Overview

overview

8

Static

static

3

WindowsUpdate.exe

windows10-2004-x64

8

WindowsUpdate.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/06/2026, 09:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WindowsUpdate.exe
  • Size 18.2MB
  • Sample260620-k87njsft4s
  • SHA256 1be14cc1883eab57b838b6ee895c92f1f8cbe951bb9db05c4a4b3cd296c70704
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasion

Malware Config

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 64 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5864
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6052
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im explorer.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2416
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3884
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im dwm.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:980
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2796
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4460
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:920
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im ShellExperienceHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3036
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im SearchApp.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5440
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im StartMenuExperienceHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:960
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im TextInputHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4908
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im SystemSettings.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4624
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:596
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im ApplicationFrameHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:256
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3032
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im explorer.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3340
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:896
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im dwm.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:6048
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:788
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6088
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im ShellExperienceHost.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1688
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im SearchApp.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2748
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2428
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im StartMenuExperienceHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4240
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im TextInputHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3556
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im SystemSettings.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2064
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im ApplicationFrameHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1020
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im explorer.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2296
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5744
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im dwm.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2484
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4412
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im ShellExperienceHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1048
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im SearchApp.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1704
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5292
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im StartMenuExperienceHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:696
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5848
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im TextInputHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2536
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im SystemSettings.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:488
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im ApplicationFrameHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2252
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1248
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im explorer.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4320
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2768
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im dwm.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5892
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3348
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im ShellExperienceHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
        3⤵
          PID:4216
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im SearchApp.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3900
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
          3⤵
            PID:2980
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im StartMenuExperienceHost.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:300
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
            3⤵
              PID:3144
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im TextInputHost.exe
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4352
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
              3⤵
                PID:1380
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im SystemSettings.exe
                  4⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5416
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
                3⤵
                  PID:3448
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im ApplicationFrameHost.exe
                    4⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4888
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
                  3⤵
                    PID:4636
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im explorer.exe
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5540
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
                    3⤵
                      PID:3644
                      • C:\Windows\system32\taskkill.exe
                        taskkill /f /im dwm.exe
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3456
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                      3⤵
                        PID:4532
                        • C:\Windows\system32\taskkill.exe
                          taskkill /f /im taskmgr.exe
                          4⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5888
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
                        3⤵
                          PID:3256
                          • C:\Windows\system32\taskkill.exe
                            taskkill /f /im ShellExperienceHost.exe
                            4⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4072
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
                          3⤵
                            PID:5928
                            • C:\Windows\system32\taskkill.exe
                              taskkill /f /im SearchApp.exe
                              4⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:6056
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
                            3⤵
                              PID:5408
                              • C:\Windows\system32\taskkill.exe
                                taskkill /f /im StartMenuExperienceHost.exe
                                4⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3080
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
                              3⤵
                                PID:2476
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /f /im TextInputHost.exe
                                  4⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3680
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
                                3⤵
                                  PID:4684
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /f /im SystemSettings.exe
                                    4⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2484
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
                                  3⤵
                                    PID:1500
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /f /im ApplicationFrameHost.exe
                                      4⤵
                                      • Kills process with taskkill
                                      PID:2840
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
                                    3⤵
                                      PID:1624
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /f /im explorer.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:3916
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
                                      3⤵
                                        PID:5148
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /f /im dwm.exe
                                          4⤵
                                          • Kills process with taskkill
                                          PID:6100
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                                        3⤵
                                          PID:5196
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /f /im taskmgr.exe
                                            4⤵
                                            • Kills process with taskkill
                                            PID:604
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
                                          3⤵
                                            PID:3872
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /f /im ShellExperienceHost.exe
                                              4⤵
                                              • Kills process with taskkill
                                              PID:4132
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
                                            3⤵
                                              PID:4796
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /f /im SearchApp.exe
                                                4⤵
                                                  PID:5076
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
                                                3⤵
                                                  PID:6124
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /f /im StartMenuExperienceHost.exe
                                                    4⤵
                                                    • Kills process with taskkill
                                                    PID:2536
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
                                                  3⤵
                                                    PID:5428
                                                    • C:\Windows\system32\taskkill.exe
                                                      taskkill /f /im TextInputHost.exe
                                                      4⤵
                                                      • Kills process with taskkill
                                                      PID:488
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
                                                    3⤵
                                                      PID:2136
                                                      • C:\Windows\system32\taskkill.exe
                                                        taskkill /f /im SystemSettings.exe
                                                        4⤵
                                                        • Kills process with taskkill
                                                        PID:2252
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
                                                      3⤵
                                                        PID:1944
                                                        • C:\Windows\system32\taskkill.exe
                                                          taskkill /f /im ApplicationFrameHost.exe
                                                          4⤵
                                                          • Kills process with taskkill
                                                          PID:4320
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
                                                        3⤵
                                                          PID:4268
                                                          • C:\Windows\system32\taskkill.exe
                                                            taskkill /f /im explorer.exe
                                                            4⤵
                                                            • Kills process with taskkill
                                                            PID:5304
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
                                                          3⤵
                                                            PID:2912
                                                            • C:\Windows\system32\taskkill.exe
                                                              taskkill /f /im dwm.exe
                                                              4⤵
                                                              • Kills process with taskkill
                                                              PID:4952
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                                                            3⤵
                                                              PID:3480
                                                              • C:\Windows\system32\taskkill.exe
                                                                taskkill /f /im taskmgr.exe
                                                                4⤵
                                                                • Kills process with taskkill
                                                                PID:3400
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
                                                              3⤵
                                                                PID:3892
                                                                • C:\Windows\system32\taskkill.exe
                                                                  taskkill /f /im ShellExperienceHost.exe
                                                                  4⤵
                                                                  • Kills process with taskkill
                                                                  PID:5268
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
