97942ccfd750c7b7614487320e2ace06136d21b3e3b09db5e2288e07791896e3

Analysis

user interaction
yes
max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.exe
Size 78.4MB
Sample260427-ptrq1aby4z
SHA256 97942ccfd750c7b7614487320e2ace06136d21b3e3b09db5e2288e07791896e3
MD5 ed51aafc918b7b969795d6f9f8cc14cc
SHA1 4fafc802d015b777424c967a69b99880df770254
SHA512 57e05e960653108b11996f2b0b76d459055af69bd36c5d0c5e820e1ebf9db1d12d4e3eb8401b227cab4d5fdf21cbb8401d63b33ba47c01ccab5938742edd50af
SSDEEP 1572864:D9zdm67R8EeWilKYFzFFd3P3R8fNknAnZ2yOogqTcaNH21A/DC7sacTB8+iaYrmU:D95TRTedlRj/h8fNknAnIdA7lxmwpgaU
TLSH
T19B08339E7BC42583E9AFC13B9102CC1B6E61EB455247845797F42C322E1B2DE997EE30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 50 IoCs

pid	Process
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe
3504	main.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	discord.com
12	discord.com
40	discord.com

Enumerates processes with tasklist 1 TTPs 9 IoCs

discovery

Process Discovery

T1057

pid	Process
4656	tasklist.exe
4844	tasklist.exe
3708	tasklist.exe
444	tasklist.exe
4972	tasklist.exe
2572	tasklist.exe
636	tasklist.exe
1464	tasklist.exe
2400	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3876	powershell.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1876	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3876	powershell.exe
3876	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	tasklist.exe
Token: SeDebugPrivilege	636	tasklist.exe
Token: SeDebugPrivilege	4656	tasklist.exe
Token: SeDebugPrivilege	4844	tasklist.exe
Token: SeDebugPrivilege	3708	tasklist.exe
Token: SeDebugPrivilege	444	tasklist.exe
Token: SeDebugPrivilege	1464	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	4972	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5100	WMIC.exe
Token: SeSecurityPrivilege	5100	WMIC.exe
Token: SeTakeOwnershipPrivilege	5100	WMIC.exe
Token: SeLoadDriverPrivilege	5100	WMIC.exe
Token: SeSystemProfilePrivilege	5100	WMIC.exe
Token: SeSystemtimePrivilege	5100	WMIC.exe
Token: SeProfSingleProcessPrivilege	5100	WMIC.exe
Token: SeIncBasePriorityPrivilege	5100	WMIC.exe
Token: SeCreatePagefilePrivilege	5100	WMIC.exe
Token: SeBackupPrivilege	5100	WMIC.exe
Token: SeRestorePrivilege	5100	WMIC.exe
Token: SeShutdownPrivilege	5100	WMIC.exe
Token: SeDebugPrivilege	5100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5100	WMIC.exe
Token: SeRemoteShutdownPrivilege	5100	WMIC.exe
Token: SeUndockPrivilege	5100	WMIC.exe
Token: SeManageVolumePrivilege	5100	WMIC.exe
Token: 33	5100	WMIC.exe
Token: 34	5100	WMIC.exe
Token: 35	5100	WMIC.exe
Token: 36	5100	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5100	WMIC.exe
Token: SeSecurityPrivilege	5100	WMIC.exe
Token: SeTakeOwnershipPrivilege	5100	WMIC.exe
Token: SeLoadDriverPrivilege	5100	WMIC.exe
Token: SeSystemProfilePrivilege	5100	WMIC.exe
Token: SeSystemtimePrivilege	5100	WMIC.exe
Token: SeProfSingleProcessPrivilege	5100	WMIC.exe
Token: SeIncBasePriorityPrivilege	5100	WMIC.exe
Token: SeCreatePagefilePrivilege	5100	WMIC.exe
Token: SeBackupPrivilege	5100	WMIC.exe
Token: SeRestorePrivilege	5100	WMIC.exe
Token: SeShutdownPrivilege	5100	WMIC.exe
Token: SeDebugPrivilege	5100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5100	WMIC.exe
Token: SeRemoteShutdownPrivilege	5100	WMIC.exe
Token: SeUndockPrivilege	5100	WMIC.exe
Token: SeManageVolumePrivilege	5100	WMIC.exe
Token: 33	5100	WMIC.exe
Token: 34	5100	WMIC.exe
Token: 35	5100	WMIC.exe
Token: 36	5100	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3912	WMIC.exe
Token: SeSecurityPrivilege	3912	WMIC.exe
Token: SeTakeOwnershipPrivilege	3912	WMIC.exe
Token: SeLoadDriverPrivilege	3912	WMIC.exe
Token: SeSystemProfilePrivilege	3912	WMIC.exe
Token: SeSystemtimePrivilege	3912	WMIC.exe
Token: SeProfSingleProcessPrivilege	3912	WMIC.exe
Token: SeIncBasePriorityPrivilege	3912	WMIC.exe
Token: SeCreatePagefilePrivilege	3912	WMIC.exe
Token: SeBackupPrivilege	3912	WMIC.exe
Token: SeRestorePrivilege	3912	WMIC.exe
Token: SeShutdownPrivilege	3912	WMIC.exe
Token: SeDebugPrivilege	3912	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3504	main.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3504	4592	main.exe	86
PID 3504 wrote to memory of 2188	3504	main.exe	90
PID 2188 wrote to memory of 2572	2188	cmd.exe	91
PID 3504 wrote to memory of 4996	3504	main.exe	92
PID 4996 wrote to memory of 636	4996	cmd.exe	93
PID 3504 wrote to memory of 1144	3504	main.exe	94
PID 1144 wrote to memory of 4656	1144	cmd.exe	95
PID 3504 wrote to memory of 1376	3504	main.exe	96
PID 1376 wrote to memory of 4844	1376	cmd.exe	97
PID 3504 wrote to memory of 904	3504	main.exe	99
PID 904 wrote to memory of 3708	904	cmd.exe	100
PID 3504 wrote to memory of 392	3504	main.exe	101
PID 392 wrote to memory of 444	392	cmd.exe	102
PID 3504 wrote to memory of 4744	3504	main.exe	103
PID 4744 wrote to memory of 1464	4744	cmd.exe	104
PID 3504 wrote to memory of 1008	3504	main.exe	105
PID 1008 wrote to memory of 2400	1008	cmd.exe	106
PID 3504 wrote to memory of 2024	3504	main.exe	107
PID 2024 wrote to memory of 4972	2024	cmd.exe	108
PID 3504 wrote to memory of 4260	3504	main.exe	109
PID 4260 wrote to memory of 5100	4260	cmd.exe	110
PID 3504 wrote to memory of 3984	3504	main.exe	111
PID 3984 wrote to memory of 3912	3984	cmd.exe	112
PID 3504 wrote to memory of 2104	3504	main.exe	113
PID 3504 wrote to memory of 3876	3504	main.exe	114
PID 2104 wrote to memory of 4032	2104	cmd.exe	115
PID 3504 wrote to memory of 1080	3504	main.exe	117
PID 1080 wrote to memory of 2824	1080	cmd.exe	118
PID 3504 wrote to memory of 1788	3504	main.exe	120
PID 1788 wrote to memory of 4244	1788	cmd.exe	121
PID 3504 wrote to memory of 3616	3504	main.exe	124
PID 3616 wrote to memory of 4860	3616	cmd.exe	125
PID 3504 wrote to memory of 3404	3504	main.exe	126
PID 3404 wrote to memory of 4596	3404	cmd.exe	127
PID 3504 wrote to memory of 4004	3504	main.exe	128
PID 4004 wrote to memory of 2232	4004	cmd.exe	129
PID 3504 wrote to memory of 4868	3504	main.exe	130
PID 4868 wrote to memory of 1876	4868	cmd.exe	131
PID 3504 wrote to memory of 4320	3504	main.exe	132
PID 4320 wrote to memory of 3736	4320	cmd.exe	133
PID 3504 wrote to memory of 2484	3504	main.exe	136
PID 2484 wrote to memory of 3316	2484	cmd.exe	137
PID 3504 wrote to memory of 3212	3504	main.exe	139
PID 3212 wrote to memory of 404	3212	cmd.exe	140
PID 3504 wrote to memory of 2228	3504	main.exe	141
PID 2228 wrote to memory of 4916	2228	cmd.exe	142
PID 3504 wrote to memory of 4620	3504	main.exe	143
PID 4620 wrote to memory of 2380	4620	cmd.exe	144
PID 3504 wrote to memory of 3168	3504	main.exe	146
PID 3168 wrote to memory of 2888	3168	cmd.exe	147
PID 3504 wrote to memory of 5100	3504	main.exe	148
PID 5100 wrote to memory of 3956	5100	cmd.exe	149
PID 3504 wrote to memory of 60	3504	main.exe	150
PID 60 wrote to memory of 4796	60	cmd.exe	151
PID 3504 wrote to memory of 4032	3504	main.exe	152
PID 4032 wrote to memory of 4276	4032	cmd.exe	153
PID 3504 wrote to memory of 544	3504	main.exe	154
PID 544 wrote to memory of 2812	544	cmd.exe	155
PID 3504 wrote to memory of 4244	3504	main.exe	156
PID 4244 wrote to memory of 900	4244	cmd.exe	157
PID 3504 wrote to memory of 4404	3504	main.exe	158
PID 4404 wrote to memory of 4860	4404	cmd.exe	159
PID 3504 wrote to memory of 4536	3504	main.exe	160
PID 4536 wrote to memory of 548	4536	cmd.exe	161

