7238453f2f69ca951fe5c18786afd4e00a8ddb8cd744f6c1e557be4c9f4efeca

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.exe
Size 16.7MB
Sample260627-ty5wmsct5m
SHA256 7238453f2f69ca951fe5c18786afd4e00a8ddb8cd744f6c1e557be4c9f4efeca
MD5 6bebc199c825c89f088b881e3dcdeb99
SHA1 4cefcf3f157d4db073a50c718f0b881c2a620aaa
SHA512 3174e85e0c4fc9e0b45695ed8308aeb22ab9ce7ada4f5c6aed429f753d7705f413c401cf13535a30bb9dafb7ebd0725a60874a633c17c146b93399d20bc028d5
SSDEEP 393216:CZqpoKgRr9ql9nP8bATr6tZq5X3OHsxtEDweFXdRlw9:WqpYjqfPOar6tZq5kwt7eJi
TLSH
T1FB0733945BC40937E8D2A13C9D72CAA1F1E1F9612B628DBF179117363F737A0483E698
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion persistence pyinstaller ransomware spyware stealer

Malware Config

Signatures

Renames multiple (69) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 64 IoCs

pid	Process
1032	SB7OCDWF.exe
3736	SB7OCDWF.exe
5920	4WZGVRKR.exe
5296	4WZGVRKR.exe
1532	HJ4IEOWF.exe
2616	HJ4IEOWF.exe
3460	ACL0BNXV.exe
2636	ACL0BNXV.exe
3316	KTWHAPCN.exe
5712	KTWHAPCN.exe
5900	YCZI0MX4.exe
3228	YCZI0MX4.exe
1564	8JYYRDLR.exe
464	8JYYRDLR.exe
1752	A39AFTM5.exe
1236	A39AFTM5.exe
1152	DLUP7GL5.exe
2388	DLUP7GL5.exe
1388	T0Y1A530.exe
4848	T0Y1A530.exe
5412	JZUOEQIT.exe
1132	JZUOEQIT.exe
5768	OD0ETI4Y.exe
5592	OD0ETI4Y.exe
5696	5URMO16U.exe
260	5URMO16U.exe
1552	LFGWS3DM.exe
4540	LFGWS3DM.exe
1508	WHUEHEU7.exe
4088	WHUEHEU7.exe
3276	WU9L01YQ.exe
5148	WU9L01YQ.exe
3516	W4TBE3W8.exe
4464	W4TBE3W8.exe
5036	UOAJ217E.exe
4852	UOAJ217E.exe
3676	D91VCL7P.exe
5960	D91VCL7P.exe
3728	R4PXY9DS.exe
5804	R4PXY9DS.exe
2920	4MKSL9TL.exe
5012	4MKSL9TL.exe
2508	VV64Y8GW.exe
1956	VV64Y8GW.exe
5404	6ZA57LQD.exe
4296	6ZA57LQD.exe
4260	QV0FRW3D.exe
5052	QV0FRW3D.exe
1652	AVJYRS0F.exe
1636	AVJYRS0F.exe
4516	2D0COY02.exe
5372	2D0COY02.exe
2008	IUW4JTF9.exe
4964	IUW4JTF9.exe
4128	57GF5TE8.exe
5308	57GF5TE8.exe
980	A149WIAY.exe
4716	A149WIAY.exe
5324	QVIOP6VZ.exe
3688	QVIOP6VZ.exe
2488	MQBEOJUQ.exe
1916	MQBEOJUQ.exe
3220	59BLA01Q.exe
4884	59BLA01Q.exe

Loads dropped DLL 64 IoCs

pid	Process
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
4256	k.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
3736	SB7OCDWF.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe
5296	4WZGVRKR.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\18ALKCE1LX = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\W9E4NQIKXE\\0E68F0Z8.exe\""	VI45VBQZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\0LFR9NJ0SS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\FJ99DP00CK\\7GIWMQBJ.exe\""	WQVGT708.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\KV7VV6L4HF = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\N550V0917X\\DGBW5K9F.exe\""	IHXFP8DH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\1RF6DHF5J3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\EDCK6XH61R\\GFGCA2NK.exe\""	DGBW5K9F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\14MXF7ZUF8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Q6AB7G8SP5\\7OIY7BFO.exe\""	67P2WN9K.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\WHK3V7BO21 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\C27PG1US16\\WHZ0RZ2J.exe\""	4LMI874R.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\4LJELP0AJI = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\HZ8H7OTBAC\\CL3ZVQ0G.exe\""	UW2188SM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\OY8WDCWFSL = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\9C7WY625KM\\W7ODJ1ZJ.exe\""	1544BFWM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\1GIPT757EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\08YDGCGKIB\\8F5XJM24.exe\""	13X7HIMF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\TG8IKLTTEY = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\EP7SVWS21W\\67P2WN9K.exe\""	KYZFM53Z.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\CU2DJ3RYNB = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SRC32XI4DD\\VI45VBQZ.exe\""	KP8LJ8B9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\XGFS93RVZ8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\VE7IDJK752\\YCZI0MX4.exe\""	KTWHAPCN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\8H8G1CJY4S = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IEANBUM12O\\QVIOP6VZ.exe\""	A149WIAY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\1K4IVP7ASH = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\C9WP1A5VF9\\1AINE0YH.exe\""	HY9SS59W.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\0N3CZAC0G8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OZPJDT8813\\OJIII7DW.exe\""	4EREIM0M.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\QT22LO90SQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\HD652CEUBP\\5FT8C6U6.exe\""	EXG4REFX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\RXU8ZLR4JV = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AX4JGKPWPS\\5URMO16U.exe\""	OD0ETI4Y.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\C5GQW98WMQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\A01BAS4TKH\\WU9L01YQ.exe\""	WHUEHEU7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\F2HVTEMBP9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\PRIIL04CK5\\6ZA57LQD.exe\""	VV64Y8GW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\4YD66JLTEI = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BCX3T3GCDX\\4LMI874R.exe\""	LMHXVZYW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\7G4XC4HX8V = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\71Q5PY5YHJ\\VX2KWTYQ.exe\""	GQZ284ZY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\X6JBC1KACL = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\W99VC9AGB9\\ACL0BNXV.exe\""	HJ4IEOWF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\PJKMQ17J3L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\1PW2HYFOV9\\KTWHAPCN.exe\""	ACL0BNXV.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\MGGPILNP9J = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\N6I60V0CF4\\A149WIAY.exe\""	57GF5TE8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\S3AA7MKQPH = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RS1W91YNMW\\EXG4REFX.exe\""	0E68F0Z8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\O6NUUVYYLE = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CID03VD8XD\\T0Y1A530.exe\""	DLUP7GL5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\CCHMBE4QO6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\A91RUPB4Z0\\LFGWS3DM.exe\""	5URMO16U.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\IUEO8HQB6H = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\8576UXCS4T\\2D0COY02.exe\""	AVJYRS0F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\WM4XKI1YWP = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XV52KDHL4E\\59BLA01Q.exe\""	MQBEOJUQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\MNVG27JA4J = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\65C210CGMK\\IUW4JTF9.exe\""	2D0COY02.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\7FIW2N5GNW = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\FZZOTEC70Q\\8HTJS82A.exe\""	5FT8C6U6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\KJ25J9LZ0R = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\GZUVYBODRJ\\GQZ284ZY.exe\""	7OIY7BFO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\9GR9WK742J = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\VUJDUO6GW8\\4MKSL9TL.exe\""	R4PXY9DS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\WH7IUJTUIL = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\S21D5B1W3U\\AVJYRS0F.exe\""	QV0FRW3D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\STJTPBZXM8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LY6XZNBSX7\\MQBEOJUQ.exe\""	QVIOP6VZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\7BSZ4TMNAB = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\FU91X4IQDQ\\UW2188SM.exe\""	KGVV77C1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\WVSSD5J32G = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\6DHUT03BTH\\CN1OED7Q.exe\""	1AINE0YH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\BUI4TST10J = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\QP6B09CL27\\D91VCL7P.exe\""	UOAJ217E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\D3W21RVMTY = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BDWJV19IL7\\CI4HQ13Q.exe\""	CL3ZVQ0G.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\FO1HU6BICW = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MH14UXA5JW\\1544BFWM.exe\""	CI4HQ13Q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\1L638N1I2G = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\5TYZYGADTT\\13X7HIMF.exe\""	9JFQTEB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\MDQFXV8QM5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RI2BBKIUAG\\WHUEHEU7.exe\""	LFGWS3DM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\7K89MQDYTF = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SQQV2W44PR\\W4TBE3W8.exe\""	WU9L01YQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\YW3SGOZ52X = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\YKPMA9F3R2\\R4PXY9DS.exe\""	D91VCL7P.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\2RH2LZVG1A = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\N6YFEH8HR8\\WQVGT708.exe\""	8HTJS82A.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\5REM9JMCF2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AGS9EECDKK\\SB7OCDWF.exe\""	k.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS2QYJ7VXR = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\NAEPWVK56F\\KGVV77C1.exe\""	WHZ0RZ2J.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\W7NNNQ7ML2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SG5PCDIWNI\\9JFQTEB8.exe\""	UB7HDQLB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\JDDMUM2C3T = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\49UB906TR1\\RMG1Q7MH.exe\""	BD6WHO3R.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\QZJOMJL810 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\E32WGNG72W\\KYZFM53Z.exe\""	GFGCA2NK.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\LCFMNGH62G = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\GJR1A0HEWN\\8JYYRDLR.exe\""	YCZI0MX4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\NNZP2UHP8T = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\1F71BS6QDB\\JZUOEQIT.exe\""	T0Y1A530.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\3FSZF7AYZT = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\YOTFCUDDK4\\OD0ETI4Y.exe\""	JZUOEQIT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\2BX5SMW7OM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\6492KUZC8K\\VV64Y8GW.exe\""	4MKSL9TL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\O48ZWKVOR6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\6MVL6GJXPF\\BD6WHO3R.exe\""	OJIII7DW.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\AR19F82QCB = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IMN4ZW1582\\LXZHJU90.exe\""	PVA5715H.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\HWGIXAAIB0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\K3R87ZNV9B\\4WZGVRKR.exe\""	SB7OCDWF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\700HZE8GNN = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\T0GW0LJ0KA\\57GF5TE8.exe\""	IUW4JTF9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\KNBIWQQFQK = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\UDCYDEPMFI\\QULVG6M3.exe\""	CN1OED7Q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\Q6ATHHI5NR = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BBEESTSMI8\\KP8LJ8B9.exe\""	RMG1Q7MH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\JV5DCD98YK = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\W3MG8M9HAU\\A39AFTM5.exe\""	8JYYRDLR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\F6NYJ5J7VL = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\ZMZO5J43PZ\\QV0FRW3D.exe\""	6ZA57LQD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\2M8A0OIMQM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\G2JOW49YG2\\LMHXVZYW.exe\""	59BLA01Q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\04YA937GCI = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\6U2WE25LS9\\4EREIM0M.exe\""	8F5XJM24.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3892	cmd.exe
5280	cmd.exe
3468	cmd.exe
2864	cmd.exe
1984	cmd.exe
6064	cmd.exe
6044	cmd.exe
4512	cmd.exe
248	cmd.exe
5600	cmd.exe
5992	cmd.exe
4584	cmd.exe
4248	cmd.exe
3404	cmd.exe
4172	cmd.exe
4504	cmd.exe
876	cmd.exe
5480	cmd.exe
4668	cmd.exe
108	cmd.exe
5376	cmd.exe
912	cmd.exe
5608	cmd.exe
1156	cmd.exe
2456	cmd.exe
5828	cmd.exe
4400	cmd.exe
2996	cmd.exe
3976	cmd.exe
1936	cmd.exe
3872	cmd.exe
5732	cmd.exe
5568	cmd.exe
5132	cmd.exe
5744	cmd.exe
52	cmd.exe
5916	cmd.exe
5808	cmd.exe
1312	cmd.exe
3868	cmd.exe
5312	cmd.exe
3664	cmd.exe
3416	cmd.exe
1288	cmd.exe
544	cmd.exe
1980	cmd.exe
2080	cmd.exe
1528	cmd.exe
5884	cmd.exe
5760	cmd.exe
4340	cmd.exe
4644	cmd.exe
5584	cmd.exe
2932	cmd.exe
3360	cmd.exe
4580	cmd.exe
5316	cmd.exe
1688	cmd.exe
3716	cmd.exe
4148	cmd.exe
5416	cmd.exe
4576	cmd.exe
4596	cmd.exe
1300	cmd.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c51c-143.dat	pyinstaller

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4256	1240	k.exe	90
PID 4256 wrote to memory of 5352	4256	k.exe	92
PID 5352 wrote to memory of 1656	5352	cmd.exe	93
PID 4256 wrote to memory of 4332	4256	k.exe	94
PID 4332 wrote to memory of 672	4332	cmd.exe	95
PID 1032 wrote to memory of 3736	1032	SB7OCDWF.exe	98
PID 3736 wrote to memory of 3664	3736	SB7OCDWF.exe	99
PID 3664 wrote to memory of 2716	3664	cmd.exe	100
PID 3736 wrote to memory of 4576	3736	SB7OCDWF.exe	101
PID 4576 wrote to memory of 5932	4576	cmd.exe	102
PID 5920 wrote to memory of 5296	5920	4WZGVRKR.exe	105
PID 5296 wrote to memory of 3848	5296	4WZGVRKR.exe	106
PID 3848 wrote to memory of 2728	3848	cmd.exe	107
PID 5296 wrote to memory of 3232	5296	4WZGVRKR.exe	108
PID 3232 wrote to memory of 5768	3232	cmd.exe	109
PID 1532 wrote to memory of 2616	1532	HJ4IEOWF.exe	112
PID 2616 wrote to memory of 1576	2616	HJ4IEOWF.exe	113
PID 1576 wrote to memory of 4924	1576	cmd.exe	114
PID 2616 wrote to memory of 1792	2616	HJ4IEOWF.exe	115
PID 1792 wrote to memory of 2252	1792	cmd.exe	116
PID 3460 wrote to memory of 2636	3460	ACL0BNXV.exe	119
PID 2636 wrote to memory of 248	2636	ACL0BNXV.exe	120
PID 248 wrote to memory of 5552	248	cmd.exe	121
PID 2636 wrote to memory of 3400	2636	ACL0BNXV.exe	122
PID 3400 wrote to memory of 1752	3400	cmd.exe	123
PID 3316 wrote to memory of 5712	3316	KTWHAPCN.exe	126
PID 5712 wrote to memory of 1156	5712	KTWHAPCN.exe	127
PID 1156 wrote to memory of 5012	1156	cmd.exe	128
PID 5712 wrote to memory of 5916	5712	KTWHAPCN.exe	129
PID 5916 wrote to memory of 2476	5916	cmd.exe	130
PID 5900 wrote to memory of 3228	5900	YCZI0MX4.exe	133
PID 3228 wrote to memory of 2000	3228	YCZI0MX4.exe	134
PID 2000 wrote to memory of 5268	2000	cmd.exe	135
PID 3228 wrote to memory of 5600	3228	YCZI0MX4.exe	136
PID 5600 wrote to memory of 4904	5600	cmd.exe	137
PID 1564 wrote to memory of 464	1564	8JYYRDLR.exe	140
PID 464 wrote to memory of 4532	464	8JYYRDLR.exe	141
PID 4532 wrote to memory of 4580	4532	cmd.exe	142
PID 464 wrote to memory of 3416	464	8JYYRDLR.exe	143
PID 3416 wrote to memory of 1252	3416	cmd.exe	144
PID 1752 wrote to memory of 1236	1752	A39AFTM5.exe	147
PID 1236 wrote to memory of 4612	1236	A39AFTM5.exe	148
PID 4612 wrote to memory of 3516	4612	cmd.exe	149
PID 1236 wrote to memory of 5992	1236	A39AFTM5.exe	150
PID 5992 wrote to memory of 2520	5992	cmd.exe	151
PID 1152 wrote to memory of 2388	1152	DLUP7GL5.exe	154
PID 2388 wrote to memory of 5444	2388	DLUP7GL5.exe	155
PID 5444 wrote to memory of 4596	5444	cmd.exe	156
PID 2388 wrote to memory of 1936	2388	DLUP7GL5.exe	157
PID 1936 wrote to memory of 5404	1936	cmd.exe	158
PID 1388 wrote to memory of 4848	1388	T0Y1A530.exe	161
PID 4848 wrote to memory of 700	4848	T0Y1A530.exe	162
PID 700 wrote to memory of 3872	700	cmd.exe	163
PID 4848 wrote to memory of 876	4848	T0Y1A530.exe	164
PID 876 wrote to memory of 2964	876	cmd.exe	165
PID 5412 wrote to memory of 1132	5412	JZUOEQIT.exe	168
PID 1132 wrote to memory of 2620	1132	JZUOEQIT.exe	169
PID 2620 wrote to memory of 2192	2620	cmd.exe	170
PID 1132 wrote to memory of 5312	1132	JZUOEQIT.exe	171
PID 5312 wrote to memory of 3372	5312	cmd.exe	172
PID 5768 wrote to memory of 5592	5768	OD0ETI4Y.exe	176
PID 5592 wrote to memory of 6120	5592	OD0ETI4Y.exe	177
PID 6120 wrote to memory of 5912	6120	cmd.exe	178
PID 5592 wrote to memory of 1436	5592	OD0ETI4Y.exe	179

