899ffe3c385096d7aaaf0dc71b9594b21c3b9442cc5952d380c56621607e1050

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/06/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
شسي.exe
Size 16.7MB
Sample260627-tythlsct4r
SHA256 899ffe3c385096d7aaaf0dc71b9594b21c3b9442cc5952d380c56621607e1050
MD5 29072c77dde4af2575bf532ebfb4e0c4
SHA1 a270e05705f0a5515b071e939c66285232f57d0a
SHA512 0925d9a0f285ce6f6ea3a0817393fce3d1bd394fd0ffac96fdf31af90d59b494c5bef03345fa7144f462ce360a765a34eb2b940a0fea366d1ecb8168187a1785
SSDEEP 393216:zZqpoKgRr9ql9nP8bATr6tZq5XeOHsxtEDweFXdRl19:dqpYjqfPOar6tZq5hwt7eJt
TLSH
T19A0733945BC40937E8D2A13C9D72C6A2F2E1F9612B628DBF179117363F737A0443E698
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion pyinstaller ransomware

Malware Config

Signatures

Renames multiple (151) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 36 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\wmpnetwk.exe	spoolsv.exe
File opened for modification	C:\Windows\System32\drivers\etc\wmpnetwk.exe	spoolsv.exe
File opened for modification	C:\Windows\System32\drivers\etc\winmgmt.exe	attrib.exe
File created	C:\Windows\System32\drivers\etc\lsass.exe	dwm.exe
File created	C:\Windows\System32\drivers\etc\csrss.exe	winmgmt.exe
File opened for modification	C:\Windows\System32\drivers\etc\winlogon.exe	wininit.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.exe	services.exe
File created	C:\Windows\System32\drivers\etc\spoolsv.exe	lsass.exe
File opened for modification	C:\Windows\System32\drivers\etc\svchost.exe	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.exe	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\wmpnetwk.exe	attrib.exe
File created	C:\Windows\System32\drivers\etc\services.exe	services.exe
File opened for modification	C:\Windows\System32\drivers\etc\spoolsv.exe	lsass.exe
File opened for modification	C:\Windows\System32\drivers\etc\spoolsv.exe	attrib.exe
File created	C:\Windows\System32\drivers\etc\explorer.exe	services.exe
File opened for modification	C:\Windows\System32\drivers\etc\wininit.exe	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\taskhost.exe	taskhost.exe
File opened for modification	C:\Windows\System32\drivers\etc\taskhost.exe	attrib.exe
File created	C:\Windows\System32\drivers\etc\winmgmt.exe	wmpnetwk.exe
File opened for modification	C:\Windows\System32\drivers\etc\dwm.exe	winlogon.exe
File opened for modification	C:\Windows\System32\drivers\etc\dwm.exe	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\winmgmt.exe	wmpnetwk.exe
File created	C:\Windows\System32\drivers\etc\svchost.exe	winmgmt.exe
File opened for modification	C:\Windows\System32\drivers\etc\svchost.exe	winmgmt.exe
File created	C:\Windows\System32\drivers\etc\winlogon.exe	wininit.exe
File opened for modification	C:\Windows\System32\drivers\etc\explorer.exe	services.exe
File created	C:\Windows\System32\drivers\etc\dwm.exe	winlogon.exe
File opened for modification	C:\Windows\System32\drivers\etc\lsass.exe	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\csrss.exe	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\winlogon.exe	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\explorer.exe	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\wininit.exe	winlogon.exe
File created	C:\Windows\System32\drivers\etc\taskhost.exe	taskhost.exe
File created	C:\Windows\System32\drivers\etc\wininit.exe	winlogon.exe
File opened for modification	C:\Windows\System32\drivers\etc\lsass.exe	dwm.exe
File opened for modification	C:\Windows\System32\drivers\etc\csrss.exe	winmgmt.exe

Executes dropped EXE 64 IoCs

pid	Process
1380	explorer.exe
1908	explorer.exe
4624	services.exe
2552	services.exe
5008	lsass.exe
3916	lsass.exe
2256	spoolsv.exe
1032	spoolsv.exe
5104	services.exe
4848	services.exe
1124	services.exe
4152	services.exe
332	winlogon.exe
1748	winlogon.exe
2624	dwm.exe
3524	dwm.exe
4628	winmgmt.exe
3228	winmgmt.exe
2336	csrss.exe
2052	csrss.exe
1420	lsass.exe
3212	lsass.exe
672	spoolsv.exe
1916	spoolsv.exe
3672	svchost.exe
3620	svchost.exe
2572	lsass.exe
2228	lsass.exe
3384	lsass.exe
1172	lsass.exe
4088	taskhost.exe
4480	taskhost.exe
3964	services.exe
4880	services.exe
2088	explorer.exe
4916	explorer.exe
4460	spoolsv.exe
2320	spoolsv.exe
3048	services.exe
2068	services.exe
4292	dwm.exe
2396	dwm.exe
4808	winlogon.exe
4516	winlogon.exe
1808	dwm.exe
2424	dwm.exe
5076	wininit.exe
4248	wininit.exe
3836	explorer.exe
3732	explorer.exe
3844	winlogon.exe
2100	winlogon.exe
1948	wininit.exe
2324	wininit.exe
1980	lsass.exe
4020	lsass.exe
1952	taskhost.exe
1292	taskhost.exe
1640	taskhost.exe
2640	taskhost.exe
3996	taskhost.exe
2636	lsass.exe
2668	lsass.exe
4296	services.exe

Loads dropped DLL 64 IoCs

pid	Process
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
2556	شسي.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
1908	explorer.exe
2552	services.exe
2552	services.exe
2552	services.exe
2552	services.exe
2552	services.exe
2552	services.exe
2552	services.exe
2552	services.exe
2552	services.exe
2552	services.exe
2552	services.exe
2552	services.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\catroot2\wininit.exe	csrss.exe
File opened for modification	C:\Windows\System32\Tasks\winmgmt.exe	attrib.exe
File opened for modification	C:\Windows\System32\spool\drivers\csrss.exe	attrib.exe
File created	C:\Windows\System32\spool\drivers\services.exe	spoolsv.exe
File opened for modification	C:\Windows\System32\wbem\dwm.exe	lsass.exe
File created	C:\Windows\System32\config\winmgmt.exe	wmpnetwk.exe
File opened for modification	C:\Windows\System32\catroot2\winlogon.exe	winmgmt.exe
File opened for modification	C:\Windows\System32\catroot2\dwm.exe	attrib.exe
File opened for modification	C:\Windows\System32\catroot2\explorer.exe	شسي.exe
File created	C:\Windows\System32\catroot2\lsass.exe	dwm.exe
File opened for modification	C:\Windows\System32\catroot2\winlogon.exe	attrib.exe
File opened for modification	C:\Windows\System32\catroot2\wininit.exe	csrss.exe
File opened for modification	C:\Windows\System32\catroot2\services.exe	taskhost.exe
File opened for modification	C:\Windows\System32\config\explorer.exe	attrib.exe
File opened for modification	C:\Windows\System32\spool\drivers\svchost.exe	dwm.exe
File created	C:\Windows\System32\config\spoolsv.exe	wmpnetwk.exe
File created	C:\Windows\System32\spool\drivers\csrss.exe	winmgmt.exe
File opened for modification	C:\Windows\System32\spool\drivers\winmgmt.exe	dwm.exe
File created	C:\Windows\System32\catroot2\csrss.exe	taskhost.exe
File opened for modification	C:\Windows\System32\Tasks\services.exe	attrib.exe
File created	C:\Windows\System32\Tasks\wmpnetwk.exe	lsass.exe
File opened for modification	C:\Windows\System32\Tasks\wmpnetwk.exe	attrib.exe
File opened for modification	C:\Windows\System32\catroot2\lsass.exe	dwm.exe
File opened for modification	C:\Windows\System32\catroot2\csrss.exe	attrib.exe
File opened for modification	C:\Windows\System32\config\spoolsv.exe	attrib.exe
File opened for modification	C:\Windows\System32\wbem\spoolsv.exe	attrib.exe
File created	C:\Windows\System32\wbem\lsass.exe	wmpnetwk.exe
File opened for modification	C:\Windows\System32\config\winmgmt.exe	attrib.exe
File created	C:\Windows\System32\catroot2\winlogon.exe	winmgmt.exe
File opened for modification	C:\Windows\System32\spool\drivers\taskhost.exe	attrib.exe
File opened for modification	C:\Windows\System32\spool\drivers\dwm.exe	csrss.exe
File opened for modification	C:\Windows\System32\catroot2\explorer.exe	attrib.exe
File opened for modification	C:\Windows\System32\spool\drivers\spoolsv.exe	lsass.exe
File opened for modification	C:\Windows\System32\catroot2\taskhost.exe	lsass.exe
File created	C:\Windows\System32\spool\drivers\winmgmt.exe	dwm.exe
File created	C:\Windows\System32\config\services.exe	winmgmt.exe
File created	C:\Windows\System32\Tasks\services.exe	explorer.exe
File created	C:\Windows\System32\config\dwm.exe	spoolsv.exe
File created	C:\Windows\System32\wbem\dwm.exe	lsass.exe
File opened for modification	C:\Windows\System32\wbem\winlogon.exe	csrss.exe
File created	C:\Windows\System32\wbem\services.exe	wmpnetwk.exe
File opened for modification	C:\Windows\System32\spool\drivers\services.exe	spoolsv.exe
File created	C:\Windows\System32\wbem\csrss.exe	svchost.exe
File opened for modification	C:\Windows\System32\wbem\explorer.exe	csrss.exe
File opened for modification	C:\Windows\System32\catroot2\services.exe	attrib.exe
File created	C:\Windows\System32\spool\drivers\explorer.exe	wininit.exe
File opened for modification	C:\Windows\System32\catroot2\lsass.exe	attrib.exe
File opened for modification	C:\Windows\System32\spool\drivers\taskhost.exe	csrss.exe
File created	C:\Windows\System32\catroot2\dwm.exe	services.exe
File created	C:\Windows\System32\catroot2\services.exe	taskhost.exe
File created	C:\Windows\System32\spool\drivers\dwm.exe	csrss.exe
File opened for modification	C:\Windows\System32\Tasks\winmgmt.exe	dwm.exe
File opened for modification	C:\Windows\System32\wbem\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\System32\config\dwm.exe	attrib.exe
File created	C:\Windows\System32\catroot2\spoolsv.exe	dwm.exe
File opened for modification	C:\Windows\System32\wbem\dwm.exe	attrib.exe
File opened for modification	C:\Windows\System32\config\services.exe	winmgmt.exe
File opened for modification	C:\Windows\System32\config\explorer.exe	lsass.exe
File opened for modification	C:\Windows\System32\catroot2\svchost.exe	taskhost.exe
File opened for modification	C:\Windows\System32\spool\drivers\explorer.exe	attrib.exe
File created	C:\Windows\System32\wbem\wmpnetwk.exe	winlogon.exe
File opened for modification	C:\Windows\System32\wbem\wmpnetwk.exe	attrib.exe
File created	C:\Windows\System32\Tasks\csrss.exe	wmpnetwk.exe
File opened for modification	C:\Windows\System32\wbem\svchost.exe	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1444	cmd.exe
2896	cmd.exe
5824	cmd.exe
2244	cmd.exe
972	cmd.exe
4012	cmd.exe
2512	cmd.exe
5900	cmd.exe
5724	cmd.exe
3144	cmd.exe
2732	cmd.exe
1092	cmd.exe
1912	cmd.exe
5948	cmd.exe
5280	cmd.exe
3296	cmd.exe
3104	cmd.exe
3236	cmd.exe
5024	cmd.exe
3708	cmd.exe
4404	cmd.exe
5664	cmd.exe
5004	cmd.exe
4400	cmd.exe
4376	cmd.exe
4352	cmd.exe
2096	cmd.exe
4572	cmd.exe
2496	cmd.exe
4860	cmd.exe
580	cmd.exe
2800	cmd.exe
5032	cmd.exe
2160	cmd.exe
2544	cmd.exe
4644	cmd.exe
1956	cmd.exe
4988	cmd.exe
2528	cmd.exe
6088	cmd.exe
2608	cmd.exe
2200	cmd.exe
3256	cmd.exe
3472	cmd.exe
1668	cmd.exe
6084	cmd.exe
1492	cmd.exe
1800	cmd.exe
4048	cmd.exe
4524	cmd.exe
5784	cmd.exe
4836	cmd.exe
444	cmd.exe
3156	cmd.exe
4716	cmd.exe
3968	cmd.exe
1716	cmd.exe
3768	cmd.exe
5612	cmd.exe
4920	cmd.exe
3760	cmd.exe
2576	cmd.exe
5336	cmd.exe
1760	cmd.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral3/files/0x001900000002b42c-150.dat	pyinstaller

