6e18f850d03ad79347d961f4a54ac5592666e32ec4f6d4c0ed37b4b229e609de

Analysis

max time kernel
150s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LoonaWare.exe
Size 35.2MB
Sample260511-mthf8aaz6m
SHA256 6e18f850d03ad79347d961f4a54ac5592666e32ec4f6d4c0ed37b4b229e609de
MD5 33190c43241a86922badd7d2953df9ea
SHA1 5ae9f76bdfb562c69aecd8e966fb403d6bcf5af2
SHA512 20a36da9e73cd348adc64357822df7023713119c8f51e31a62a59447f23057630358545abf97bec00d3caec6d49470b9c2d80cf7cf01fa62f816b32a3e8f5a23
SSDEEP 786432:hXuKzAW8CyVmdGLLsKMMo5ovsVuRp8hNffIR4gRcqcF13usOd9GsjNu0:h7zAWvyVQpoeOyYc3u5T
TLSH
T1A787338076D90499F14A4335E4E3EB528AC7B022473BD4CB1BF8A6861E736E5FD75B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Loads dropped DLL 23 IoCs

pid	Process
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe
5904	LoonaWare.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	ip-api.com
2	api.ipify.org

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
3184	tasklist.exe
2880	tasklist.exe
5572	tasklist.exe
4716	tasklist.exe
3328	tasklist.exe
3828	tasklist.exe
4752	tasklist.exe
5796	tasklist.exe
1160	tasklist.exe
4456	tasklist.exe
4224	tasklist.exe
5668	tasklist.exe
4328	tasklist.exe
5764	tasklist.exe
1840	tasklist.exe
2464	tasklist.exe
5024	tasklist.exe
5668	tasklist.exe
1052	tasklist.exe
2188	tasklist.exe
5592	tasklist.exe
3660	tasklist.exe
2428	tasklist.exe
4692	tasklist.exe
4844	tasklist.exe
2128	tasklist.exe
2780	tasklist.exe
2360	tasklist.exe
2488	tasklist.exe
3892	tasklist.exe
3932	tasklist.exe
5944	tasklist.exe
3180	tasklist.exe
5492	tasklist.exe
3172	tasklist.exe
2236	tasklist.exe
1824	tasklist.exe
2412	tasklist.exe
5408	tasklist.exe
3916	tasklist.exe
2096	tasklist.exe
3240	tasklist.exe
3788	tasklist.exe
1784	tasklist.exe
5064	tasklist.exe
2244	tasklist.exe
4380	tasklist.exe
3880	tasklist.exe
2924	tasklist.exe
2852	tasklist.exe
4468	tasklist.exe
6032	tasklist.exe
5516	tasklist.exe
3804	tasklist.exe
2292	tasklist.exe
1048	tasklist.exe
4336	tasklist.exe
1224	tasklist.exe
1148	tasklist.exe
1092	tasklist.exe
2464	tasklist.exe
1748	tasklist.exe
3076	tasklist.exe
4604	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\loona_wallpaper.bmp"	LoonaWare.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4236	powershell.exe
1644	powershell.exe
3968	powershell.exe
2240	powershell.exe
5828	powershell.exe
4732	powershell.exe
1472	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 5 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2944	cmd.exe
5848	cmd.exe
4236	powershell.exe
740	netsh.exe
3876	netsh.exe

System Owner/User Discovery 1 TTPs 2 IoCs

Attempt to identify the primary or current user.