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4228	attrib.exe
3180	attrib.exe
5012	attrib.exe
1728	attrib.exe
5820	attrib.exe
1656	attrib.exe
6032	attrib.exe
5208	attrib.exe
2012	attrib.exe
5824	attrib.exe
2728	attrib.exe
4596	attrib.exe
2192	attrib.exe
3372	attrib.exe
2700	attrib.exe
1416	attrib.exe
1756	attrib.exe
6008	attrib.exe
2416	attrib.exe
6056	attrib.exe
5932	attrib.exe
5976	attrib.exe
3044	attrib.exe
1964	attrib.exe
4664	attrib.exe
5704	attrib.exe
3832	attrib.exe
5780	attrib.exe
2544	attrib.exe
6060	attrib.exe
2416	attrib.exe
1360	attrib.exe
4888	attrib.exe
6032	attrib.exe
1444	attrib.exe
5304	attrib.exe
1264	attrib.exe
2640	attrib.exe
1444	attrib.exe
1120	attrib.exe
4284	attrib.exe
5556	attrib.exe
5304	attrib.exe
5104	attrib.exe
3516	attrib.exe
3728	attrib.exe
2096	attrib.exe
2628	attrib.exe
2868	attrib.exe
4740	attrib.exe
2808	attrib.exe
5368	attrib.exe
1656	attrib.exe
2244	attrib.exe
4472	attrib.exe
4472	attrib.exe
3832	attrib.exe
5124	attrib.exe
5888	attrib.exe
5268	attrib.exe
2744	attrib.exe
3044	attrib.exe
3488	attrib.exe
5304	attrib.exe

C:\Users\Admin\AppData\Local\Temp\k.exe
"C:\Users\Admin\AppData\Local\Temp\k.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\k.exe
  "C:\Users\Admin\AppData\Local\Temp\k.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\AGS9EECDKK\SB7OCDWF.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5352
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\AGS9EECDKK\SB7OCDWF.exe
      4⤵
      Views/modifies file attributes
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\AGS9EECDKK"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\AGS9EECDKK
      4⤵
      PID:672

C:\Users\Admin\AppData\Roaming\Microsoft\AGS9EECDKK\SB7OCDWF.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AGS9EECDKK\SB7OCDWF.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Roaming\Microsoft\AGS9EECDKK\SB7OCDWF.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\AGS9EECDKK\SB7OCDWF.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\K3R87ZNV9B\4WZGVRKR.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\K3R87ZNV9B\4WZGVRKR.exe
      4⤵
      PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\K3R87ZNV9B"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\K3R87ZNV9B
      4⤵
      Views/modifies file attributes
      PID:5932

C:\Users\Admin\AppData\Roaming\Microsoft\K3R87ZNV9B\4WZGVRKR.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\K3R87ZNV9B\4WZGVRKR.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Users\Admin\AppData\Roaming\Microsoft\K3R87ZNV9B\4WZGVRKR.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\K3R87ZNV9B\4WZGVRKR.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\JP3WLMLJ3R\HJ4IEOWF.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\JP3WLMLJ3R\HJ4IEOWF.exe
      4⤵
      Views/modifies file attributes
      PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\JP3WLMLJ3R"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\JP3WLMLJ3R
      4⤵
      PID:5768

C:\Users\Admin\AppData\Roaming\Microsoft\JP3WLMLJ3R\HJ4IEOWF.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\JP3WLMLJ3R\HJ4IEOWF.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Roaming\Microsoft\JP3WLMLJ3R\HJ4IEOWF.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\JP3WLMLJ3R\HJ4IEOWF.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\W99VC9AGB9\ACL0BNXV.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\W99VC9AGB9\ACL0BNXV.exe
      4⤵
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\W99VC9AGB9"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\W99VC9AGB9
      4⤵
      PID:2252

C:\Users\Admin\AppData\Roaming\Microsoft\W99VC9AGB9\ACL0BNXV.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\W99VC9AGB9\ACL0BNXV.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Roaming\Microsoft\W99VC9AGB9\ACL0BNXV.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\W99VC9AGB9\ACL0BNXV.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\1PW2HYFOV9\KTWHAPCN.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\1PW2HYFOV9\KTWHAPCN.exe
      4⤵
      PID:5552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\1PW2HYFOV9"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\1PW2HYFOV9
      4⤵
      PID:1752

C:\Users\Admin\AppData\Roaming\Microsoft\1PW2HYFOV9\KTWHAPCN.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\1PW2HYFOV9\KTWHAPCN.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Roaming\Microsoft\1PW2HYFOV9\KTWHAPCN.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\1PW2HYFOV9\KTWHAPCN.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\VE7IDJK752\YCZI0MX4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\VE7IDJK752\YCZI0MX4.exe
      4⤵
      Views/modifies file attributes
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\VE7IDJK752"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5916
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\VE7IDJK752
      4⤵
      PID:2476

C:\Users\Admin\AppData\Roaming\Microsoft\VE7IDJK752\YCZI0MX4.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\VE7IDJK752\YCZI0MX4.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Users\Admin\AppData\Roaming\Microsoft\VE7IDJK752\YCZI0MX4.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\VE7IDJK752\YCZI0MX4.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\GJR1A0HEWN\8JYYRDLR.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\GJR1A0HEWN\8JYYRDLR.exe
      4⤵
      Views/modifies file attributes
      PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\GJR1A0HEWN"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5600
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\GJR1A0HEWN
      4⤵
      PID:4904

C:\Users\Admin\AppData\Roaming\Microsoft\GJR1A0HEWN\8JYYRDLR.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\GJR1A0HEWN\8JYYRDLR.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Roaming\Microsoft\GJR1A0HEWN\8JYYRDLR.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\GJR1A0HEWN\8JYYRDLR.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\W3MG8M9HAU\A39AFTM5.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\W3MG8M9HAU\A39AFTM5.exe
      4⤵
      PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\W3MG8M9HAU"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\W3MG8M9HAU
      4⤵
      PID:1252

C:\Users\Admin\AppData\Roaming\Microsoft\W3MG8M9HAU\A39AFTM5.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\W3MG8M9HAU\A39AFTM5.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Roaming\Microsoft\W3MG8M9HAU\A39AFTM5.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\W3MG8M9HAU\A39AFTM5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\V9WMI4DKP4\DLUP7GL5.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\V9WMI4DKP4\DLUP7GL5.exe
      4⤵
      Views/modifies file attributes
      PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\V9WMI4DKP4"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\V9WMI4DKP4
      4⤵
      PID:2520

C:\Users\Admin\AppData\Roaming\Microsoft\V9WMI4DKP4\DLUP7GL5.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\V9WMI4DKP4\DLUP7GL5.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Roaming\Microsoft\V9WMI4DKP4\DLUP7GL5.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\V9WMI4DKP4\DLUP7GL5.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\CID03VD8XD\T0Y1A530.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\CID03VD8XD\T0Y1A530.exe
      4⤵
      Views/modifies file attributes
      PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\CID03VD8XD"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\CID03VD8XD
      4⤵
      PID:5404

C:\Users\Admin\AppData\Roaming\Microsoft\CID03VD8XD\T0Y1A530.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CID03VD8XD\T0Y1A530.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Roaming\Microsoft\CID03VD8XD\T0Y1A530.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CID03VD8XD\T0Y1A530.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\1F71BS6QDB\JZUOEQIT.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\1F71BS6QDB\JZUOEQIT.exe
      4⤵
      PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\1F71BS6QDB"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\1F71BS6QDB
      4⤵
      PID:2964

C:\Users\Admin\AppData\Roaming\Microsoft\1F71BS6QDB\JZUOEQIT.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\1F71BS6QDB\JZUOEQIT.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Users\Admin\AppData\Roaming\Microsoft\1F71BS6QDB\JZUOEQIT.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\1F71BS6QDB\JZUOEQIT.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\YOTFCUDDK4\OD0ETI4Y.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\YOTFCUDDK4\OD0ETI4Y.exe
      4⤵
      Views/modifies file attributes
      PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\YOTFCUDDK4"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\YOTFCUDDK4
      4⤵
      Views/modifies file attributes
      PID:3372

C:\Users\Admin\AppData\Roaming\Microsoft\YOTFCUDDK4\OD0ETI4Y.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\YOTFCUDDK4\OD0ETI4Y.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Users\Admin\AppData\Roaming\Microsoft\YOTFCUDDK4\OD0ETI4Y.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\YOTFCUDDK4\OD0ETI4Y.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\AX4JGKPWPS\5URMO16U.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\AX4JGKPWPS\5URMO16U.exe
      4⤵
      PID:5912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\AX4JGKPWPS"
    3⤵
    PID:1436
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\AX4JGKPWPS
      4⤵
      PID:5764

C:\Users\Admin\AppData\Roaming\Microsoft\AX4JGKPWPS\5URMO16U.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AX4JGKPWPS\5URMO16U.exe"
1⤵
- Executes dropped EXE
PID:5696
- C:\Users\Admin\AppData\Roaming\Microsoft\AX4JGKPWPS\5URMO16U.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\AX4JGKPWPS\5URMO16U.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\A91RUPB4Z0\LFGWS3DM.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4400
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\A91RUPB4Z0\LFGWS3DM.exe
      4⤵
      Views/modifies file attributes
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\A91RUPB4Z0"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1980
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\A91RUPB4Z0
      4⤵
      Views/modifies file attributes
      PID:4740

C:\Users\Admin\AppData\Roaming\Microsoft\A91RUPB4Z0\LFGWS3DM.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\A91RUPB4Z0\LFGWS3DM.exe"
1⤵
- Executes dropped EXE
PID:1552
- C:\Users\Admin\AppData\Roaming\Microsoft\A91RUPB4Z0\LFGWS3DM.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\A91RUPB4Z0\LFGWS3DM.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\RI2BBKIUAG\WHUEHEU7.exe"
    3⤵
    PID:2692
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\RI2BBKIUAG\WHUEHEU7.exe
      4⤵
      Views/modifies file attributes
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\RI2BBKIUAG"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5480
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\RI2BBKIUAG
      4⤵
      Views/modifies file attributes
      PID:3728

C:\Users\Admin\AppData\Roaming\Microsoft\RI2BBKIUAG\WHUEHEU7.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\RI2BBKIUAG\WHUEHEU7.exe"
1⤵
- Executes dropped EXE
PID:1508
- C:\Users\Admin\AppData\Roaming\Microsoft\RI2BBKIUAG\WHUEHEU7.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\RI2BBKIUAG\WHUEHEU7.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\A01BAS4TKH\WU9L01YQ.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4584
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\A01BAS4TKH\WU9L01YQ.exe
      4⤵
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\A01BAS4TKH"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3892
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\A01BAS4TKH
      4⤵
      PID:2968

C:\Users\Admin\AppData\Roaming\Microsoft\A01BAS4TKH\WU9L01YQ.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\A01BAS4TKH\WU9L01YQ.exe"
1⤵
- Executes dropped EXE
PID:3276
- C:\Users\Admin\AppData\Roaming\Microsoft\A01BAS4TKH\WU9L01YQ.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\A01BAS4TKH\WU9L01YQ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\SQQV2W44PR\W4TBE3W8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5808
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\SQQV2W44PR\W4TBE3W8.exe
      4⤵
      PID:3812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\SQQV2W44PR"
    3⤵
    PID:2828
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\SQQV2W44PR
      4⤵
      Views/modifies file attributes
      PID:2808

C:\Users\Admin\AppData\Roaming\Microsoft\SQQV2W44PR\W4TBE3W8.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\SQQV2W44PR\W4TBE3W8.exe"
1⤵
- Executes dropped EXE
PID:3516
- C:\Users\Admin\AppData\Roaming\Microsoft\SQQV2W44PR\W4TBE3W8.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SQQV2W44PR\W4TBE3W8.exe"
  2⤵
  - Executes dropped EXE
  PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\1A6BMJT1WJ\UOAJ217E.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4596
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\1A6BMJT1WJ\UOAJ217E.exe
      4⤵
      Views/modifies file attributes
      PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\1A6BMJT1WJ"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5884
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\1A6BMJT1WJ
      4⤵
      Views/modifies file attributes
      PID:1360

C:\Users\Admin\AppData\Roaming\Microsoft\1A6BMJT1WJ\UOAJ217E.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\1A6BMJT1WJ\UOAJ217E.exe"
1⤵
- Executes dropped EXE
PID:5036
- C:\Users\Admin\AppData\Roaming\Microsoft\1A6BMJT1WJ\UOAJ217E.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\1A6BMJT1WJ\UOAJ217E.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\QP6B09CL27\D91VCL7P.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4580
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\QP6B09CL27\D91VCL7P.exe
      4⤵
      PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\QP6B09CL27"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3872
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\QP6B09CL27
      4⤵
      PID:2428