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2556	1820	شسي.exe	82
PID 2556 wrote to memory of 1956	2556	شسي.exe	84
PID 1956 wrote to memory of 3704	1956	cmd.exe	85
PID 2556 wrote to memory of 5040	2556	شسي.exe	86
PID 5040 wrote to memory of 1380	5040	cmd.exe	88
PID 1380 wrote to memory of 1908	1380	explorer.exe	89
PID 1908 wrote to memory of 5004	1908	explorer.exe	90
PID 5004 wrote to memory of 3296	5004	cmd.exe	91
PID 1908 wrote to memory of 4620	1908	explorer.exe	92
PID 4620 wrote to memory of 4624	4620	cmd.exe	94
PID 4624 wrote to memory of 2552	4624	services.exe	95
PID 2552 wrote to memory of 2096	2552	services.exe	96
PID 2096 wrote to memory of 3160	2096	cmd.exe	97
PID 2552 wrote to memory of 4616	2552	services.exe	98
PID 4616 wrote to memory of 5008	4616	cmd.exe	100
PID 5008 wrote to memory of 3916	5008	lsass.exe	101
PID 3916 wrote to memory of 3968	3916	lsass.exe	102
PID 3968 wrote to memory of 3092	3968	cmd.exe	103
PID 3916 wrote to memory of 4792	3916	lsass.exe	104
PID 4792 wrote to memory of 2256	4792	cmd.exe	106
PID 2256 wrote to memory of 1032	2256	spoolsv.exe	107
PID 1032 wrote to memory of 4988	1032	spoolsv.exe	108
PID 4988 wrote to memory of 3484	4988	cmd.exe	109
PID 1032 wrote to memory of 1404	1032	spoolsv.exe	110
PID 1404 wrote to memory of 5104	1404	cmd.exe	112
PID 5104 wrote to memory of 4848	5104	services.exe	113
PID 4848 wrote to memory of 1492	4848	services.exe	114
PID 1492 wrote to memory of 4572	1492	cmd.exe	115
PID 4848 wrote to memory of 4612	4848	services.exe	116
PID 4612 wrote to memory of 1124	4612	cmd.exe	118
PID 1124 wrote to memory of 4152	1124	services.exe	119
PID 4152 wrote to memory of 1716	4152	services.exe	120
PID 1716 wrote to memory of 1368	1716	cmd.exe	121
PID 4152 wrote to memory of 3292	4152	services.exe	122
PID 3292 wrote to memory of 332	3292	cmd.exe	124
PID 332 wrote to memory of 1748	332	winlogon.exe	125
PID 1748 wrote to memory of 4836	1748	winlogon.exe	126
PID 4836 wrote to memory of 4000	4836	cmd.exe	127
PID 1748 wrote to memory of 2672	1748	winlogon.exe	128
PID 2672 wrote to memory of 2624	2672	cmd.exe	130
PID 2624 wrote to memory of 3524	2624	dwm.exe	131
PID 3524 wrote to memory of 1760	3524	dwm.exe	132
PID 1760 wrote to memory of 4244	1760	cmd.exe	133
PID 3524 wrote to memory of 1712	3524	dwm.exe	134
PID 1712 wrote to memory of 4628	1712	cmd.exe	136
PID 4628 wrote to memory of 3228	4628	winmgmt.exe	137
PID 3228 wrote to memory of 2160	3228	winmgmt.exe	138
PID 2160 wrote to memory of 240	2160	cmd.exe	139
PID 3228 wrote to memory of 4972	3228	winmgmt.exe	140
PID 4972 wrote to memory of 2336	4972	cmd.exe	142
PID 2336 wrote to memory of 2052	2336	csrss.exe	143
PID 2052 wrote to memory of 3296	2052	csrss.exe	144
PID 3296 wrote to memory of 4860	3296	cmd.exe	145
PID 2052 wrote to memory of 2188	2052	csrss.exe	146
PID 2188 wrote to memory of 1420	2188	cmd.exe	148
PID 1420 wrote to memory of 3212	1420	lsass.exe	149
PID 3212 wrote to memory of 3104	3212	lsass.exe	150
PID 3104 wrote to memory of 5016	3104	cmd.exe	151
PID 3212 wrote to memory of 2388	3212	lsass.exe	152
PID 2388 wrote to memory of 672	2388	cmd.exe	154
PID 672 wrote to memory of 1916	672	spoolsv.exe	155
PID 1916 wrote to memory of 2608	1916	spoolsv.exe	156
PID 2608 wrote to memory of 1520	2608	cmd.exe	157
PID 1916 wrote to memory of 2368	1916	spoolsv.exe	158

Views/modifies file attributes 1 TTPs 61 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4572	attrib.exe
3452	attrib.exe
4596	attrib.exe
5840	attrib.exe
496	attrib.exe
3336	attrib.exe
3808	attrib.exe
1464	attrib.exe
2588	attrib.exe
1680	attrib.exe
5652	attrib.exe
3092	attrib.exe
3208	attrib.exe
1772	attrib.exe
3704	attrib.exe
3484	attrib.exe
5016	attrib.exe
3640	attrib.exe
4396	attrib.exe
1696	attrib.exe
224	attrib.exe
2412	attrib.exe
4020	attrib.exe
2888	attrib.exe
4244	attrib.exe
224	attrib.exe
3136	attrib.exe
4720	attrib.exe
608	attrib.exe
5836	attrib.exe
3752	attrib.exe
4244	attrib.exe
952	attrib.exe
3824	attrib.exe
5232	attrib.exe
1368	attrib.exe
1520	attrib.exe
3848	attrib.exe
1616	attrib.exe
4472	attrib.exe
5636	attrib.exe
2528	attrib.exe
1508	attrib.exe
1816	attrib.exe
3296	attrib.exe
4000	attrib.exe
2028	attrib.exe
1296	attrib.exe
228	attrib.exe
2164	attrib.exe
4860	attrib.exe
4536	attrib.exe
816	attrib.exe
2492	attrib.exe
5960	attrib.exe
3160	attrib.exe
240	attrib.exe
2276	attrib.exe
3304	attrib.exe
348	attrib.exe
2688	attrib.exe

C:\Users\Admin\AppData\Local\Temp\شسي.exe
"C:\Users\Admin\AppData\Local\Temp\شسي.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\شسي.exe
  "C:\Users\Admin\AppData\Local\Temp\شسي.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\explorer.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\catroot2\explorer.exe
      4⤵
      Drops file in System32 directory
      Views/modifies file attributes
      PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\System32\catroot2\explorer.exe
      C:\Windows\System32\catroot2\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1380
    - - C:\Windows\System32\catroot2\explorer.exe
        
        C:\Windows\System32\catroot2\explorer.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\Tasks\services.exe"
        6⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\Tasks\services.exe
        7⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3296
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\services.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\System32\Tasks\services.exe
        
        C:\Windows\System32\Tasks\services.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\System32\Tasks\services.exe
        
        C:\Windows\System32\Tasks\services.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\lsass.exe"
        9⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\lsass.exe
        10⤵
        Views/modifies file attributes
        
        PID:3160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\lsass.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\spoolsv.exe"
        12⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\spoolsv.exe
        13⤵
        Views/modifies file attributes
        
        PID:3092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\spoolsv.exe"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\System32\spool\drivers\spoolsv.exe
        
        C:\Windows\System32\spool\drivers\spoolsv.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\System32\spool\drivers\spoolsv.exe
        
        C:\Windows\System32\spool\drivers\spoolsv.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\services.exe"
        15⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\services.exe
        16⤵
        Views/modifies file attributes
        
        PID:3484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\services.exe"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\System32\spool\drivers\services.exe
        
        C:\Windows\System32\spool\drivers\services.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\System32\spool\drivers\services.exe
        
        C:\Windows\System32\spool\drivers\services.exe
        17⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\services.exe"
        18⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\services.exe
        19⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:4572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\services.exe"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\System32\drivers\etc\services.exe
        
        C:\Windows\System32\drivers\etc\services.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\System32\drivers\etc\services.exe
        
        C:\Windows\System32\drivers\etc\services.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\winlogon.exe"
        21⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\config\winlogon.exe
        22⤵
        Views/modifies file attributes
        
        PID:1368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\winlogon.exe"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:332
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\Tasks\dwm.exe"
        24⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\Tasks\dwm.exe
        25⤵
        Views/modifies file attributes
        
        PID:4000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\dwm.exe"
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\Tasks\winmgmt.exe"
        27⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\Tasks\winmgmt.exe
        28⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\winmgmt.exe"
        27⤵
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\System32\Tasks\winmgmt.exe
        
        C:\Windows\System32\Tasks\winmgmt.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\System32\Tasks\winmgmt.exe
        
        C:\Windows\System32\Tasks\winmgmt.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\csrss.exe"
        30⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\csrss.exe
        31⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\csrss.exe"
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\System32\spool\drivers\csrss.exe
        
        C:\Windows\System32\spool\drivers\csrss.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\System32\spool\drivers\csrss.exe
        
        C:\Windows\System32\spool\drivers\csrss.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\Tasks\lsass.exe"
        33⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\Tasks\lsass.exe
        34⤵
        Views/modifies file attributes
        
        PID:4860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\lsass.exe"
        33⤵
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        35⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\spoolsv.exe"
        36⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\spoolsv.exe
        37⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:5016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\spoolsv.exe"
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\System32\drivers\etc\spoolsv.exe
        
        C:\Windows\System32\drivers\etc\spoolsv.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:672
        
        C:\Windows\System32\drivers\etc\spoolsv.exe
        
        C:\Windows\System32\drivers\etc\spoolsv.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\Tasks\svchost.exe"
        39⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\Tasks\svchost.exe
        40⤵
        Views/modifies file attributes
        
        PID:1520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\svchost.exe"
        39⤵
        
        PID:2368
        
        C:\Windows\System32\Tasks\svchost.exe
        
        C:\Windows\System32\Tasks\svchost.exe
        40⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\System32\Tasks\svchost.exe
        
        C:\Windows\System32\Tasks\svchost.exe
        41⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\lsass.exe"
        42⤵
        
        PID:860
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        43⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        44⤵
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\lsass.exe"
        45⤵
        
        PID:4116
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        46⤵
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\taskhost.exe"
        48⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1092
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\taskhost.exe
        49⤵
        Views/modifies file attributes
        
        PID:2528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\taskhost.exe"
        48⤵
        
        PID:3528
        
        C:\Windows\System32\catroot2\taskhost.exe
        
        C:\Windows\System32\catroot2\taskhost.exe
        49⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\System32\catroot2\taskhost.exe
        
        C:\Windows\System32\catroot2\taskhost.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\services.exe"
        51⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3760
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\services.exe
        52⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\services.exe"
        51⤵
        
        PID:4928
        
        C:\Windows\System32\catroot2\services.exe
        
        C:\Windows\System32\catroot2\services.exe
        52⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\System32\catroot2\services.exe
        
        C:\Windows\System32\catroot2\services.exe
        53⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\explorer.exe"
        54⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1912
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\explorer.exe
        55⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\explorer.exe"
        54⤵
        
        PID:4548
        
        C:\Windows\System32\drivers\etc\explorer.exe
        
        C:\Windows\System32\drivers\etc\explorer.exe
        55⤵
        Executes dropped EXE
        
        PID:2088
        
        C:\Windows\System32\drivers\etc\explorer.exe
        
        C:\Windows\System32\drivers\etc\explorer.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\spoolsv.exe"
        57⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4572
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\spoolsv.exe
        58⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\spoolsv.exe"
        57⤵
        
        PID:912
        
        C:\Windows\System32\wbem\spoolsv.exe
        
        C:\Windows\System32\wbem\spoolsv.exe
        58⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\System32\wbem\spoolsv.exe
        
        C:\Windows\System32\wbem\spoolsv.exe
        59⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\services.exe"
        60⤵
        
        PID:2932
        
        C:\Windows\System32\spool\drivers\services.exe
        
        C:\Windows\System32\spool\drivers\services.exe
        61⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\System32\spool\drivers\services.exe
        
        C:\Windows\System32\spool\drivers\services.exe
        62⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\dwm.exe"
        63⤵
        
        PID:1328
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        64⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        65⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\winlogon.exe"
        66⤵
        
        PID:2104
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        67⤵
        Executes dropped EXE
        
        PID:4808
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        68⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\dwm.exe"
        69⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4400
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\dwm.exe
        70⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\dwm.exe"
        69⤵
        
        PID:4072
        
        C:\Windows\System32\drivers\etc\dwm.exe
        
        C:\Windows\System32\drivers\etc\dwm.exe
        70⤵
        Executes dropped EXE
        
        PID:1808
        
        C:\Windows\System32\drivers\etc\dwm.exe
        
        C:\Windows\System32\drivers\etc\dwm.exe
        71⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\Tasks\wininit.exe"
        72⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2800
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\Tasks\wininit.exe
        73⤵
        Views/modifies file attributes
        
        PID:4020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\wininit.exe"
        72⤵
        
        PID:2420
        
        C:\Windows\System32\Tasks\wininit.exe
        
        C:\Windows\System32\Tasks\wininit.exe
        73⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\System32\Tasks\wininit.exe
        
        C:\Windows\System32\Tasks\wininit.exe
        74⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\explorer.exe"
        75⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1444
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\explorer.exe
        76⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\explorer.exe"
        75⤵
        
        PID:2604
        
        C:\Windows\System32\spool\drivers\explorer.exe
        
        C:\Windows\System32\spool\drivers\explorer.exe
        76⤵
        Executes dropped EXE
        
        PID:3836
        
        C:\Windows\System32\spool\drivers\explorer.exe
        
        C:\Windows\System32\spool\drivers\explorer.exe
        77⤵
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\winlogon.exe"
        78⤵
        
        PID:8
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        79⤵
        Executes dropped EXE
        