                                                                3⤵
                                                                  PID:408
                                                                  • C:\Windows\system32\taskkill.exe
                                                                    taskkill /f /im SearchApp.exe
                                                                    4⤵
                                                                    • Kills process with taskkill
                                                                    PID:6108
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
                                                                  3⤵
                                                                    PID:3516
                                                                    • C:\Windows\system32\taskkill.exe
                                                                      taskkill /f /im StartMenuExperienceHost.exe
                                                                      4⤵
                                                                      • Kills process with taskkill
                                                                      PID:712
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
                                                                    3⤵
                                                                      PID:6048
                                                                      • C:\Windows\system32\taskkill.exe
                                                                        taskkill /f /im TextInputHost.exe
                                                                        4⤵
                                                                          PID:2348
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
                                                                        3⤵
                                                                          PID:5508
                                                                          • C:\Windows\system32\taskkill.exe
                                                                            taskkill /f /im SystemSettings.exe
                                                                            4⤵
                                                                            • Kills process with taskkill
                                                                            PID:692
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
                                                                          3⤵
                                                                            PID:3052
                                                                            • C:\Windows\system32\taskkill.exe
                                                                              taskkill /f /im ApplicationFrameHost.exe
                                                                              4⤵
                                                                              • Kills process with taskkill
                                                                              PID:1416
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
                                                                            3⤵
                                                                              PID:2704
                                                                              • C:\Windows\system32\taskkill.exe
                                                                                taskkill /f /im explorer.exe
                                                                                4⤵
                                                                                • Kills process with taskkill
                                                                                PID:3160
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
                                                                              3⤵
                                                                                PID:2556
                                                                                • C:\Windows\system32\taskkill.exe
                                                                                  taskkill /f /im dwm.exe
                                                                                  4⤵
                                                                                    PID:960
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                                                                                  3⤵
                                                                                    PID:3452
                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                      taskkill /f /im taskmgr.exe
                                                                                      4⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:5108
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
                                                                                    3⤵
                                                                                      PID:3820
                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                        taskkill /f /im ShellExperienceHost.exe
                                                                                        4⤵
                                                                                          PID:3436
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
                                                                                        3⤵
                                                                                          PID:2964
                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                            taskkill /f /im SearchApp.exe
                                                                                            4⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:5756
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
                                                                                          3⤵
                                                                                            PID:3108
                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                              taskkill /f /im StartMenuExperienceHost.exe
                                                                                              4⤵
                                                                                                PID:5528
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
                                                                                              3⤵
                                                                                                PID:2800
                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                  taskkill /f /im TextInputHost.exe
                                                                                                  4⤵
                                                                                                  • Kills process with taskkill
                                                                                                  PID:3668
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
                                                                                                3⤵
                                                                                                  PID:3920
                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                    taskkill /f /im SystemSettings.exe
                                                                                                    4⤵
                                                                                                    • Kills process with taskkill
                                                                                                    PID:6040
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
                                                                                                  3⤵
                                                                                                    PID:3268
                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                      taskkill /f /im ApplicationFrameHost.exe
                                                                                                      4⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:4120
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
                                                                                                    3⤵
                                                                                                      PID:4784
                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                        taskkill /f /im explorer.exe
                                                                                                        4⤵
                                                                                                        • Kills process with taskkill
                                                                                                        PID:5000
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
                                                                                                      3⤵
                                                                                                        PID:5312
                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                          taskkill /f /im dwm.exe
                                                                                                          4⤵
                                                                                                            PID:3812
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                                                                                                          3⤵
                                                                                                            PID:488
                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                              taskkill /f /im taskmgr.exe
                                                                                                              4⤵
                                                                                                                PID:4760
                                                                                                        • C:\Windows\system32\dwm.exe
                                                                                                          "dwm.exe"
                                                                                                          1⤵
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4432
                                                                                                        • C:\Windows\system32\dwm.exe
                                                                                                          "dwm.exe"
                                                                                                          1⤵
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4328
                                                                                                        • C:\Windows\system32\dwm.exe
                                                                                                          "dwm.exe"
                                                                                                          1⤵
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:3364
                                                                                                        • C:\Windows\system32\dwm.exe
                                                                                                          "dwm.exe"
                                                                                                          1⤵
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:5460
                                                                                                        • C:\Windows\system32\dwm.exe
                                                                                                          "dwm.exe"
                                                                                                          1⤵
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:5788
                                                                                                        • C:\Windows\system32\dwm.exe
                                                                                                          "dwm.exe"
                                                                                                          1⤵
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:2728
                                                                                                        • C:\Windows\system32\dwm.exe
                                                                                                          "dwm.exe"
                                                                                                          1⤵
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:3364
                                                                                                        • C:\Windows\system32\dwm.exe
                                                                                                          "dwm.exe"
                                                                                                          1⤵
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:2352
                                                                                                        • C:\Windows\system32\LogonUI.exe
                                                                                                          "LogonUI.exe" /flags:0x0 /state0:0xa39b4055 /state1:0x41c64e6d
                                                                                                          1⤵
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:1732
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k CameraMonitor
                                                                                                          1⤵
                                                                                                            PID:3388
                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                            \SystemRoot\System32\smss.exe 000001c4 000000c8
                                                                                                            1⤵
                                                                                                              PID:3348
                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                              \SystemRoot\System32\smss.exe 000003e4 000000c8