C:\Users\Admin\AppData\Roaming\Microsoft\QP6B09CL27\D91VCL7P.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\QP6B09CL27\D91VCL7P.exe"
1⤵
- Executes dropped EXE
PID:3676
- C:\Users\Admin\AppData\Roaming\Microsoft\QP6B09CL27\D91VCL7P.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\QP6B09CL27\D91VCL7P.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\YKPMA9F3R2\R4PXY9DS.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5280
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\YKPMA9F3R2\R4PXY9DS.exe
      4⤵
      Views/modifies file attributes
      PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\YKPMA9F3R2"
    3⤵
    PID:3120
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\YKPMA9F3R2
      4⤵
      Views/modifies file attributes
      PID:2096

C:\Users\Admin\AppData\Roaming\Microsoft\YKPMA9F3R2\R4PXY9DS.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\YKPMA9F3R2\R4PXY9DS.exe"
1⤵
- Executes dropped EXE
PID:3728
- C:\Users\Admin\AppData\Roaming\Microsoft\YKPMA9F3R2\R4PXY9DS.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\YKPMA9F3R2\R4PXY9DS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\VUJDUO6GW8\4MKSL9TL.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3868
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\VUJDUO6GW8\4MKSL9TL.exe
      4⤵
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\VUJDUO6GW8"
    3⤵
    PID:4660
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\VUJDUO6GW8
      4⤵
      PID:4552

C:\Users\Admin\AppData\Roaming\Microsoft\VUJDUO6GW8\4MKSL9TL.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\VUJDUO6GW8\4MKSL9TL.exe"
1⤵
- Executes dropped EXE
PID:2920
- C:\Users\Admin\AppData\Roaming\Microsoft\VUJDUO6GW8\4MKSL9TL.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\VUJDUO6GW8\4MKSL9TL.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\6492KUZC8K\VV64Y8GW.exe"
    3⤵
    PID:5612
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\6492KUZC8K\VV64Y8GW.exe
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\6492KUZC8K"
    3⤵
    PID:5448
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\6492KUZC8K
      4⤵
      PID:3924

C:\Users\Admin\AppData\Roaming\Microsoft\6492KUZC8K\VV64Y8GW.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\6492KUZC8K\VV64Y8GW.exe"
1⤵
- Executes dropped EXE
PID:2508
- C:\Users\Admin\AppData\Roaming\Microsoft\6492KUZC8K\VV64Y8GW.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\6492KUZC8K\VV64Y8GW.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\PRIIL04CK5\6ZA57LQD.exe"
    3⤵
    PID:4176
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\PRIIL04CK5\6ZA57LQD.exe
      4⤵
      PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\PRIIL04CK5"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4248
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\PRIIL04CK5
      4⤵
      PID:2020

C:\Users\Admin\AppData\Roaming\Microsoft\PRIIL04CK5\6ZA57LQD.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\PRIIL04CK5\6ZA57LQD.exe"
1⤵
- Executes dropped EXE
PID:5404
- C:\Users\Admin\AppData\Roaming\Microsoft\PRIIL04CK5\6ZA57LQD.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\PRIIL04CK5\6ZA57LQD.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\ZMZO5J43PZ\QV0FRW3D.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4668
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\ZMZO5J43PZ\QV0FRW3D.exe
      4⤵
      Views/modifies file attributes
      PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\ZMZO5J43PZ"
    3⤵
    PID:2848
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\ZMZO5J43PZ
      4⤵
      PID:3332

C:\Users\Admin\AppData\Roaming\Microsoft\ZMZO5J43PZ\QV0FRW3D.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\ZMZO5J43PZ\QV0FRW3D.exe"
1⤵
- Executes dropped EXE
PID:4260
- C:\Users\Admin\AppData\Roaming\Microsoft\ZMZO5J43PZ\QV0FRW3D.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\ZMZO5J43PZ\QV0FRW3D.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\S21D5B1W3U\AVJYRS0F.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5316
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\S21D5B1W3U\AVJYRS0F.exe
      4⤵
      PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\S21D5B1W3U"
    3⤵
    PID:2348
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\S21D5B1W3U
      4⤵
      PID:4616

C:\Users\Admin\AppData\Roaming\Microsoft\S21D5B1W3U\AVJYRS0F.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\S21D5B1W3U\AVJYRS0F.exe"
1⤵
- Executes dropped EXE
PID:1652
- C:\Users\Admin\AppData\Roaming\Microsoft\S21D5B1W3U\AVJYRS0F.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\S21D5B1W3U\AVJYRS0F.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\8576UXCS4T\2D0COY02.exe"
    3⤵
    PID:4792
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\8576UXCS4T\2D0COY02.exe
      4⤵
      PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\8576UXCS4T"
    3⤵
    PID:5968
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\8576UXCS4T
      4⤵
      Views/modifies file attributes
      PID:5976

C:\Users\Admin\AppData\Roaming\Microsoft\8576UXCS4T\2D0COY02.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\8576UXCS4T\2D0COY02.exe"
1⤵
- Executes dropped EXE
PID:4516
- C:\Users\Admin\AppData\Roaming\Microsoft\8576UXCS4T\2D0COY02.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\8576UXCS4T\2D0COY02.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\65C210CGMK\IUW4JTF9.exe"
    3⤵
    PID:1148
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\65C210CGMK\IUW4JTF9.exe
      4⤵
      PID:1216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\65C210CGMK"
    3⤵
    PID:2468
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\65C210CGMK
      4⤵
      PID:2476

C:\Users\Admin\AppData\Roaming\Microsoft\65C210CGMK\IUW4JTF9.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\65C210CGMK\IUW4JTF9.exe"
1⤵
- Executes dropped EXE
PID:2008
- C:\Users\Admin\AppData\Roaming\Microsoft\65C210CGMK\IUW4JTF9.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\65C210CGMK\IUW4JTF9.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\T0GW0LJ0KA\57GF5TE8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1288
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\T0GW0LJ0KA\57GF5TE8.exe
      4⤵
      Views/modifies file attributes
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\T0GW0LJ0KA"
    3⤵
    PID:1160
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\T0GW0LJ0KA
      4⤵
      Views/modifies file attributes
      PID:5556

C:\Users\Admin\AppData\Roaming\Microsoft\T0GW0LJ0KA\57GF5TE8.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\T0GW0LJ0KA\57GF5TE8.exe"
1⤵
- Executes dropped EXE
PID:4128
- C:\Users\Admin\AppData\Roaming\Microsoft\T0GW0LJ0KA\57GF5TE8.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\T0GW0LJ0KA\57GF5TE8.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\N6I60V0CF4\A149WIAY.exe"
    3⤵
    PID:5852
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\N6I60V0CF4\A149WIAY.exe
      4⤵
      Views/modifies file attributes
      PID:2640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\N6I60V0CF4"
    3⤵
    PID:2964
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\N6I60V0CF4
      4⤵
      Views/modifies file attributes
      PID:3044

C:\Users\Admin\AppData\Roaming\Microsoft\N6I60V0CF4\A149WIAY.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\N6I60V0CF4\A149WIAY.exe"
1⤵
- Executes dropped EXE
PID:980
- C:\Users\Admin\AppData\Roaming\Microsoft\N6I60V0CF4\A149WIAY.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\N6I60V0CF4\A149WIAY.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\IEANBUM12O\QVIOP6VZ.exe"
    3⤵
    PID:2656
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\IEANBUM12O\QVIOP6VZ.exe
      4⤵
      Views/modifies file attributes
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\IEANBUM12O"
    3⤵
    PID:3168
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\IEANBUM12O
      4⤵
      PID:1908

C:\Users\Admin\AppData\Roaming\Microsoft\IEANBUM12O\QVIOP6VZ.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IEANBUM12O\QVIOP6VZ.exe"
1⤵
- Executes dropped EXE
PID:5324
- C:\Users\Admin\AppData\Roaming\Microsoft\IEANBUM12O\QVIOP6VZ.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\IEANBUM12O\QVIOP6VZ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\LY6XZNBSX7\MQBEOJUQ.exe"
    3⤵
    PID:2272
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\LY6XZNBSX7\MQBEOJUQ.exe
      4⤵
      Views/modifies file attributes
      PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\LY6XZNBSX7"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2932
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\LY6XZNBSX7
      4⤵
      Views/modifies file attributes
      PID:3044

C:\Users\Admin\AppData\Roaming\Microsoft\LY6XZNBSX7\MQBEOJUQ.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\LY6XZNBSX7\MQBEOJUQ.exe"
1⤵
- Executes dropped EXE
PID:2488
- C:\Users\Admin\AppData\Roaming\Microsoft\LY6XZNBSX7\MQBEOJUQ.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\LY6XZNBSX7\MQBEOJUQ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\XV52KDHL4E\59BLA01Q.exe"
    3⤵
    PID:2728
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\XV52KDHL4E\59BLA01Q.exe
      4⤵
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\XV52KDHL4E"
    3⤵
    PID:5544
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\XV52KDHL4E
      4⤵
      Views/modifies file attributes
      PID:6032

C:\Users\Admin\AppData\Roaming\Microsoft\XV52KDHL4E\59BLA01Q.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\XV52KDHL4E\59BLA01Q.exe"
1⤵
- Executes dropped EXE
PID:3220
- C:\Users\Admin\AppData\Roaming\Microsoft\XV52KDHL4E\59BLA01Q.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\XV52KDHL4E\59BLA01Q.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\G2JOW49YG2\LMHXVZYW.exe"
    3⤵
    PID:672
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\G2JOW49YG2\LMHXVZYW.exe
      4⤵
      PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\G2JOW49YG2"
    3⤵
    PID:3396
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\G2JOW49YG2
      4⤵
      PID:4252

C:\Users\Admin\AppData\Roaming\Microsoft\G2JOW49YG2\LMHXVZYW.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\G2JOW49YG2\LMHXVZYW.exe"
1⤵
PID:2428
- C:\Users\Admin\AppData\Roaming\Microsoft\G2JOW49YG2\LMHXVZYW.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\G2JOW49YG2\LMHXVZYW.exe"
  2⤵
  - Adds Run key to start application
  PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\BCX3T3GCDX\4LMI874R.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:108
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\BCX3T3GCDX\4LMI874R.exe
      4⤵
      Views/modifies file attributes
      PID:2244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\BCX3T3GCDX"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3468
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\BCX3T3GCDX
      4⤵
      Views/modifies file attributes
      PID:1756

C:\Users\Admin\AppData\Roaming\Microsoft\BCX3T3GCDX\4LMI874R.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BCX3T3GCDX\4LMI874R.exe"
1⤵
PID:5976
- C:\Users\Admin\AppData\Roaming\Microsoft\BCX3T3GCDX\4LMI874R.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\BCX3T3GCDX\4LMI874R.exe"
  2⤵
  - Adds Run key to start application
  PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\C27PG1US16\WHZ0RZ2J.exe"
    3⤵
    PID:472
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\C27PG1US16\WHZ0RZ2J.exe
      4⤵
      PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\C27PG1US16"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5732
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\C27PG1US16
      4⤵
      Views/modifies file attributes
      PID:1656

C:\Users\Admin\AppData\Roaming\Microsoft\C27PG1US16\WHZ0RZ2J.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\C27PG1US16\WHZ0RZ2J.exe"
1⤵
PID:2808
- C:\Users\Admin\AppData\Roaming\Microsoft\C27PG1US16\WHZ0RZ2J.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\C27PG1US16\WHZ0RZ2J.exe"
  2⤵
  - Adds Run key to start application
  PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\NAEPWVK56F\KGVV77C1.exe"
    3⤵
    PID:3556
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\NAEPWVK56F\KGVV77C1.exe
      4⤵
      Views/modifies file attributes
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\NAEPWVK56F"
    3⤵
    PID:3856
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\NAEPWVK56F
      4⤵
      Views/modifies file attributes
      PID:1964

C:\Users\Admin\AppData\Roaming\Microsoft\NAEPWVK56F\KGVV77C1.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\NAEPWVK56F\KGVV77C1.exe"
1⤵
PID:2252
- C:\Users\Admin\AppData\Roaming\Microsoft\NAEPWVK56F\KGVV77C1.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\NAEPWVK56F\KGVV77C1.exe"
  2⤵
  - Adds Run key to start application
  PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\FU91X4IQDQ\UW2188SM.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3404
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\FU91X4IQDQ\UW2188SM.exe
      4⤵
      PID:6052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\FU91X4IQDQ"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3360
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\FU91X4IQDQ
      4⤵
      Views/modifies file attributes
      PID:1444

C:\Users\Admin\AppData\Roaming\Microsoft\FU91X4IQDQ\UW2188SM.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\FU91X4IQDQ\UW2188SM.exe"
1⤵
PID:5528
- C:\Users\Admin\AppData\Roaming\Microsoft\FU91X4IQDQ\UW2188SM.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\FU91X4IQDQ\UW2188SM.exe"
  2⤵
  - Adds Run key to start application
  PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\HZ8H7OTBAC\CL3ZVQ0G.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5760
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\HZ8H7OTBAC\CL3ZVQ0G.exe
      4⤵
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\HZ8H7OTBAC"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4340
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\HZ8H7OTBAC
      4⤵
      PID:3184

C:\Users\Admin\AppData\Roaming\Microsoft\HZ8H7OTBAC\CL3ZVQ0G.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\HZ8H7OTBAC\CL3ZVQ0G.exe"
1⤵
PID:1392
- C:\Users\Admin\AppData\Roaming\Microsoft\HZ8H7OTBAC\CL3ZVQ0G.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\HZ8H7OTBAC\CL3ZVQ0G.exe"
  2⤵
  - Adds Run key to start application
  PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\BDWJV19IL7\CI4HQ13Q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4148
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\BDWJV19IL7\CI4HQ13Q.exe
      4⤵
      Views/modifies file attributes
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\BDWJV19IL7"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5568
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\BDWJV19IL7
      4⤵
      PID:4408

C:\Users\Admin\AppData\Roaming\Microsoft\BDWJV19IL7\CI4HQ13Q.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BDWJV19IL7\CI4HQ13Q.exe"
1⤵
PID:1708
- C:\Users\Admin\AppData\Roaming\Microsoft\BDWJV19IL7\CI4HQ13Q.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\BDWJV19IL7\CI4HQ13Q.exe"
  2⤵
  - Adds Run key to start application
  PID:1892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\MH14UXA5JW\1544BFWM.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2864
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\MH14UXA5JW\1544BFWM.exe
      4⤵
      Views/modifies file attributes
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\MH14UXA5JW"
    3⤵
    PID:4232
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\MH14UXA5JW
      4⤵
      Views/modifies file attributes
      PID:2544