        PID:3844
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        80⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\wininit.exe"
        81⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1800
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\wininit.exe
        82⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:3640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\wininit.exe"
        81⤵
        
        PID:696
        
        C:\Windows\System32\drivers\etc\wininit.exe
        
        C:\Windows\System32\drivers\etc\wininit.exe
        82⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\System32\drivers\etc\wininit.exe
        
        C:\Windows\System32\drivers\etc\wininit.exe
        83⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\lsass.exe"
        84⤵
        
        PID:2296
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        85⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        86⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\taskhost.exe"
        87⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3236
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\taskhost.exe
        88⤵
        Views/modifies file attributes
        
        PID:3336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\taskhost.exe"
        87⤵
        
        PID:3420
        
        C:\Windows\System32\wbem\taskhost.exe
        
        C:\Windows\System32\wbem\taskhost.exe
        88⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\System32\wbem\taskhost.exe
        
        C:\Windows\System32\wbem\taskhost.exe
        89⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\taskhost.exe"
        90⤵
        
        PID:3356
        
        C:\Windows\System32\wbem\taskhost.exe
        
        C:\Windows\System32\wbem\taskhost.exe
        91⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:1640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\taskhost.exe"
        92⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:972
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\taskhost.exe
        93⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:2888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\taskhost.exe"
        92⤵
        
        PID:3448
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        93⤵
        Executes dropped EXE
        
        PID:2640
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        94⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\lsass.exe"
        95⤵
        
        PID:1888
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        96⤵
        Executes dropped EXE
        
        PID:2636
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        97⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\services.exe"
        98⤵
        
        PID:980
        
        C:\Windows\System32\Tasks\services.exe
        
        C:\Windows\System32\Tasks\services.exe
        99⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\System32\Tasks\services.exe
        
        C:\Windows\System32\Tasks\services.exe
        100⤵
        
        PID:4816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\spoolsv.exe"
        101⤵
        
        PID:2504
        
        C:\Windows\System32\wbem\spoolsv.exe
        
        C:\Windows\System32\wbem\spoolsv.exe
        102⤵
        
        PID:2964
        
        C:\Windows\System32\wbem\spoolsv.exe
        
        C:\Windows\System32\wbem\spoolsv.exe
        103⤵
        Drops file in System32 directory
        
        PID:3376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\dwm.exe"
        104⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4920
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\config\dwm.exe
        105⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\dwm.exe"
        104⤵
        
        PID:3908
        
        C:\Windows\System32\config\dwm.exe
        
        C:\Windows\System32\config\dwm.exe
        105⤵
        
        PID:4608
        
        C:\Windows\System32\config\dwm.exe
        
        C:\Windows\System32\config\dwm.exe
        106⤵
        
        PID:4544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\dwm.exe"
        107⤵
        
        PID:2548
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        108⤵
        
        PID:4604
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        109⤵
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\spoolsv.exe"
        110⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2544
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\spoolsv.exe
        111⤵
        Views/modifies file attributes
        
        PID:3848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\spoolsv.exe"
        110⤵
        
        PID:3468
        
        C:\Windows\System32\catroot2\spoolsv.exe
        
        C:\Windows\System32\catroot2\spoolsv.exe
        111⤵
        
        PID:1376
        
        C:\Windows\System32\catroot2\spoolsv.exe
        
        C:\Windows\System32\catroot2\spoolsv.exe
        112⤵
        Drops file in Drivers directory
        
        PID:1540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\wmpnetwk.exe"
        113⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5024
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\wmpnetwk.exe
        114⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:3808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\wmpnetwk.exe"
        113⤵
        
        PID:5116
        
        C:\Windows\System32\drivers\etc\wmpnetwk.exe
        
        C:\Windows\System32\drivers\etc\wmpnetwk.exe
        114⤵
        
        PID:3380
        
        C:\Windows\System32\drivers\etc\wmpnetwk.exe
        
        C:\Windows\System32\drivers\etc\wmpnetwk.exe
        115⤵
        Drops file in Drivers directory
        
        PID:2392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\winmgmt.exe"
        116⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2496
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\winmgmt.exe
        117⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:1816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\winmgmt.exe"
        116⤵
        
        PID:3584
        
        C:\Windows\System32\drivers\etc\winmgmt.exe
        
        C:\Windows\System32\drivers\etc\winmgmt.exe
        117⤵
        
        PID:1284
        
        C:\Windows\System32\drivers\etc\winmgmt.exe
        
        C:\Windows\System32\drivers\etc\winmgmt.exe
        118⤵
        
        PID:2196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\csrss.exe"
        119⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2200
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\config\csrss.exe
        120⤵
        Views/modifies file attributes
        
        PID:3452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\csrss.exe"
        119⤵
        
        PID:3972
        
        C:\Windows\System32\config\csrss.exe
        
        C:\Windows\System32\config\csrss.exe
        120⤵
        
        PID:764
        
        C:\Windows\System32\config\csrss.exe
        
        C:\Windows\System32\config\csrss.exe
        121⤵
        
        PID:4892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\lsass.exe"
        122⤵
        
        PID:4092
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        123⤵
        
        PID:1816
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        124⤵
        Drops file in System32 directory
        
        PID:2500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\Tasks\wmpnetwk.exe"
        125⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3768
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\Tasks\wmpnetwk.exe
        126⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\wmpnetwk.exe"
        125⤵
        
        PID:2180
        
        C:\Windows\System32\Tasks\wmpnetwk.exe
        
        C:\Windows\System32\Tasks\wmpnetwk.exe
        126⤵
        
        PID:4840
        
        C:\Windows\System32\Tasks\wmpnetwk.exe
        
        C:\Windows\System32\Tasks\wmpnetwk.exe
        127⤵
        Drops file in System32 directory
        
        PID:2204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\lsass.exe"
        128⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4376
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\lsass.exe
        129⤵
        Views/modifies file attributes
        
        PID:1616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\lsass.exe"
        128⤵
        
        PID:4036
        
        C:\Windows\System32\wbem\lsass.exe
        
        C:\Windows\System32\wbem\lsass.exe
        129⤵
        
        PID:2128
        
        C:\Windows\System32\wbem\lsass.exe
        
        C:\Windows\System32\wbem\lsass.exe
        130⤵
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\dwm.exe"
        131⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2896
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\dwm.exe
        132⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\dwm.exe"
        131⤵
        
        PID:1864
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        132⤵
        
        PID:4580
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        133⤵
        Drops file in Drivers directory
        
        PID:3656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\lsass.exe"
        134⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4860
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\lsass.exe
        135⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:2028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\lsass.exe"
        134⤵
        
        PID:2460
        
        C:\Windows\System32\drivers\etc\lsass.exe
        
        C:\Windows\System32\drivers\etc\lsass.exe
        135⤵
        
        PID:2560
        
        C:\Windows\System32\drivers\etc\lsass.exe
        
        C:\Windows\System32\drivers\etc\lsass.exe
        136⤵
        
        PID:3464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\dwm.exe"
        137⤵
        
        PID:3776
        
        C:\Windows\System32\drivers\etc\dwm.exe
        
        C:\Windows\System32\drivers\etc\dwm.exe
        138⤵
        
        PID:2116
        
        C:\Windows\System32\drivers\etc\dwm.exe
        
        C:\Windows\System32\drivers\etc\dwm.exe
        139⤵
        Drops file in System32 directory
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\winmgmt.exe"
        140⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4048
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\winmgmt.exe
        141⤵
        Views/modifies file attributes
        
        PID:1296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\winmgmt.exe"
        140⤵
        
        PID:5080
        
        C:\Windows\System32\spool\drivers\winmgmt.exe
        
        C:\Windows\System32\spool\drivers\winmgmt.exe
        141⤵
        
        PID:4252
        
        C:\Windows\System32\spool\drivers\winmgmt.exe
        
        C:\Windows\System32\spool\drivers\winmgmt.exe
        142⤵
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\services.exe"
        143⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4352
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\config\services.exe
        144⤵
        Views/modifies file attributes
        
        PID:4472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\services.exe"
        143⤵
        
        PID:1352
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        144⤵
        
        PID:1408
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        145⤵
        
        PID:1804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\dwm.exe"
        146⤵
        
        PID:3192
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        147⤵
        
        PID:4044
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        148⤵
        Drops file in System32 directory
        
        PID:3772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\lsass.exe"
        149⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3144
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\lsass.exe
        150⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\lsass.exe"
        149⤵
        
        PID:2812
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        150⤵
        
        PID:4944
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        151⤵
        
        PID:3140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\winlogon.exe"
        152⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4524
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\winlogon.exe
        153⤵
        Views/modifies file attributes
        
        PID:952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\winlogon.exe"
        152⤵
        
        PID:3392
        
        C:\Windows\System32\spool\drivers\winlogon.exe
        
        C:\Windows\System32\spool\drivers\winlogon.exe
        153⤵
        
        PID:1612
        
        C:\Windows\System32\spool\drivers\winlogon.exe
        
        C:\Windows\System32\spool\drivers\winlogon.exe
        154⤵
        Drops file in System32 directory
        
        PID:3396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\wmpnetwk.exe"
        155⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2528
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\wmpnetwk.exe
        156⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\wmpnetwk.exe"
        155⤵
        
        PID:1964
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        156⤵
        
        PID:4576
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        157⤵
        Drops file in System32 directory
        
        PID:3348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\Tasks\csrss.exe"
        158⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3708
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\Tasks\csrss.exe
        159⤵
        Views/modifies file attributes
        
        PID:2276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\csrss.exe"
        158⤵
        
        PID:4000
        
        C:\Windows\System32\Tasks\csrss.exe
        
        C:\Windows\System32\Tasks\csrss.exe
        159⤵
        
        PID:4100
        
        C:\Windows\System32\Tasks\csrss.exe
        
        C:\Windows\System32\Tasks\csrss.exe
        160⤵
        Drops file in System32 directory
        
        PID:3636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\winlogon.exe"
        161⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3256
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\winlogon.exe
        162⤵
        Views/modifies file attributes
        
        PID:2412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\winlogon.exe"
        161⤵
        
        PID:4652
        
        C:\Windows\System32\wbem\winlogon.exe
        
        C:\Windows\System32\wbem\winlogon.exe
        162⤵
        
        PID:396
        
        C:\Windows\System32\wbem\winlogon.exe
        
        C:\Windows\System32\wbem\winlogon.exe
        163⤵
        
        PID:3160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\lsass.exe"
        164⤵
        
        PID:4024
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        165⤵
        
        PID:3456
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        166⤵
        
        PID:5048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\wmpnetwk.exe"
        167⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2732
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\wmpnetwk.exe
        168⤵
        Views/modifies file attributes
        
        PID:1464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\wmpnetwk.exe"
        167⤵
        
        PID:1232
        
        C:\Windows\System32\catroot2\wmpnetwk.exe
        
        C:\Windows\System32\catroot2\wmpnetwk.exe
        168⤵
        
        PID:3848
        
        C:\Windows\System32\catroot2\wmpnetwk.exe
        
        C:\Windows\System32\catroot2\wmpnetwk.exe
        169⤵
        Drops file in System32 directory
        
        PID:2568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\winmgmt.exe"
        170⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4404
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\config\winmgmt.exe
        171⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\winmgmt.exe"
        170⤵
        
        PID:1084
        
        C:\Windows\System32\config\winmgmt.exe
        
        C:\Windows\System32\config\winmgmt.exe
        171⤵
        
        PID:236
        
        C:\Windows\System32\config\winmgmt.exe
        
        C:\Windows\System32\config\winmgmt.exe
        172⤵
        Drops file in Drivers directory
        
        PID:240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\csrss.exe"
        173⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4012
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\csrss.exe
        174⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:3304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\csrss.exe"
        173⤵
        
        PID:4728
        
        C:\Windows\System32\drivers\etc\csrss.exe
        
        C:\Windows\System32\drivers\etc\csrss.exe
        174⤵
        
        PID:4112
        
        C:\Windows\System32\drivers\etc\csrss.exe
        
        C:\Windows\System32\drivers\etc\csrss.exe
        175⤵
        
        PID:1368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\services.exe"
        176⤵
        
        PID:1676
        
        C:\Windows\System32\spool\drivers\services.exe
        
        C:\Windows\System32\spool\drivers\services.exe
        177⤵
        
        PID:3704
        
        C:\Windows\System32\spool\drivers\services.exe
        
        C:\Windows\System32\spool\drivers\services.exe
        178⤵
        
        PID:1412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\winlogon.exe"
        179⤵
        
        PID:4980
        
        C:\Windows\System32\wbem\winlogon.exe
        
        C:\Windows\System32\wbem\winlogon.exe
        180⤵
        
        PID:1460
        
        C:\Windows\System32\wbem\winlogon.exe
        
        C:\Windows\System32\wbem\winlogon.exe
        181⤵
        
        PID:4084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\services.exe"
        182⤵
        
        PID:3548
        
        C:\Windows\System32\Tasks\services.exe
        
        C:\Windows\System32\Tasks\services.exe
        183⤵
        
        PID:3304
        
        C:\Windows\System32\Tasks\services.exe
        
        C:\Windows\System32\Tasks\services.exe
        184⤵
        
        PID:3884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\taskhost.exe"
        185⤵
        