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq ollydbg.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ollydbg.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq x64dbg.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq x64dbg.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq ida.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ida.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq ida64.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq ida64.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq windbg.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq windbg.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq immunitydebugger.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq immunitydebugger.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq procexp.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procexp.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq procmon.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq procmon.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq wireshark.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq wireshark.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get model"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get model
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic baseboard get product"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get product
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoLogo -NoExit -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:3940
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:3416
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:2168
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:3388
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:964
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:4800
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:4000
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:3500
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:748
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:3968
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:3480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:3636
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:4276
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:2772
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:3728
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:4596
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:2260
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:4532
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:3096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic logicaldisk where drivetype=2 get deviceid"
    3⤵
    PID:4892
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where drivetype=2 get deviceid
      4⤵
      PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.env

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\.env
Size 107B
SHA256 9098620e64e7c77f83052c73041f4083c9c450b8e931c5d6d8a20e11fefb0a99
MD5 977ab34a16c4214b983067238f45c7ee
SHA1 068f57b5cd961986d92bb24cc90d68b4a4e8ce7e
SHA512 5c86f8bc9545e170a503629c39c15127d35bef70b6a02fd8e43d11f960925cad9e2d0efe69ed261d937b7ec3606f3d4dbd1f789b4741c75f53db899da6e43b2b
TLSH
T1DBB0124D79F820516496D9E18E45469522C8771EC95366A8DCDBC8FAA0B5020D3F3547
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 880cb1680bf1977aa232cccb59a49dc9d3708d940af0f0a9029734216a6dc2bb
MD5 6d4f9da12243a8be192ab0fd7277e5dd
SHA1 94496aecc9ca1c38bce35a87201b53c8512ccd8b
SHA512 6d4f5ffd2c56f4b9cec1a5435c501e244fac975f5972c52ac237e9395273f1712df2b62a86eff5e60c2e0649d004967d399c094a11703298e8fb1e6ec24e202e
SSDEEP 192:9IORWghW+yW1c31DSdVWQ4WWhyRdlYl6d3RX01k9z3AQKe1sbV:9IyWghWd3Id1lYlORR9zGe1sp
TLSH
T11BA239878EE89103FDAA5D7046F9DA433C3C6BC71510A06522E9F65D28D37C6EB1471E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 d5bcedb99014c6d0993eb76af35ac16e820969ecfb149f19b75d02d603dd52a9
MD5 95504df89f18fead4a3f33669fc0d4e0
SHA1 13088aa1ddcd513053730975c56c3eee50e9c541
SHA512 4f6c721a271569f3ec814e01bd1691ce2351ae9ec06a93439ea218ce6d8a9f5054cb23bbfdf0674bbd2e2abbe576ac242c0ae655cff1b254da513fbe917295b9
SSDEEP 192:O2WghWHyW1c31DSdVWQ4KWhSvsXcY00pyEuX01k9z3ACNWdIaofQ:O2WghWS3IdDEcEpcR9zPMNWQ
TLSH
T167A23B835BAC8043FDAA6E7043B9DA837D3C27CB1550E19606D9F5581C937C5EB2872D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 7c8276339755acd397f44b7affa938103ea72966d4c066a4cdc259bc0e8500fe
MD5 a15c6d00605e61bd207a342ccf48df26
SHA1 b053a07320ae33fb28a0848e5074a6ff3bc89b9f
SHA512 cc568e28aec1c5694cdae8c8ea34f44849e1a67c489c2c67a56815c427549e0ea0571da40670eedfafaae8efb803f479dc2d983356274b24ca7b5ba40e49c6c1