C:\Users\Admin\AppData\Roaming\Microsoft\MH14UXA5JW\1544BFWM.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\MH14UXA5JW\1544BFWM.exe"
1⤵
PID:3828
- C:\Users\Admin\AppData\Roaming\Microsoft\MH14UXA5JW\1544BFWM.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\MH14UXA5JW\1544BFWM.exe"
  2⤵
  - Adds Run key to start application
  PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\9C7WY625KM\W7ODJ1ZJ.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2456
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\9C7WY625KM\W7ODJ1ZJ.exe
      4⤵
      Views/modifies file attributes
      PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\9C7WY625KM"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1984
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\9C7WY625KM
      4⤵
      PID:2192

C:\Users\Admin\AppData\Roaming\Microsoft\9C7WY625KM\W7ODJ1ZJ.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\9C7WY625KM\W7ODJ1ZJ.exe"
1⤵
PID:1720
- C:\Users\Admin\AppData\Roaming\Microsoft\9C7WY625KM\W7ODJ1ZJ.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\9C7WY625KM\W7ODJ1ZJ.exe"
  2⤵
  PID:2576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\17OBZJRMH9\HY9SS59W.exe"
    3⤵
    PID:3044
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\17OBZJRMH9\HY9SS59W.exe
      4⤵
      Views/modifies file attributes
      PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\17OBZJRMH9"
    3⤵
    PID:6020
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\17OBZJRMH9
      4⤵
      PID:1656

C:\Users\Admin\AppData\Roaming\Microsoft\17OBZJRMH9\HY9SS59W.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\17OBZJRMH9\HY9SS59W.exe"
1⤵
PID:2212
- C:\Users\Admin\AppData\Roaming\Microsoft\17OBZJRMH9\HY9SS59W.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\17OBZJRMH9\HY9SS59W.exe"
  2⤵
  - Adds Run key to start application
  PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\C9WP1A5VF9\1AINE0YH.exe"
    3⤵
    PID:5348
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\C9WP1A5VF9\1AINE0YH.exe
      4⤵
      PID:1168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\C9WP1A5VF9"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5828
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\C9WP1A5VF9
      4⤵
      PID:4728

C:\Users\Admin\AppData\Roaming\Microsoft\C9WP1A5VF9\1AINE0YH.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\C9WP1A5VF9\1AINE0YH.exe"
1⤵
PID:756
- C:\Users\Admin\AppData\Roaming\Microsoft\C9WP1A5VF9\1AINE0YH.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\C9WP1A5VF9\1AINE0YH.exe"
  2⤵
  - Adds Run key to start application
  PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\6DHUT03BTH\CN1OED7Q.exe"
    3⤵
    PID:3696
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\6DHUT03BTH\CN1OED7Q.exe
      4⤵
      Views/modifies file attributes
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\6DHUT03BTH"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1312
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\6DHUT03BTH
      4⤵
      PID:4448

C:\Users\Admin\AppData\Roaming\Microsoft\6DHUT03BTH\CN1OED7Q.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\6DHUT03BTH\CN1OED7Q.exe"
1⤵
PID:4924
- C:\Users\Admin\AppData\Roaming\Microsoft\6DHUT03BTH\CN1OED7Q.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\6DHUT03BTH\CN1OED7Q.exe"
  2⤵
  - Adds Run key to start application
  PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\UDCYDEPMFI\QULVG6M3.exe"
    3⤵
    PID:1884
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\UDCYDEPMFI\QULVG6M3.exe
      4⤵
      Views/modifies file attributes
      PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\UDCYDEPMFI"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2996
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\UDCYDEPMFI
      4⤵
      Views/modifies file attributes
      PID:5704

C:\Users\Admin\AppData\Roaming\Microsoft\UDCYDEPMFI\QULVG6M3.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\UDCYDEPMFI\QULVG6M3.exe"
1⤵
PID:3292
- C:\Users\Admin\AppData\Roaming\Microsoft\UDCYDEPMFI\QULVG6M3.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\UDCYDEPMFI\QULVG6M3.exe"
  2⤵
  PID:2880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\VBD5A2WJ8Q\UB7HDQLB.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4172
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\VBD5A2WJ8Q\UB7HDQLB.exe
      4⤵
      Views/modifies file attributes
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\VBD5A2WJ8Q"
    3⤵
    PID:1272
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\VBD5A2WJ8Q
      4⤵
      PID:2224

C:\Users\Admin\AppData\Roaming\Microsoft\VBD5A2WJ8Q\UB7HDQLB.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\VBD5A2WJ8Q\UB7HDQLB.exe"
1⤵
PID:5736
- C:\Users\Admin\AppData\Roaming\Microsoft\VBD5A2WJ8Q\UB7HDQLB.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\VBD5A2WJ8Q\UB7HDQLB.exe"
  2⤵
  - Adds Run key to start application
  PID:476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\SG5PCDIWNI\9JFQTEB8.exe"
    3⤵
    PID:5504
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\SG5PCDIWNI\9JFQTEB8.exe
      4⤵
      Views/modifies file attributes
      PID:6032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\SG5PCDIWNI"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4644
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\SG5PCDIWNI
      4⤵
      PID:5552

C:\Users\Admin\AppData\Roaming\Microsoft\SG5PCDIWNI\9JFQTEB8.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\SG5PCDIWNI\9JFQTEB8.exe"
1⤵
PID:2168
- C:\Users\Admin\AppData\Roaming\Microsoft\SG5PCDIWNI\9JFQTEB8.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SG5PCDIWNI\9JFQTEB8.exe"
  2⤵
  - Adds Run key to start application
  PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\5TYZYGADTT\13X7HIMF.exe"
    3⤵
    PID:5244
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\5TYZYGADTT\13X7HIMF.exe
      4⤵
      Views/modifies file attributes
      PID:1444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\5TYZYGADTT"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6064
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\5TYZYGADTT
      4⤵
      PID:3096

C:\Users\Admin\AppData\Roaming\Microsoft\5TYZYGADTT\13X7HIMF.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\5TYZYGADTT\13X7HIMF.exe"
1⤵
PID:3600
- C:\Users\Admin\AppData\Roaming\Microsoft\5TYZYGADTT\13X7HIMF.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\5TYZYGADTT\13X7HIMF.exe"
  2⤵
  - Adds Run key to start application
  PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\08YDGCGKIB\8F5XJM24.exe"
    3⤵
    PID:1224
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\08YDGCGKIB\8F5XJM24.exe
      4⤵
      Views/modifies file attributes
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\08YDGCGKIB"
    3⤵
    PID:4116
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\08YDGCGKIB
      4⤵
      Views/modifies file attributes
      PID:2628

C:\Users\Admin\AppData\Roaming\Microsoft\08YDGCGKIB\8F5XJM24.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\08YDGCGKIB\8F5XJM24.exe"
1⤵
PID:2544
- C:\Users\Admin\AppData\Roaming\Microsoft\08YDGCGKIB\8F5XJM24.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\08YDGCGKIB\8F5XJM24.exe"
  2⤵
  - Adds Run key to start application
  PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\6U2WE25LS9\4EREIM0M.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5744
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\6U2WE25LS9\4EREIM0M.exe
      4⤵
      PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\6U2WE25LS9"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:52
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\6U2WE25LS9
      4⤵
      Views/modifies file attributes
      PID:5824

C:\Users\Admin\AppData\Roaming\Microsoft\6U2WE25LS9\4EREIM0M.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\6U2WE25LS9\4EREIM0M.exe"
1⤵
PID:5304
- C:\Users\Admin\AppData\Roaming\Microsoft\6U2WE25LS9\4EREIM0M.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\6U2WE25LS9\4EREIM0M.exe"
  2⤵
  - Adds Run key to start application
  PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\OZPJDT8813\OJIII7DW.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1300
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\OZPJDT8813\OJIII7DW.exe
      4⤵
      PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\OZPJDT8813"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5584
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\OZPJDT8813
      4⤵
      PID:5564

C:\Users\Admin\AppData\Roaming\Microsoft\OZPJDT8813\OJIII7DW.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\OZPJDT8813\OJIII7DW.exe"
1⤵
PID:6052
- C:\Users\Admin\AppData\Roaming\Microsoft\OZPJDT8813\OJIII7DW.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\OZPJDT8813\OJIII7DW.exe"
  2⤵
  - Adds Run key to start application
  PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\6MVL6GJXPF\BD6WHO3R.exe"
    3⤵
    PID:3216
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\6MVL6GJXPF\BD6WHO3R.exe
      4⤵
      PID:5556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\6MVL6GJXPF"
    3⤵
    PID:1656
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\6MVL6GJXPF
      4⤵
      Views/modifies file attributes
      PID:5208

C:\Users\Admin\AppData\Roaming\Microsoft\6MVL6GJXPF\BD6WHO3R.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\6MVL6GJXPF\BD6WHO3R.exe"
1⤵
PID:4724
- C:\Users\Admin\AppData\Roaming\Microsoft\6MVL6GJXPF\BD6WHO3R.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\6MVL6GJXPF\BD6WHO3R.exe"
  2⤵
  - Adds Run key to start application
  PID:3776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\49UB906TR1\RMG1Q7MH.exe"
    3⤵
    PID:6132
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\49UB906TR1\RMG1Q7MH.exe
      4⤵
      Views/modifies file attributes
      PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\49UB906TR1"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5376
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\49UB906TR1
      4⤵
      Views/modifies file attributes
      PID:1416

C:\Users\Admin\AppData\Roaming\Microsoft\49UB906TR1\RMG1Q7MH.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\49UB906TR1\RMG1Q7MH.exe"
1⤵
PID:5356
- C:\Users\Admin\AppData\Roaming\Microsoft\49UB906TR1\RMG1Q7MH.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\49UB906TR1\RMG1Q7MH.exe"
  2⤵
  - Adds Run key to start application
  PID:1184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\BBEESTSMI8\KP8LJ8B9.exe"
    3⤵
    PID:4836
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\BBEESTSMI8\KP8LJ8B9.exe
      4⤵
      PID:3552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\BBEESTSMI8"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6044
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\BBEESTSMI8
      4⤵
      PID:4456

C:\Users\Admin\AppData\Roaming\Microsoft\BBEESTSMI8\KP8LJ8B9.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BBEESTSMI8\KP8LJ8B9.exe"
1⤵
PID:1416
- C:\Users\Admin\AppData\Roaming\Microsoft\BBEESTSMI8\KP8LJ8B9.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\BBEESTSMI8\KP8LJ8B9.exe"
  2⤵
  - Adds Run key to start application
  PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\SRC32XI4DD\VI45VBQZ.exe"
    3⤵
    PID:3668
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\SRC32XI4DD\VI45VBQZ.exe
      4⤵
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\SRC32XI4DD"
    3⤵
    PID:2716
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\SRC32XI4DD
      4⤵
      PID:3984

C:\Users\Admin\AppData\Roaming\Microsoft\SRC32XI4DD\VI45VBQZ.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\SRC32XI4DD\VI45VBQZ.exe"
1⤵
PID:5552
- C:\Users\Admin\AppData\Roaming\Microsoft\SRC32XI4DD\VI45VBQZ.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SRC32XI4DD\VI45VBQZ.exe"
  2⤵
  - Adds Run key to start application
  PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\W9E4NQIKXE\0E68F0Z8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3976
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\W9E4NQIKXE\0E68F0Z8.exe
      4⤵
      Views/modifies file attributes
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\W9E4NQIKXE"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5608
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\W9E4NQIKXE
      4⤵
      PID:1780

C:\Users\Admin\AppData\Roaming\Microsoft\W9E4NQIKXE\0E68F0Z8.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\W9E4NQIKXE\0E68F0Z8.exe"
1⤵
PID:4664
- C:\Users\Admin\AppData\Roaming\Microsoft\W9E4NQIKXE\0E68F0Z8.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\W9E4NQIKXE\0E68F0Z8.exe"
  2⤵
  - Adds Run key to start application
  PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\RS1W91YNMW\EXG4REFX.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2080
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\RS1W91YNMW\EXG4REFX.exe
      4⤵
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\RS1W91YNMW"
    3⤵
    PID:3336
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\RS1W91YNMW
      4⤵
      PID:2912

C:\Users\Admin\AppData\Roaming\Microsoft\RS1W91YNMW\EXG4REFX.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\RS1W91YNMW\EXG4REFX.exe"
1⤵
PID:6060
- C:\Users\Admin\AppData\Roaming\Microsoft\RS1W91YNMW\EXG4REFX.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\RS1W91YNMW\EXG4REFX.exe"
  2⤵
  - Adds Run key to start application
  PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\HD652CEUBP\5FT8C6U6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5132
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\HD652CEUBP\5FT8C6U6.exe
      4⤵
      PID:3568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\HD652CEUBP"
    3⤵
    PID:4824
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\HD652CEUBP
      4⤵
      Views/modifies file attributes
      PID:1120

C:\Users\Admin\AppData\Roaming\Microsoft\HD652CEUBP\5FT8C6U6.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\HD652CEUBP\5FT8C6U6.exe"
1⤵
PID:5008
- C:\Users\Admin\AppData\Roaming\Microsoft\HD652CEUBP\5FT8C6U6.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\HD652CEUBP\5FT8C6U6.exe"
  2⤵
  - Adds Run key to start application
  PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\FZZOTEC70Q\8HTJS82A.exe"
    3⤵
    PID:1488
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\FZZOTEC70Q\8HTJS82A.exe
      4⤵
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\FZZOTEC70Q"
    3⤵
    PID:4084
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\FZZOTEC70Q
      4⤵
      Views/modifies file attributes
      PID:2868

C:\Users\Admin\AppData\Roaming\Microsoft\FZZOTEC70Q\8HTJS82A.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\FZZOTEC70Q\8HTJS82A.exe"
1⤵
PID:5868
- C:\Users\Admin\AppData\Roaming\Microsoft\FZZOTEC70Q\8HTJS82A.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\FZZOTEC70Q\8HTJS82A.exe"
  2⤵
  - Adds Run key to start application
  PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\N6YFEH8HR8\WQVGT708.exe"
    3⤵
    PID:1548
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\N6YFEH8HR8\WQVGT708.exe
      4⤵
      PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\N6YFEH8HR8"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1688
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\N6YFEH8HR8
      4⤵
      PID:6096

C:\Users\Admin\AppData\Roaming\Microsoft\N6YFEH8HR8\WQVGT708.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\N6YFEH8HR8\WQVGT708.exe"
1⤵
PID:948
- C:\Users\Admin\AppData\Roaming\Microsoft\N6YFEH8HR8\WQVGT708.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\N6YFEH8HR8\WQVGT708.exe"
  2⤵
  - Adds Run key to start application
  PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\FJ99DP00CK\7GIWMQBJ.exe"
    3⤵
    PID:244
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\FJ99DP00CK\7GIWMQBJ.exe
      4⤵
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\FJ99DP00CK"
    3⤵
    PID:3952
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\FJ99DP00CK
      4⤵
      PID:3176

C:\Users\Admin\AppData\Roaming\Microsoft\FJ99DP00CK\7GIWMQBJ.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\FJ99DP00CK\7GIWMQBJ.exe"
1⤵
PID:1192
- C:\Users\Admin\AppData\Roaming\Microsoft\FJ99DP00CK\7GIWMQBJ.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\FJ99DP00CK\7GIWMQBJ.exe"
  2⤵
  PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\7NY9VNRVCC\IHXFP8DH.exe"
    3⤵
    PID:3436
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\7NY9VNRVCC\IHXFP8DH.exe
      4⤵
      Views/modifies file attributes
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\7NY9VNRVCC"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4512
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\7NY9VNRVCC
      4⤵
      Views/modifies file attributes
      PID:2416