        PID:1644
        
        C:\Windows\System32\wbem\taskhost.exe
        
        C:\Windows\System32\wbem\taskhost.exe
        186⤵
        
        PID:1984
        
        C:\Windows\System32\wbem\taskhost.exe
        
        C:\Windows\System32\wbem\taskhost.exe
        187⤵
        
        PID:4564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\lsass.exe"
        188⤵
        
        PID:1860
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        189⤵
        
        PID:3796
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        190⤵
        
        PID:2468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\dwm.exe"
        191⤵
        
        PID:3248
        
        C:\Windows\System32\config\dwm.exe
        
        C:\Windows\System32\config\dwm.exe
        192⤵
        
        PID:1332
        
        C:\Windows\System32\config\dwm.exe
        
        C:\Windows\System32\config\dwm.exe
        193⤵
        
        PID:4472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\svchost.exe"
        194⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5032
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\svchost.exe
        195⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\svchost.exe"
        194⤵
        
        PID:4464
        
        C:\Windows\System32\wbem\svchost.exe
        
        C:\Windows\System32\wbem\svchost.exe
        195⤵
        
        PID:2276
        
        C:\Windows\System32\wbem\svchost.exe
        
        C:\Windows\System32\wbem\svchost.exe
        196⤵
        Drops file in System32 directory
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\csrss.exe"
        197⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:444
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\csrss.exe
        198⤵
        Views/modifies file attributes
        
        PID:1696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\csrss.exe"
        197⤵
        
        PID:4976
        
        C:\Windows\System32\wbem\csrss.exe
        
        C:\Windows\System32\wbem\csrss.exe
        198⤵
        
        PID:3988
        
        C:\Windows\System32\wbem\csrss.exe
        
        C:\Windows\System32\wbem\csrss.exe
        199⤵
        
        PID:3752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\lsass.exe"
        200⤵
        
        PID:2312
        
        C:\Windows\System32\drivers\etc\lsass.exe
        
        C:\Windows\System32\drivers\etc\lsass.exe
        201⤵
        
        PID:2844
        
        C:\Windows\System32\drivers\etc\lsass.exe
        
        C:\Windows\System32\drivers\etc\lsass.exe
        202⤵
        
        PID:1108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\winmgmt.exe"
        203⤵
        
        PID:3764
        
        C:\Windows\System32\spool\drivers\winmgmt.exe
        
        C:\Windows\System32\spool\drivers\winmgmt.exe
        204⤵
        
        PID:952
        
        C:\Windows\System32\spool\drivers\winmgmt.exe
        
        C:\Windows\System32\spool\drivers\winmgmt.exe
        205⤵
        Drops file in System32 directory
        
        PID:2588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\winlogon.exe"
        206⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:580
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\winlogon.exe
        207⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\winlogon.exe"
        206⤵
        
        PID:1104
        
        C:\Windows\System32\catroot2\winlogon.exe
        
        C:\Windows\System32\catroot2\winlogon.exe
        207⤵
        
        PID:1296
        
        C:\Windows\System32\catroot2\winlogon.exe
        
        C:\Windows\System32\catroot2\winlogon.exe
        208⤵
        
        PID:3928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\winmgmt.exe"
        209⤵
        
        PID:864
        
        C:\Windows\System32\Tasks\winmgmt.exe
        
        C:\Windows\System32\Tasks\winmgmt.exe
        210⤵
        
        PID:4208
        
        C:\Windows\System32\Tasks\winmgmt.exe
        
        C:\Windows\System32\Tasks\winmgmt.exe
        211⤵
        
        PID:660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\csrss.exe"
        212⤵
        
        PID:3260
        
        C:\Windows\System32\spool\drivers\csrss.exe
        
        C:\Windows\System32\spool\drivers\csrss.exe
        213⤵
        
        PID:2848
        
        C:\Windows\System32\spool\drivers\csrss.exe
        
        C:\Windows\System32\spool\drivers\csrss.exe
        214⤵
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\taskhost.exe"
        215⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3472
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\taskhost.exe
        216⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\taskhost.exe"
        215⤵
        
        PID:4752
        
        C:\Windows\System32\spool\drivers\taskhost.exe
        
        C:\Windows\System32\spool\drivers\taskhost.exe
        216⤵
        
        PID:2888
        
        C:\Windows\System32\spool\drivers\taskhost.exe
        
        C:\Windows\System32\spool\drivers\taskhost.exe
        217⤵
        
        PID:1484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\dwm.exe"
        218⤵
        
        PID:4680
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        219⤵
        
        PID:5020
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        220⤵
        
        PID:852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\dwm.exe"
        221⤵
        
        PID:348
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        222⤵
        
        PID:1500
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        223⤵
        
        PID:784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\winlogon.exe"
        224⤵
        
        PID:3220
        
        C:\Windows\System32\wbem\winlogon.exe
        
        C:\Windows\System32\wbem\winlogon.exe
        225⤵
        
        PID:4992
        
        C:\Windows\System32\wbem\winlogon.exe
        
        C:\Windows\System32\wbem\winlogon.exe
        226⤵
        
        PID:1152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\csrss.exe"
        227⤵
        
        PID:5060
        
        C:\Windows\System32\Tasks\csrss.exe
        
        C:\Windows\System32\Tasks\csrss.exe
        228⤵
        
        PID:2072
        
        C:\Windows\System32\Tasks\csrss.exe
        
        C:\Windows\System32\Tasks\csrss.exe
        229⤵
        
        PID:1616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\taskhost.exe"
        230⤵
        
        PID:4368
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        231⤵
        
        PID:4884
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        232⤵
        Drops file in System32 directory
        
        PID:3600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\csrss.exe"
        233⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4644
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\csrss.exe
        234⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\csrss.exe"
        233⤵
        
        PID:816
        
        C:\Windows\System32\catroot2\csrss.exe
        
        C:\Windows\System32\catroot2\csrss.exe
        234⤵
        
        PID:2148
        
        C:\Windows\System32\catroot2\csrss.exe
        
        C:\Windows\System32\catroot2\csrss.exe
        235⤵
        Drops file in System32 directory
        
        PID:1892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\wininit.exe"
        236⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1668
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\wininit.exe
        237⤵
        Views/modifies file attributes
        
        PID:1680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\wininit.exe"
        236⤵
        
        PID:2744
        
        C:\Windows\System32\catroot2\wininit.exe
        
        C:\Windows\System32\catroot2\wininit.exe
        237⤵
        
        PID:2260
        
        C:\Windows\System32\catroot2\wininit.exe
        
        C:\Windows\System32\catroot2\wininit.exe
        238⤵
        
        PID:4312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\csrss.exe"
        239⤵
        
        PID:772
        
        C:\Windows\System32\Tasks\csrss.exe
        
        C:\Windows\System32\Tasks\csrss.exe
        240⤵
        
        PID:5068
        
        C:\Windows\System32\Tasks\csrss.exe
        
        C:\Windows\System32\Tasks\csrss.exe
        241⤵
        
        PID:4748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\wmpnetwk.exe"
        242⤵
        
        PID:4032
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        243⤵
        
        PID:1256
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        244⤵
        
        PID:2524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\services.exe"
        245⤵
        
        PID:1184
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        246⤵
        
        PID:2864
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        247⤵
        
        PID:2876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\taskhost.exe"
        248⤵
        
        PID:4120
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        249⤵
        
        PID:3284
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        250⤵
        
        PID:2400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\wininit.exe"
        251⤵
        
        PID:3816
        
        C:\Windows\System32\Tasks\wininit.exe
        
        C:\Windows\System32\Tasks\wininit.exe
        252⤵
        
        PID:4056
        
        C:\Windows\System32\Tasks\wininit.exe
        
        C:\Windows\System32\Tasks\wininit.exe
        253⤵
        
        PID:3632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\lsass.exe"
        254⤵
        
        PID:3488
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        255⤵
        
        PID:4996
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        256⤵
        
        PID:3736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\winmgmt.exe"
        257⤵
        
        PID:4532
        
        C:\Windows\System32\config\winmgmt.exe
        
        C:\Windows\System32\config\winmgmt.exe
        258⤵
        
        PID:3000
        
        C:\Windows\System32\config\winmgmt.exe
        
        C:\Windows\System32\config\winmgmt.exe
        259⤵
        
        PID:1128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\taskhost.exe"
        260⤵
        
        PID:2584
        
        C:\Windows\System32\wbem\taskhost.exe
        
        C:\Windows\System32\wbem\taskhost.exe
        261⤵
        
        PID:4244
        
        C:\Windows\System32\wbem\taskhost.exe
        
        C:\Windows\System32\wbem\taskhost.exe
        262⤵
        
        PID:4640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\winlogon.exe"
        263⤵
        
        PID:3264
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        264⤵
        
        PID:2620
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        265⤵
        
        PID:3388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\csrss.exe"
        266⤵
        
        PID:2316
        
        C:\Windows\System32\config\csrss.exe
        
        C:\Windows\System32\config\csrss.exe
        267⤵
        
        PID:412
        
        C:\Windows\System32\config\csrss.exe
        
        C:\Windows\System32\config\csrss.exe
        268⤵
        Drops file in System32 directory
        
        PID:1844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\dwm.exe"
        269⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2576
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\dwm.exe
        270⤵
        Views/modifies file attributes
        
        PID:2164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\dwm.exe"
        269⤵
        
        PID:2224
        
        C:\Windows\System32\spool\drivers\dwm.exe
        
        C:\Windows\System32\spool\drivers\dwm.exe
        270⤵
        
        PID:1736
        
        C:\Windows\System32\spool\drivers\dwm.exe
        
        C:\Windows\System32\spool\drivers\dwm.exe
        271⤵
        
        PID:652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\services.exe"
        272⤵
        
        PID:2892
        
        C:\Windows\System32\Tasks\services.exe
        
        C:\Windows\System32\Tasks\services.exe
        273⤵
        
        PID:2212
        
        C:\Windows\System32\Tasks\services.exe
        
        C:\Windows\System32\Tasks\services.exe
        274⤵
        
        PID:1464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\explorer.exe"
        275⤵
        
        PID:4104
        
        C:\Windows\System32\spool\drivers\explorer.exe
        
        C:\Windows\System32\spool\drivers\explorer.exe
        276⤵
        
        PID:3452
        
        C:\Windows\System32\spool\drivers\explorer.exe
        
        C:\Windows\System32\spool\drivers\explorer.exe
        277⤵
        
        PID:1132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\lsass.exe"
        278⤵
        
        PID:2956
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        279⤵
        
        PID:5036
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        280⤵
        
        PID:2592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\wmpnetwk.exe"
        281⤵
        
        PID:4864
        
        C:\Windows\System32\Tasks\wmpnetwk.exe
        
        C:\Windows\System32\Tasks\wmpnetwk.exe
        282⤵
        
        PID:2280
        
        C:\Windows\System32\Tasks\wmpnetwk.exe
        
        C:\Windows\System32\Tasks\wmpnetwk.exe
        283⤵
        
        PID:2112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\dwm.exe"
        284⤵
        
        PID:4852
        
        C:\Windows\System32\drivers\etc\dwm.exe
        
        C:\Windows\System32\drivers\etc\dwm.exe
        285⤵
        
        PID:4468
        
        C:\Windows\System32\drivers\etc\dwm.exe
        
        C:\Windows\System32\drivers\etc\dwm.exe
        286⤵
        
        PID:1696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\lsass.exe"
        287⤵
        
        PID:1988
        
        C:\Windows\System32\drivers\etc\lsass.exe
        
        C:\Windows\System32\drivers\etc\lsass.exe
        288⤵
        
        PID:4912
        
        C:\Windows\System32\drivers\etc\lsass.exe
        
        C:\Windows\System32\drivers\etc\lsass.exe
        289⤵
        Drops file in System32 directory
        
        PID:1660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\explorer.exe"
        290⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2512
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\config\explorer.exe
        291⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\explorer.exe"
        290⤵
        
        PID:1624
        
        C:\Windows\System32\config\explorer.exe
        
        C:\Windows\System32\config\explorer.exe
        291⤵
        
        PID:776
        
        C:\Windows\System32\config\explorer.exe
        
        C:\Windows\System32\config\explorer.exe
        292⤵
        
        PID:5300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\dwm.exe"
        293⤵
        
        PID:5352
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        294⤵
        
        PID:5392
        
        C:\Windows\System32\Tasks\dwm.exe
        
        C:\Windows\System32\Tasks\dwm.exe
        295⤵
        Drops file in System32 directory
        
        PID:5768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\svchost.exe"
        296⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5824
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\spool\drivers\svchost.exe
        297⤵
        Views/modifies file attributes
        
        PID:5840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\svchost.exe"
        296⤵
        
        PID:5856
        
        C:\Windows\System32\spool\drivers\svchost.exe
        
        C:\Windows\System32\spool\drivers\svchost.exe
        297⤵
        
        PID:5896
        
        C:\Windows\System32\spool\drivers\svchost.exe
        
        C:\Windows\System32\spool\drivers\svchost.exe
        298⤵
        
        PID:1960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\wmpnetwk.exe"
        299⤵
        
        PID:2904
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        300⤵
        
        PID:5152
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        301⤵
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\services.exe"
        302⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5612
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\services.exe
        303⤵
        Views/modifies file attributes
        
        PID:5636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\services.exe"
        302⤵
        