SSDEEP 192:dqnWghWDyW1c31DSdVWQ4WWhCZMYHnsTX01k9z3Ap+dikp:snWghWe3IdZZMYMTR9zCgikp
TLSH
T1CCA23AD64BA8D003F86B9D7042E8DA877C3CB3D71A00D5761BD9F5981C93385EB24A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 0c06dfc6cd7d358b58ea4e6af0cb54e0469bb89d5b2a12c187fc788f9543741f
MD5 ec742e31a7e877d5879a3717d6fc956d
SHA1 d910c426f12e60978738e4c36c036d62bb3009d6
SHA512 a736431ae25648f928fd1e2c58aa5603e76cbe29719cd364d4c680a42eb41d3e7e0fa90138677ff940eafca77c5e10819dcf9df03f59d32f7154be0230dc2f56
SSDEEP 192:gHmxD3P1WghWB9fyW1c31DSdVWQ4iWhn7AvpGX01k9z3A5+F:gHA1WghWBA3Ide0pGR9zgw
TLSH
T1B8A23A8687BC8103FDAA6DB043E9D9437C3C6BC61A50916656D9F6982C933C1EF2472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 804c3ae2c3dc033bdc5beec45cb369c8470c0d9a790bed79b05ae93cdad83460
MD5 1f172e12104e5ed8afcfa32df27e8e9a
SHA1 81e8d5e79c411cc2fd870ead764eb53ded34f3ce
SHA512 830b409f1d0a318f9bfceb87ae639ff61c9563b54e95ca09e0ea1967eb11d6b8eeed6fe2eba06d7b8b5dbc2aecd0ad2006e5b72963508852e1868a45315b8a32
SSDEEP 192:9WghWRyW1c31DSdVWQ4iWhjunvM30LRLLX01k9z3Awd8C+9Ivi:9WghWQ3IdaukELRPR9zVd8CHi
TLSH
T1AAA22C9556B88143FCA66E7052B8D6837C3C6BC71E60D0661AD5F98C2C973C5EB10E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-fibers-l1-1-1.dll
Size 21KB
SHA256 0456c30ee2124ebe7788cd7c41a96a8ce8f5c18e4f28c782e1be4b9852c5b0b0
MD5 ad951158527940bac000e0baf0c73d63
SHA1 6b6ee384a4d7df4eb8e9ab60dfea1d4b62bea922
SHA512 56104592b857df6c07e673136f762a56faa4f9e93702411a8ab2109f739a0605c36f1d298c6047a8860ab130a6ec2231c52cb8a9ea8ce5462c98991029a7699f
SSDEEP 192:6ZWghWVWjKMaKVWQ4WWhj9BtaFFX01k9z3AYps+VWxW5UH:QWghWVKy9WR9zrpsqWWUH
TLSH
T18CA23BC696BC8043FDAB5E7042B8DA877C3D67C71950D0AA56E4F59C2C93391EB20A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 7645683e443ba242e8ae03fa8241aaec1c304bbb3b6eacd5897f85846d98e2c7
MD5 bc64ea90cadc294a08fdacaf808d398e
SHA1 8b3f6b9ca8da827d04a5d792414fd1f356284dca
SHA512 cff8fdc6fd1c8d915d0701c5298b75beee1611fdd3f346f509a11f0564dcb94000575f128e35030610c4f1fc02860d0d54b744fbe9675ec4e7fc011a7191c7b2
SSDEEP 192:x8whDPvVr8rFTstWghWxyW1c31DSdVWQ4WWhW81BHX01k9z3A+HFIGNf:TJPvVrTWghWw3IdJIBHR9zB+Gf
TLSH
T1EFC20A83D9B4F24BFC8F9A3151A6C983683553C6051490D61BD8E79C3CF7386E39869E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 b2c7cb7d8cc4d78d3aeaa33be5f37fa72c8dacdafb9259e2ab9c633eb4523221
MD5 b0a23a59470d0d05f65e68b34cc3151d
SHA1 fb847743919b14904144b463cba1700d14d60b8c
SHA512 91a4743187b8fe97d3a72ab132b0f995529ff490919ddb779df2e5f700e72c32d6de3ec574d6a4f02531252731790b720af3c27eee6889c397933c9b3de8f164
SSDEEP 192:7SVKWghWgyW1c31DSdVWQ4qWhEpvTKDUX01k9z3ASw4TL:7eKWghWb3Id5rpR9zGoL
TLSH
T1FEA22B978AB89143FD9B5E7052E8EA833D3C37D7195090A606E8F5982C837C5EB1472D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-file-l2-1-0.dll
Size 21KB
SHA256 cf9bbd97661a1bafe171e5f9fc1edf7f172da0bc6424e1b68550455196a0a049
MD5 9ae6d3043815d2cad7f1aeb38c6d82ef
SHA1 d57d80b9377fc522e326b4c8a3b819fba3d6396d
SHA512 a2229f677b9db677a5f336d500022a083d319add8d3016ed0e0ba3c9dc026b25069b0b1ca01d101ff4a5410101bb1fc167f289000200f5970b747fa4d01ee515
SSDEEP 192:hsWghW9lxHyW1c31DSdVWQ4WWhpjj9BtaFFX01k9z3AYps+VWxVK:hsWghW9lk3IdoP9WR9zrpsqWLK
TLSH
T137A23BC1D6BC9143FD5BAE7042A8D9837C3D77C71650806A16A8F59C2CA33C5EB24A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 a6a86eed6c1b67723d66b8715bc148e45650f3017c2a22d35ae2b06348a4b8e0
MD5 b897ff4bbbc100b803e1476b42277b61
SHA1 82a3be04ed265d08806f288d1762a48ec08d6add
SHA512 c3efecb3f64fe18b17bfa4ac3679baabadca6ccf3cec6e51f43ca0d3ce1e15ac4c46d6e96fe19d9565d047f997a4a4a58ac58ced73b0f320aa3d1b9695ec05bf
SSDEEP 192:CtWghW0yW1c31DSdVWQ4OWhkAgfcMbnoQNpX01k9z3A6PQNTrT:CtWghW/3IdN/7R9zVaT
TLSH
T16BA22BD29B7C9003FC6B697082E9DA833C3C6BD7295091E61A94F9592C533C5EB3072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 81cae96e0876aa0b5242e2acc6014b5c51f811389979d7dc583d3cb9374e549c
MD5 7ae52347ec08e6849086764a26963c17
SHA1 90a02c9dc84531cf172f0ded67c686cd828552c7
SHA512 5f201b9631199a8243af71bd8f5767e0024e95a92e00b0289f01a0514525638fecbbc357944175d20b727f77cbc03d1679cca107d568d7174d1e49236524dd82
SSDEEP 192:jvxlHWghWeWjKMaKVWQ4iWYQgiZTOebR5X01k9z3AVm4jFxV:jvxlHWghW+KI9bt5R9zcdjFn
TLSH
T1D2A23B8A85AC9143FD9EAE7002E5CA977D3C67CA1950D06512E5F15C1C933C1EB34BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 bcb5b0ec15fd59cf19d5ffc490a40d907c1f320c3a5f2b9570c24bf62d8c43d6
MD5 6a44ff92b08801dcdf9fa525e9916bc3
SHA1 72975520c648621def2037b449dbb350411554bb
SHA512 6d11ddac9407bdb8f874b537723503b04729618956fd65ae4cdaedc63b68c5188c65dac9ad9feb7f9f35ac0e9030e9304657b97782c6f9c5440baa869599ca57
SSDEEP 192:7GWghW+hWjKMaKVWQ4OWb8Lrp0KBQfX01k9z3A9JjoS:qWghW+JK28RxB+R9zyJjP
TLSH
T1B6A23B859ABC5587F8EA6E7042E8DE837C3C77C61A40906646E5F4581C937C1FB34B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-kernel32-legacy-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-kernel32-legacy-l1-1-1.dll
Size 21KB
SHA256 d3667ed353e1548c8833280e50834b634b9775d15d25ce0511d2b385d7a607a8
MD5 ec9ea954d82514e4a1df8a2825d7ae94
SHA1 0f43a140ac8b95a061c30c0698328f8888e5447c
SHA512 47d7fd7207822324bbf4f2ca6e321451137a584e735c02640ec63ed32275a26ee0312409c77433491c0f900667d36bea4d987f8509301987129cb6ccaa132b4e
SSDEEP 192:sBYlDQkWghWqWjKMaKVWQ4WW1DWXYz1X01k9z3AfS6nI:sBEQkWghWCKToJR9zkO
TLSH
T1ADA22AD696B88183F9AAADB052E8D9833D3C67C71950907616D4F69C28933C5DB30B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 007305876bdf0472c403ddcf8c1f8a0d3831427e06ddfaea8e40aaaa8d870384
MD5 413a42576ccfabd99401a69d4e5a790a
SHA1 1701b3038c03bf0e707eb3b098bbd5d29955a2b8
SHA512 e5a0594303e36e3f081cf17bded3a9d2ba5fc161770c682f3f13d91df30fe7f1678c28089b1073b1c7f48724473b9da038a1f166e9d4d61983ae2eea62adc3be
SSDEEP 192:FTvuBL3BBLBWghWrWjKMaKVWQ4OWchHssDX01k9z3ALYtcm:FTvuBL3BPWghWzKnFDR9zk3m
TLSH
T1ACA22BC2956C9143F8EA6E7042A0D8877C3973C75920D4AA45E9F6982CE33D0FB20B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 058a3bcb3c1e463bce5c1990c369600dcca924f1b0aac87dde15f10c00fb4aaf
MD5 776fb42f857d54989b2697b34ccc6e03
SHA1 abdb792e85a0f29b9a2dec0b56e32aa023c363ad
SHA512 1ed6bc1a9bb046339f5c04a46a7f0778a27bddfe0aea924c80b298cfb10f8bcd9e1fba82a4535b9f90acb516bc92a1475047f858f3bf474b5225ea257bb44918
SSDEEP 384:QnaOMw3zdp3bwjGzue9/0jCRrndb4auWghWAK6+spGR9zgf5e:hOMwBprwjGzue9/0jCRrndbCpY9zae
TLSH
T1B6A22A86C6A8E207F85DDD7061ABC9432C3867C54922D8A643E6FB5438F3385EB6076D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 b27f216be782ad764c881d45612838efe3e4ee34ac8a7171319d6d42c0bee37b
MD5 ae82aec85f7fa3d31ea5a6bdeb235f09
SHA1 145dd44d90759cedf2f7db47065735b0cc3384f6
SHA512 c45b7388ca8b87d81526f60fb4d0df845151190b342e5ba98aa4d0e203420190611bb26b43de96fc0200e22c717db5409274fd57b6738fbc24c19558705687ad
SSDEEP 192:dVWghW/yW1c31DSdVWQ4OWhC5VXC4dlgX01k9z3AUjTbV35d:dVWghW63IdJVXC4deR9zVjPV3
TLSH
T1AFA24B864BAC9547F8AB5D7153E4CA937C3EA7C71890916746B4F4442CE33C1EB30A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 9054404f0aff7ac16d86f672117715047ec1d2797a47ed44bdcb2fbb022421c5
MD5 23530fa19f79999dcc9cba8390192256
SHA1 f46b1c6d5858183f55df96e96060aad3af0b2e52
SHA512 305884643ccde497ffb8f9302bfcbca4b580571f02c00880f4f1788a3f94492486cc6061cff3f8793c01f4181971264f8c3c597c2b10ecfe3dcc67621182d6fe
SSDEEP 192:s4VWghWYWjKMaKVWQ4WWIR1WXYz1X01k9z3AfSPDmo:s4VWghWYKDRwoJR9zk+
TLSH
T1D5A23BD592A8C143FDAA6DB042E8D9833C3DA7C61910D07567E5F9582CA33D1EB30B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 1ec7a2a06577bb6781fbd3e32176de34e22692134e79ed3b478bde9048c007f9
MD5 5b813f85cd9fb0b75085cc1a5af8f929
SHA1 eb3670dd439cbbc6a8223e1d9e09e68c94e7060a
SHA512 11dd69fe6110c2e9568a93425c07b96faa6f9a1d1be8714e9de8ef41a0ed8173f5d5db17dc1ba0dce6f2857b402c7499c48b99eef2f900bfe22cc19af0aa1eaa
SSDEEP 192:HwFPtWghWayW1c31DSdVWQ4iWhF/4lXefqg7i1X01k9z3ADCyyBW1yKlF:QFFWghWZ3IdS/nR7i1R9zW3aW1yKlF
TLSH
T11CA24B91A6BC9003FE8AA93041EDE9673C3C57E70C10C0A65695FB5828A7351FB24B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 dd41abec22841140f58ee12b60f825d72bdb7b6c61765c4465c10dcb6072373e
MD5 f8f72fbc5f315ecba9dcd701c641c670
SHA1 c26dce69a0587252c16f293701d749180539cad4
SHA512 9f88da990332ac2442079be35ed220735cf6274983453ed3b74c10195d67a73053c3c3b7f7f93c17daff94497aedc5791264e3dbf3157ff99332a71317eadebf
SSDEEP 192:YMck1JzX9cKSI0WghW2WjKMaKVWQ4iWLINFPKBWX01k9z3AyAijn:dck1JzNcKSI0WghWGKW8KER9zA8n
TLSH
T13CA21AD685BCD283FC8E9C702294DA536C3A97C60D25847106E5F69D3DEB3C2E63462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 0203d7ebe58d19216f53812a8944044c663df83ad118fc3e308dfe8a694774fe
MD5 b7a16442965c65d7d75ff8e2b61c2f79
SHA1 e03e80eac8c6c1dfe47a909d3568768b4e71c4e9
SHA512 9e88bd48a54d461593b3d925c954bc93d49f960f21cd251906140deae72d8642e2ca0dc461b880f24cce96eb897e9e7d22ef02ef017f12044316a650964c9b11
SSDEEP 192:lJDfIeITWghWZyW1c31DSdVWQ4WWhiY/Yl6d3RX01k9z3AQKe1513E:lJDfIeUWghWI3IdRY/YlORR9zGe15JE
TLSH
T14AA229C28ABC9143FDAA5E7052A9DA533C3DA7CB1520902611E4F66C2DD33C1EB14A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-profile-l1-1-0.dll
Size 21KB
SHA256 c4f24e945d3cb6362ac6cc396b8d235f16308c80831770e2b8b72456330fb475
MD5 f6b675d664e24a1c112b3e9503ffe84a
SHA1 a04d9639bbacfc361cf4f35a0a6431a77d4409fe