C:\Users\Admin\AppData\Roaming\Microsoft\7NY9VNRVCC\IHXFP8DH.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\7NY9VNRVCC\IHXFP8DH.exe"
1⤵
PID:4180
- C:\Users\Admin\AppData\Roaming\Microsoft\7NY9VNRVCC\IHXFP8DH.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\7NY9VNRVCC\IHXFP8DH.exe"
  2⤵
  - Adds Run key to start application
  PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\N550V0917X\DGBW5K9F.exe"
    3⤵
    PID:3812
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\N550V0917X\DGBW5K9F.exe
      4⤵
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\N550V0917X"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3716
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\N550V0917X
      4⤵
      Views/modifies file attributes
      PID:3832

C:\Users\Admin\AppData\Roaming\Microsoft\N550V0917X\DGBW5K9F.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\N550V0917X\DGBW5K9F.exe"
1⤵
PID:5848
- C:\Users\Admin\AppData\Roaming\Microsoft\N550V0917X\DGBW5K9F.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\N550V0917X\DGBW5K9F.exe"
  2⤵
  - Adds Run key to start application
  PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\EDCK6XH61R\GFGCA2NK.exe"
    3⤵
    PID:4888
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\EDCK6XH61R\GFGCA2NK.exe
      4⤵
      Views/modifies file attributes
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\EDCK6XH61R"
    3⤵
    PID:1296
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\EDCK6XH61R
      4⤵
      PID:5300

C:\Users\Admin\AppData\Roaming\Microsoft\EDCK6XH61R\GFGCA2NK.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\EDCK6XH61R\GFGCA2NK.exe"
1⤵
PID:2760
- C:\Users\Admin\AppData\Roaming\Microsoft\EDCK6XH61R\GFGCA2NK.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\EDCK6XH61R\GFGCA2NK.exe"
  2⤵
  - Adds Run key to start application
  PID:5596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\E32WGNG72W\KYZFM53Z.exe"
    3⤵
    PID:1696
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\E32WGNG72W\KYZFM53Z.exe
      4⤵
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\E32WGNG72W"
    3⤵
    PID:3768
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\E32WGNG72W
      4⤵
      Views/modifies file attributes
      PID:4228

C:\Users\Admin\AppData\Roaming\Microsoft\E32WGNG72W\KYZFM53Z.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\E32WGNG72W\KYZFM53Z.exe"
1⤵
PID:5952
- C:\Users\Admin\AppData\Roaming\Microsoft\E32WGNG72W\KYZFM53Z.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\E32WGNG72W\KYZFM53Z.exe"
  2⤵
  - Adds Run key to start application
  PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\EP7SVWS21W\67P2WN9K.exe"
    3⤵
    PID:4764
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\EP7SVWS21W\67P2WN9K.exe
      4⤵
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\EP7SVWS21W"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1528
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\EP7SVWS21W
      4⤵
      Views/modifies file attributes
      PID:6056

C:\Users\Admin\AppData\Roaming\Microsoft\EP7SVWS21W\67P2WN9K.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\EP7SVWS21W\67P2WN9K.exe"
1⤵
PID:1260
- C:\Users\Admin\AppData\Roaming\Microsoft\EP7SVWS21W\67P2WN9K.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\EP7SVWS21W\67P2WN9K.exe"
  2⤵
  - Adds Run key to start application
  PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Q6AB7G8SP5\7OIY7BFO.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:912
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Q6AB7G8SP5\7OIY7BFO.exe
      4⤵
      PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Q6AB7G8SP5"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4504
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Q6AB7G8SP5
      4⤵
      PID:264

C:\Users\Admin\AppData\Roaming\Microsoft\Q6AB7G8SP5\7OIY7BFO.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Q6AB7G8SP5\7OIY7BFO.exe"
1⤵
PID:1748
- C:\Users\Admin\AppData\Roaming\Microsoft\Q6AB7G8SP5\7OIY7BFO.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Q6AB7G8SP5\7OIY7BFO.exe"
  2⤵
  - Adds Run key to start application
  PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\GZUVYBODRJ\GQZ284ZY.exe"
    3⤵
    PID:3744
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\GZUVYBODRJ\GQZ284ZY.exe
      4⤵
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\GZUVYBODRJ"
    3⤵
    PID:1780
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\GZUVYBODRJ
      4⤵
      PID:1280

C:\Users\Admin\AppData\Roaming\Microsoft\GZUVYBODRJ\GQZ284ZY.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\GZUVYBODRJ\GQZ284ZY.exe"
1⤵
PID:4496
- C:\Users\Admin\AppData\Roaming\Microsoft\GZUVYBODRJ\GQZ284ZY.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\GZUVYBODRJ\GQZ284ZY.exe"
  2⤵
  - Adds Run key to start application
  PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\71Q5PY5YHJ\VX2KWTYQ.exe"
    3⤵
    PID:3852
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\71Q5PY5YHJ\VX2KWTYQ.exe
      4⤵
      PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\71Q5PY5YHJ"
    3⤵
    PID:1888
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\71Q5PY5YHJ
      4⤵
      PID:1216

C:\Users\Admin\AppData\Roaming\Microsoft\71Q5PY5YHJ\VX2KWTYQ.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\71Q5PY5YHJ\VX2KWTYQ.exe"
1⤵
PID:2480
- C:\Users\Admin\AppData\Roaming\Microsoft\71Q5PY5YHJ\VX2KWTYQ.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\71Q5PY5YHJ\VX2KWTYQ.exe"
  2⤵
  PID:264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\JFH1HWEI67\PVA5715H.exe"
    3⤵
    PID:5428
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\JFH1HWEI67\PVA5715H.exe
      4⤵
      Views/modifies file attributes
      PID:2700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\JFH1HWEI67"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:544
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\JFH1HWEI67
      4⤵
      Views/modifies file attributes
      PID:5888

C:\Users\Admin\AppData\Roaming\Microsoft\JFH1HWEI67\PVA5715H.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\JFH1HWEI67\PVA5715H.exe"
1⤵
PID:5212
- C:\Users\Admin\AppData\Roaming\Microsoft\JFH1HWEI67\PVA5715H.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\JFH1HWEI67\PVA5715H.exe"
  2⤵
  - Adds Run key to start application
  PID:2152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\IMN4ZW1582\LXZHJU90.exe"
    3⤵
    PID:5300
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\IMN4ZW1582\LXZHJU90.exe
      4⤵
      PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\IMN4ZW1582"
    3⤵
    PID:5776
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\IMN4ZW1582
      4⤵
      Views/modifies file attributes
      PID:5124