        PID:5640
        
        C:\Windows\System32\wbem\services.exe
        
        C:\Windows\System32\wbem\services.exe
        303⤵
        
        PID:5672
        
        C:\Windows\System32\wbem\services.exe
        
        C:\Windows\System32\wbem\services.exe
        304⤵
        
        PID:6036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\svchost.exe"
        305⤵
        
        PID:6132
        
        C:\Windows\System32\Tasks\svchost.exe
        
        C:\Windows\System32\Tasks\svchost.exe
        306⤵
        
        PID:2464
        
        C:\Windows\System32\Tasks\svchost.exe
        
        C:\Windows\System32\Tasks\svchost.exe
        307⤵
        
        PID:324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\wininit.exe"
        308⤵
        
        PID:5452
        
        C:\Windows\System32\Tasks\wininit.exe
        
        C:\Windows\System32\Tasks\wininit.exe
        309⤵
        
        PID:5436
        
        C:\Windows\System32\Tasks\wininit.exe
        
        C:\Windows\System32\Tasks\wininit.exe
        310⤵
        
        PID:5840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\wininit.exe"
        311⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5948
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\wininit.exe
        312⤵
        Views/modifies file attributes
        
        PID:5960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\wininit.exe"
        311⤵
        
        PID:5976
        
        C:\Windows\System32\wbem\wininit.exe
        
        C:\Windows\System32\wbem\wininit.exe
        312⤵
        
        PID:6064
        
        C:\Windows\System32\wbem\wininit.exe
        
        C:\Windows\System32\wbem\wininit.exe
        313⤵
        
        PID:5260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\wmpnetwk.exe"
        314⤵
        
        PID:3808
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        315⤵
        
        PID:5224
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        316⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\spoolsv.exe"
        317⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5784
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\config\spoolsv.exe
        318⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\spoolsv.exe"
        317⤵
        
        PID:856
        
        C:\Windows\System32\config\spoolsv.exe
        
        C:\Windows\System32\config\spoolsv.exe
        318⤵
        
        PID:4968
        
        C:\Windows\System32\config\spoolsv.exe
        
        C:\Windows\System32\config\spoolsv.exe
        319⤵
        
        PID:1924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\dwm.exe"
        320⤵
        
        PID:2164
        
        C:\Windows\System32\spool\drivers\dwm.exe
        
        C:\Windows\System32\spool\drivers\dwm.exe
        321⤵
        
        PID:5184
        
        C:\Windows\System32\spool\drivers\dwm.exe
        
        C:\Windows\System32\spool\drivers\dwm.exe
        322⤵
        
        PID:4280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\wininit.exe"
        323⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5664
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\config\wininit.exe
        324⤵
        Views/modifies file attributes
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\wininit.exe"
        323⤵
        
        PID:5740
        
        C:\Windows\System32\config\wininit.exe
        
        C:\Windows\System32\config\wininit.exe
        324⤵
        
        PID:4168
        
        C:\Windows\System32\config\wininit.exe
        
        C:\Windows\System32\config\wininit.exe
        325⤵
        
        PID:6124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\lsass.exe"
        326⤵
        
        PID:1044
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        327⤵
        
        PID:4952
        
        C:\Windows\System32\Tasks\lsass.exe
        
        C:\Windows\System32\Tasks\lsass.exe
        328⤵
        
        PID:2020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\spoolsv.exe"
        329⤵
        
        PID:5604
        
        C:\Windows\System32\config\spoolsv.exe
        
        C:\Windows\System32\config\spoolsv.exe
        330⤵
        
        PID:5920
        
        C:\Windows\System32\config\spoolsv.exe
        
        C:\Windows\System32\config\spoolsv.exe
        331⤵
        
        PID:6076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\explorer.exe"
        332⤵
        
        PID:2372
        
        C:\Windows\System32\drivers\etc\explorer.exe
        
        C:\Windows\System32\drivers\etc\explorer.exe
        333⤵
        
        PID:1620
        
        C:\Windows\System32\drivers\etc\explorer.exe
        
        C:\Windows\System32\drivers\etc\explorer.exe
        334⤵
        
        PID:5388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\wininit.exe"
        335⤵
        
        PID:5516
        
        C:\Windows\System32\drivers\etc\wininit.exe
        
        C:\Windows\System32\drivers\etc\wininit.exe
        336⤵
        
        PID:5760
        
        C:\Windows\System32\drivers\etc\wininit.exe
        
        C:\Windows\System32\drivers\etc\wininit.exe
        337⤵
        
        PID:5828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\spoolsv.exe"
        338⤵
        
        PID:6072
        
        C:\Windows\System32\catroot2\spoolsv.exe
        
        C:\Windows\System32\catroot2\spoolsv.exe
        339⤵
        
        PID:1392
        
        C:\Windows\System32\catroot2\spoolsv.exe
        
        C:\Windows\System32\catroot2\spoolsv.exe
        340⤵
        
        PID:3648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\lsass.exe"
        341⤵
        
        PID:5340
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        342⤵
        
        PID:5112
        
        C:\Windows\System32\spool\drivers\lsass.exe
        
        C:\Windows\System32\spool\drivers\lsass.exe
        343⤵
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\taskhost.exe"
        344⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5900
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\config\taskhost.exe
        345⤵
        Views/modifies file attributes
        
        PID:3208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\taskhost.exe"
        344⤵
        
        PID:5424
        
        C:\Windows\System32\config\taskhost.exe
        
        C:\Windows\System32\config\taskhost.exe
        345⤵
        
        PID:4940
        
        C:\Windows\System32\config\taskhost.exe
        
        C:\Windows\System32\config\taskhost.exe
        346⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\svchost.exe"
        347⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2244
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\svchost.exe
        348⤵
        Views/modifies file attributes
        
        PID:2688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\svchost.exe"
        347⤵
        
        PID:5956
        
        C:\Windows\System32\catroot2\svchost.exe
        
        C:\Windows\System32\catroot2\svchost.exe
        348⤵
        
        PID:5180
        
        C:\Windows\System32\catroot2\svchost.exe
        
        C:\Windows\System32\catroot2\svchost.exe
        349⤵
        
        PID:3336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\services.exe"
        350⤵
        
        PID:3012
        
        C:\Windows\System32\wbem\services.exe
        
        C:\Windows\System32\wbem\services.exe
        351⤵
        
        PID:1592
        
        C:\Windows\System32\wbem\services.exe
        
        C:\Windows\System32\wbem\services.exe
        352⤵
        
        PID:5356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\wininit.exe"
        353⤵
        
        PID:3984
        
        C:\Windows\System32\config\wininit.exe
        
        C:\Windows\System32\config\wininit.exe
        354⤵
        
        PID:5800
        
        C:\Windows\System32\config\wininit.exe
        
        C:\Windows\System32\config\wininit.exe
        355⤵
        
        PID:5656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\csrss.exe"
        356⤵
        
        PID:5684
        
        C:\Windows\System32\drivers\etc\csrss.exe
        
        C:\Windows\System32\drivers\etc\csrss.exe
        357⤵
        
        PID:5780
        
        C:\Windows\System32\drivers\etc\csrss.exe
        
        C:\Windows\System32\drivers\etc\csrss.exe
        358⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\wbem\explorer.exe"
        359⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3156
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\wbem\explorer.exe
        360⤵
        Views/modifies file attributes
        
        PID:496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\explorer.exe"
        359⤵
        
        PID:4316
        
        C:\Windows\System32\wbem\explorer.exe
        
        C:\Windows\System32\wbem\explorer.exe
        360⤵
        
        PID:5472
        
        C:\Windows\System32\wbem\explorer.exe
        
        C:\Windows\System32\wbem\explorer.exe
        361⤵
        
        PID:5448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\winlogon.exe"
        362⤵
        
        PID:3440
        
        C:\Windows\System32\spool\drivers\winlogon.exe
        
        C:\Windows\System32\spool\drivers\winlogon.exe
        363⤵
        
        PID:5936
        
        C:\Windows\System32\spool\drivers\winlogon.exe
        
        C:\Windows\System32\spool\drivers\winlogon.exe
        364⤵
        
        PID:6096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\csrss.exe"
        365⤵
        
        PID:5220
        
        C:\Windows\System32\Tasks\csrss.exe
        
        C:\Windows\System32\Tasks\csrss.exe
        366⤵
        
        PID:2024
        
        C:\Windows\System32\Tasks\csrss.exe
        
        C:\Windows\System32\Tasks\csrss.exe
        367⤵
        
        PID:5088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\dwm.exe"
        368⤵
        
        PID:6004
        
        C:\Windows\System32\spool\drivers\dwm.exe
        
        C:\Windows\System32\spool\drivers\dwm.exe
        369⤵
        
        PID:5276
        
        C:\Windows\System32\spool\drivers\dwm.exe
        
        C:\Windows\System32\spool\drivers\dwm.exe
        370⤵
        
        PID:5532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\services.exe"
        371⤵
        
        PID:5268
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        372⤵
        
        PID:5468
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        373⤵
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\catroot2\dwm.exe"
        374⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5280
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\catroot2\dwm.exe
        375⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\dwm.exe"
        374⤵
        
        PID:4812
        
        C:\Windows\System32\catroot2\dwm.exe
        
        C:\Windows\System32\catroot2\dwm.exe
        375⤵
        
        PID:5368
        
        C:\Windows\System32\catroot2\dwm.exe
        
        C:\Windows\System32\catroot2\dwm.exe
        376⤵
        
        PID:5456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\services.exe"
        377⤵
        
        PID:5344
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        378⤵
        
        PID:4984
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        379⤵
        
        PID:4844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\winmgmt.exe"
        380⤵
        
        PID:5680
        
        C:\Windows\System32\config\winmgmt.exe
        
        C:\Windows\System32\config\winmgmt.exe
        381⤵
        
        PID:5944
        
        C:\Windows\System32\config\winmgmt.exe
        
        C:\Windows\System32\config\winmgmt.exe
        382⤵
        Drops file in Drivers directory
        
        PID:5496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\svchost.exe"
        383⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:6088
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\svchost.exe
        384⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:5836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\svchost.exe"
        383⤵
        
        PID:5168
        
        C:\Windows\System32\drivers\etc\svchost.exe
        
        C:\Windows\System32\drivers\etc\svchost.exe
        384⤵
        
        PID:6092
        
        C:\Windows\System32\drivers\etc\svchost.exe
        
        C:\Windows\System32\drivers\etc\svchost.exe
        385⤵
        
        PID:6080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\wininit.exe"
        386⤵
        
        PID:5140
        
        C:\Windows\System32\config\wininit.exe
        
        C:\Windows\System32\config\wininit.exe
        387⤵
        
        PID:6040
        
        C:\Windows\System32\config\wininit.exe
        
        C:\Windows\System32\config\wininit.exe
        388⤵
        Drops file in Drivers directory
        
        PID:5316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\drivers\etc\winlogon.exe"
        389⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4716
        
        C:\Windows\system32\attrib.exe
        
        attrib +h C:\Windows\System32\drivers\etc\winlogon.exe
        390⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:5232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\winlogon.exe"
        389⤵
        
        PID:5572
        
        C:\Windows\System32\drivers\etc\winlogon.exe
        
        C:\Windows\System32\drivers\etc\winlogon.exe
        390⤵
        
        PID:1772
        
        C:\Windows\System32\drivers\etc\winlogon.exe
        
        C:\Windows\System32\drivers\etc\winlogon.exe
        391⤵
        
        PID:6024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\lsass.exe"
        392⤵
        
        PID:4596
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        393⤵
        
        PID:5412
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        394⤵
        
        PID:5196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\spool\drivers\wmpnetwk.exe"
        395⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\wmpnetwk.exe"
        395⤵
        
        PID:5576
        
        C:\Windows\System32\spool\drivers\wmpnetwk.exe
        
        C:\Windows\System32\spool\drivers\wmpnetwk.exe
        396⤵
        
        PID:5440
        
        C:\Windows\System32\spool\drivers\wmpnetwk.exe
        
        C:\Windows\System32\spool\drivers\wmpnetwk.exe
        397⤵
        
        PID:4888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\wininit.exe"
        398⤵
        
        PID:5812
        
        C:\Windows\System32\config\wininit.exe
        
        C:\Windows\System32\config\wininit.exe
        399⤵
        
        PID:5408
        
        C:\Windows\System32\config\wininit.exe
        
        C:\Windows\System32\config\wininit.exe
        400⤵
        
        PID:5548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\explorer.exe"
        401⤵
        
        PID:5712
        
        C:\Windows\System32\spool\drivers\explorer.exe
        
        C:\Windows\System32\spool\drivers\explorer.exe
        402⤵
        
        PID:400
        
        C:\Windows\System32\spool\drivers\explorer.exe
        
        C:\Windows\System32\spool\drivers\explorer.exe
        403⤵
        
        PID:2972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\dwm.exe"
        404⤵
        
        PID:5980
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        405⤵
        
        PID:5244
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        406⤵
        
        PID:5360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\wininit.exe"
        407⤵
        
        PID:128
        
        C:\Windows\System32\Tasks\wininit.exe
        
        C:\Windows\System32\Tasks\wininit.exe
        408⤵
        
        PID:5520
        
        C:\Windows\System32\Tasks\wininit.exe
        
        C:\Windows\System32\Tasks\wininit.exe
        409⤵
        
        PID:6012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\dwm.exe"
        410⤵
        