                                                                                                              1⤵
                                                                                                                PID:300
                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                \SystemRoot\System32\smss.exe 000003a4 000000c8
                                                                                                                1⤵
                                                                                                                  PID:5540
                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                  \SystemRoot\System32\smss.exe 000003e0 000000c8
                                                                                                                  1⤵
                                                                                                                    PID:3456
                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                    \SystemRoot\System32\smss.exe 000003ac 000000c8
                                                                                                                    1⤵
                                                                                                                      PID:3436
                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                      \SystemRoot\System32\smss.exe 000003a4 000000c8
                                                                                                                      1⤵
                                                                                                                        PID:2840
                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                        \SystemRoot\System32\smss.exe 000003a4 000000c8
                                                                                                                        1⤵
                                                                                                                          PID:5756
                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                          \SystemRoot\System32\smss.exe 000003a0 000000c8
                                                                                                                          1⤵
                                                                                                                            PID:3916
                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                            \SystemRoot\System32\smss.exe 000003b0 000000c8
                                                                                                                            1⤵
                                                                                                                              PID:5528
                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                              \SystemRoot\System32\smss.exe 000003ec 000000c8
                                                                                                                              1⤵
                                                                                                                                PID:3080
                                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                                \SystemRoot\System32\smss.exe 00000370 000000c8
                                                                                                                                1⤵
                                                                                                                                  PID:4680
                                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                                  \SystemRoot\System32\smss.exe 00000340 000000c8
                                                                                                                                  1⤵
                                                                                                                                    PID:3900
                                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                                    \SystemRoot\System32\smss.exe 00000370 000000c8
                                                                                                                                    1⤵
                                                                                                                                      PID:4352
                                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                                      \SystemRoot\System32\smss.exe 00000328 000000c8
                                                                                                                                      1⤵
                                                                                                                                        PID:4888
                                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                                        \SystemRoot\System32\smss.exe 000003b4 000000c8
                                                                                                                                        1⤵
                                                                                                                                          PID:4072
                                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                                          \SystemRoot\System32\smss.exe 000003b8 000000c8
                                                                                                                                          1⤵
                                                                                                                                            PID:5888
                                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                                            \SystemRoot\System32\smss.exe 00000380 000000c8
                                                                                                                                            1⤵
                                                                                                                                              PID:6040
                                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                                              \SystemRoot\System32\smss.exe 000003d4 000000c8
                                                                                                                                              1⤵
                                                                                                                                                PID:604
                                                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                                                \SystemRoot\System32\smss.exe 0000039c 000000c8
                                                                                                                                                1⤵
                                                                                                                                                  PID:4132
                                                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                                                  \SystemRoot\System32\smss.exe 000003fc 000000c8
                                                                                                                                                  1⤵
                                                                                                                                                    PID:5076
                                                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                                                    \SystemRoot\System32\smss.exe 00000360 000000c8
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2484
                                                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                                                      \SystemRoot\System32\smss.exe 00000348 000000c8
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3680
                                                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                                                        \SystemRoot\System32\smss.exe 000003f4 000000c8
                                                                                                                                                        1⤵
                                                                                                                                                          PID:6100
                                                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                                                          \SystemRoot\System32\smss.exe 0000034c 000000c8
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2536
                                                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                                                            \SystemRoot\System32\smss.exe 000003b0 000000c8
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4952
                                                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                                                              \SystemRoot\System32\smss.exe 00000354 000000c8
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4320
                                                                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                                                                \SystemRoot\System32\smss.exe 00000340 000000c8
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5304
                                                                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                                                                  \SystemRoot\System32\smss.exe 00000374 000000c8
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:6108
                                                                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                                                                    \SystemRoot\System32\smss.exe 000003d8 000000c8
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:712
                                                                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                                                                      \SystemRoot\System32\smss.exe 00000340 000000c8
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5268
                                                                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                                                                        \SystemRoot\System32\smss.exe 000002d0 000000c8
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:3400
                                                                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                                                                          \SystemRoot\System32\smss.exe 000003fc 000000c8
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:2348
                                                                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                                                                            \SystemRoot\System32\smss.exe 00000348 000000c8
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:692
                                                                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                                                                              \SystemRoot\System32\smss.exe 000003a8 000000c8
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:1416
                                                                                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                                                                                \SystemRoot\System32\smss.exe 000002d0 000000c8
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:960
                                                                                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                                                                                  \SystemRoot\System32\smss.exe 00000378 000000c8
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3160
                                                                                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                                                                                    \SystemRoot\System32\smss.exe 00000374 000000c8
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5108
                                                                                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                                                                                      \SystemRoot\System32\smss.exe 000003e8 000000c8
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4760
                                                                                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                                                                                        \SystemRoot\System32\smss.exe 000003e8 000000c8
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:3668
                                                                                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                                                                                          \SystemRoot\System32\smss.exe 0000032c 000000c8
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4120
                                                                                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                                                                                            \SystemRoot\System32\smss.exe 000002d4 000000c8
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5000
                                                                                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                                                                                              \SystemRoot\System32\smss.exe 0000035c 000000c8
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:3812
                                                                                                                                                                                              • C:\Windows\system32\wbem\WMIADAP.EXE
                                                                                                                                                                                                wmiadap.exe /R /T
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                PID:2900