C:\Users\Admin\AppData\Roaming\Microsoft\IMN4ZW1582\LXZHJU90.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IMN4ZW1582\LXZHJU90.exe"
1⤵
PID:1912
- C:\Users\Admin\AppData\Roaming\Microsoft\IMN4ZW1582\LXZHJU90.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\IMN4ZW1582\LXZHJU90.exe"
  2⤵
  PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\HW2NL4B6G6\NH1GVEDB.exe"
    3⤵
    PID:4216
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\HW2NL4B6G6\NH1GVEDB.exe
      4⤵
      Views/modifies file attributes
      PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\HW2NL4B6G6"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5416
  - - C:\Windows\System32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\HW2NL4B6G6
      4⤵
      PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_hashlib.pyd
Size 67KB
SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
MD5 ff7c390260b2c94396abcc5323db052e
SHA1 adc7babe127c3586c81f321ad20ff87785945795
SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
TLSH
T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_queue.pyd
Size 35KB
SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
MD5 8ac260b670f58c4d08ba0a7e5512133d
SHA1 3ac300d794c60ac58c68961ebd10c7fed8585fda
SHA512 a523efb322f7863033f7bb8101134a9ce6a137979665ed0daf2072eebf016a3b89bf0c386f4c3b84c3b2455814bc482581cf07a6606cdcef7df22b96e6a4fa2e
SSDEEP 768:mJe4W6rB0Bwh6EIjRUYSyYTegc2Ip4NMTxf1mlIJxp1:EhSBwcEIjRUYSyYiS9NgfIkxz
TLSH
T1A9F28DC6A65C4097E663C970C1A2DF92F975FBD39B0146DF2178C1890E237C2A73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_wmi.pyd
Size 39KB
SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
MD5 bca71458b37ab9784290593636006405
SHA1 4a7effcc12a283b9c65a06b6af62c1cc44820861
SHA512 fd7e5e40a9cde0253684cf0ff6f343c60c597087eda27cfa3726ec2d870b4dea1e7140c55e0de7eca0f5ee36eae32fa0092cd88be4e9969c91cdb94ac923ab7c
SSDEEP 768:y2/EEqrVmjsJuMOQMV4Ij3iYyYTegc2Ip4K4Txf1ml9dHx7Lsc:XE9BE3MOQMV4Ij3iYyYiS9JfIbHxnsc
TLSH
T14B037D85E6644052FA67C571C0A6CE93F971BB935B11878F32A582990F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\base_library.zip
Size 1.3MB
SHA256 e524be8c02642c4f65bf060dde4cf85433f1abcf288a532577361d6db297c5c4
MD5 a21de64594faa78091b92f7e404ae621
SHA1 06080c43111189182db75949a47391844bea2ffe
SHA512 738319fbb1ff19657fe66aee60e511309d7db442169cbc6b63584f557b2b478e1bed180a9489650540af0a5ac92fcb5f0fe8b8d6115465dbf626c134b17d29bc
SSDEEP 24576:syuUF93uRpalbkQeOdP2m2dfQidfmFLIw8:LuUF93uR5/DdNh
TLSH
T1AB552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\certifi\cacert.pem
Size 230KB
SHA256 7cef540c6af3bf0a3c7d0070bd3fd7aae34f8aa805b408d1c27a01c8aeb305df
MD5 3ff2cb6c83e4cd529491f71cd24ac916
SHA1 edf51e1bb2c167d25acc9b15077cc3f68909d30f
SHA512 b45a1f506a5ef09dfef6ebbb6e64fe297d19fd70c827cf665adb4d2943786fcafbb4436c7ae0de083bf760f882dbea24f9936c5afc5ca46a6e2f6f7cd9a5f4a9
SSDEEP 6144:0plSRrqADwYCuCRT/QRSRqNb7c4u59hrB:0LSRrHnRWav309n
TLSH
T142347B954F2A9C092C9FE1C1CA9B1357DD3E027A99FEF0F1390A2408D24622A57FDD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\charset_normalizer\cd.cp314-win_amd64.pyd
Size 10KB
SHA256 da3ce780d6d58ae8c6920b99f806f64d58a1b33f4a01382861b01b50549199f8
MD5 d22406cd44bf4cc0de40f2975eb9cfb7
SHA1 672fae4c492c41a11b82b71ddf6956e25bdf74d9
SHA512 cb8c9f0eb6688412394669d3f1d799e3a89aba0c6c3c3aec67f70cf636df7fa34e29ded3e830a532334f468d55754da3d2d8b7c7954f5ead6a5af2812efe64b9
SSDEEP 192:h7JGrmoX+sMl/++Ch9p85BgQ9NgeAwJz6:hJ4m446OR9DAe
TLSH
T1D122F85CFE6458AAD9158138C6374E4BB132BB22170273CF8370A06A1FA37E66534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\python3.DLL
Size 72KB
SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
MD5 303f286d14b7db861ad96314bd8bf3f7
SHA1 2745bd50e91648968888ad495ebf4f66d10e4533
SHA512 4beb99ecd472df29d099c179f0a1c8809f741594d81704cc1d8194169c0826273cb9cfcfe2b7fc4b98fc07742c55fcafa9257c8a67450000dbdec3971acf13c5
SSDEEP 768:WQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:DbTrnXngXMFEIjG0xyYiS9yfILB8
TLSH
T13A735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\pywin32_system32\pywintypes314.dll
Size 133KB
SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
MD5 c11818bd607c6060902836c3f6bf024a
SHA1 31846f719f3eb804c8ffcf3783ef343b8e206730
SHA512 3349ddeaf776a5f6e20026e217d56cfbcf053772c3366af5aa3282ff2889cd92a2c31ba39b3cbaa18a90d6d1e9bbde97215278f12dbd7724062d5c3f06fd6e63
SSDEEP 3072:WZkbcF76SzXHDjEquY/rZ6YrFc1V4Bpg7d+LLvvzab:WZkbc0STfPuY/rP+1V4XgR+LT
TLSH
T1F2D32947374648DAE97A937DCD771A02C3A6B0000711E3CF46A1C2AA5F637E5AD3BB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\select.pyd
Size 32KB
SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
MD5 9e31eff5c36a868a6010be873e0f58b5
SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
TLSH
T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\unicodedata.pyd
Size 740KB
SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
MD5 624ffa84aa15efced4c1fd8e5ccf0b95
SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
TLSH
T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\win32\win32crypt.pyd
Size 123KB
SHA256 1144670ad8271e4d477167bcb55b8ec38e8ad9f02c6fbfe66024e67083da2131
MD5 bef94c55e5f2b9c742467469abdbb089
SHA1 720fc0e2954fea3822144ca97303c6d60eb64133
SHA512 07644f2a5f9b6ae3fed2c55366aba74f5f3961d3deb1316139a1300df7229ae0d2be543b8100cc07cb8ba530c62d44a8e5c5b702641e63da4366eb946bb71799
SSDEEP 3072:+sFWiORseWQgjXefpRoh+MNO3xhxRXvxh+Pal:+0W9SQg0okRfxh+A
TLSH
T10EC33A1332964DD6E9AAD3BDC8239807E7A4B0154721ABCF0950C6DA0F67BE06D3E749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ARC4.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_ARC4.pyd
Size 10KB
SHA256 f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1
MD5 eff0f16d6e853ea2cbc7b3bcab5e0591
SHA1 d9e9947afa2871a4814b9eeedab7209f9f32c9a8
SHA512 ceaaea7c60c66e4cab3b21d237ae753e94cbef397c3a9bb40c636421dc6b66cf92355d213fd14cd8d55ef06618ae3504ee229a8c6afe866f0e94d7c46ae9bd2f
SSDEEP 96:ajZuck7BNymq3UtFfZAn401wlKsQ9AfJkSRsP64Cz6+q2c5n1kBRcX6goyOazh:okNNyatvAn40q9WE6R2YORcqgola
TLSH
T13222288CFA564CEEEA6540B58A270B4FB075B711575273CF03B0917A0E637C6363A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
MD5 17c99edf022309bc2c54a732fb8fbf26
SHA1 57a8cbcbf0caed90b8ce9adc8f9188561f4a5e2b
SHA512 f8dc12948abc33487f136b92efe755b7234ea8ea65b40dbfabe6bdcf8214c1dcf3509d1ecf5f21741e5300456b03983739c9f400ef8352fcac9f3edf90c37f92
SSDEEP 192:SBeCWznuR5zIzpshfrQ0ZFqdpofnLjcqg542:SBOCMpqVDqUge2
TLSH
T159521792F32701EAE42B9175CD734A4BAABCBA00635167DB1320C1178C62BE1323E796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_chacha20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_chacha20.pyd
Size 13KB
SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
MD5 709be56d3ae0cb50807a6b54a762c875
SHA1 65e9ba3b8485f9bf53aeb15ed240c4c13a695bbf
SHA512 09e913290687e172d10cacef8b27d7ddb763218b32872e8ae1a3122db53f561e82a869a02e882cb3aa1c461fd403258532b9762cf66109681da9f157a88a7d15
SSDEEP 192:k30Y+Ne3erKrgMntNGWCL6qT043ZJPrBne9lkNEcqg2:k3ko1KLK2Jc9i4g
TLSH
T106522A89FB7054EDE56240B5C473070EEAF1BB20E711ABCB4360959A1EA3BD1313FA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_pkcs1_decode.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_pkcs1_decode.pyd
Size 13KB
SHA256 320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc
MD5 b5600245089e36b00e9fb4f4327a9f5f
SHA1 61cd2fbc4f83506001ed4650439f35916a006e0d
SHA512 179698c5c6f568a9f152bfdbef9369d31cc2a4d3355b9a5ba5fe4b4498410124daf890098c15e7b70a60a498c25f11517fb48e8ece55f5a2fd4236241df8cda3
SSDEEP 192:h76XJdfr7i0iNWGO6z0x+/kOn/cqgvVJWC:cJxC0e+QvRg
TLSH
T19252E946F66AEAA8E9674174C62B4B1FB9FDF500635073DB0351C99A1DB33C1327E640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_arc2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_arc2.pyd
Size 14KB
SHA256 1faa4c424bb33c9aff778a74ffc9468d281290d510e0ef44eae3730785efc1c9
MD5 530bb99610b35527c3b06a22fd92ccec
SHA1 4242ea2c3884eb64b5f6bbf692dc87a347ced5c3
SHA512 d46443866c9296065f151163f8503ca9b726f4dfe689c1da3d6a47940bdc0dca75f3bd87eb672b20ef51cf22f2e65f07dad30e0f9e5addad5abeb27d6f60e68c
SSDEEP 192:t07obuccnuzHysARb0tWmn++0dmwjd8tZcqgew3:V6n643mo4JJgH3
TLSH
T121622B46BA7809F4D92F8178C4F3C70CA2B97199230C9FDF0264961A2D13FE56A3E2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_blowfish.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_blowfish.pyd
Size 19KB
SHA256 6f6f3d25dad7d864ac3dfb54177ed6978c3acd36810af90e8874100317737706
MD5 403a4f70938f58c15daeb4a63d7ecadb
SHA1 21e4f3c75afb71bcad683ae607cd677f3c2415cf
SHA512 ed11e69f332c150dda9f563aee4b3ef1bc870d0c8be348be0d835f76f10420694ba072e1455341b97ab761873d0b45f76741fad7e98c9460fe05449865de5305
SSDEEP 192:iI2AcU5uMeFhK8YVfyc0u/yO0Bfx4RqI6HJAyZJg8D0KThxA+rAQE+tnJiO88Z52:9eS701RiMpJgLa0Mp8XgIO
TLSH
T18F925C4DECA856BAEE200274C6468D9FE12FF534633DEBCF2770168D09166E60E747A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cast.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_cast.pyd
Size 23KB
SHA256 7bcd3c30c7f9caaf4fa1d78de079d74278ef8b5c857f4243b8ee7fdaa6a20e4d
MD5 c5ecf284e05e75955a40e1276c9b250d
SHA1 ce58ae475b5c3024f879766f16767ce53d494e07
SHA512 f418c785d7083a7e4e991d788e2eb55276773ef7f98e0591ceed1b58546abc7973b4cae53b342691a09bf160cebbe99e3651c78130faa849b46605eafa2e6c6f
SSDEEP 384:j6quf9b7Dry3YcZXmrfXA+UA10ol31tuX9ewg:E9y3YqXmrXA+NNxWte1
TLSH
T175B26C65F32688EDD667C435C4135E5FE039B861332543FB0762A29A1E1B7E8A83D3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_cbc.pyd
Size 11KB
SHA256 a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc
MD5 088a5fda312ec2e1957e83d530f9bb8f
SHA1 29629e5dc8ade5f79eaa20017dbe01589d160508
SHA512 146c224d680bdd60dc680a744bd7ae08a867cf28d0e6e251e108fd19ec77e13e2e0f50558032391e6effd62644460ff06831e2da46291bd046144ca232e0a5d6
SSDEEP 96:I4T693BMwxTwu9B2GKLCReiEyqLsN59la1oC01VGlN5C5J2SlKsPViRDAnzdTqke:IJB3jD2hoeeqLO9I1oC07xlYmBtcqg9
TLSH
T10932184BEA158AF9D1134336C0770649AAB6BB10B38277CF0365916A2D337D2723E795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_cfb.pyd
Size 12KB
SHA256 cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca
MD5 bf18d19eb79557e767a8e8e1eda6c060
SHA1 3067f33faac3e247c5620d1ecd479e3c2335ddac
SHA512 86b65dcbde28c598ca401e513afb3866b391e8059adebc672ab41b96d5469f4011df48949e5684a1deb4a602a485384f8186e423c2df196afc6d79eb18fdf2ef
SSDEEP 192:wTDWsIyXckwWdk01fdpXHrc46cqgzW0i:wTibk5tdxgVgzfi
TLSH
T17C42198AFAA989FDF4460235C4374A46A5B6B604735173CF0302819A3E33BC53B3D695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732
MD5 3d0fb2250c76b501abf008d8e6180594
SHA1 e6bd8cd9a1473ca9b74d3f029f0c18e7fc710fb8
SHA512 165ba96e64706f9273abcc964fcdd25acc672e03b95e2e38c4edcfbd6f71daf323496abb055cc66d47d1bcf2120a45c6ea55a2ae4b9b5ba50b68e8a2df341f89
SSDEEP 192:9f7EXDMXiKEEEEEm9JdwdNuRxe7CO/vJcf30pdA4kFoxX6zUIlPrx2cqgVVv:9DEXYz9JdwdNuSLvJz/A49qz5ltWgr
TLSH
T191621A06FA545CBDF61242B8C972450D92BFB9046360BBDF0765D2962E23AC4337F6E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_des.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_des.pyd
Size 51KB
SHA256 0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb
MD5 a2de9a3a802296d900f1630358eba28d
SHA1 6f40310592c16fa2943aebdd9f97207fb56b5af5
SHA512 9284ebd7fb443018bb97fdd0e165cb1e257afdb9c9ff1205b9be6bffda99daa0bb0ebe7638d33c9a539ab6c57884cf0f6c5ab248aade1a65eb15d088835e7b23
SSDEEP 192:WLpuiFenKAnKfmZRXbXXrzHyLFX4QiOMO0c0Jt3pzK3zBAArQ37ri1dR9fEk2xYQ:WLQi8nKAnKy8BXhXYr39KGrZTd/gji1
TLSH
T102333217FB6401EAD03D4B3404EB0B61AAA7A4B522A347931F55596C6EF37E13E72EC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_des3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_des3.pyd
Size 51KB
SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
MD5 494239f9453679d80511becc23c6b621
SHA1 ea32905bca3e7dea62894bd7b85164237250ebb6
SHA512 902036872eb515252d483804934516c06614a4da80592207a2b6b0b2795ceabc961520bc67475bfafb319f0bf006cecbf0a131cc16889dfa498ee43cc2565c77
SSDEEP 192:WjpuiFenKAnKfmZRXbXXrzHyYhmvwzlwIl8R0qsyzzBAArQ37ri1dR9fEk2xYN0g:WjQi8nKAnKy8YsvwhqDCrZK4egk
TLSH
T11D332317FB6401EAD03E4B3404EB0B61A9A7A4B522A347931F55596C6EF37E13E72EC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2
MD5 b9f8151c65bdaf81bf9407a32e77959b
SHA1 3670e2d9afb0ddb4e98f301381aae49561c25272
SHA512 21c250f873651bc4fd0dc18d9054a31b0e3c0ec1837910d430943121884fc7728fe8b8340494e0625f9dd90c6dc031fbce5c53a913476051419d7dd06772bc32
SSDEEP 96:dkLC5MmvMN3zAhrZMo4hwFD01tbOlYjMIJKUSUsPNfSzVfqZ7EhSGfcX6g53:dkOJUN3zQGWFD0gB3UsWhncqg5
TLSH
T1A922E889FA5648F6EA1682F5C9374E0EA179B720572233CF0374962A1E627CB3139781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_eksblowfish.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_eksblowfish.pyd
Size 20KB
SHA256 29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504
MD5 b6037ceaa162c50fc25f1b361b4250c9
SHA1 db595668b78af345d5b4f044902bd1e3491ee74b
SHA512 a0a284000dddc1bc0682d57f57c0f8a7aa9361f9c5b433a9489d10d582c937fdd3dd8ea90e7cf10247a9aed15752c12eea902325b2269074486b67873d227085
SSDEEP 192:sI2AcrbC2s30v23HQDleHSTy8N0E0BVXpLKHJAyZJg8D0KThxA+rAQE+tnJiO8sU:mC2c0v23QkZZDXpmpJgLa0Mp8sng+dx
TLSH
T146926D48ED4845EAEE60457CC542CD6FE62FF538233DDBCF276266890916AD20E70391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ocb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_ocb.pyd
Size 17KB
SHA256 c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d
MD5 35b044d9ecd823161ef267517ba88509
SHA1 b0a1e7b5001faf7ca9edd0c4071702c70bfed972
SHA512 2e2ca2125b47e8c772e3b18411e7141ee6e92b6a2e9b7b6e4e278b739b3f16a3e12eaabe0548c3dde41909f7402ff82c01c8a2134c3b9a718b57a7cec7b3967c
SSDEEP 384:simo3psoTezczsogeXOvm/yR/DBQcHXfD7gG:Qo3psoTezcQogeXOsSLB73L8
TLSH
T16A82E907AD729B8EE5D0513800A6867DF1BB75F14328D2BF8EE850BA3D392C815397E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Cipher\_raw_ofb.pyd
Size 11KB
SHA256 1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073
MD5 a2b9f1db81ee431f07a848f44153518f
SHA1 6a8b92d822193e5e58629c2a22863df9676155b4
SHA512 191cbd7884672fdb5a9ad2a6b2158567fb9e083c9f0ce59aa3c2c56c17c280a5e0aa5ec17ebb8eeb588ffafdb59e32084286eb79b74bd9b4f3611c4d442725fb
SSDEEP 192:hp3neSoeeqLO9I1oC07xlYmf6tcqgkaB:/EqiCm7Yrg
TLSH
T12632194BEA9089F9D526437680634A45AAB1FB10639177CF0310955B1E33ACA337E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2b.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_BLAKE2b.pyd
Size 14KB
SHA256 1890d90f46bfa13588dd07eeaa230e68186e3ed929e4c1fe7221c8fea89e5683
MD5 7fcad6d233f8f41636258c970390284c
SHA1 5f8438e146d56e303d05087ce7dc29ac0628801b