        PID:5552
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        411⤵
        
        PID:5212
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        412⤵
        
        PID:5192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\config\svchost.exe"
        413⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\svchost.exe"
        413⤵
        
        PID:3196
        
        C:\Windows\System32\config\svchost.exe
        
        C:\Windows\System32\config\svchost.exe
        414⤵
        
        PID:5608
        
        C:\Windows\System32\config\svchost.exe
        
        C:\Windows\System32\config\svchost.exe
        415⤵
        
        PID:2872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\taskhost.exe"
        416⤵
        
        PID:2084
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        417⤵
        
        PID:5580
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        
        C:\Windows\System32\drivers\etc\taskhost.exe
        418⤵
        
        PID:3716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\spoolsv.exe"
        419⤵
        
        PID:2516
        
        C:\Windows\System32\catroot2\spoolsv.exe
        
        C:\Windows\System32\catroot2\spoolsv.exe
        420⤵
        
        PID:5676
        
        C:\Windows\System32\catroot2\spoolsv.exe
        
        C:\Windows\System32\catroot2\spoolsv.exe
        421⤵
        
        PID:5540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\lsass.exe"
        422⤵
        
        PID:4588
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        423⤵
        
        PID:6100
        
        C:\Windows\System32\catroot2\lsass.exe
        
        C:\Windows\System32\catroot2\lsass.exe
        424⤵
        
        PID:6016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\winlogon.exe"
        425⤵
        
        PID:5692
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        426⤵
        
        PID:3668
        
        C:\Windows\System32\config\winlogon.exe
        
        C:\Windows\System32\config\winlogon.exe
        427⤵
        
        PID:1680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\spoolsv.exe"
        428⤵
        
        PID:3644
        
        C:\Windows\System32\config\spoolsv.exe
        
        C:\Windows\System32\config\spoolsv.exe
        429⤵
        
        PID:5984
        
        C:\Windows\System32\config\spoolsv.exe
        
        C:\Windows\System32\config\spoolsv.exe
        430⤵
        
        PID:5248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\taskhost.exe"
        431⤵
        
        PID:5756
        
        C:\Windows\System32\catroot2\taskhost.exe
        
        C:\Windows\System32\catroot2\taskhost.exe
        432⤵
        
        PID:6032
        
        C:\Windows\System32\catroot2\taskhost.exe
        
        C:\Windows\System32\catroot2\taskhost.exe
        433⤵
        
        PID:5952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\csrss.exe"
        434⤵
        
        PID:4584
        
        C:\Windows\System32\config\csrss.exe
        
        C:\Windows\System32\config\csrss.exe
        435⤵
        
        PID:5536
        
        C:\Windows\System32\config\csrss.exe
        
        C:\Windows\System32\config\csrss.exe
        436⤵
        
        PID:1248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\spool\drivers\wmpnetwk.exe"
        437⤵
        
        PID:1944
        
        C:\Windows\System32\spool\drivers\wmpnetwk.exe
        
        C:\Windows\System32\spool\drivers\wmpnetwk.exe
        438⤵
        
        PID:4632
        
        C:\Windows\System32\spool\drivers\wmpnetwk.exe
        
        C:\Windows\System32\spool\drivers\wmpnetwk.exe
        439⤵
        
        PID:2836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\svchost.exe"
        440⤵
        
        PID:5312
        
        C:\Windows\System32\drivers\etc\svchost.exe
        
        C:\Windows\System32\drivers\etc\svchost.exe
        441⤵
        
        PID:6008
        
        C:\Windows\System32\drivers\etc\svchost.exe
        
        C:\Windows\System32\drivers\etc\svchost.exe
        442⤵
        
        PID:4216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\wmpnetwk.exe"
        443⤵
        
        PID:6140
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        444⤵
        
        PID:5636
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        
        C:\Windows\System32\wbem\wmpnetwk.exe
        445⤵
        
        PID:5592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\winlogon.exe"
        446⤵
        
        PID:1780
        
        C:\Windows\System32\catroot2\winlogon.exe
        
        C:\Windows\System32\catroot2\winlogon.exe
        447⤵
        
        PID:2268
        
        C:\Windows\System32\catroot2\winlogon.exe
        
        C:\Windows\System32\catroot2\winlogon.exe
        448⤵
        
        PID:5480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\services.exe"
        449⤵
        
        PID:2720
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        450⤵
        
        PID:5488
        
        C:\Windows\System32\config\services.exe
        
        C:\Windows\System32\config\services.exe
        451⤵
        
        PID:3640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\svchost.exe"
        452⤵
        
        PID:6136
        
        C:\Windows\System32\catroot2\svchost.exe
        
        C:\Windows\System32\catroot2\svchost.exe
        453⤵
        
        PID:1996
        
        C:\Windows\System32\catroot2\svchost.exe
        
        C:\Windows\System32\catroot2\svchost.exe
        454⤵
        
        PID:5304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\dwm.exe"
        455⤵
        
        PID:5688
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        456⤵
        
        PID:5124
        
        C:\Windows\System32\wbem\dwm.exe
        
        C:\Windows\System32\wbem\dwm.exe
        457⤵
        
        PID:2360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\drivers\etc\explorer.exe"
        458⤵
        
        PID:5772
        
        C:\Windows\System32\drivers\etc\explorer.exe
        
        C:\Windows\System32\drivers\etc\explorer.exe
        459⤵
        
        PID:5216
        
        C:\Windows\System32\drivers\etc\explorer.exe
        
        C:\Windows\System32\drivers\etc\explorer.exe
        460⤵
        
        PID:5204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\winmgmt.exe"
        461⤵
        
        PID:2996
        
        C:\Windows\System32\config\winmgmt.exe
        
        C:\Windows\System32\config\winmgmt.exe
        462⤵
        
        PID:588
        
        C:\Windows\System32\config\winmgmt.exe
        
        C:\Windows\System32\config\winmgmt.exe
        463⤵
        
        PID:5136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Windows\System32\Tasks\winlogon.exe"
        464⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Tasks\winlogon.exe"
        464⤵
        
        PID:5776
        
        C:\Windows\System32\Tasks\winlogon.exe
        
        C:\Windows\System32\Tasks\winlogon.exe
        465⤵
        
        PID:5348
        
        C:\Windows\System32\Tasks\winlogon.exe
        
        C:\Windows\System32\Tasks\winlogon.exe
        466⤵
        
        PID:5868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\catroot2\winlogon.exe"
        467⤵
        
        PID:5188
        
        C:\Windows\System32\catroot2\winlogon.exe
        
        C:\Windows\System32\catroot2\winlogon.exe
        468⤵
        
        PID:6020
        
        C:\Windows\System32\catroot2\winlogon.exe
        
        C:\Windows\System32\catroot2\winlogon.exe
        469⤵
        
        PID:6028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\config\dwm.exe"
        470⤵
        