discovery

System Owner/User Discovery

T1033

pid	Process
2504	cmd.exe
3968	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3288	WMIC.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
272	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2108	systeminfo.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Control Panel\Desktop\WallpaperStyle = "10"	LoonaWare.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Control Panel\Desktop\TileWallpaper = "0"	LoonaWare.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4732	powershell.exe
4732	powershell.exe
1472	powershell.exe
1472	powershell.exe
4236	powershell.exe
4236	powershell.exe
1644	powershell.exe
3968	powershell.exe
1644	powershell.exe
3968	powershell.exe
2240	powershell.exe
2240	powershell.exe
3084	tasklist.exe
3084	tasklist.exe
2240	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3084	tasklist.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeIncreaseQuotaPrivilege	3328	WMIC.exe
Token: SeSecurityPrivilege	3328	WMIC.exe
Token: SeTakeOwnershipPrivilege	3328	WMIC.exe
Token: SeLoadDriverPrivilege	3328	WMIC.exe
Token: SeSystemProfilePrivilege	3328	WMIC.exe
Token: SeSystemtimePrivilege	3328	WMIC.exe
Token: SeProfSingleProcessPrivilege	3328	WMIC.exe
Token: SeIncBasePriorityPrivilege	3328	WMIC.exe
Token: SeCreatePagefilePrivilege	3328	WMIC.exe
Token: SeBackupPrivilege	3328	WMIC.exe
Token: SeRestorePrivilege	3328	WMIC.exe
Token: SeShutdownPrivilege	3328	WMIC.exe
Token: SeDebugPrivilege	3328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3328	WMIC.exe
Token: SeRemoteShutdownPrivilege	3328	WMIC.exe
Token: SeUndockPrivilege	3328	WMIC.exe
Token: SeManageVolumePrivilege	3328	WMIC.exe
Token: 33	3328	WMIC.exe
Token: 34	3328	WMIC.exe
Token: 35	3328	WMIC.exe
Token: 36	3328	WMIC.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeDebugPrivilege	2924	whoami.exe
Token: SeIncreaseQuotaPrivilege	3328	WMIC.exe
Token: SeSecurityPrivilege	3328	WMIC.exe
Token: SeTakeOwnershipPrivilege	3328	WMIC.exe
Token: SeLoadDriverPrivilege	3328	WMIC.exe
Token: SeSystemProfilePrivilege	3328	WMIC.exe
Token: SeSystemtimePrivilege	3328	WMIC.exe
Token: SeProfSingleProcessPrivilege	3328	WMIC.exe
Token: SeIncBasePriorityPrivilege	3328	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 5904	5872	LoonaWare.exe	79
PID 5904 wrote to memory of 2944	5904	LoonaWare.exe	80
PID 2944 wrote to memory of 3876	2944	cmd.exe	82
PID 5904 wrote to memory of 3448	5904	LoonaWare.exe	83
PID 3448 wrote to memory of 4732	3448	cmd.exe	85
PID 5904 wrote to memory of 720	5904	LoonaWare.exe	86
PID 720 wrote to memory of 1472	720	cmd.exe	88
PID 4732 wrote to memory of 2108	4732	powershell.exe	89
PID 5904 wrote to memory of 5848	5904	LoonaWare.exe	90
PID 5848 wrote to memory of 4236	5848	cmd.exe	93
PID 1472 wrote to memory of 272	1472	powershell.exe	94
PID 5904 wrote to memory of 232	5904	LoonaWare.exe	95
PID 232 wrote to memory of 1644	232	cmd.exe	97
PID 5904 wrote to memory of 2504	5904	LoonaWare.exe	98
PID 2504 wrote to memory of 3968	2504	cmd.exe	100
PID 4236 wrote to memory of 740	4236	powershell.exe	101
PID 5904 wrote to memory of 2952	5904	LoonaWare.exe	102
PID 2952 wrote to memory of 2240	2952	cmd.exe	104
PID 1644 wrote to memory of 3084	1644	powershell.exe	105
PID 5904 wrote to memory of 5612	5904	LoonaWare.exe	106
PID 5612 wrote to memory of 5828	5612	cmd.exe	108
PID 3968 wrote to memory of 2924	3968	powershell.exe	109
PID 2240 wrote to memory of 3328	2240	powershell.exe	111
PID 5828 wrote to memory of 2232	5828	powershell.exe	112
PID 5904 wrote to memory of 4532	5904	LoonaWare.exe	113
PID 4532 wrote to memory of 2608	4532	cmd.exe	115
PID 5904 wrote to memory of 5212	5904	LoonaWare.exe	116
PID 5212 wrote to memory of 5588	5212	cmd.exe	118
PID 5904 wrote to memory of 2440	5904	LoonaWare.exe	119
PID 2440 wrote to memory of 3680	2440	cmd.exe	121
PID 5904 wrote to memory of 1832	5904	LoonaWare.exe	122
PID 1832 wrote to memory of 2188	1832	cmd.exe	124
PID 5904 wrote to memory of 1548	5904	LoonaWare.exe	125
PID 1548 wrote to memory of 2384	1548	cmd.exe	127
PID 5904 wrote to memory of 1640	5904	LoonaWare.exe	128
PID 1640 wrote to memory of 5668	1640	cmd.exe	130
PID 5904 wrote to memory of 5520	5904	LoonaWare.exe	131
PID 5520 wrote to memory of 388	5520	cmd.exe	133
PID 5904 wrote to memory of 5076	5904	LoonaWare.exe	134
PID 5076 wrote to memory of 3172	5076	cmd.exe	136
PID 5904 wrote to memory of 1656	5904	LoonaWare.exe	137
PID 1656 wrote to memory of 1748	1656	cmd.exe	139
PID 5904 wrote to memory of 2252	5904	LoonaWare.exe	140
PID 2252 wrote to memory of 3076	2252	cmd.exe	142
PID 5904 wrote to memory of 5220	5904	LoonaWare.exe	143
PID 5220 wrote to memory of 2360	5220	cmd.exe	145
PID 5904 wrote to memory of 2528	5904	LoonaWare.exe	146
PID 2528 wrote to memory of 4280	2528	cmd.exe	148
PID 5904 wrote to memory of 5864	5904	LoonaWare.exe	149
PID 5864 wrote to memory of 3316	5864	cmd.exe	151
PID 5904 wrote to memory of 5292	5904	LoonaWare.exe	152
PID 5292 wrote to memory of 1432	5292	cmd.exe	154
PID 5904 wrote to memory of 1440	5904	LoonaWare.exe	155
PID 1440 wrote to memory of 2464	1440	cmd.exe	157
PID 5904 wrote to memory of 1444	5904	LoonaWare.exe	158
PID 1444 wrote to memory of 608	1444	cmd.exe	160
PID 5904 wrote to memory of 5032	5904	LoonaWare.exe	161
PID 5032 wrote to memory of 1824	5032	cmd.exe	163
PID 5904 wrote to memory of 5752	5904	LoonaWare.exe	164
PID 5752 wrote to memory of 4604	5752	cmd.exe	166
PID 5904 wrote to memory of 2820	5904	LoonaWare.exe	167
PID 2820 wrote to memory of 3240	2820	cmd.exe	169
PID 5904 wrote to memory of 2112	5904	LoonaWare.exe	170
PID 2112 wrote to memory of 3184	2112	cmd.exe	172

C:\Users\Admin\AppData\Local\Temp\LoonaWare.exe
"C:\Users\Admin\AppData\Local\Temp\LoonaWare.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Users\Admin\AppData\Local\Temp\LoonaWare.exe
  "C:\Users\Admin\AppData\Local\Temp\LoonaWare.exe"
  2⤵
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "systeminfo > "C:\Users\Admin\AppData\Local\Temp\lw_sysinfo.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "systeminfo > "C:\Users\Admin\AppData\Local\Temp\lw_sysinfo.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4732
    - - C:\Windows\system32\systeminfo.exe
        
        "C:\Windows\system32\systeminfo.exe"
        5⤵
        Gathers system information
        
        PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\lw_ipconfig.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\lw_ipconfig.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /all
        5⤵
        Gathers network information
        
        PID:272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\lw_wifi_profiles.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\lw_wifi_profiles.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "tasklist /V > "C:\Users\Admin\AppData\Local\Temp\lw_tasks.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "tasklist /V > "C:\Users\Admin\AppData\Local\Temp\lw_tasks.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Windows\system32\tasklist.exe
        
        "C:\Windows\system32\tasklist.exe" /V
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "whoami /all > "C:\Users\Admin\AppData\Local\Temp\lw_whoami.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - System Owner/User Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "whoami /all > "C:\Users\Admin\AppData\Local\Temp\lw_whoami.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Owner/User Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe" /all
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "wmic cpu get name /value > "C:\Users\Admin\AppData\Local\Temp\lw_cpu.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "wmic cpu get name /value > "C:\Users\Admin\AppData\Local\Temp\lw_cpu.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2240
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" cpu get name /value
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "wmic memorychip get capacity /value > "C:\Users\Admin\AppData\Local\Temp\lw_ram.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "wmic memorychip get capacity /value > "C:\Users\Admin\AppData\Local\Temp\lw_ram.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5828
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" memorychip get capacity /value
        5⤵
        
        PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5212
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5520
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5292
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4860
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5512
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5308
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3924
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4600
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4588
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_videocontroller get name /value"
    3⤵
    PID:3380
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name /value
      4⤵
      Detects videocard installed
      PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2608
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
    3⤵
    PID:3860
  - - C:\Windows\system32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4296
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5236
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5088
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3704
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5508
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2996
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2068
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5316
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5600
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:568
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1380
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2644
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2036
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1156
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:956
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5132
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:6016
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5732
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3852
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4852
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4356
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4440
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4208
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5040
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2628
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4232
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5116
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1244
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2188
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5960
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1492
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1412
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:6056
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3936
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1528
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5440
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5524
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:272
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1452
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3016
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:756
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:740
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3948
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3888
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:944
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3900
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5348
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1584
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5328
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4776
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5224
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1604
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5108
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5736
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3976
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5060
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3708
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5340
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:6036
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1676
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4568
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4280
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2104
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4736
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:556
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5968
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:6136
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2552
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5992
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1424
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4740
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1136
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3608
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5104
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5020
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2556
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5372
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:484
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:6032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5808
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4152
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4808
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5484
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:788
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4304
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4380
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3172
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2360
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4344
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4744
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3580
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1732
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4192
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Owner/User Discovery