SHA512 447b2dc34155ca2f846a214a42bf27b8717faa05fca385463a3362f29e2be6101d3a51daba4693cf5ce44029d1e6750dc1835e5b84fd746e0cd8c11417b7cf90
SSDEEP 192:GEj3+V2rQnjt1wmg9wzj0YW+OGRQYaza0DcYkoIiz7K+Hcqgv0TKM:Gy3+AojO9kjPO7xjDlZPvgv2K
TLSH
T1FC523B49E27588FDE92F82F48233051AE7B1B520A31167DF4360C2D61D32BD2763E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
MD5 efb1f498321597f1aaf7fb6a57603c76
SHA1 1c074ba191dade8b05924dbf4933916817fd19be
SHA512 44f0ec8a4044fed41440ede528e2d2b9005477a8e163de4121f8344dba116e179de98a4131f6ff2d211e44a28c541733742e8263f83b8b6bd1479dd7d96fcbcc
SSDEEP 192:yd8+SBjsK5tcGndG4xfSo06lw7KDy8gJcqgwxCLx:88575trWCvcgwxCL
TLSH
T1F9525C85F6A985FEE85B42B98673490996B9F414635073CF0351C5AE1C33BC6327F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MD2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_MD2.pyd
Size 14KB
SHA256 804c60219443c2ea969e1b3a717eaeea09c91742d9be78d614136a4431ff590f
MD5 c32c84cec7fe60f5a73dbcec5a75778f
SHA1 e01136ac95706ced3f9a7dbe6f1822e20f0228ce
SHA512 9c24d7ebe4424d44c166bbe2abe5d916decdd4acd56b8428815ed5c7adbe446f30b5321c60e27449211ed48947c8fef77728033c399856573052a301261ae83c
SSDEEP 384:2yEhKnLg9yH8puzoFaPERIQw2p3Z2p1VT7QvgB:hEhmLg9yH8puzoFaPERIQbp38pv/
TLSH
T1A152A845A9694FBDDDB541F470B32B4E74E97E028310FEEB13A092964D27680317EEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MD4.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_MD4.pyd
Size 13KB
SHA256 38fff9037abdb579f9847a6718b8643c31c3c7ad91fee29a778b60c444c91a7c
MD5 43a0cb1b7c6cf8a96300575abc2c10e3
SHA1 29e4d8743c64dbeb8b753630f3d7aa5700650280
SHA512 8279c3b16b25ccf98fd12c64ed27d17a030a74076ef0f5291322941380bdaff0654f8ba5454ec0374528646de5f35f9c1ef7a897c9d6eba38ceabf404636d8f8
SSDEEP 192:x1sAD7I/9hAIHeqoDoMfI/uTWg0Ixde+U1cqgYjeiI:x1sAD7KvdVKqMd0gIe
TLSH
T1D4523B4AFA7408B9E51983B9C6734F0DD6F97900536117CF039192AE1D33BC0353DA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MD5.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_MD5.pyd
Size 15KB
SHA256 ee469ab6d4dbdac22eea7bc40f3e2872442c649e03778d8d6b94a112da1e31aa
MD5 1f0d820fa427968ef57363bf3e94d6d2
SHA1 26def5ff85a0e499855b9c2b43da11b9d2a68b27
SHA512 c23e5bedb35326436c3f9734874ea2f2a7a8d55f1d365e23c2b6cdd9e7f12c231a5908063b2a3a8c2c1e608c5a8af349b5e5c1197c12b7789c61ca719300f87c
SSDEEP 192:HBvzcuiDSjej8IOcjGXnDPjrl70P/B5J7ihnbFccqgy:BwuiDSyjxJeDbu3B7GbFwg
TLSH
T1AF625B09FA2045FAF555C2B5C0334A1AE6F8B929A3A25BCF0395D69D0D23BC0B23D7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_RIPEMD160.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_RIPEMD160.pyd
Size 13KB
SHA256 ccf7c7182ecfc7a3215d7913feeee8f8c35a6db71ffa2895f9bd7de3084c26ad
MD5 60a8ae930ed0a8f307795f571edb13d4
SHA1 68708a86ef046fc738b342742c82d48c2cd237d5
SHA512 1b11b6d8fe303a631c740524750c48fb64368d3405ba7bf31997d004d82db4821d7cd8b2fdf44d2407f3e806e147fc02408de8ce9c75950ca209d0e2842d77c6
SSDEEP 192:jJepPGkZF2zz1vL0A0XstQchQf25KcqgY2:FepLMz2A6GrR5agY2
TLSH
T174522B4AFE5945EAEE9682F544230929E4FC76100713E3CB8360795A1D337C4B0BF6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 8f80524247c830d9bb590d025e15ec34d7d337a16e5c4422e2da0448d06c88a6
MD5 d350d601e5716a85f4beeba6e11f54d0
SHA1 8e972659a7867859ca9d36f454e8e2c49634b128
SHA512 a34cbfbdd5a429407d441a5bd163307f18f6af2403b44dc9c0c4365a6a5d8e0b6a3a0a24ef2e272e2e916a3a2a58be0ffe9e90408cfb60e6049fb5b9aa56620c
SSDEEP 192:4Zo2R1J+0eDPSgkNZuOdlptvTuh+Kt/sPLKz2V0uj2IjW+Hrcqg9K2:BOJ+0QPSfu6Oh+FLkgx/dg9
TLSH
T10A823C94EAAA54FDE625C434C6534A2F9379B11A4B61E3CF07E042ED0D233EB5838B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA384.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_SHA384.pyd
Size 25KB
SHA256 38086fc4e0c53f5153571073995610ac91c454c6aa161588b651286a585526ec
MD5 680889bcd0470c282a2f57cf844f3f39
SHA1 81b1a36c0f811c88463824b0d9edb0d94df856a0
SHA512 cd3eace0e93ef71f1f7847ecaf2c18f48d6098dc305c54c552ef63bafac65619ba833eedd24745904a9be4a0abafa58cca57a7604716c85a64d15d7d2c63bfc7
SSDEEP 768:Ftui0gel9soFdkO66MlPGXmXcH4J9MQACs:Zu/FZ6nPxMRQA5
TLSH
T195C2D902ED685324CC15A7384BB9DF39DAA4B71443E0EBF746E231C82D565C72AB85CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA512.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_SHA512.pyd
Size 25KB
SHA256 adab3a8ef9daa73b1e9ca83d66a726c8ad256eed119ab2d7d3fcee10f8f013d1
MD5 41a1d0414de80ad9262567c5960e7edf
SHA1 8b0e74580eb0a99459ee3c766346569aad9b9314
SHA512 bc12bd5386d94834690ea6dcb3b948f32131580531f8bea72df4bbedcc5c060cb5267eebda7168cc8c994fda776a22c58f0eec9d2351a797fc7c9b8f4c820a31
SSDEEP 768:Gtui0gel9soFdkO66MlPGXmXcx409X/HnX7ChlRV:eu/FZ6nPxMF/37kV
TLSH
T1A9C2FB01EC685324DC15533847B9DF3ADAA4B71483E0EAF746E231C53D565C72BB858B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_clmul.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_ghash_clmul.pyd
Size 12KB
SHA256 63d9bbdac4e8e2c95b1a41eb7a2b42047b6a0c8d36447165e32167d3c7a57aee
MD5 1dd22e3cfce1c65ffc00c2cfdf273805
SHA1 73a4e6237ad3cb30c7750ddb22e531944bfb6233
SHA512 b32d77ee7177af8b1b027e8f524af9784aa82fc376554a35d216572908e9487a75c70001a41ec68f8c992511dfe0cdf27aa6fa5d1b779468d73405117cc9b12b
SSDEEP 96:UXzBHOTvaNKigvldRMKgUU4sEvJLaVah01YlVlJnOJdS4sPiF1Pzws28dOJoz0Tf:UgTEnb4pJLqah0ux41bwLPS0T7cqg
TLSH
T14642194CFA9656ADE4170176C93B4B4A5AF5B61867E0A3DF036280B91E333D2332DBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_portable.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_ghash_portable.pyd
Size 12KB
SHA256 ca4c4e24af0d7f879f9cb73df6e27f83441071dd466c366a4f4b467101e50e21
MD5 ed8ba1c678bcbe969589a0f20bce9b3a
SHA1 b326823cacd6291636db929a8bfedcf6210cd54a
SHA512 13edde6b06bc6540d067d7316da6667165f526dc6253ff5227e98909ddc92218fc71c21d199ee040b213a5148ed6d880531fc254d2e4573ab0553cd918492669
SSDEEP 192:5T7f40jJIUxDDr+f0SUVxZ7JuuA78VUbB5cqgs:dDq6rSyZ7Cd9g
TLSH
T1D2420A8EF65499E9CD1A0175C4334F0AB6FDFA2067916BCB036266692D33EC1333AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_keccak.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_keccak.pyd
Size 15KB
SHA256 393c54d090197d55d87619e99528d2e774c9157632115a07fcf35ee50681e78f
MD5 939e83dd4104999b942fbb538b7910ab
SHA1 88857d92ed8229dcf4fcb44ab8fc2104d7dffb04
SHA512 6fdcb2a332031c873522dcd2f0bdf033961ffcf1a431b1c9e4ffded33c7c664b849519dae2e5256361a9e2415c975ee127eb270db27273079cc2d89aabd7738a
SSDEEP 384:Iib6zJrayMQYWRskTdflLaIZXYaNRH2g:IiuaMRl5NaeXhRHz
TLSH
T12C620846F6A644F5E53A82B1C9331B0AAEB571212700B7CF27B4926D1D73B81713E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_poly1305.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Hash\_poly1305.pyd
Size 13KB
SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
MD5 270e84da3ea602e7691b3fa415490297
SHA1 adcd3bc6baf56d53a6daa75867119f6590d8e11b
SHA512 81ed2993583304d7d7ec7a6699417661a60f0f36807b6e507896448293c9b225819787c4acb83cbf534d089ad7da461e7e289938bebd078eca65a1bd827aeeb5
SSDEEP 192:+CxGqkbOfnVSu41fMlps6BsS10NXloWL6NIXu3cqgmO:Aq5f3Vpl4xiWWNpJg
TLSH
T1FF522A8BFA5515F9E83682B588334A0EEA797A11135067CF436088EE0C33BC272397D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_modexp.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Math\_modexp.pyd
Size 30KB
SHA256 fc122c8e0a1c236c2a0b20009ed710602545577ba34a9fafed71eb84e56a2e76
MD5 2f44dc08973333126ba3daa977c909b5
SHA1 a06d37536df9482b30541a30e799cb02243d5c9b
SHA512 f3bf133f53cf415742125e7d15e7739190d2a96eb7a4a1e54e426d722d1175c80526240a3ffa127dc7118dfdd54c5c5f567191645a51904aeb01a8388f16a059
SSDEEP 384:2+URkXHWlnSr0BX4pMg1X9RecIdFXgS0qcG1SlXX8pYUM+grFI1ej3vOgodAX:2ZRQHCngpMgC0Ew+P1ejDod
TLSH
T171D25B12D6D801ECDEBBC13CD6F6494BEAB67588230143CF93B089790E739E66639B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Protocol\_scrypt.pyd
Size 12KB
SHA256 00c9b6915dfb9ed91e8d40c78f6b536c5ccdabd2760fcf9501d0522e97e2d600
MD5 d21f9b5765c83bfd97b4b16027ff83f4
SHA1 1965e7c74ad04f1c36e751bc198b1ceebe6dd793
SHA512 f6248fa077cc74a837b1ec6928919068d0b3c111170e7e1e7eb66bae6e6d05b4ab6bad2ff50cca1ec0e349a3be1ba1fca8d947592e8cd768228d574297de81de
SSDEEP 192:h3B6qjvnrrx5yWva2Hbds/P0pxz9l8lcqgO:/6qTVC2akHrMgO
TLSH
T1B342394DFA5049F9F6124279C4334E5AA5BAB60027B17BCF03A4929A1E733C6323D796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_curve25519.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\PublicKey\_curve25519.pyd
Size 19KB
SHA256 265e86937759418ae394671ece28fde8099206cc5f1946cc4f9efcef4b140e8e
MD5 ba2ed47a2f1fa681e953d234339fd1e2
SHA1 4544dedd05b72340502429042756e83f409ec1e7
SHA512 c01e41fe6a4e9559d2d8164e91064808669cdde11ce29ad5330523f68634a6ed47e089f77b075252012c4a11c389ae6ffb40995a5ef91c17ffec329cf91b9e79
SSDEEP 384:tHyxYpBu9OSW0mvO9bhgyQbC13SB3HPPc20eJq8g7:tHrYmvO9HmW3sB0eU7
TLSH
T10A922847FE8502B9CD369438C46656BBF368F6199B71BBCF06D216582C73AE0253CB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_curve448.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\PublicKey\_curve448.pyd
Size 57KB
SHA256 f7a7f91ab11a78d21f948f53c41c3f4b4b778dc3b34c1b2c1d9035b663569757
MD5 adf3e7416da4e481d68246e09f4a7a73
SHA1 b93e88053e7c6f5d84e50fd5698ce8116be60d22
SHA512 eef6d8e5c53c43a3982b2aa92a35ca480b5b9de13cd46bb0d672ff342974f67b3bfaab802ccee10186725478c93e6f242a0d351abcdee4054e597bf4efd1860a
SSDEEP 1536:V/4M6LKlAYBR0pjvfY1z7O0Q055KovA3qb3ut8zANQFa8L1UHCZIrkzTC:l4M6LKlAYBMg1z7O0Q055KovA3qb3ut/
TLSH
T10743B752868554D4C8BBD23EFD7F8943BAA5F4480B4983CFD5A089B01EB9EA175BF700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ec_ws.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\PublicKey\_ec_ws.pyd
Size 737KB
SHA256 93bfb0675b855ef94fe14aa5cb33a41a8b95c737f8774b015a31f32f9f3eac8e
MD5 14bde3698b42114fc95ab3f835744cfb
SHA1 4059d53c597c2a74e86d5aae1b9b0e0cd5928ace
SHA512 ded53960f6d2224b328550d606ca0db967838a97842b823dddf40969f01cd662b5cb8d03a4d80c2d3665b8905baf8e29da40d07dbe17eecc7f6988bc478436d9
SSDEEP 12288:6IOHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:zOHoxJFf1p34hcrn5Go9yQO6
TLSH
T1ABF4F11692C558C4C9BBD33DBD2B8A43BBB2F4484B9A43CFE2B585B05D76D6021BE305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ed25519.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\PublicKey\_ed25519.pyd
Size 23KB
SHA256 1f0d1a616875d430879bd7467296c1632c02b9266001781f7e59aa19b0e66cba
MD5 5d14a0505e324826b387a682e2e5b789
SHA1 58827c9708a4313b93b78bed3eb110f554673c3f
SHA512 57ddbc5fe95ef37298fa98eb65ad2280cdc7f8f0b3d6ec9a2fe8bab657da884c45b0cc2ed42f6cc394efa312d458b80dc688e3b61bb6012d4e122b03202ab4c1
SSDEEP 384:1iR4ZlladW0mvO9bhgyQCCAEZ1n0lF2LfZ1EHLNjdxqlIgM:1zlahmvO9Hj8i2bYBdxEt
TLSH
T1BCB23947BABA12F9DC3B8538C119176AF3A4B215C734B78B06E358052D72AE5913EF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ed448.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\PublicKey\_ed448.pyd
Size 73KB
SHA256 20fe0b35808c110762e5e4302aa8d926bf42211209e6bf8e438e914e42a58c09
MD5 617020ec629cebd633b37d3cefcfdeee
SHA1 e52922eb69df68ee0aac61f6f1553e621d54308d
SHA512 db33dc63d593b48a61a48c6950d7b88aa1deb8c89b57de46c553d99ef051294b0d04781ce20697519bbd72c9feb6579a4748ffc56d98c4d16692b7b38bafc865
SSDEEP 1536:7L8NhQDnXNnN9LMmT4k7QvUQkwSsWB/wVHqoPy7O0J054MovAfqb3lt8gKNQCv8H:7L8NheXNnjLMmT4MQvUQkw1VHqoPy7OC
TLSH
T1B773845592C164D4C8BBD37EFD7F8942B6A6F4480B8A538FD2B085B01E75EA169BF300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 c77f18f1f7a377bc388de0104abf4868d6f0c2ef7ef2b97b34d875cfc3040aac
MD5 fecc7e50926f0ec3286d9cac0bc3938a
SHA1 e12c70ee106d580a9adb0f81b38734d376266607
SHA512 925cdac89dbb66b8b9f69e9beeda001c4735e16fb1a3e3c0ab94648a7b8915f99469b0bf87e3a0d0ddc39d35a8f66680ae22c96eed22af354aed225b761a25c6
SSDEEP 96:dkEOstOzARCvriZUj01tClcbzMoJqUSzXsPc/7azsncZqkSffcX6gi1:dkEXtOzRr+Uj0TsBz178sncwkgcqgi
TLSH
T13322E888FA568CF6E51582B9C9374E4EB175B710972067CF1374CA691E227CB313A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\_asyncio.pyd
Size 76KB
SHA256 cc27a21453b309197030b5fa8051a8a9c89aec79f9b81ee4ea2a2551ac0f912f
MD5 c2a29938ef6730c1418140a15e0cea86
SHA1 e137c778526eb34068c0d85fd37d30b81773013b
SHA512 3f5b212f005b944d872fd3e84a68d1de11809143312571d6540db9cb219c4e9f62137f90af77a81b7b342d8d1665c819b6738dce7a5be1e0d6a135564ae69043
SSDEEP 768:J3yo/J0GKLIsPwpVnU+C4qMiOU1OnzM8nV6JQIjDnSSyYTegc2Ip4YTxf1ml6Z+o:VJyyUoCgQ8nVYQIjDnSSyYiS9kfILpm
TLSH
T1B5737C87A2A44186EEB79174CA536FC3FBB1F1859901935F51A4C18F1F533A18FBA322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\_cffi_backend.cp314-win_amd64.pyd
Size 177KB
SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
TLSH
T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\_decimal.pyd
Size 283KB
SHA256 1ee2247153ec6c6e5b3b49402f294b2b7325385ad489a5522e6fa9b406575e8b
MD5 bc63a4bb65d50f6de111deecd8de3457
SHA1 60ffbdc52782ddffad0c74774896159ec8eeb5d0
SHA512 60479c96b9fafb34e1c2d93970d69f53694c998cc6667fdde731e61675eb62d0a4bf875e5a3b939ebdcd7dfea8621a30d9ee30f6d7a0c7b83e058d77e36a1dd9
SSDEEP 6144:IBEAqz+G/rY2HvCnv4mrqGqqM43fIWeAxMoWl0:IuAERbvuvzVooWl0
TLSH
T14B547E96A3490CA4EF778474CA479A57F7B2B8414360D38F43A48A972F933A3673E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\_multiprocessing.pyd
Size 37KB
SHA256 a8c15ee29f60536e00fd7c26c0315e062c4f018e2e46e7f6eb65c1fed0d886a4
MD5 547b59dc1f6caef6706ca1129b5f9618
SHA1 b990f779204ddebcc00ab926be6c17b462fb3a63
SHA512 00f49b94a31b8dca6790845e0185b7f7cecb52fa99472bac523cc8ee4efb679585e3476c727e55b43f2b434ed12af51c41364113db89f0f98113be24ab2ab2a6
SSDEEP 768:HFMV/fpXybycUlgIj7teyYTegc2Ip4u+Txf1mlIJ5pC/:HWpXybycKgIj7teyYiS9uefIk5S
TLSH
T1BD038C86A6684053E9639670C5A3EE87F935F7871F22865F3195C2CE0E373C1736A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\_overlapped.pyd
Size 56KB
SHA256 0e8b684fdcc8c6de88bd4b92b6ed44a6fd917949c98b0691285e0cf6c760dc36
MD5 c96e86f3868d0323c88700f0671d9f20
SHA1 c8b9561fb80af89a67fbac11e103ef120dca4ce4
SHA512 d6953e6e566236f2bd01e40de751e545b680607ad07c8c7f7b8ac621f4c1ed3a227ac14cc45e66e15a0a1f18083ee4aebbacb24b784ced35bd227173b6b41d16
SSDEEP 1536:/sjKfS6rBgq/Wtg4urMp8IjCtDyYiS9ZfIklp:0tgxrMp8IjCtOK
TLSH
T1D6437B4A6B9401DBEE73D179D1A38E03FB74B2D34601931F61A8D28A1F23791A72F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\charset_normalizer\md.cp314-win_amd64.pyd
Size 10KB
SHA256 8e3e0a719a4ec835fbd9b3128636a09692fe173f4e01c527653bfdb7bd723808
MD5 5655da6af0eb292f6b14ebd506b218b8
SHA1 c1c00149ac6b56cb0cc17381c5a09bfa3a5c5a16
SHA512 fa5049bcb2e1f71cb0ffb4d3289919897929f5342cb39ba1f19494ed759ecbfe1cb955a412d4599f552d4be83145b2516e0321b2e53a1708954a0164e7a85ef5
SSDEEP 192:O7JGrmoX+sMl/++Ch9p8OBYQ9NgeAwJz6:yJ4m446R59DAe
TLSH
T1A122F85CFE7458AAD9154138C6374E4AB132BB22170277CF9370A06A1FA37E66534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography-48.0.1.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