                                                                                                                                                                                              Network

                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                    VCRUNTIME140.dll
                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_5864_813427_NKGKlgDV3dI\VCRUNTIME140.dll
                                                                                                                                                                                                    • Size 116KB
                                                                                                                                                                                                    • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                    _bz2.pyd
                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_5864_813427_NKGKlgDV3dI\_bz2.pyd
                                                                                                                                                                                                    • Size 82KB
                                                                                                                                                                                                    • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                    _ctypes.pyd
                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_5864_813427_NKGKlgDV3dI\_ctypes.pyd
                                                                                                                                                                                                    • Size 121KB
                                                                                                                                                                                                    • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                    _lzma.pyd
                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_5864_813427_NKGKlgDV3dI\_lzma.pyd
                                                                                                                                                                                                    • Size 155KB
                                                                                                                                                                                                    • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                    blocker.dll
                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_5864_813427_NKGKlgDV3dI\blocker.dll
                                                                                                                                                                                                    • Size 5.6MB
                                                                                                                                                                                                    • SHA256 69819e89b98e8e004f44f1decb08b62e96e6afed7b2441b62ff1caae0670367c
                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                    libffi-8.dll
                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_5864_813427_NKGKlgDV3dI\libffi-8.dll
                                                                                                                                                                                                    • Size 38KB
                                                                                                                                                                                                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                    python311.dll
                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_5864_813427_NKGKlgDV3dI\python311.dll
                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                    • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                    Submit Download