SHA512 68be8b15d57fcfa4b4371298f7a2352673c954869d5b265d99182f4e1951a443d632e7e450a20aab7d4df6eff01b8f2aa043606603dc01ace9fb4d3094edb18d
SSDEEP 192:PWghWkWjKMaKVWQ4iWUzvpGX01k9z3A5ufero:PWghWsK3pGR9zgMJ
TLSH
T1E6A22986C67C9003FDABAD7042E8DD437C3D77C75A60906642E9F59818933D1EF20A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 21KB
SHA256 e93bcae3cce38e176e7cda2d3f83c04aee03288062fb2a111468ec2fbc641bbb
MD5 52646e14fa4165ebaefec3045aa1a454
SHA1 ae90394c90c5988e0b7455a14cdfb44b36d5612b
SHA512 ab74472609e3d4f52ad48b55229edcb2b77593b2a62dc619f5e33b818aac6607f7b6d6c5ad246b55e71926b47533f148e9c7a198560f4ab8a6480554ea6850dd
SSDEEP 192:LGeVUWghWLyW1c31DSdVWQ4iWhTYhlvpGX01k9z3A5XZ5YP:LGeVUWghW23Id3hJpGR9zgT2
TLSH
T1A3A2289A87AC8003FD9B6E7043A9CE977D3D6BC71A90903605D5F5881C833D4EB14A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-string-l1-1-0.dll
Size 21KB
SHA256 8eb1da72518c92b2250e16e5fcf221bcc3febdcb9294f6830f3034756d44aae9
MD5 be5bdba74967842cf93f9f3743f4e6c7
SHA1 69321ff56a28c38cb139cbecf65c31dae5dd75af
SHA512 2a124520201a12dcb02f0251aa03092503fb5768cb2e3a1ea24585b436112fd58a342c3400fc6628022d4367359a53e6ae145e5cc519ca500f6c0cc2203b9770
SSDEEP 192:88yMvrAWghW5yW1c31DSdVWQ4WWhYF81BHX01k9z3A+H+JY:88yMv0WghWo3IdNIBHR9zBeW
TLSH
T1A6A22A8296A8C106FD6A6E7043E9DB877C3D67C72910D1B152D8F9881C933D5EB24B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-synch-l1-1-0.dll
Size 21KB
SHA256 5f2c9c688fcba002f7dd0ffcb22b213402a3f18fa5cede2a0a6d960a614ab6f6
MD5 6f65079a34539427c7578769278f7f9e
SHA1 1c11247c916b160f677197ade12344e811dcef41
SHA512 7a493cd69de5274164515728dce13a9c6e67bb4a6fa46c5532cc00e7f1933337aeafe81c604a94e73190ef802f8a67f92252bdbb8f0f3ca4148a7ae9bee42824
SSDEEP 384:VYAuD/iwidv3V0dfpkXc0vVavkWghWf3IdB2R9zn7mPt:JHdv3VqpkXc0vVaWCEK9ziPt
TLSH
T145A2285696E4A287FC6FDC7042DACA833C382B874910D47215D9EA5D3DE33D1EB2462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-synch-l1-2-0.dll
Size 21KB
SHA256 7bd60aee2db91901c5804c6c69f9d877727bd8cddec30bcd047bc3afec5d8852
MD5 d9a8a89d917760865d76766eb737c4a7
SHA1 6fe438d4718762b039042d6d061a88b09ba8d265
SHA512 514e6450eaebf38879da0f83632700473f6a34ffe8e872e2549105d2c989764f57a9208aee77b1701206891c3e397d91fefbe7836e6240af5781c5f7c4e70218
SSDEEP 192:xtZ3HWghWHyW1c31DSdVWQ4iWhaUIgiZTOebR5X01k9z3AVm4ELZ:xtZ3HWghWS3IdT9bt5R9zcdW
TLSH
T19AA24BA796A89503FC5AAD7043E6D6837C3C2BCA1910956113E9F15C2CE33C1EB24F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-sysinfo-l1-1-0.dll
Size 21KB
SHA256 0eea540b635eadae0d4fd77d72438d8f49658bc6433253babf99fdf1fe3aec0a
MD5 7fd7dd402380cd5e57155acc86a494b4
SHA1 1eb69bac1e6ea06fa02d53f2023ab68768ec5142
SHA512 b92f3f0f7e3cb09b50a496f303e36a063a6ca51fa704c641a6f56e5f3fa8de5cdd6da5bedbcb06e6ec468c238f36cfb0fc3bb6b29d96f7ecfecef33b11a35ab1
SSDEEP 192:CgdKIMFcma0WghWvyW1c31DSdVWQ4WWhAE28Yl6d3RX01k9z3AQKe1ReoM:H970WghWK3IdOZYlORR9zGe1Ro
TLSH
T125A21AD39BB89203FC9A5E7052EAD6833C3867C65510C41902E5F75D2DE33CAEB2462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-sysinfo-l1-2-0.dll
Size 21KB
SHA256 f03792b75b79cd3ed91953c2960019e5b5d331dd5bad713b617cd3ec8d3150fb
MD5 c04a8cd941b3d85c19ed30d3f99b6c83
SHA1 d07029d9b05eb89c9e3b12215f64d5d7e811eb0d
SHA512 a88674e11fe827f2da8845b6f1255703cf8de80e6103cca70365efbc8c9e5298cc59e1ee534e0335693feac2127c1137531a7c6656ebef577f695f2f7b3d9418
SSDEEP 192:tQl0XWghWWyW1c31DSdVWQ4WWhcARHj9BtaFFX01k9z3AYps+VWx8BVdyRUAE:tEyWghWl3IdmRD9WR9zrpsqWiBVdOUN
TLSH
T1C9A22B8697BC8003FD6E6E7042A9D9837C3C67C71511D15512A9F5AD2CA3385FB24A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-timezone-l1-1-0.dll
Size 21KB
SHA256 ef80d454da25256a4c5af5322ced313867576978e8201ec0946eac21d44fe637
MD5 c0246065b2a0ae2d49b2907aef284db8
SHA1 5dfdce8c77dee9755a67d25c1b58583333a93475
SHA512 299e54b4c6a9ab8d29de7310e9023f74e6fde748b30cd7476f8d8ed77a2d8867c46fc3252665f02807df92f774c67fbfdbd56e7969a780ff25d57bbf8566ef78
SSDEEP 192:TPWghW4WjKMaKVWQ4iW4zhnvM30LRLLX01k9z3Awd8ZU:TPWghW4KvkELRPR9zVd8ZU
TLSH
T11AA219E7D7688043FCEF6B7007E8D9937D386BD60950D0A615E7E5482897385EB20A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-util-l1-1-0.dll
Size 21KB
SHA256 910f94a276ac11a8f2721a5bdaf25c2089d2c5fa83fa593b05dbb0f5b00b6d27
MD5 e83f4522a2615040f6ad48c70625709a
SHA1 6a5624443a7e49cc3aff9dc4ef5bd254cf6657a7
SHA512 c9d722278442cf42de08e8d4de507a5faae579611c0f11390d42cd2712a26dd296b97343f732ee8f7587f58aa87d143fac6e653a0d96a14bcd3f0cc0ff9908ae
SSDEEP 192:/WghWmWjKMaKVWQ4WWpaExj9BtaFFX01k9z3AYps+VWx0DEr:/WghWWKaaS9WR9zrpsqW/
TLSH
T1A1A22BC795BCC042FC5EAD7042A8DE433C3D67C6155090A966E9F5982CA33D1EB24B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-conio-l1-1-0.dll
Size 21KB
SHA256 d306cb07db31e3d74d2c79891e8c861feaa13e8dfa5d1ce042cd777ea1566b0a
MD5 df9d231a3bda292efdc625f2729eb36a
SHA1 86a57f67d8398d0aa0b1b4f3e8fc190887009143
SHA512 675d819b367cd5fb4739883f350468a078048f97443ea79a34535237f80f8ddc2fc02d69473fae8df0e5dc18b196c491fd59939fca808741aa2dfd05a44fb6ea
SSDEEP 192:bh1UWghWWyW1c31DSdVWQ4iWhSetvgiZTOebR5X01k9z3AVm4W/iMIF:bcWghWl3Idbi9bt5R9zcdWvIF
TLSH
T1B3A2074366FC5907E94B9B30A2F9EBC37D392BCB2A5060664295F4582CC73D9BF1062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-convert-l1-1-0.dll
Size 25KB
SHA256 81f4b3cd11611aeaa94171ebc1079e501ec247e8da6c113e6c81a3877acca15d
MD5 10586394ea9480d896dc90cb41fbb349
SHA1 b7572485a312ba7a228d0a3c1ad118a6187f88e6
SHA512 45824a49a13bec16961ff56a402b5cbbbfda4639a15fb48061f86d16995fa49ff7901e9e339a873135822756a7a1b7a69b2f0499e4568cb334bcac04a425a3ec
SSDEEP 192:f9cypWghWayW1c31DSdVWQ4WWhtWXYz1X01k9z3AfSOpT+:CypWghWZ3IdZoJR9zka
TLSH
T137C2C65766E42F12EA9F177221FED7E62A341B82169053B4C243E54C3882792BDA7C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-environment-l1-1-0.dll
Size 21KB
SHA256 1884872dbbe89023100d7f15e7b3a3eac16c3c8e3c103016c87c223bdc60ba7a
MD5 4b2639aa215141a968dddefb30e5e21d
SHA1 10680e48e128b348bcf22ec87de68acb36749def
SHA512 5c66fa31a7959581cb7967a33627de42c88e919ce6ac2ab56b74e8cc81c9e082fd407cdd08fd235f5c29cffd15b4fa07531e0f8456925b8293de39b713a1c3d8
SSDEEP 192:mEIWghW9WjKMaKVWQ4WWi81BHX01k9z3A+H8GPihd/:2WghWNKDIBHR9zB5Pid/
TLSH
T135A23A8646BC9103F99A6D3042F8DB873C3D67C61D0090B696A9F94828D3395BB31A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-filesystem-l1-1-0.dll
Size 21KB
SHA256 54545d0571542469e80141d18e1af3c5185f6ce849478f1bd829f53703a92ae1
MD5 2708aaf92c87e569b312556e51fb11f8
SHA1 a2980aceeeee25f462a0b440da16a17ab719cbfc
SHA512 17766eb2f94e914e655439a0f596fc165fd7c5195f0682fdfefbfee8b4ac50540701c2bb91f55ffb334c6e10a799cc4689f8eefd3b33f23c783414ffd1f92eda
SSDEEP 192:IDEpnWlC0i5CxWghWmWjKMaKVWQ4iWzSINFPKBWX01k9z3AyA/Bb+9J0h:ZnWm5CxWghWWKQS8KER9zAg9J0h
TLSH
T1E2A2188756D86E13EDAB1F7202FCCBD73E3D2BC6094285A2D196E45839D33807F2195A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-heap-l1-1-0.dll
Size 21KB
SHA256 0d69f5d5720655dd15172949e379dce5dc364e1920f6fcab8f809aed7ed2ce9c
MD5 011cf908bfb96ebe4f6dae19820b1c9f
SHA1 266511422f8d52a6fee8d40c7e9436ce2bebbde8
SHA512 c299cdd3bfc892f8348b811d2c25a6d9d74b42b4d3f5eace7c947ea3c5a34f1aab786d9b7a041aa97a6c0e03117540378c9ada51118912194ef17ac52274c0f9
SSDEEP 192:pJh8Y17aFBR0WghWoyW1c31DSdVWQ4OWhTYyttuX01k9z3A8:3LpWghWz3Id4SR9zz
TLSH
T12FA229C24AF85543E9AB6F7057F8EB873D39A7C26D0094678186F8982C833C1FB2161D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-locale-l1-1-0.dll
Size 21KB
SHA256 7d49900ca3815f1737b10e0c7e603dde326053d56e89139c41eae3d27dec7d8b
MD5 b86b2d5160adc92730398286e29f6a39
SHA1 a882980356e9d6f65d83ccb0ca95bd26c66bd1ae
SHA512 32c94f96eaeaa951796e835a226bc46106e4027fae8516e280c213ecbfce74eda8d8a316b4187bbb5acaa993e581446ac8a6cc282fb8d1641a12610ce78f8c46
SSDEEP 192:h3WghWiyyW1c31DSdVWQ4WWh28NunZMiuyCksX01k9z3An+/Nj:FWghWih3IdyNviCksR9zI+Fj
TLSH
T14EA23A8687A85543F9969EB082FCDBC77C3927C6160184765286F99C2C833DCFB14A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-math-l1-1-0.dll
Size 29KB
SHA256 a991ecd3b528f586274c638cdfa196454f2bccca70692652867bf224f7cc6258
MD5 41f4e348b750a18e8599a756021f947a
SHA1 a9d0904404f1f8454cee19551e0e20afe04287e8
SHA512 97008e9bc24eded6fc0393b4582817a20d9aedf278b857c17eea7ede46f5d282fc3a931a5b64a4ce14d2dd912b8171a8dfa90e37cf76f2106890aee17eddd768
SSDEEP 384:B7yaFM4Oe59Ckb1hgmL1WghW/nK8pGR9zgi:lFMq59Bb1j5YY9z5
TLSH
T176D2D44B59ECFF53D58F4BB701F48BCE69381AE250D1B5B4C94BA08834627C4BE53A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-private-l1-1-0.dll
Size 73KB
SHA256 b481e525346526ceccac17603eb7d10b565201735e94e76aa0333bca230fa723
MD5 deb7d19586f915a546b5417826138e7a
SHA1 9aecf78e4a64d497852cc61b55c9c4e7738e7de5
SHA512 73d467d74b79326085f4ddfc991cc698299ad87fde969aca939d4e549d5a3ecc08c3fe398bbb4cf0234f7f5d7a2831b55f416296523907c1ede74bfaf9798cb0
SSDEEP 1536:5fQTZqDe5c4bFe2JyhcvxXWpD7d3334BkZnjPTAVzzoj:OZqDe5c4bFe2JyhcvxXWpD7d3334BkZl
TLSH
T1C673F6DB49E63F21E58FF3B76BFB17C90B253A4408806274EAC7556B34853A9BC53A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-process-l1-1-0.dll
Size 21KB
SHA256 95a4f71991dc98393a69a56c3562f38882a9842daeb7f905e49d9b40a1ea5e38
MD5 33ba276fb5f1d0308219577600106293
SHA1 1e5cc4034695bcbecce085a911389592c12d4535
SHA512 d7045a8ee9e2c313678d055a1ce190c2b8800e9d7bccf273bbe260695a157947084a3268065f108d9625b85e1dec70b82f5fdf67263bd585e6504ee7e0edb610
SSDEEP 192:0eXrqjd7JWghWJKWjKMaKVWQ4iWnlMlXefqg7i1X01k9z3ADCyyBj1HjvzV:04roWghWJiKIlbR7i1R9zW3aj1HLR
TLSH
T18EA2298B9BF85943EA7B9E3041F8CB837E3B57C25900917ACAA6F44C2453345AB3165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-runtime-l1-1-0.dll
Size 25KB
SHA256 09b320d575b456b1199e4e2b09d34d4200fb8146b297ca78d06d80e9158a45e0
MD5 7307d9479d874ec7df299f497c0b03f3
SHA1 ade7ffa3482e68127d1d8494e11337088a0616e4
SHA512 f945ac79a99c72e4a26461e19aba66adbfc31b60a26b6d9338f6667a3795bafb4941a7b446a67a433308254fb112242886be34dea466c639bf5dcbc075a88d4f
SSDEEP 192:QmGqX8mPrpJhhf4AN5/KilWghWwyW1c31DSdVWQ4WWhiqDtagQ5X01k9z3AJwTnX:Qysyr7bWghWL3IdKDtdQ5R9zVTILO
TLSH
T1F7C208438AE87F07E98B2B3342F9C7C71E3623862A509576D597F48C35C2785BD2621E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-stdio-l1-1-0.dll
Size 25KB
SHA256 4e72f645f47abae98427b4ce8c510f96112c16e640721ce3f82d3619eb3961a8
MD5 a3ac58404a0ceed624f9a18d0a65852b
SHA1 c77396fc5c699c2fd22e586e28a99e2cacbf0bed
SHA512 73663e1f7af32b806189a8b3feac672344cbc2cd383f26eb59d911f03491a8e3aa3c2c14801e6bc99888d1b45fa171e2dac574c6c901ff37d16cfd674db4d7a9
SSDEEP 192:V7V2OlkuWYFxEpahvWghWIcyW1c31DSdVWQ46WhAnQH81BHX01k9z3A+HB36:xV2oFVhvWghWQ3IdcIBHR9zBk
TLSH
T180C2D68795EC7F02E68B87331AFAEBDA1B315783280071B9D147E88436C63997E1715E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-string-l1-1-0.dll
Size 25KB
SHA256 265c87b9a63420de788ba7855e847b4eb794c4256080eeacf64b81e70af889cd
MD5 38f92437d012a0f6ad6e435dfaed6cea
SHA1 b361369f57086675d5481a93dfde65c971aafa13
SHA512 36f71ebcefba9a762c0773c89f2dc674cc7d5ecfd6156f882e646554a68cc6a6ebf8d28554b66fa8f7b57ab6be29b06a42cfddbb7847bbc42bb7de09851a79a3
SSDEEP 768:oCV5yguNvZ5VQgx3SbwA71IkF8RX8R9zHv:T5yguNvZ5VQgx3SbwA71IzR8zP
TLSH
T11DC2D64746F83F06D98F07B355FACBC72A344F56254153B5D1A3A48C38827A6BE27A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-time-l1-1-0.dll
Size 21KB
SHA256 ac90c44b194135bf555ac7df2405d443da87e1374e5b5bb408a2761a9bc63e3d
MD5 d709d32a2744df53af5fb8a50c85a32f
SHA1 a326f3ce8542f65e58b1c154af9bc5ba232a26fb
SHA512 ca973ab3d503bd818448fa874ba9640299e0d0d7b8b2e82a801ab39d961c22f9bff4def1eaff4d7fc5052af27a1fbfa6d52706311e21da37f8a8df3db2838bdd
SSDEEP 192:G5hwDuWghWryW1c31DSdVWQ4KWhmwY00pyEuX01k9z3ACNWwIbh:AWghWW3Id1wEpcR9zPMfh
TLSH
T177A2E7434AE8AA07FEDB1B7152F9CBDB3F3417C216C071768656A8583A93380FE2651D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-crt-utility-l1-1-0.dll
Size 21KB
SHA256 3fc3564e2276e8149856e74f59f594549d017a3a967ea66450e1c04af8768bc8
MD5 cc741d481aea80559546da3464b01ce0
SHA1 a8dbc99d525b71ca53860991fba3fe10f67343de
SHA512 600afbc7ff488291ff06c677dfba3db96d65b43d1c3f834e94bf1de225a940f8c8049cedb082d665758f22aacf2808d2915c18793bf11fd0d17cdff8150880e3
SSDEEP 192:B/fHQdujWghW8yW1c31DSdVWQ4iWhCmyM1D+INFPKBWX01k9z3AyAA9jOx:B/fNWghW33Id+N1a8KER9zAdx
TLSH
T16BA219974AA89603E9AB6F7143F8D7C37C386B86191095B241E6F98C2C53784FF3161E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\base_library.zip
Size 1.3MB
SHA256 58ada9953906840960d393092dcde3dfa03bc44ba1fd4d060a9a669788abedfa
MD5 861d2ca9ee4b94d069221fa72cea1e54
SHA1 e7eb76ccc5fa74646c8180a60498763c35abb056
SHA512 a7b58bc909ac2e5fca7cefb9cbe120590a25d82014c5b5f57473360a499d09cb27d0792ad6c2805f159adeed71d2ea475f5eda457b9be92b02d9ef51b1ee21c3
SSDEEP 12288:btYzGNcT17i2cPPdxhYRqij8/djdTkRWwW7WpTwtZyCMWftL+DRfqhTQL69uOBaM:WSeT175cPPdxhYO/dZv7WpTDqhz/F
TLSH
T14A550992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\python3.dll
Size 70KB
SHA256 85d02d4c7e28c0f183415dc2be5fe8e06aa7fa0567673c75c65c0031f59e1e8b
MD5 c947a886e61ad18d052840e095aaa5fc
SHA1 4a2d0092e50757e0b951565c02dd541ab48da96e
SHA512 d4b3d769fa4c22e914e12ac8b63263bacda72b351bea5bd53ba1d0fd6a6c57c98fc392645170f26e7c84fdf855fbe587615f4f3b1f150285420f5b26bda2da0a
SSDEEP 1536:LotssyKcunV8PT5Iyy00yrcz89YfIZRSjB:MtssyKQ5Iyy0AcZoB
TLSH
T120634CC25B5BF8A2D6F665FC78DDD9CD242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\ucrtbase.dll
Size 1.3MB
SHA256 3088326cb0fe5b5646e02c7b2de71ae363fcd26a0000cf32209c8bed05a7a866
MD5 04e1eb90abb78c5fa6b440a6f17ddddb
SHA1 aef1c0b9fdf7aaa115e3c0a285c8ca8603f3852d
SHA512 d9ba76a2bec20eba80481ecdb5616061a45f689d41cfdd8957287675a30a60ca3e997589d4312aba7c148735477a0b432f42fe7f7b8d2f7c2cb1d3aea8f56d86
SSDEEP 24576:LQPuhXyFmugCw3wUAceM0Xps3pRzgTuJ6b1yats799SmxvSZX0ypKpoPn:LQWhXyFm7Cw3w3ccXpezaM9tp0
TLSH
T1D155AE2266AD01E9C5BFD13DC65B4506E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vns0iwts.mii.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vns0iwts.mii.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/444-1207-0x000002CA893E0000-0x000002CA89489000-memory.dmp

Download

memory/636-1203-0x000001DBCD910000-0x000001DBCD9B9000-memory.dmp

Download

memory/1464-1208-0x000002AFDAF50000-0x000002AFDAFF9000-memory.dmp

Download

memory/1876-1226-0x00000283CCB00000-0x00000283CCBA9000-memory.dmp

Download

memory/2400-1209-0x0000025162350000-0x00000251623F9000-memory.dmp

Download

memory/2572-1202-0x000002DB043D0000-0x000002DB04479000-memory.dmp

Download

memory/3504-1222-0x000001B4A76D0000-0x000001B4A7779000-memory.dmp

Download

memory/3708-1206-0x000002BD372A0000-0x000002BD37349000-memory.dmp

Download

memory/3876-1211-0x00000233CD050000-0x00000233CD072000-memory.dmp

Download

memory/3876-1219-0x00000233CD550000-0x00000233CD594000-memory.dmp

Download

memory/3876-1220-0x00000233CD620000-0x00000233CD696000-memory.dmp

Download

memory/3876-1223-0x00000233B4C20000-0x00000233B4C2C000-memory.dmp

Download

memory/3876-1224-0x00000233B4D70000-0x00000233B4E19000-memory.dmp

Download

memory/4656-1204-0x000001AF04C50000-0x000001AF04CF9000-memory.dmp

Download

memory/4844-1205-0x000001BB81A10000-0x000001BB81AB9000-memory.dmp

Download

memory/4972-1210-0x0000022181420000-0x00000221814C9000-memory.dmp

Download