T1033

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
TLSH
T11B117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\81d243bd2c585b0f4821__mypyc.cp310-win_amd64.pyd
Size 211KB
SHA256 5b80e8963c54771f2d923eb0469a7a293cabf172bdcff8ef2f28804948c4ec8c
MD5 b0e271fd313010344c828ebbddf45235
SHA1 d1d820b006f4dfe0d30d5368c15331174e666fca
SHA512 a4ea7dbd92957a64d3a48bcc597acf6a8331c4ee269cb6d9cb55d0dfeeac5b6cd07411ff7b7f9db0ea65d6fc00c76ebb32004367d0f4f3c2895a35d4a59bb24a
SSDEEP 6144:q/Q8nHRnSJNmWW+hYxkP8VXaVHaT8fyFmiGJZMzwjAToZK+:q/fRm8R
TLSH
T1A424293A52480060ED7752798C639613E5B3F6620B3156CF09E0C6751F17BEAB7BEB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\PIL\_imaging.cp310-win_amd64.pyd
Size 2.5MB
SHA256 63909e2f10cff5f511a1c4fe62a6fe6ac293b5fb32af426ca30e631e9faaba3a
MD5 28ef74a24fc52b0574faf4d3bf4d836c
SHA1 9c2fab01314f6a4dda2de0a3087c255830b5fe23
SHA512 2b9d6651f4bd907594bc1993f9e859d2ced8438a899bb06af387750263c0a35c0b09bc2260e8ac203e42da9980f286fc813462f07a7d7a98047d3ec18db82f47
SSDEEP 49152:m4Tiv8VatRqUgQT/V4yd5cvi8/VkidCfHdwzBPd1e:+uJvMidCliBl
TLSH
T140C56C46E9D19499C6B28034CDA6C216E3B1B80D17F187F77684A7F93E23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
TLSH
T1E0A37D4A77A542BBC06ED274C1A39906F7B0B840877063CF07B5466A5F23BE19E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\VCRUNTIME140_1.dll
Size 37KB
SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
MD5 75e78e4bf561031d39f86143753400ff
SHA1 324c2a99e39f8992459495182677e91656a05206
SHA512 ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
SSDEEP 768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
TLSH
T1C9034B9463B88085E1AB82B0C4935F17BE7DF9654B50538F0BA1C15D2F63BD0BA3D32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_asyncio.pyd
Size 62KB
SHA256 3b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010
MD5 6eb3c9fc8c216cea8981b12fd41fbdcd
SHA1 5f3787051f20514bb9e34f9d537d78c06e7a43e6
SHA512 2027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b
SSDEEP 1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
TLSH
T15E537C87D2908198D8A7A1B8D8730F46E771F5944B00478E6168D28D3F733528BFFBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_bz2.pyd
Size 81KB
SHA256 f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
MD5 a4b636201605067b676cc43784ae5570
SHA1 e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA512 02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
SSDEEP 1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
TLSH
T1CC839E93F6A456B9E41BA27A95B14353D330FE49039093EFF684831B2F03B917C6935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_ctypes.pyd
Size 119KB
SHA256 92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
MD5 87596db63925dbfe4d5f0f36394d7ab0
SHA1 ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA512 e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
SSDEEP 3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
TLSH
T13DC36B1B2354109AEA678078C5B35E07DB71F8595B2083CF0294C6AE2F63BE35E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_decimal.pyd
Size 244KB
SHA256 6314c99a3efa15307e7bdbe18c0b49bc841c734f42923a0b44aab42ed7d4a62d
MD5 10f7b96c666f332ec512edade873eecb
SHA1 4f511c030d4517552979105a8bb8cccf3a56fcea
SHA512 cfe5538e3becbc3aa5540c627af7bf13ad8f5c160b581a304d1510e0cb2876d49801df76916dcda6b7e0654ce145bb66d6e31bd6174524ae681d5f2b49088419
SSDEEP 6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
TLSH
T179346C1AA2490DA4DE778074D89B9B53F7B178844360C3CF43A48AA67F577A323BD784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_elementtree.pyd
Size 124KB
SHA256 940d360744414399037257431492853565b17f83d7d7d25fb0209ef6f7c260c2
MD5 b9537ebd7efc39c77f0505d9ffb84cdd
SHA1 a7c977acf0185cfb1bbe38136e97699f0a54af40
SHA512 4efe42206b17061b0f2e6249e2668b7017ca9af54457931839db59a4a752b053de08884f7b13c6637ff9736c57193c3c8a5ab0cee28b52aa64a58972d9d5aeb2
SSDEEP 3072:uWyaXDrPxv8RwXQYk2wHC4YkTQNl4I/0O/0t/0S/0rRvnT24ZhIS1fSMg:1nPxv8SZk2wbnQQItWleT24Z8
TLSH
T1ACC34A5B62A5C0AFE462007C92A74F46D7B2FCA00E4187CF6294F6AD5F337923E69315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_hashlib.pyd
Size 60KB
SHA256 1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430
MD5 49ce7a28e1c0eb65a9a583a6ba44fa3b
SHA1 dcfbee380e7d6c88128a807f381a831b6a752f10
SHA512 cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9
SSDEEP 768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
TLSH
T131537E05A69440B9C96742B8CAD31F5BEAF1F0405751ABEF0358C1CE1F237C396BA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_lzma.pyd
Size 154KB
SHA256 80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
MD5 b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA1 4efe3f21be36095673d949cceac928e11522b29c
SHA512 e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
SSDEEP 3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
TLSH
T1FFF33982A394F4E5F7628C78DA624F13D7F678490310929A12CCD36E2B1FB755A2E713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_multiprocessing.pyd
Size 32KB
SHA256 be8269c83666eaa342788e62085a3db28f81512d2cfa6156bf137b13ebebe9e0
MD5 71ac323c9f6e8a174f1b308b8c036e88
SHA1 0521df96b0d622544638c1903d32b1aff1f186b0
SHA512 014d73846f06e9608525a4b737b7fccbe2123d0e8eb17301244b9c1829498328f7bc839cc45a1563cf066668ea6e0c4e3a5a0821ab05c999a97c20aa669e9eda
SSDEEP 768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
TLSH
T157E26D43DA94189EE437C575D4D35F19E931F696075083DF2328C25E0F323826BAA79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_overlapped.pyd
Size 47KB
SHA256 0606a0c5c4ab46c4a25ded5a2772e672016cac574503681841800f9059af21c4
MD5 7e6bd435c918e7c34336c7434404eedf
SHA1 f3a749ad1d7513ec41066ab143f97fa4d07559e1
SHA512 c8bf4b1ec6c8fa09c299a8418ee38cdccb04afa3a3c2e6d92625dbc2de41f81dd0df200fd37fcc41909c2851ac5ca936af632307115b9ac31ec020d9ed63f157
SSDEEP 768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
TLSH
T156237D466B9404CACE67827D94B36F16EA7174A14311C39F6228C64E0F723D1AFBA3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_queue.pyd
Size 29KB
SHA256 09c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66
MD5 23f4becf6a1df36aee468bb0949ac2bc
SHA1 a0e027d79a281981f97343f2d0e7322b9fe9b441
SHA512 3ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b
SSDEEP 768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
TLSH
T151D29E879AA45C96D433C17194E66E25F930FB91970083DF3218C35D1F337826BBA79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_socket.pyd
Size 75KB
SHA256 8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
MD5 e137df498c120d6ac64ea1281bcab600
SHA1 b515e09868e9023d43991a05c113b2b662183cfe
SHA512 cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
SSDEEP 1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
TLSH
T1A2735A52A29050B9D27381B6C5635F23EB70F4C0179593CF1260DA6E2F23792AF7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_ssl.pyd
Size 155KB
SHA256 58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
MD5 35f66ad429cd636bcad858238c596828
SHA1 ad4534a266f77a9cdce7b97818531ce20364cb65
SHA512 1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
SSDEEP 3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
TLSH
T10DF37C47F24419A7E817E4BDC2230A13EBB5F045231157CE49D6D68A0F13B46AF7ABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tcl_data\auto.tcl
Size 21KB
SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
MD5 08edf746b4a088cb4185c165177bd604
SHA1 395cda114f23e513eef4618da39bb86d034124bf
SHA512 c1727e265a6b0b54773c886a1bce73512e799ba81a4fceeeb84cdc33f5505a5e0984e96326a78c46bf142bc4652a80e213886f60eb54adf92e4dffe953c87f6b
SSDEEP 384:UqT9XC9VZv9QXCTxsCTHI7672ORgS0mzBvxFRTX7Xvt3wBTnFXhCUvuyqz:LT9XC9VZviXCVsCLI7JlmzBvTxvt3gTW
TLSH
T199A2C7635F9542A630B1C22B553DB9A4EF2F81B70675801D38FC912C37F1815C6BEAEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tcl_data\http1.0\pkgIndex.tcl
Size 746B
SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
MD5 a387908e2fe9d84704c2e47a7f6e9bc5
SHA1 f3c08b3540033a54a59cb3b207e351303c9e29c6
SHA512 7ac804d23e72e40e7b5532332b4a8d8446c6447bb79b4fe32402b13836079d348998ea0659802ab0065896d4f3c06f5866c6b0d90bf448f53e803d8c243bbc63
TLSH
T1720110C7AEF563A02C318B82364BE791DF1DE218F37256FA7450541C80A3866AB4A934
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tcl_data\init.tcl
Size 25KB
SHA256 331bcf0f9f635bd57c3384f2237260d074708b0975c700cfcbdb285f5f59ab1f
MD5 982eae7a49263817d83f744ffcd00c0e
SHA1 81723dfea5576a0916abeff639debe04ce1d2c83
SHA512 31370d8390c4608e7a727eed9ee7f4c568ecb913ae50184b6f105da9c030f3b9f4b5f17968d8975b2f60df1b0c5e278512e74267c935fe4ec28f689ac6a97129
SSDEEP 768:rXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:ygGdKli4eonlm6offLzehNi
TLSH
T1C3B2A7112384917932B343368AB9B598ED7EC1F715AD41BCB8CC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tcl_data\opt0.4\pkgIndex.tcl
Size 620B
SHA256 6a4abd2c519a745325c26fb23be7bbf95252d653a24806eb37fd4aa6a6479afe
MD5 07532085501876dcc6882567e014944c
SHA1 6bc7a122429373eb8f039b413ad81c408a96cb80
SHA512 0d604e862f3a1a19833ead99aaf15a9f142178029ab64c71d193cee4901a0196c1eeddc2bce715b7fa958ac45c194e63c77a71e4be4f9aedfd5b44cf2a726e76
TLSH
T1A4F00CA6AFE183A468A18CC33584F751AF2EF078726010F63414E49CE2A00A65F8F8B0
MD5 SHA1 SHA512 TLSH

Submit Download

package.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tcl_data\package.tcl
Size 23KB
SHA256 f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948
MD5 ddb0ab9842b64114138a8c83c4322027
SHA1 eccacdc2ccd86a452b21f3cf0933fd41125de790
SHA512 c0cf718258b4d59675c088551060b34ce2bc8638958722583ac2313dc354223bfef793b02f1316e522a14c7ba9bed219531d505de94dc3c417fc99d216a01463
SSDEEP 384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
TLSH
T174B2C9217389925A34B153639B352C8CCF3EC0FB51A951BC78D882BC77709190ADEBE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tcl_data\tclIndex
Size 5KB
SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
MD5 c62fb22f4c9a3eff286c18421397aaf4
SHA1 4a49b8768cff68f2effaf21264343b7c632a51b2
SHA512 558d401cb6af8ce3641af55caebc9c5005ab843ee84f60c6d55afbbc7f7129da9c58c2f55c887c3159107546fa6bc13ffc4cca63ea8841d7160b8aa99161a185
SSDEEP 96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
TLSH
T14FC1301AA756C72803F481074999FE283ADED1E4D33DC93E99A491CD10B30076FEE9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tcl_data\tm.tcl
Size 11KB
SHA256 4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f
MD5 215262a286e7f0a14f22db1aa7875f05
SHA1 66b942ba6d3120ef8d5840fcdeb06242a47491ff
SHA512 6ecd745d7da9d826240c0ab59023c703c94b158ae48c1410faa961a8edb512976a4f15ae8def099b58719adf0d2a9c37e6f29f54d39c1ab7ee81fa333a60f39b
SSDEEP 192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
TLSH
T1EC42B512B38A536A62B313254EBAF294DB2DD1FE57E5506C744D81A837208284B7F7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

button.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tk_data\button.tcl
Size 21KB
SHA256 1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5
MD5 aeb53f7f1506cdfdfe557f54a76060ce
SHA1 ebb3666ee444b91a0d335da19c8333f73b71933b
SHA512 acdad4df988df6b2290fc9622e8eaccc31787fecdc98dcca38519cb762339d4d3fb344ae504b8c7918d6f414f4ad05d15e828df7f7f68f363bec54b11c9b7c43
SSDEEP 384:Tv7cBCAsj9oqlFFSsB3VfRt+lMpWaNwJgzCHarc6gAsj9oqlFFSsB3VlRtYlMpBz:TvweHBBTfIZxHBnZWqbJPBFIaVlCj26+
TLSH
T19DA2CED1CA01437667738226957FA260EF5050FA86AB5418B45E80FC3FFF86A466E3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

entry.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tk_data\entry.tcl
Size 17KB
SHA256 af1de90270693273b52fc735da6b5cd5ca794f5afd4cf03ffd95147161098048
MD5 f109865c52d1fd602e2d53e559e56c22
SHA1 5884a3bb701c27ba1bf35c6add7852e84d73d81f
SHA512 b2f92b0ac03351cdb785d3f7ef107b61252398540b5f05f0cc9802b4d28b882ba6795601a68e88d3abc53f216b38f07fcc03660ab6404cf6685f6d80cc4357fc
SSDEEP 384:mDfyRIlBk3yrt8qLjtpa+qh+rA4rsWRWrrMUtCPnkKYNlPp64ZnCD:mDfyRIlBk3yJ8mtpaplcp6o
TLSH
T15A8231D62D05577562B7C373E3BBF600EE36907726934026759693A02FB6022036EFDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icons.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tk_data\icons.tcl
Size 10KB
SHA256 1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85
MD5 995a0a8f7d0861c268aead5fc95a42ea
SHA1 21e121cf85e1c4984454237a646e58ec3c725a72
SHA512 db7f5e0bc7d5c5f750e396e645f50a3e0cde61c9e687add0a40d0c1aa304ddfbceeb9f33ad201560c6e2b051f2eded07b41c43d00f14ee435cdeee73b56b93c7
SSDEEP 192:0nEPytJLl1S47T3YqN5/vkJpnhXqBB4aw2rqZiygTtYTpOq/pc75Mk:xqLz7F5KTqBBLuZ1gTSsqhk
TLSH
T182329E33554065820BF7CDED7B9BE289FD5004AB260D2885B48A832A7FB5550EF317A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

listbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tk_data\listbox.tcl
Size 14KB
SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
MD5 804e6dce549b2e541986c0ce9e75e2d1
SHA1 c44ee09421f127cf7f4070a9508f22709d06d043
SHA512 029426c4f659848772e6bb1d8182eb03d2b43adf68fcfcc1ea1c2cc7c883685deda3fffda7e071912b9bda616ad7af2e1cb48ce359700c1a22e1e53e81cae34b
SSDEEP 384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
TLSH
T1246242C42C34637171FFD22746FABB81FF6990A70595504438ACD0A4BF758B246ADACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tk_data\pkgIndex.tcl
Size 376B
SHA256 3f2539e85e2a9017913e61fe2600b499315e1a6f249a4ff90e0b530a1eeb8898
MD5 3367ce12a4ba9baaf7c5127d7412aa6a
SHA1 865c775bb8f56c3c5dfc8c71bfaf9ef58386161d
SHA512 f5d858f17fe358762e8fdbbf3d78108dba49be5c5ed84b964143c0adce76c140d904cd353646ec0831ff57cd0a0af864d1833f3946a235725fff7a45c96872eb
TLSH
T149E068880321AB1A4AA26543A890EE4C3FEE90BFE94CC19E301521DCEF12080ADDD8F5
MD5 SHA1 SHA512 TLSH

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tk_data\tk.tcl
Size 23KB
SHA256 0f617d96cbf213296d7a5f7fcffbb4ae1149840d7d045211ef932e8dd66683e9
MD5 338184e46bd23e508daedbb11a4f0950
SHA1 437db31d487c352472212e8791c8252a1412cb0e
SHA512 8fb8a353eecd0d19638943f0a9068dccebf3fb66d495ea845a99a89229d61a77c85b530f597fd214411202055c1faa9229b6571c591c9f4630490e1eb30b9cd3
SSDEEP 384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
TLSH
T1DEB2D7195DC062B3513BC13F53BB2A00E87558FB2776644978DC48B92F6883B06FE9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_tkinter.pyd
Size 63KB
SHA256 6c0f81a098529d6965602fa2984eb38de7ef633cb00daf05d583a2f7d38c2cb1
MD5 56d3851235509f24d0efddbc4723e06e
SHA1 f9dd247525f2ceb8ce8ce60d3db0f439af9ecec5
SHA512 f6a688f0cf74c77cf26aac0df2a986e11779b166c4b45b226388c8fe476985cb47525715d20244c09ad47ca87afcee83705d2dcfe241fdcf3868eb9caae3d736
SSDEEP 1536:JM6zciVl77hMk81C/LCYrzpIS5S07SyVK:JHzcxkp/LCYrzpIS5S0bK
TLSH
T169538CAB5BA4009ACE67C17DC5B34F13DA75B4410A20934F02A8D34A1F737A397FAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\_uuid.pyd
Size 23KB
SHA256 51dd1ea5e8cacf7ec4cadefdf685334c7725ff85978390d0b3d67fc8c54fe1db
MD5 13aa3af9aed86cc917177ae1f41acc9b
SHA1 f5d95679afda44a6689dbb45e93ebe0e9cd33d69
SHA512 e1f5dbd6c0afcf207de0100cba6f1344feb0006a5c12dc92768ab2d24e3312f0852f3cd31a416aafeb0471cd13a6c0408f0da62956f7870b2e22d174a8b23c45
SSDEEP 384:I3AVpEWz6TPQxISewl4IYiSy1pCQXdW4i/8E9VFL2Utah:ISpENTQxISewLYiSyvNWeEdy
TLSH
T180B25C86CAA04C55DC2786B1A4E44F1AE931F7959B5083CB331DC1591FA13C367BA3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.webp

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\background.webp
Size 66KB
SHA256 ec7528d322acafd671e121b9cbd6a38b433329ebd3b42c921678a598ce8fc300
MD5 7fe75c88fd884905e8876f25cf2265ce
SHA1 a7ec85a0298538e44d7b27f71b74f70a6bffe889
SHA512 523242863fd7a3492c03e6239b10ace0668fdc0a29ca67eae53bbb6277037168b2fb3049ab151b496525d1e5778292d3c3cade6f6381b2c72d16b115b36b8124
SSDEEP 1536:ZDOYczJY/zCRI07PwV37B4MSJ2Lg6cjrXCCt2b0lUIwA:xPczAzCRIw/hULgDMWN
TLSH
T1EC63123C0D19A26BDF0CC47D9045E3DD2C051424922E7F6D5AC8B02AF89A1FDABA5D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\base_library.zip
Size 859KB
SHA256 64e98fa1a68584f5784f84b9e0e8581a996d5eb97c71293dfd8d3ef3f25d29e4
MD5 5089e597ffcf5c6699174d5df507edf6
SHA1 be936b7ce3eb89d9b70a7481aaeec25413321229
SHA512 247c603229732abfec85b106f0b2c9c45b85ed7b5931ccf52b5f80c6ce5791794aacfd8a79ab547520d70916a747eb123f100465d7ad8049648115fbaf0b3833
SSDEEP 12288:efpEiVpSSfWy+EHYK1Iy6uB9tdXVwx9A4a2YUYCMNcsW:efpEMV+EHY6dVwx9La2dYCMNrW
TLSH
T19A153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\libcrypto-1_1.dll
Size 3.3MB
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
SSDEEP 98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
TLSH
T1E2F58C5AA3AC0184E5FAC17CC9574727E7B1B45A93B09BCF08A681780F27BD6273DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\libssl-1_1.dll
Size 682KB
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
SSDEEP 12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
TLSH
T173E43A95ABB51498D5E6C17C8A534A33E3BAF4141330AFCF0661893E0F17BD92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\pyexpat.pyd
Size 193KB
SHA256 dbe6e7be3a7418811bd5987b0766d8d660190d867cd42f8ed79e70d868e8aa43
MD5 6bc89ebc4014a8db39e468f54aaafa5e
SHA1 68d04e760365f18b20f50a78c60ccfde52f7fcd8
SHA512 b7a6a383eb131deb83eee7cc134307f8545fb7d043130777a8a9a37311b64342e5a774898edd73d80230ab871c4d0aa0b776187fa4edec0ccde5b9486dbaa626
SSDEEP 3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
TLSH
T1F4147C5771A5C0EBD8938038D6974A0BDBB2F8A5038197CF1294EB7D5F27B423E68319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\python310.dll
Size 4.3MB
SHA256 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
MD5 c80b5cb43e5fe7948c3562c1fff1254e
SHA1 f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA512 faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
SSDEEP 49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
TLSH
T165267B22A2640194DAB79477C5238646CBF1FC552F20E34F41A4BAD92F73BA316EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\select.pyd
Size 28KB
SHA256 68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
MD5 adc412384b7e1254d11e62e451def8e9
SHA1 04e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA512 f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
SSDEEP 384:rPxHeWt+twhCBsHqF2BMXR6VIS7GuIYiSy1pCQkyw24i/8E9VFL2Ut8JU:ZeS+twhC6HqwmYVIS7GjYiSyv7VeEdH
TLSH
T1F4D29F8BD7901889E823C6B154E68F06EA35B6614750C3CF3315C26D2F637C277BA799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\tcl86t.dll
Size 1.8MB
SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
MD5 75909678c6a79ca2ca780a1ceb00232e
SHA1 39ddbeb1c288335abe910a5011d7034345425f7d
SHA512 91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf
SSDEEP 24576:aNJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBH9:aNgjid2LD5W4ac6xdLvIkhHP4ATdeD0
TLSH
T1A785AF1BEB6411E8D4ABD1BCC227EA0BDBF1B4191350A6DB51A08F512F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgcat-1.6.1.tm