METADATA

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography-48.0.1.dist-info\METADATA
Size 4KB
SHA256 5b62dcfcaddf62e26f8c28f6055c0aba858eea2a3697a3fc8e7aced427bf8d94
MD5 c0db5ec6ade3b37bcbfd3c8350e04dc6
SHA1 f74c4fc420198c2aaaaf6e088319081d3f515c93
SHA512 dc5820cf8a67ddc33cf71b072fcaedfacf4017585b2f5f2d57c221219b33397145eaee8b369226b87abe170b8a90ef4206e56ffa27ce63185562e4051639c31f
SSDEEP 96:DuPQIUQIhQIKQILbQIRIaMtjaVMvxsxPN1mvJNBMecc2yWvE2fNdR7eLShemR:3cPuP1slU5bmvEq7eLQemR
TLSH
T13F91735F3BD9A9E42BC2868B743EC0465537854D794B759CFBF88314B991B31823E01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RECORD

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography-48.0.1.dist-info\RECORD
Size 17KB
SHA256 9524f19a4b225a04ebcb24dabcef9528360c91d5551aa7f8f8d8417859afae4f
MD5 772a6a973b7409b588b046f1bd19df52
SHA1 6e2328c492622a7a1981e700326cb85ab7c99a2d
SHA512 e22aea47a812a95a4b6e92514464f3f52f1c87769843a5c8bf56b8f7303ea878394b3e892e8c728123346b5edbd64615143a0f358f08a89cbd7f9ca136d45682
SSDEEP 384:UXnp1H1jqWBQV+26WS28KSNhba9j5UNHtHh0:U3dFO+WB
TLSH
T15D82CD1E7E45F00577E09B5ED1FE9622BD4AD9A93273227CFBA057186ADDB40822D033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography-48.0.1.dist-info\WHEEL
Size 96B
SHA256 94650381b57f9cf60ea09b18d3df47d966d528cb86f1eed4ddf05778ed3d6c75
MD5 65ef9fc04b65b93a91bbbd0febf972f9
SHA1 77474c877bc016942215e6eba8bdc39f850df1b6
SHA512 b79cdda6a2dba456d34c0e5e83d770375f7da4dc6b7d0f8ff1fd0bf94dfbb4df7832c65ad0c93499fbf953fce8612ce3751282b4dd87c6e5b6ba0fa50f731e66
TLSH
T12EB01210838004FB90566927C01885183F91C20DD8B32058F8C12140AA0C81C10CCDF9
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography-48.0.1.dist-info\licenses\LICENSE
Size 197B
SHA256 3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb
MD5 8c3617db4fb6fae01f1d253ab91511e4
SHA1 e442040c26cd76d1b946822caf29011a51f75d6d
SHA512 77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998
TLSH
T188D0233EB357631142D1046E171714CFAF07B40418475209F41415F134E390A4B3C5D0
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.APACHE

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography-48.0.1.dist-info\licenses\LICENSE.APACHE
Size 11KB
SHA256 aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe
MD5 4e168cce331e5c827d4c2b68a6200e1b
SHA1 de33ead2bee64352544ce0aa9e410c0c44fdf7d9
SHA512 f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52
SSDEEP 192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
TLSH
T19432623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.BSD

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography-48.0.1.dist-info\licenses\LICENSE.BSD
Size 1KB
SHA256 602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb
MD5 5ae30ba4123bc4f2fa49aa0b0dce887b
SHA1 ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8
SHA512 ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41
TLSH
T14E31655B12844BE34AD2165565A7B9C0B08DC03F3A236E0A3C6EF3485F7B42EC57B051
MD5 SHA1 SHA512 TLSH

Submit Download

cryptography-rust.cyclonedx.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography-48.0.1.dist-info\sboms\cryptography-rust.cyclonedx.json
Size 44KB
SHA256 96a30705de11760925ec7d110b6a2136f4694eca2634668eaf7849d23a1b16cc
MD5 1c93a8526ba372d8a873b8e825715140
SHA1 8db76de717e086aac8895bc6e1b90c213ad2bf98
SHA512 fda5cf812e8af800ecc1149fb276ed319c2e37700c9d5bf7b04a1283b36d6e0e154c92514b8f3e383b63a9829afe10992ff623e6dae8618946e81a1db110c0af
SSDEEP 768:rIEhf9zVJx/ZjVjBttvqDMaXCpiQh4pEFAyzoWE7iSbG81M1MymgVd0gM+SiW5sl:rIEhf9hJx/ZjVjBttvqDMaXCpiQhAgXB
TLSH
T10213BFAFDC588DA30F8165A80D79D081A223804BED85FD4DBF4D426C5F8D46E2ABD6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sbom.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography-48.0.1.dist-info\sboms\sbom.json
Size 1KB
SHA256 1a09d4e90e1573436bac11f64e41caed47daacda7beb1fc4c8f99d7e561b4447
MD5 f987676959f2ea17b53ef1a888455bb3
SHA1 32c4d0307c9269aa1e5d6a080a0c38b7e2a7bb5c
SHA512 d4b0d577aa78f466d39dc98b07b717788c6f10fc62b8e566c37cd0bf3847efaef794f3ccaa3ba6daf9665c3d3c79c1bb9d23426eb10063b5d968258b2f4e8aa9
TLSH
T18F21633BDE401C2B1EB527B4EE794267F560166F51C08C0B737E824C5FB6896A847F2A
MD5 SHA1 SHA512 TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\cryptography\hazmat\bindings\_rust.pyd
Size 9.4MB
SHA256 cbae8065586611b18e9ffba1885af0b3ba9c52b9e79c85ca4a33264c626e159d
MD5 01dc448748085ef1227dc27146faffae
SHA1 776f810f12bf68ee156eed118b093dc74beba249
SHA512 86a21162d43f8e743c15080b8b8bee59198c33717b36a002b3b0eb3bfb421badfb7c4face33fd5a88d8e637e5c890a143691c16428a6ce7a736059c1d218419c
SSDEEP 98304:AkX5yU5serrr6G+PX9MX8OZO8z/CRSgq+IUBm:fX5ys+PX9MX8O88z/hzP
TLSH
T173A67C25BAA950ACC86AC4B8C34756339B7034DA0B747AFF49D486B52F76BE01B3D701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\pyexpat.pyd
Size 214KB
SHA256 9349be352300fef4b16da0574c670b174d75094574ab51f3d385767d1e3dfc0d
MD5 d6e692eacc35a0195bda97cef2345c18
SHA1 f010bc356b81149c390dea898eef59e6600de198
SHA512 ef2c9a33a0cb15f7673af716099b0735550a111d056422102ba6102618f1e9aa8c2d91a6cf0fd9eca03c3b6d0f0855a7807144585fc58ef08d13a6b27f6ace42
SSDEEP 3072:O3qcWGiB96M+1+XyXu1w2wiMuUL4blSA+gq9qUSGAoP4lSTmyBt3cBFN2X1JcGGz:lGiBK1+XyXu1GL4blSA+gqLt6yz3GnWs
TLSH
T17B247D9BB261C1E7D853803CE5968B17DAB1F86603909ACF12C4E77C9F2B7513B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\INSTALLER
Size 2B
SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
MD5 45210da832f9626829457a65e9e7c4d0
SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
MD5 SHA1 SHA512

Submit Download

METADATA

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\METADATA
Size 4KB
SHA256 a3e38b9ee4326289d4864704f30e299ee769e2309ce9f4a75f0de1a50ad0a356
MD5 395966581da45a834d806a0692ce6746
SHA1 1df950968870ceb8a6c0c0f002236727c4790c90
SHA512 c9c73d4a3173c1af8b1bd655e1e81af716a783923b3f4ac85099d1b9df1fe13afada34a4fdedf5c54065d61ddd360cd1814d6051a0354036eeb4dfed39ecaf1d
SSDEEP 96:DIYZtaCc0coeLMrlNzmpp9hoxN4GTqFc+ZFZyDN00x2jZ2SBXZJSwTE:3c0coOMhNKpThoxN4Gee+dC0vJHJSwTE
TLSH
T195A1959337C24653BBC241C765CCC3AA9126D458A69B4085FF698DBC4F51BFD1376234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RECORD

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\RECORD
Size 1KB
SHA256 52a6b8ee0de15cf7fd99625f43b97cd2e3942ac86f16054ea90de48e66f29355
MD5 17eacda1d7065b6ea59eb70f9e8ad4db
SHA1 f516b63df75b3852bbc72b0f8fd629248ca313d7
SHA512 c9e3a200f89b2dc64eb75a5ff83729473827496c105df756fa6f8bd5735e89de2c90e2267bcef44d3b58525c247038c4e5026dc9cbaf786fe9949590e236d52b
TLSH
T12931779B3A45D00B3A5724E1AF98AB7178603A83F257C65ADD354F345BB88CCF264D03
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\WHEEL
Size 91B
SHA256 ff309ddcdd65ebd02bc724dbf2bcc4a0ff53a5b61792a44548d383e4ebb19d3b
MD5 08dd01ac2afdbb287cc668d51c7056c8
SHA1 e7224da97ededfb9d0239cf7cade76ebe3997743
SHA512 917f7621e0d457d149964de3cddf50fe49be13388879f60ed818eaecdf5080864386c9cf2474dc2e514907935983d73dee1967b404f2941edced73856a1d6d1e
TLSH
T1B7B012150A4115F814A0EE134068A1201A70854799956079B14A03446549D1406CDC5E
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\LICENSE
Size 10KB
SHA256 458502e12d97bbf64438606a20044aa85eb05fb0a8a807bb35dbec253fd1fc04
MD5 cf73015ea0156450506e8000d1f7fa37
SHA1 07d2319108d2b21bbd478a2dedaa69e1f66ff494
SHA512 4688a2d2e7a6c9332367595a0a1e7d59d306bd6dfc6473d9894e8472bbcdab00f03f8d1244bc95a540e3167e73320e851294e7485557434aa24690d5fbd1f456
SSDEEP 192:iaW/NVo4UTo1YEHFNnFE6GheQGC2B1CVnhOCoHqxLJbzjwokTGNH3Hv:iJhUk1Hfl9/GHbLNdkTGNH/
TLSH
T10422643F774803770AC20162BB8BA4CBF32E903D379656645059C068236BD6583FB6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

top_level.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI34602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
Size 19B
SHA256 08eddf0fdcb29403625e4acca38a872d5fe6a972f6b02e4914a82dd725804fe0
MD5 a24465f7850ba59507bf86d89165525c
SHA1 4e61f9264de74783b5924249bcfe1b06f178b9ad
SHA512 ecf1f6b777970f5257bddd353305447083008cebd8e5a27c3d1da9c7bdc3f9bf3abd6881265906d6d5e11992653185c04a522f4db5655ff75eedb766f93d5d48
MD5 SHA1 SHA512

Submit Download

_SHA224.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\Crypto\Hash\_SHA224.pyd
Size 21KB
SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
MD5 f18df573602776a7449e4452aec66d99
SHA1 28a957f3b1a738a4d10452faf867f484c2ac743c
SHA512 ad6cd03b1ce8a01fe87ecdb403701e44c118a799e39fd36989be9997b9b29c8a4f52765a67d1cdce3bd9eeb2147020fdd898afde52a6f5855f1037e48cfae9e8
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmzIHXqBJ93c3O9zMR7kLMhgZvRv:JP/Ytswv9HXM3c3hkLMKZZv
TLSH
T137A20B19AF3884A4E40E603AB333867B7BF47600D394B7EF8A505B991C263ED563465A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SB7OCDWF.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\AGS9EECDKK\SB7OCDWF.exe
Size 16.7MB
SHA256 7238453f2f69ca951fe5c18786afd4e00a8ddb8cd744f6c1e557be4c9f4efeca
MD5 6bebc199c825c89f088b881e3dcdeb99
SHA1 4cefcf3f157d4db073a50c718f0b881c2a620aaa
SHA512 3174e85e0c4fc9e0b45695ed8308aeb22ab9ce7ada4f5c6aed429f753d7705f413c401cf13535a30bb9dafb7ebd0725a60874a633c17c146b93399d20bc028d5
SSDEEP 393216:CZqpoKgRr9ql9nP8bATr6tZq5X3OHsxtEDweFXdRlw9:WqpYjqfPOar6tZq5kwt7eJi
TLSH
T1FB0733945BC40937E8D2A13C9D72CAA1F1E1F9612B628DBF179117363F737A0483E698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads