssl-3.dll
Size 624KB
SHA256 8dd682b158496623237d0d2acdd24156b791d91cbf0705a013a52137a7b3ae22
MD5 a12f68a8210588c4ecea30b5c1a15731
SHA1 c0716e8646e13bbb8fa778eaa6b5995b3e1c9267
SHA512 32148921b781ee56ba1272c8fec086abdd829379f7ec33b90d419b47f39b2a51c17915fd87d20413b3cbe4528d5b90765ae5ed5a17243f71e183facc7d475f3a
SSDEEP 12288:dM3j7WBILcJg7JJp0aWTSDkGzUZ5n3jNsynd+Fe9Xb29F:dMXWBIPy75d+Fe9Xb29F
TLSH
T1CED48D92A7C25DD1E0C940BA19BB1BBE1A3E93006724C5D34F919DA98D61BC6277F3CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\python3.DLL
Size 70KB
SHA256 d86b896ef60912a02164fc81039f91b19d80e0e7739d4ce034c3ec0ba4fccc5b
MD5 3131d817a0d71db27460e49bf99da869
SHA1 df84e48a8cddd8b0b57b84e840eadd536992cb9f
SHA512 ad713bc0999b084b653fa2ad8a365032359b2103ac01caf126d876d65dcf49b03c507fa1e07c5a38661ebf053789427b73faa8ebb1776e210b58f2cd93b43758
SSDEEP 1536:4otssyKcunV8PSlI+y0hycA89XIfIkGEV00:ftssyKZlI+y0tJW00
TLSH
T18A634BC25B5BF8A2D6F665FC78DDD9CD242B02CC53268D9FA47993920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313._pth

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\python313._pth
Size 80B
SHA256 35ddf94682ff9aa713a8d63557242ad00f3f28fdd39337f02c3bda4c0f791577
MD5 c23ad35e55e5b1a71ee2e9dd97723749
SHA1 3c5332fcf5e31d3c84fcba3eb722d4c36a1802cf
SHA512 9fd07332911783ff9d534d952eb8cfece7cbeb1934a34da2ab5274d671c38bdbc75e491b3bcac332dd882310c243f389ac6dc7c0eb80e9c0131dff2244e3ad73
TLSH
T140A0220208A30080002020283FC002F88F32330CAB003A0E8BC02E380B00E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\python313.dll
Size 5.2MB
SHA256 d50df66d0416a37172debc62728335b7586bc6ba9d5d358c336f4a87f27d0a42
MD5 ba3374c244ceb35e43199aab27ab2632
SHA1 ecbcedea2be87effa0f74e2b8b830a88174536c7
SHA512 dc706b2e4dd2d9fb2095aee3ba27bfe3403912f0ce8531e0ed49c372caedaa91fabc260595fc6671361815aee0c3b51577e8fd1675db7fe69225ac4073087a64
SSDEEP 98304:lVmtRKOxF8ldKgHxbTltCb2G0VkDMHgMPDcDdbh1a:lVyxF8XCQPaU
TLSH
T1BD465C12715BC2E9ED6C187991AA9EB7BC390D04BB6640C394523D6C4FB06E2F37E706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.zip

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\python313.zip
Size 3.6MB
SHA256 40720a224f67ea5c4fdfc1c80dadc42e0b029a3c24f557bef72a3059e96fe212
MD5 c7c54d5b3709ed8ee1740fe39e7a1649
SHA1 9423eaac8731a841c18c091b4d734480f2f519b9
SHA512 8a56eb6b62b734f7f8c34e684a2b0b9f14b2be5dab3dce628c229e708878307ccc1974d354c218f0ba80d6bd85f74698bd17380023987040bcd3fdd401025c6b
SSDEEP 98304:CPPAb9w6bexF0vtwf4dpG0R5MQ4IesoTOO/a4IWOeny:0ywZFNfMHXcte
TLSH
T1E6063322847E9947D943723520E4DA0BAE1E83D5B1C0A65F4F0D91B2BE936F59B2F01F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\pythonw.exe
Size 100KB
SHA256 988b11f6726fe08c575430049b12e754ba866812d9d6575214ea6669cab716eb
MD5 d224e235909c3df82a284d58432cf2fc
SHA1 c5ca4412159438a899c4e308636d78e8b8942f0b
SHA512 ae07f4b9d5446559cc9eb32f7eaa629c3fff1b13dc96053ab61a0f1933b2cc4a6bd1cc2b7a0ccc428a34bd8da4edd1e2c61fb2116125ec67579d2d41ee18d71c
SSDEEP 1536:jo2kAhIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/70shkycA89NfIk5EVe:zSwMpdCq/IM8uIGfl/70srte
TLSH
T100A3F741E62CBDCDE548D5314A75E4F25E24ED327580A51EB7F37F462832293FA0A83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\select.pyd
Size 29KB
SHA256 1d1fb472144578c0d2b6793b2c63756952917de5d693fd0bf8d05cf3cae4f959
MD5 93977b867d58df6ced16668d37595912
SHA1 894813ab47d557fd7b54d2a42226b1d1b9a3e348
SHA512 ac4621fec92aacc27a4690ddc76c2113294414b738e30cfbea094a6b2e518a5021a32b0d8497c4633dca65718f565eddcc13d9f50e0b6cc27159371482d4f96a
SSDEEP 768:zmTkkS/mnfk/CY2rJolI+9GmxycTOJh2Ip49QTxf1ml9dHJjLHI:zmokhf5VKlI+9GGycA8998fIbHJvo
TLSH
T185D28ECA9A1440B3EDD659B066E5CD93F938A7930DD549A331EB91880E633C1FF36268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\32463183-e61d-4133-b4f9-8691105091d6\utils\python-3.13.11-embed-win32\unicodedata.pyd
Size 686KB
SHA256 7e32838f564c2f669199f7a43956d44782865b549ebe412b3727c0292cdb2878
MD5 d266b873ba60dfbc5bbc895f7ee3fbf8
SHA1 f975a0e92f51d2b3d69de1019c031069d95b39eb
SHA512 25b617239559a3d0ffb5de8f6b77d36b7e9368e6b5db7c4ff345b798151f54ccd1ce4a3562aab18dee1a5f23e1d89dfd60a1669e4e290dec52955631b5b77429
SSDEEP 12288:WvNdLI/X77mvfldCKEMihH32W3cnPSqrUN4V:WvNW7qNxEd3cnPq4V
TLSH
T1ECE4F5D9BBCF8D26E68B363948E3710F5171C3B35F1A8636B6182361D85B3B449D182E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QVKGSYNL.exe

Path C:\Users\Admin\AppData\Local\Temp\QVKGSYNL.exe
Size 9.4MB
SHA256 5d7c6a2f5171346e67236e9f4b11a873eae268fa9da744c8951474e168d44727
MD5 99cfd282879a606bd253ae00348babe6
SHA1 f5c1e12f4fe77602bb0e38db620cd0e4f29737ca
SHA512 d231d49bf30cddb22b23c289d294c8eaeb00c939ccd958d4775f58081ca62648800b909757d0c5c7c23bfb3ac1c76adba302210d2a5dc77a5c7cdb18d674cfc0
SSDEEP 196608:/LZ2IA/5k3RmD+I8Smti5cbI31/h2kSySC+lFvBSdmh6M9:F2IKVfeimbIl/h2bySzvh6M9
TLSH
T1F6A6333164615037E6F205B3FA2886303DADB7286741D8A9D3C4EE5D3EB89C1A7B7352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NScurl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdCB7B.tmp\NScurl.dll
Size 7.4MB
SHA256 9bcaa62be62b427c06769006200208264217c0957b3ac4f150f687fcfd29155e
MD5 db425209aa38a6f6d8379f441b99950d
SHA1 951baa838310b9352dc9f8923ea7ada206efab94
SHA512 dd96e9ffb4c38bb3826ea0c178b9bfd71d38ce6d9f1887d3262c4ea8313049d2ba7b9a5279980d8981b8cc49929801e02ccd5fe48dffe7a787e9cff658592741
SSDEEP 196608:gfb4qtMPEdoSlT5x4Ww4EbEEW7IDqlcT1VuDx7Kk/fcHLKoW:WqLK
TLSH
T1A1764A94FECB04F1E55784B0D8EBB37F8B34A7118125D6BAEE0C1E56F933701261A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\nsdCB7B.tmp\cookies.txt
Size 135B
SHA256 be7a52d6d1b2e5e2c7a9e338f3ab71b4b2e76797f19cc06d5899aece2701365b
MD5 fc31b34eb1f36e5ff23be7f4621aa04e
SHA1 cef8d9c3577f04c9e102f942ee9bbe98dec50df5
SHA512 c5289e754453876b9646124952850f27325af5345c7522b9478a51c794277d5d0fa55cc105cbcab4dd72a2f76b107b97cea49a0296512c086412ddeb92441a65
TLSH
T14CC02BAF30C7901B0360C3503AC0156B8581810D4B4CD101A0862C2E438C154644C5CA
MD5 SHA1 SHA512 TLSH

Submit Download

ntba_broker_carrier_agreement.pdf

Path C:\Users\Admin\AppData\Local\Temp\ntba_broker_carrier_agreement.pdf
Size 32KB
SHA256 da3c6a3667975c55b0310f420aea0afc01606316294db9bd7c0a9ab4c2ecd204
MD5 50e1019896599c4e39cce31e2c6f6775
SHA1 fc7b690129881b5b6d7b65377a6106377ec8fa57
SHA512 65dc6abe9d806575cc82e704cb3a19e3c49dcf4c2cc74229ca5eaf51125139fc6328c8c23ac41a4d050a822c589f126a18f69f503f3ca73d33537f8a9fac7839
SSDEEP 768:2LB//wtF1szKs688TOkYhlHVmlj6NmsAsonE5XtbPmpsO:q//guBNPhlHVk6N8se2NPmpB
TLSH
T1CDE2D310814E3CDED21627DA635F3C0E721EB272B0C59A823B7CEB4447A1D7BA95364B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HTCTL32.DLL

Path C:\Users\Admin\AppData\Local\Temp\test2\HTCTL32.DLL
Size 320KB
SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
MD5 2d3b207c8a48148296156e5725426c7f
SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
SSDEEP 6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
TLSH
T150646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSM.LIC

Path C:\Users\Admin\AppData\Local\Temp\test2\NSM.LIC
Size 257B
SHA256 ad0d05305fdeb3736c1e8d49c3a6746073d27b4703eb6de6589bdc4aa72d7b54
MD5 390c964070626a64888d385c514f568e
SHA1 a556209655dcb5e939fd404f57d199f2bb6da9b3
SHA512 f089c59a24f33410cf98fba7ea0dd2ca0fd997efc9a03e5355cde3c1a1f4a78b13cebd387099b9de824bffea01c489d8f0e90df56f89973007dabb6afdde607f
TLSH
T1EAD02B8AA1225037078102617EA495AF81C5A1188758B954B5A816255CA56301B9D0AC
MD5 SHA1 SHA512 TLSH

Submit Download

PCICHEK.DLL

Path C:\Users\Admin\AppData\Local\Temp\test2\PCICHEK.DLL
Size 18KB
SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
MD5 a0b9388c5f18e27266a31f8c5765b263
SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
SSDEEP 192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
TLSH
T15D821BD21F696503EBE24E7161EADA165D36B6D0AB74C0EF307581452EC0BE03E6931F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCICL32.DLL

Path C:\Users\Admin\AppData\Local\Temp\test2\PCICL32.DLL
Size 3.6MB
SHA256 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
MD5 00587238d16012152c2e951a087f2cc9
SHA1 c4e27a43075ce993ff6bb033360af386b2fc58ff
SHA512 637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226
SSDEEP 49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
TLSH
T125060831E544CC72E156407ADC7DAADD41162DA00F1886EF398EB9692FF23C422F9E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client32.ini

Path C:\Users\Admin\AppData\Local\Temp\test2\client32.ini
Size 530B
SHA256 1eb0157a91331e2c3e5a0d217f48820f6cbeff605206744288e1ad33f17a693a
MD5 23460700d717b3457c75ecf5e179b1a0
SHA1 f875525f7fb8974fba5798fe15f273d25008eea0
SHA512 755ecf067a56c40ae42aa734e0ed1434699deed4b4d4b00ae1b7ce6751a99f3e41a2d92182430329551e835e01b6f3058168be265803b8452beadb44a418a64a
TLSH
T1E0F059252A0BFD5E019AB3D7B67441C12FE35141E4487922A708AA0F6F31C29C8FE898
MD5 SHA1 SHA512 TLSH

Submit Download

msedgewebview.exe

Path C:\Users\Admin\AppData\Local\Temp\test2\msedgewebview.exe
Size 117KB
SHA256 06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268
MD5 ee75b57b9300aab96530503bfae8a2f2
SHA1 98dd757e1c1fa8b5605bda892aa0b82ebefa1f07
SHA512 660259bb0fd317c7fb76505da8cbc477e146615fec10e02779cd4f527aeb00caed833af72f90b128bb62f10326209125e809712d9acb41017e503126e5f85673
SSDEEP 768:zfVZl6FhWr80/SqUr2pe/3NPHDHf/ckvKoGr2pe/kCHDHf/ckPG:z70hGaq0ee/3hjHTIee/djHC
TLSH
T1ECC3B34F469DE173EA42E97CC4819B050DA4BEC9B8B458FB005EF63E3E3178E2B5415A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Temp\test2\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcicapi.dll

Path C:\Users\Admin\AppData\Local\Temp\test2\pcicapi.dll
Size 32KB
SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
MD5 dcde2248d19c778a41aa165866dd52d0
SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
SSDEEP 768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
TLSH
T14EE27EC59A88A493F9C94C7571EEEB375C3976F0675400D3B2A682B91AD83F2347821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACE.dll

Path C:\Windows\Temp\{7844701F-9E4A-4DC0-829D-0D62C575FA73}\.ba\ACE.dll
Size 1.2MB
SHA256 b335af7bc5dbf3da2158efce5a7392768c4c34aadbb5277951a2ad7a223d5f00
MD5 8c2a90fbb1a4597289adb8fc10e8adf9
SHA1 6e99e5b613de404f0a1d0b85296c7e71dff9168b
SHA512 e4ac0dd28e6ad0c7dfb171924d159e147d211ae286f2c979fbbe22ac560bc1908ba4bef826f71c4187861a89820d74024ee03359e659f42b6e5fb8f78eadb5a3
SSDEEP 24576:kICfjAcykWygmwxeHYuYLWAi+PTMgUnMU3:PCSkWygnhTMgUnMU3
TLSH
T16C455C60BA9E8266F6DAA2718E7D7B2F587DD01107388FC3910CDB1418952D72F37A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PiM.exe

Path C:\Windows\Temp\{7844701F-9E4A-4DC0-829D-0D62C575FA73}\.ba\PiM.exe
Size 410KB
SHA256 d0eae0c90115c457663852e8ad6c9207d3f51b442dc0f3749fd8b8714d02a55b
MD5 8451f78db829135bd27111f55996a637
SHA1 554ce6d6aff6ceb4c3408ddc2c6511ba528d593b
SHA512 93a3db226e1b66a48711aa9d29ad9b7253b2aac78c5170f09fbc2004ebf4e5695463a68d68b8d6a79ffc26dcd272fe5d83eb7f634748543aa328141237bba1f8
SSDEEP 6144:gpWQwLmEGNBUcJVrEcKrCj/hGgbPjhNuoQIOCVyT8:gpWQwLmEG3U4VrTKrCESPjCkyT8
TLSH
T1679449617B9AC932E5E312728E7AA79F143EFA314F3A52C776980B4D6C612C11E31707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pictorial.dll

Path C:\Windows\Temp\{7844701F-9E4A-4DC0-829D-0D62C575FA73}\.ba\Pictorial.dll
Size 496KB
SHA256 cb845016015ca44908501dfc0dfeced06178b6986f204814a7d5c7656fbb79de
MD5 9fb7e8618fcd8cd203233c3a8c8999d8
SHA1 085780e8b15c0b93c02654ea941a7c18739a7b0a
SHA512 9a2ca80cd53e1670e51e381e43a4a918ad560a521ac368277cf14f6d055cdbfe12dddf344b67095d9c1d417777b5646f22d2dab203cd9a17856fa861063c76f0
SSDEEP 12288:Xr/Cl2eOOZ/Ql5ZWIvHdHl7EX0JbRoFO1fSBi9b2nYyCnQtvo4+:XDrdHldbXfSmb2n8nQJo
TLSH
T11EB4AF52AA81D073E58210F516BA97BB5E3EA6354314D4C3F3D44D74AE206E2BF3938E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wsmanclient.dll

Path C:\Windows\Temp\{7844701F-9E4A-4DC0-829D-0D62C575FA73}\.ba\Wsmanclient.dll
Size 1.2MB
SHA256 f9d7b41c12f45ef6c109aa60c534e7abe176400e24d2c56b3fed528a4631a7bd
MD5 4a0dea439a40afd412456b9f3970f3c0
SHA1 626bbacb08f1306d7bbdc6a514e7eca9dd8d39a4
SHA512 c763a698f67896164e81235ad60256adfa989567f6793d37fd152776f6d7e78b694c45e5cc9d1b83a617a1469c482dfed38c399de1d9742aff2b6d35f3249e04
SSDEEP 24576:0A+64/QGqY0QJbJxWIc6XW/Y+vEM65VJ8YRnZARzlMjTHK73SFfLj:P3HYfqIHm/Y+vEa7iFfLj
TLSH
T153458DE2379880B1DAAC02769D69677D047FA76807F001D3BBE46B9D7D2A0C35F36606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QVKGSYNL.exe

Path C:\Windows\Temp\{F5C0BC3D-A5D9-4ED2-952E-CDEF9FE83F64}\.cr\QVKGSYNL.exe
Size 6.6MB
SHA256 ad6c822ffbe04fdf75c3daa61e02f8754a253e37158ffc888f708bfb0dd9ddd4
MD5 5dfd933d2bfde1c23e556f4a2d83613e
SHA1 b547898a155288a53fdd5043764cef65eac7aeb1
SHA512 d08b12017027d7e5e4fd4124d886e9641dec84ebc5e7aff068ddbc8dc389366d23ebe5610658e858e51aed86d60e2a1772df9224030cf24435c7898b211898f9
SSDEEP 196608:/LZ2IA/5k3RmD+I8Smti5cbI31/h2kSySC+m:F2IKVfeimbIl/h2bySI
TLSH
T13366233160A15027E6F10577FA2892307DACB7286B9188A9D3C4FD5D3FB85C1A7FB252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-215-0x0000000004490000-0x00000000044D3000-memory.dmp

Download

memory/1432-218-0x0000000004490000-0x00000000044D3000-memory.dmp

Download

memory/1432-217-0x0000000004490000-0x00000000044D3000-memory.dmp

Download

memory/1432-216-0x0000000004490000-0x00000000044D3000-memory.dmp

Download

memory/1432-195-0x0000000003360000-0x0000000003370000-memory.dmp

Download

memory/2220-388-0x0000000001140000-0x0000000001147000-memory.dmp

Download

memory/2220-387-0x00000000738E0000-0x0000000073923000-memory.dmp

Download

memory/2220-389-0x0000000001160000-0x0000000001168000-memory.dmp

Download

memory/2588-394-0x000000000A7D0000-0x000000000AEC2000-memory.dmp

Download

memory/2588-396-0x000000000A7D0000-0x000000000AA7B000-memory.dmp

Download

memory/5080-407-0x00000223F74C0000-0x00000223F752C000-memory.dmp

Download

memory/5080-400-0x00007FF60AFA0000-0x00007FF60B03A000-memory.dmp

Download

memory/5080-401-0x00007FF6D7590000-0x00007FF6D7A03000-memory.dmp

Download

memory/5080-405-0x00007FF60AFA0000-0x00007FF60B03A000-memory.dmp

Download

memory/5080-408-0x00000223F8180000-0x00000223F8342000-memory.dmp

Download

memory/5080-409-0x00000223F8000000-0x00000223F8050000-memory.dmp

Download

memory/5080-410-0x00000223F8350000-0x00000223F83C6000-memory.dmp

Download

memory/5080-414-0x00007FF60AFA0000-0x00007FF60B03A000-memory.dmp

Download

memory/5080-482-0x00000223F8A40000-0x00000223F8F68000-memory.dmp

Download

memory/5080-484-0x00000223F80B0000-0x00000223F8159000-memory.dmp

Download

memory/5400-392-0x00000000008C0000-0x00000000008C8000-memory.dmp

Download

memory/5400-390-0x0000000075670000-0x00000000756B3000-memory.dmp

Download

memory/5400-391-0x00000000006A0000-0x00000000006A7000-memory.dmp

Download