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\tcl8\8.5\msgcat-1.6.1.tm
Size 34KB
SHA256 6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb
MD5 bd4ff2a1f742d9e6e699eeee5e678ad1
SHA1 811ad83aff80131ba73abc546c6bd78453bf3eb9
SHA512 b77e4a68017ba57c06876b21b8110c636f9ba1dd0ba9d7a0c50096f3f6391508cf3562dd94aceaf673113dbd336109da958044aefac0afb0f833a652e4438f43
SSDEEP 768:m3xQvCzasI/rHPG2yfkZ0Kbh91iQ3Lnq5MIVYB8mbgijsPIWtw4qvUm:4xQvCzasIDHPG2yW0kJ32imXmUij6JjG
TLSH
T1EEF2D624334741AB36B2526799B9A2A4CE3CE23F10AB959FB89A801C7731F5D43F74D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\tk86t.dll
Size 1.5MB
SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
MD5 4b6270a72579b38c1cc83f240fb08360
SHA1 1a161a014f57fe8aa2fadaab7bc4f9faaac368de
SHA512 0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9
SSDEEP 24576:C1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58KOJ0wd98ydeyRP/ecr:CIyQD9FU43GLUKuPO6EinYTVAFSvESKI
TLSH
T178655B06A261C198C26EE134C91796BAEBF17C04931457DB76A0BE6D3F33BD2277A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\unicodedata.pyd
Size 1.1MB
SHA256 2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758
MD5 102bbbb1f33ce7c007aac08fe0a1a97e
SHA1 9a8601bea3e7d4c2fa6394611611cda4fc76e219
SHA512 a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32
SSDEEP 12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
TLSH
T147355909B9C24EE6E88B06B940D3117B2F61C1720F1B6B4F76A5532D9C763A34EE653C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watermark.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI58722\watermark.png
Size 529KB
SHA256 1b4d7720fa25b0fa57409bff58a9b0a0bdb2808b99500aaab625dd5124b237ff
MD5 2d0a5f770303df519caf14d317d32bc6
SHA1 de3d15f89d87e6221a782b274733e70460a00ad8
SHA512 93eaca10940b267c75946a9e88bb7b3d4742fdba54f0829d25054bfe253887116aeac550aba296cbc55940a0cd490bd6df02a6429baf37143b133d86e80f403a
SSDEEP 12288:/myIr1u7NDKxPAxzK9t2YeqaepkNxyO5z0Gvyd5EV/gYck:+Fr1whP3q/pQxJp0Gq74wk
TLSH
T146B423264A49386C1C6B8F785D833B83584732F1DB7A902C8E4E56EA73E712E8D755CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_u4lavhal.hv2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u4lavhal.hv2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1472-1094-0x0000014908A70000-0x0000014908A82000-memory.dmp

Download

memory/1472-1093-0x0000014906D60000-0x0000014906D6C000-memory.dmp

Download

memory/1644-1143-0x000002137B260000-0x000002137B272000-memory.dmp

Download

memory/1644-1142-0x000002137AEB0000-0x000002137AEBC000-memory.dmp

Download

memory/2240-1123-0x000001DAD1A20000-0x000001DAD1A2C000-memory.dmp

Download

memory/2240-1124-0x000001DAD1B20000-0x000001DAD1B32000-memory.dmp

Download

memory/3968-1133-0x0000022F488E0000-0x0000022F488F2000-memory.dmp

Download

memory/3968-1132-0x0000022F487C0000-0x0000022F487CC000-memory.dmp

Download

memory/4236-1117-0x00000226FB700000-0x00000226FB70C000-memory.dmp

Download

memory/4236-1118-0x00000226FBD90000-0x00000226FBDA2000-memory.dmp

Download

memory/4732-1137-0x0000020761250000-0x000002076125C000-memory.dmp

Download

memory/4732-1138-0x0000020761300000-0x0000020761312000-memory.dmp

Download

memory/4732-1070-0x00000207795F0000-0x0000020779612000-memory.dmp

Download

memory/5828-1129-0x000002CE0AE70000-0x000002CE0AE82000-memory.dmp

Download

memory/5828-1128-0x000002CE094A0000-0x000002CE094AC000-memory.dmp

Download

memory/5904-1160-0x000002106EB10000-0x000002106EB1C000-memory.dmp

Download

memory/5904-1164-0x0000021070250000-0x0000021070262000-memory.dmp

Download