        PID:5700
        
        C:\Windows\System32\config\dwm.exe
        
        C:\Windows\System32\config\dwm.exe
        471⤵
        
        PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_asyncio.pyd
Size 76KB
SHA256 cc27a21453b309197030b5fa8051a8a9c89aec79f9b81ee4ea2a2551ac0f912f
MD5 c2a29938ef6730c1418140a15e0cea86
SHA1 e137c778526eb34068c0d85fd37d30b81773013b
SHA512 3f5b212f005b944d872fd3e84a68d1de11809143312571d6540db9cb219c4e9f62137f90af77a81b7b342d8d1665c819b6738dce7a5be1e0d6a135564ae69043
SSDEEP 768:J3yo/J0GKLIsPwpVnU+C4qMiOU1OnzM8nV6JQIjDnSSyYTegc2Ip4YTxf1ml6Z+o:VJyyUoCgQ8nVYQIjDnSSyYiS9kfILpm
TLSH
T1B5737C87A2A44186EEB79174CA536FC3FBB1F1859901935F51A4C18F1F533A18FBA322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_cffi_backend.cp314-win_amd64.pyd
Size 177KB
SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
TLSH
T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_decimal.pyd
Size 283KB
SHA256 1ee2247153ec6c6e5b3b49402f294b2b7325385ad489a5522e6fa9b406575e8b
MD5 bc63a4bb65d50f6de111deecd8de3457
SHA1 60ffbdc52782ddffad0c74774896159ec8eeb5d0
SHA512 60479c96b9fafb34e1c2d93970d69f53694c998cc6667fdde731e61675eb62d0a4bf875e5a3b939ebdcd7dfea8621a30d9ee30f6d7a0c7b83e058d77e36a1dd9
SSDEEP 6144:IBEAqz+G/rY2HvCnv4mrqGqqM43fIWeAxMoWl0:IuAERbvuvzVooWl0
TLSH
T14B547E96A3490CA4EF778474CA479A57F7B2B8414360D38F43A48A972F933A3673E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_hashlib.pyd
Size 67KB
SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
MD5 ff7c390260b2c94396abcc5323db052e
SHA1 adc7babe127c3586c81f321ad20ff87785945795
SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
TLSH
T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_multiprocessing.pyd
Size 37KB
SHA256 a8c15ee29f60536e00fd7c26c0315e062c4f018e2e46e7f6eb65c1fed0d886a4
MD5 547b59dc1f6caef6706ca1129b5f9618
SHA1 b990f779204ddebcc00ab926be6c17b462fb3a63
SHA512 00f49b94a31b8dca6790845e0185b7f7cecb52fa99472bac523cc8ee4efb679585e3476c727e55b43f2b434ed12af51c41364113db89f0f98113be24ab2ab2a6
SSDEEP 768:HFMV/fpXybycUlgIj7teyYTegc2Ip4u+Txf1mlIJ5pC/:HWpXybycKgIj7teyYiS9uefIk5S
TLSH
T1BD038C86A6684053E9639670C5A3EE87F935F7871F22865F3195C2CE0E373C1736A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_overlapped.pyd
Size 56KB
SHA256 0e8b684fdcc8c6de88bd4b92b6ed44a6fd917949c98b0691285e0cf6c760dc36
MD5 c96e86f3868d0323c88700f0671d9f20
SHA1 c8b9561fb80af89a67fbac11e103ef120dca4ce4
SHA512 d6953e6e566236f2bd01e40de751e545b680607ad07c8c7f7b8ac621f4c1ed3a227ac14cc45e66e15a0a1f18083ee4aebbacb24b784ced35bd227173b6b41d16
SSDEEP 1536:/sjKfS6rBgq/Wtg4urMp8IjCtDyYiS9ZfIklp:0tgxrMp8IjCtOK
TLSH
T1D6437B4A6B9401DBEE73D179D1A38E03FB74B2D34601931F61A8D28A1F23791A72F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_queue.pyd
Size 35KB
SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
MD5 8ac260b670f58c4d08ba0a7e5512133d
SHA1 3ac300d794c60ac58c68961ebd10c7fed8585fda
SHA512 a523efb322f7863033f7bb8101134a9ce6a137979665ed0daf2072eebf016a3b89bf0c386f4c3b84c3b2455814bc482581cf07a6606cdcef7df22b96e6a4fa2e
SSDEEP 768:mJe4W6rB0Bwh6EIjRUYSyYTegc2Ip4NMTxf1mlIJxp1:EhSBwcEIjRUYSyYiS9NgfIkxz
TLSH
T1A9F28DC6A65C4097E663C970C1A2DF92F975FBD39B0146DF2178C1890E237C2A73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_wmi.pyd
Size 39KB
SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
MD5 bca71458b37ab9784290593636006405
SHA1 4a7effcc12a283b9c65a06b6af62c1cc44820861
SHA512 fd7e5e40a9cde0253684cf0ff6f343c60c597087eda27cfa3726ec2d870b4dea1e7140c55e0de7eca0f5ee36eae32fa0092cd88be4e9969c91cdb94ac923ab7c
SSDEEP 768:y2/EEqrVmjsJuMOQMV4Ij3iYyYTegc2Ip4K4Txf1ml9dHx7Lsc:XE9BE3MOQMV4Ij3iYyYiS9JfIbHxnsc
TLSH
T14B037D85E6644052FA67C571C0A6CE93F971BB935B11878F32A582990F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\base_library.zip
Size 1.3MB
SHA256 e524be8c02642c4f65bf060dde4cf85433f1abcf288a532577361d6db297c5c4
MD5 a21de64594faa78091b92f7e404ae621
SHA1 06080c43111189182db75949a47391844bea2ffe
SHA512 738319fbb1ff19657fe66aee60e511309d7db442169cbc6b63584f557b2b478e1bed180a9489650540af0a5ac92fcb5f0fe8b8d6115465dbf626c134b17d29bc
SSDEEP 24576:syuUF93uRpalbkQeOdP2m2dfQidfmFLIw8:LuUF93uR5/DdNh
TLSH
T1AB552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\charset_normalizer\cd.cp314-win_amd64.pyd
Size 10KB
SHA256 da3ce780d6d58ae8c6920b99f806f64d58a1b33f4a01382861b01b50549199f8
MD5 d22406cd44bf4cc0de40f2975eb9cfb7
SHA1 672fae4c492c41a11b82b71ddf6956e25bdf74d9
SHA512 cb8c9f0eb6688412394669d3f1d799e3a89aba0c6c3c3aec67f70cf636df7fa34e29ded3e830a532334f468d55754da3d2d8b7c7954f5ead6a5af2812efe64b9
SSDEEP 192:h7JGrmoX+sMl/++Ch9p85BgQ9NgeAwJz6:hJ4m446OR9DAe
TLSH
T1D122F85CFE6458AAD9158138C6374E4BB132BB22170273CF8370A06A1FA37E66534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\pyexpat.pyd
Size 214KB
SHA256 9349be352300fef4b16da0574c670b174d75094574ab51f3d385767d1e3dfc0d
MD5 d6e692eacc35a0195bda97cef2345c18
SHA1 f010bc356b81149c390dea898eef59e6600de198
SHA512 ef2c9a33a0cb15f7673af716099b0735550a111d056422102ba6102618f1e9aa8c2d91a6cf0fd9eca03c3b6d0f0855a7807144585fc58ef08d13a6b27f6ace42
SSDEEP 3072:O3qcWGiB96M+1+XyXu1w2wiMuUL4blSA+gq9qUSGAoP4lSTmyBt3cBFN2X1JcGGz:lGiBK1+XyXu1GL4blSA+gqLt6yz3GnWs
TLSH
T17B247D9BB261C1E7D853803CE5968B17DAB1F86603909ACF12C4E77C9F2B7513B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\python3.dll
Size 72KB
SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
MD5 303f286d14b7db861ad96314bd8bf3f7
SHA1 2745bd50e91648968888ad495ebf4f66d10e4533
SHA512 4beb99ecd472df29d099c179f0a1c8809f741594d81704cc1d8194169c0826273cb9cfcfe2b7fc4b98fc07742c55fcafa9257c8a67450000dbdec3971acf13c5
SSDEEP 768:WQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:DbTrnXngXMFEIjG0xyYiS9yfILB8
TLSH
T13A735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\pywin32_system32\pywintypes314.dll
Size 133KB
SHA256 e62808f40462f8066c8d19811cebd15467de6992b1cb48be5f5903910f5395f7
MD5 c11818bd607c6060902836c3f6bf024a
SHA1 31846f719f3eb804c8ffcf3783ef343b8e206730
SHA512 3349ddeaf776a5f6e20026e217d56cfbcf053772c3366af5aa3282ff2889cd92a2c31ba39b3cbaa18a90d6d1e9bbde97215278f12dbd7724062d5c3f06fd6e63
SSDEEP 3072:WZkbcF76SzXHDjEquY/rZ6YrFc1V4Bpg7d+LLvvzab:WZkbc0STfPuY/rP+1V4XgR+LT
TLSH
T1F2D32947374648DAE97A937DCD771A02C3A6B0000711E3CF46A1C2AA5F637E5AD3BB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\select.pyd
Size 32KB
SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
MD5 9e31eff5c36a868a6010be873e0f58b5
SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
TLSH
T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\unicodedata.pyd
Size 740KB
SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
MD5 624ffa84aa15efced4c1fd8e5ccf0b95
SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
TLSH
T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18202\win32\win32crypt.pyd
Size 123KB
SHA256 1144670ad8271e4d477167bcb55b8ec38e8ad9f02c6fbfe66024e67083da2131
MD5 bef94c55e5f2b9c742467469abdbb089
SHA1 720fc0e2954fea3822144ca97303c6d60eb64133
SHA512 07644f2a5f9b6ae3fed2c55366aba74f5f3961d3deb1316139a1300df7229ae0d2be543b8100cc07cb8ba530c62d44a8e5c5b702641e63da4366eb946bb71799
SSDEEP 3072:+sFWiORseWQgjXefpRoh+MNO3xhxRXvxh+Pal:+0W9SQg0okRfxh+A
TLSH
T10EC33A1332964DD6E9AAD3BDC8239807E7A4B0154721ABCF0950C6DA0F67BE06D3E749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ARC4.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_ARC4.pyd
Size 10KB
SHA256 f6538c0c003f317f88720b230581e950d1da11307cb9f322c7282c14bc720ca1
MD5 eff0f16d6e853ea2cbc7b3bcab5e0591
SHA1 d9e9947afa2871a4814b9eeedab7209f9f32c9a8
SHA512 ceaaea7c60c66e4cab3b21d237ae753e94cbef397c3a9bb40c636421dc6b66cf92355d213fd14cd8d55ef06618ae3504ee229a8c6afe866f0e94d7c46ae9bd2f
SSDEEP 96:ajZuck7BNymq3UtFfZAn401wlKsQ9AfJkSRsP64Cz6+q2c5n1kBRcX6goyOazh:okNNyatvAn40q9WE6R2YORcqgola
TLSH
T13222288CFA564CEEEA6540B58A270B4FB075B711575273CF03B0917A0E637C6363A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
MD5 17c99edf022309bc2c54a732fb8fbf26
SHA1 57a8cbcbf0caed90b8ce9adc8f9188561f4a5e2b
SHA512 f8dc12948abc33487f136b92efe755b7234ea8ea65b40dbfabe6bdcf8214c1dcf3509d1ecf5f21741e5300456b03983739c9f400ef8352fcac9f3edf90c37f92
SSDEEP 192:SBeCWznuR5zIzpshfrQ0ZFqdpofnLjcqg542:SBOCMpqVDqUge2
TLSH
T159521792F32701EAE42B9175CD734A4BAABCBA00635167DB1320C1178C62BE1323E796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_chacha20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_chacha20.pyd
Size 13KB
SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
MD5 709be56d3ae0cb50807a6b54a762c875
SHA1 65e9ba3b8485f9bf53aeb15ed240c4c13a695bbf
SHA512 09e913290687e172d10cacef8b27d7ddb763218b32872e8ae1a3122db53f561e82a869a02e882cb3aa1c461fd403258532b9762cf66109681da9f157a88a7d15
SSDEEP 192:k30Y+Ne3erKrgMntNGWCL6qT043ZJPrBne9lkNEcqg2:k3ko1KLK2Jc9i4g
TLSH
T106522A89FB7054EDE56240B5C473070EEAF1BB20E711ABCB4360959A1EA3BD1313FA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_pkcs1_decode.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_pkcs1_decode.pyd
Size 13KB
SHA256 320ca46655bae21c964515726183ab86069d55262671798287072d9ff6bd54bc
MD5 b5600245089e36b00e9fb4f4327a9f5f
SHA1 61cd2fbc4f83506001ed4650439f35916a006e0d
SHA512 179698c5c6f568a9f152bfdbef9369d31cc2a4d3355b9a5ba5fe4b4498410124daf890098c15e7b70a60a498c25f11517fb48e8ece55f5a2fd4236241df8cda3
SSDEEP 192:h76XJdfr7i0iNWGO6z0x+/kOn/cqgvVJWC:cJxC0e+QvRg
TLSH
T19252E946F66AEAA8E9674174C62B4B1FB9FDF500635073DB0351C99A1DB33C1327E640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_arc2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_arc2.pyd
Size 14KB
SHA256 1faa4c424bb33c9aff778a74ffc9468d281290d510e0ef44eae3730785efc1c9
MD5 530bb99610b35527c3b06a22fd92ccec
SHA1 4242ea2c3884eb64b5f6bbf692dc87a347ced5c3
SHA512 d46443866c9296065f151163f8503ca9b726f4dfe689c1da3d6a47940bdc0dca75f3bd87eb672b20ef51cf22f2e65f07dad30e0f9e5addad5abeb27d6f60e68c
SSDEEP 192:t07obuccnuzHysARb0tWmn++0dmwjd8tZcqgew3:V6n643mo4JJgH3
TLSH
T121622B46BA7809F4D92F8178C4F3C70CA2B97199230C9FDF0264961A2D13FE56A3E2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_blowfish.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_blowfish.pyd
Size 19KB
SHA256 6f6f3d25dad7d864ac3dfb54177ed6978c3acd36810af90e8874100317737706
MD5 403a4f70938f58c15daeb4a63d7ecadb
SHA1 21e4f3c75afb71bcad683ae607cd677f3c2415cf
SHA512 ed11e69f332c150dda9f563aee4b3ef1bc870d0c8be348be0d835f76f10420694ba072e1455341b97ab761873d0b45f76741fad7e98c9460fe05449865de5305
SSDEEP 192:iI2AcU5uMeFhK8YVfyc0u/yO0Bfx4RqI6HJAyZJg8D0KThxA+rAQE+tnJiO88Z52:9eS701RiMpJgLa0Mp8XgIO
TLSH
T18F925C4DECA856BAEE200274C6468D9FE12FF534633DEBCF2770168D09166E60E747A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cast.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_cast.pyd
Size 23KB
SHA256 7bcd3c30c7f9caaf4fa1d78de079d74278ef8b5c857f4243b8ee7fdaa6a20e4d
MD5 c5ecf284e05e75955a40e1276c9b250d
SHA1 ce58ae475b5c3024f879766f16767ce53d494e07
SHA512 f418c785d7083a7e4e991d788e2eb55276773ef7f98e0591ceed1b58546abc7973b4cae53b342691a09bf160cebbe99e3651c78130faa849b46605eafa2e6c6f
SSDEEP 384:j6quf9b7Dry3YcZXmrfXA+UA10ol31tuX9ewg:E9y3YqXmrXA+NNxWte1
TLSH
T175B26C65F32688EDD667C435C4135E5FE039B861332543FB0762A29A1E1B7E8A83D3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_cbc.pyd
Size 11KB
SHA256 a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc
MD5 088a5fda312ec2e1957e83d530f9bb8f
SHA1 29629e5dc8ade5f79eaa20017dbe01589d160508
SHA512 146c224d680bdd60dc680a744bd7ae08a867cf28d0e6e251e108fd19ec77e13e2e0f50558032391e6effd62644460ff06831e2da46291bd046144ca232e0a5d6
SSDEEP 96:I4T693BMwxTwu9B2GKLCReiEyqLsN59la1oC01VGlN5C5J2SlKsPViRDAnzdTqke:IJB3jD2hoeeqLO9I1oC07xlYmBtcqg9
TLSH
T10932184BEA158AF9D1134336C0770649AAB6BB10B38277CF0365916A2D337D2723E795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_cfb.pyd
Size 12KB
SHA256 cc2b5cec4b408492921f872aa7d6f6452fab6b1a6e561305865c6e709b784aca
MD5 bf18d19eb79557e767a8e8e1eda6c060
SHA1 3067f33faac3e247c5620d1ecd479e3c2335ddac
SHA512 86b65dcbde28c598ca401e513afb3866b391e8059adebc672ab41b96d5469f4011df48949e5684a1deb4a602a485384f8186e423c2df196afc6d79eb18fdf2ef
SSDEEP 192:wTDWsIyXckwWdk01fdpXHrc46cqgzW0i:wTibk5tdxgVgzfi
TLSH
T17C42198AFAA989FDF4460235C4374A46A5B6B604735173CF0302819A3E33BC53B3D695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732
MD5 3d0fb2250c76b501abf008d8e6180594
SHA1 e6bd8cd9a1473ca9b74d3f029f0c18e7fc710fb8
SHA512 165ba96e64706f9273abcc964fcdd25acc672e03b95e2e38c4edcfbd6f71daf323496abb055cc66d47d1bcf2120a45c6ea55a2ae4b9b5ba50b68e8a2df341f89
SSDEEP 192:9f7EXDMXiKEEEEEm9JdwdNuRxe7CO/vJcf30pdA4kFoxX6zUIlPrx2cqgVVv:9DEXYz9JdwdNuSLvJz/A49qz5ltWgr
TLSH
T191621A06FA545CBDF61242B8C972450D92BFB9046360BBDF0765D2962E23AC4337F6E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_des.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_des.pyd
Size 51KB
SHA256 0f2b26d1cc382feceb879761ca3629ea2e3b84518d965fc196ae6df06bc0dbbb
MD5 a2de9a3a802296d900f1630358eba28d
SHA1 6f40310592c16fa2943aebdd9f97207fb56b5af5
SHA512 9284ebd7fb443018bb97fdd0e165cb1e257afdb9c9ff1205b9be6bffda99daa0bb0ebe7638d33c9a539ab6c57884cf0f6c5ab248aade1a65eb15d088835e7b23
SSDEEP 192:WLpuiFenKAnKfmZRXbXXrzHyLFX4QiOMO0c0Jt3pzK3zBAArQ37ri1dR9fEk2xYQ:WLQi8nKAnKy8BXhXYr39KGrZTd/gji1
TLSH
T102333217FB6401EAD03D4B3404EB0B61AAA7A4B522A347931F55596C6EF37E13E72EC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_des3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_des3.pyd
Size 51KB
SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
MD5 494239f9453679d80511becc23c6b621
SHA1 ea32905bca3e7dea62894bd7b85164237250ebb6
SHA512 902036872eb515252d483804934516c06614a4da80592207a2b6b0b2795ceabc961520bc67475bfafb319f0bf006cecbf0a131cc16889dfa498ee43cc2565c77
SSDEEP 192:WjpuiFenKAnKfmZRXbXXrzHyYhmvwzlwIl8R0qsyzzBAArQ37ri1dR9fEk2xYN0g:WjQi8nKAnKy8YsvwhqDCrZK4egk
TLSH
T11D332317FB6401EAD03E4B3404EB0B61A9A7A4B522A347931F55596C6EF37E13E72EC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2
MD5 b9f8151c65bdaf81bf9407a32e77959b
SHA1 3670e2d9afb0ddb4e98f301381aae49561c25272
SHA512 21c250f873651bc4fd0dc18d9054a31b0e3c0ec1837910d430943121884fc7728fe8b8340494e0625f9dd90c6dc031fbce5c53a913476051419d7dd06772bc32
SSDEEP 96:dkLC5MmvMN3zAhrZMo4hwFD01tbOlYjMIJKUSUsPNfSzVfqZ7EhSGfcX6g53:dkOJUN3zQGWFD0gB3UsWhncqg5
TLSH
T1A922E889FA5648F6EA1682F5C9374E0EA179B720572233CF0374962A1E627CB3139781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_eksblowfish.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_eksblowfish.pyd
Size 20KB
SHA256 29e1b1394c14c56253ab880730a1e11732c45ef40d90ec4ee1c5d3e614cc9504
MD5 b6037ceaa162c50fc25f1b361b4250c9
SHA1 db595668b78af345d5b4f044902bd1e3491ee74b
SHA512 a0a284000dddc1bc0682d57f57c0f8a7aa9361f9c5b433a9489d10d582c937fdd3dd8ea90e7cf10247a9aed15752c12eea902325b2269074486b67873d227085
SSDEEP 192:sI2AcrbC2s30v23HQDleHSTy8N0E0BVXpLKHJAyZJg8D0KThxA+rAQE+tnJiO8sU:mC2c0v23QkZZDXpmpJgLa0Mp8sng+dx
TLSH
T146926D48ED4845EAEE60457CC542CD6FE62FF538233DDBCF276266890916AD20E70391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ocb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_ocb.pyd
Size 17KB
SHA256 c8a77501cdc9304d919c16d41ba28c86c766de84ee463a0efd68c5cc3829af1d
MD5 35b044d9ecd823161ef267517ba88509
SHA1 b0a1e7b5001faf7ca9edd0c4071702c70bfed972
SHA512 2e2ca2125b47e8c772e3b18411e7141ee6e92b6a2e9b7b6e4e278b739b3f16a3e12eaabe0548c3dde41909f7402ff82c01c8a2134c3b9a718b57a7cec7b3967c
SSDEEP 384:simo3psoTezczsogeXOvm/yR/DBQcHXfD7gG:Qo3psoTezcQogeXOsSLB73L8
TLSH
T16A82E907AD729B8EE5D0513800A6867DF1BB75F14328D2BF8EE850BA3D392C815397E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Cipher\_raw_ofb.pyd
Size 11KB
SHA256 1f08af90b5854c58207cfbaed6f68dbec87bd30f1ed7da065ad46073e3761073
MD5 a2b9f1db81ee431f07a848f44153518f
SHA1 6a8b92d822193e5e58629c2a22863df9676155b4
SHA512 191cbd7884672fdb5a9ad2a6b2158567fb9e083c9f0ce59aa3c2c56c17c280a5e0aa5ec17ebb8eeb588ffafdb59e32084286eb79b74bd9b4f3611c4d442725fb
SSDEEP 192:hp3neSoeeqLO9I1oC07xlYmf6tcqgkaB:/EqiCm7Yrg
TLSH
T12632194BEA9089F9D526437680634A45AAB1FB10639177CF0310955B1E33ACA337E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2b.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_BLAKE2b.pyd
Size 14KB
SHA256 1890d90f46bfa13588dd07eeaa230e68186e3ed929e4c1fe7221c8fea89e5683
MD5 7fcad6d233f8f41636258c970390284c
SHA1 5f8438e146d56e303d05087ce7dc29ac0628801b
SHA512 447b2dc34155ca2f846a214a42bf27b8717faa05fca385463a3362f29e2be6101d3a51daba4693cf5ce44029d1e6750dc1835e5b84fd746e0cd8c11417b7cf90
SSDEEP 192:GEj3+V2rQnjt1wmg9wzj0YW+OGRQYaza0DcYkoIiz7K+Hcqgv0TKM:Gy3+AojO9kjPO7xjDlZPvgv2K
TLSH
T1FC523B49E27588FDE92F82F48233051AE7B1B520A31167DF4360C2D61D32BD2763E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
MD5 efb1f498321597f1aaf7fb6a57603c76
SHA1 1c074ba191dade8b05924dbf4933916817fd19be
SHA512 44f0ec8a4044fed41440ede528e2d2b9005477a8e163de4121f8344dba116e179de98a4131f6ff2d211e44a28c541733742e8263f83b8b6bd1479dd7d96fcbcc
SSDEEP 192:yd8+SBjsK5tcGndG4xfSo06lw7KDy8gJcqgwxCLx:88575trWCvcgwxCL
TLSH
T1F9525C85F6A985FEE85B42B98673490996B9F414635073CF0351C5AE1C33BC6327F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MD2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_MD2.pyd
Size 14KB
SHA256 804c60219443c2ea969e1b3a717eaeea09c91742d9be78d614136a4431ff590f
MD5 c32c84cec7fe60f5a73dbcec5a75778f
SHA1 e01136ac95706ced3f9a7dbe6f1822e20f0228ce
SHA512 9c24d7ebe4424d44c166bbe2abe5d916decdd4acd56b8428815ed5c7adbe446f30b5321c60e27449211ed48947c8fef77728033c399856573052a301261ae83c
SSDEEP 384:2yEhKnLg9yH8puzoFaPERIQw2p3Z2p1VT7QvgB:hEhmLg9yH8puzoFaPERIQbp38pv/
TLSH
T1A152A845A9694FBDDDB541F470B32B4E74E97E028310FEEB13A092964D27680317EEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MD4.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_MD4.pyd
Size 13KB
SHA256 38fff9037abdb579f9847a6718b8643c31c3c7ad91fee29a778b60c444c91a7c
MD5 43a0cb1b7c6cf8a96300575abc2c10e3
SHA1 29e4d8743c64dbeb8b753630f3d7aa5700650280
SHA512 8279c3b16b25ccf98fd12c64ed27d17a030a74076ef0f5291322941380bdaff0654f8ba5454ec0374528646de5f35f9c1ef7a897c9d6eba38ceabf404636d8f8
SSDEEP 192:x1sAD7I/9hAIHeqoDoMfI/uTWg0Ixde+U1cqgYjeiI:x1sAD7KvdVKqMd0gIe
TLSH
T1D4523B4AFA7408B9E51983B9C6734F0DD6F97900536117CF039192AE1D33BC0353DA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MD5.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_MD5.pyd
Size 15KB
SHA256 ee469ab6d4dbdac22eea7bc40f3e2872442c649e03778d8d6b94a112da1e31aa
MD5 1f0d820fa427968ef57363bf3e94d6d2
SHA1 26def5ff85a0e499855b9c2b43da11b9d2a68b27
SHA512 c23e5bedb35326436c3f9734874ea2f2a7a8d55f1d365e23c2b6cdd9e7f12c231a5908063b2a3a8c2c1e608c5a8af349b5e5c1197c12b7789c61ca719300f87c
SSDEEP 192:HBvzcuiDSjej8IOcjGXnDPjrl70P/B5J7ihnbFccqgy:BwuiDSyjxJeDbu3B7GbFwg
TLSH
T1AF625B09FA2045FAF555C2B5C0334A1AE6F8B929A3A25BCF0395D69D0D23BC0B23D7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_RIPEMD160.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_RIPEMD160.pyd
Size 13KB
SHA256 ccf7c7182ecfc7a3215d7913feeee8f8c35a6db71ffa2895f9bd7de3084c26ad
MD5 60a8ae930ed0a8f307795f571edb13d4
SHA1 68708a86ef046fc738b342742c82d48c2cd237d5
SHA512 1b11b6d8fe303a631c740524750c48fb64368d3405ba7bf31997d004d82db4821d7cd8b2fdf44d2407f3e806e147fc02408de8ce9c75950ca209d0e2842d77c6
SSDEEP 192:jJepPGkZF2zz1vL0A0XstQchQf25KcqgY2:FepLMz2A6GrR5agY2
TLSH
T174522B4AFE5945EAEE9682F544230929E4FC76100713E3CB8360795A1D337C4B0BF6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 8f80524247c830d9bb590d025e15ec34d7d337a16e5c4422e2da0448d06c88a6
MD5 d350d601e5716a85f4beeba6e11f54d0
SHA1 8e972659a7867859ca9d36f454e8e2c49634b128
SHA512 a34cbfbdd5a429407d441a5bd163307f18f6af2403b44dc9c0c4365a6a5d8e0b6a3a0a24ef2e272e2e916a3a2a58be0ffe9e90408cfb60e6049fb5b9aa56620c
SSDEEP 192:4Zo2R1J+0eDPSgkNZuOdlptvTuh+Kt/sPLKz2V0uj2IjW+Hrcqg9K2:BOJ+0QPSfu6Oh+FLkgx/dg9
TLSH
T10A823C94EAAA54FDE625C434C6534A2F9379B11A4B61E3CF07E042ED0D233EB5838B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA384.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_SHA384.pyd
Size 25KB
SHA256 38086fc4e0c53f5153571073995610ac91c454c6aa161588b651286a585526ec
MD5 680889bcd0470c282a2f57cf844f3f39
SHA1 81b1a36c0f811c88463824b0d9edb0d94df856a0
SHA512 cd3eace0e93ef71f1f7847ecaf2c18f48d6098dc305c54c552ef63bafac65619ba833eedd24745904a9be4a0abafa58cca57a7604716c85a64d15d7d2c63bfc7
SSDEEP 768:Ftui0gel9soFdkO66MlPGXmXcH4J9MQACs:Zu/FZ6nPxMRQA5
TLSH
T195C2D902ED685324CC15A7384BB9DF39DAA4B71443E0EBF746E231C82D565C72AB85CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA512.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_SHA512.pyd
Size 25KB
SHA256 adab3a8ef9daa73b1e9ca83d66a726c8ad256eed119ab2d7d3fcee10f8f013d1
MD5 41a1d0414de80ad9262567c5960e7edf
SHA1 8b0e74580eb0a99459ee3c766346569aad9b9314
SHA512 bc12bd5386d94834690ea6dcb3b948f32131580531f8bea72df4bbedcc5c060cb5267eebda7168cc8c994fda776a22c58f0eec9d2351a797fc7c9b8f4c820a31
SSDEEP 768:Gtui0gel9soFdkO66MlPGXmXcx409X/HnX7ChlRV:eu/FZ6nPxMF/37kV
TLSH
T1A9C2FB01EC685324DC15533847B9DF3ADAA4B71483E0EAF746E231C53D565C72BB858B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_clmul.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_ghash_clmul.pyd
Size 12KB
SHA256 63d9bbdac4e8e2c95b1a41eb7a2b42047b6a0c8d36447165e32167d3c7a57aee
MD5 1dd22e3cfce1c65ffc00c2cfdf273805
SHA1 73a4e6237ad3cb30c7750ddb22e531944bfb6233
SHA512 b32d77ee7177af8b1b027e8f524af9784aa82fc376554a35d216572908e9487a75c70001a41ec68f8c992511dfe0cdf27aa6fa5d1b779468d73405117cc9b12b
SSDEEP 96:UXzBHOTvaNKigvldRMKgUU4sEvJLaVah01YlVlJnOJdS4sPiF1Pzws28dOJoz0Tf:UgTEnb4pJLqah0ux41bwLPS0T7cqg
TLSH
T14642194CFA9656ADE4170176C93B4B4A5AF5B61867E0A3DF036280B91E333D2332DBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_portable.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_ghash_portable.pyd
Size 12KB
SHA256 ca4c4e24af0d7f879f9cb73df6e27f83441071dd466c366a4f4b467101e50e21
MD5 ed8ba1c678bcbe969589a0f20bce9b3a
SHA1 b326823cacd6291636db929a8bfedcf6210cd54a
SHA512 13edde6b06bc6540d067d7316da6667165f526dc6253ff5227e98909ddc92218fc71c21d199ee040b213a5148ed6d880531fc254d2e4573ab0553cd918492669
SSDEEP 192:5T7f40jJIUxDDr+f0SUVxZ7JuuA78VUbB5cqgs:dDq6rSyZ7Cd9g
TLSH
T1D2420A8EF65499E9CD1A0175C4334F0AB6FDFA2067916BCB036266692D33EC1333AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_keccak.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_keccak.pyd
Size 15KB
SHA256 393c54d090197d55d87619e99528d2e774c9157632115a07fcf35ee50681e78f
MD5 939e83dd4104999b942fbb538b7910ab
SHA1 88857d92ed8229dcf4fcb44ab8fc2104d7dffb04
SHA512 6fdcb2a332031c873522dcd2f0bdf033961ffcf1a431b1c9e4ffded33c7c664b849519dae2e5256361a9e2415c975ee127eb270db27273079cc2d89aabd7738a
SSDEEP 384:Iib6zJrayMQYWRskTdflLaIZXYaNRH2g:IiuaMRl5NaeXhRHz
TLSH
T12C620846F6A644F5E53A82B1C9331B0AAEB571212700B7CF27B4926D1D73B81713E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_poly1305.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Hash\_poly1305.pyd
Size 13KB
SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
MD5 270e84da3ea602e7691b3fa415490297
SHA1 adcd3bc6baf56d53a6daa75867119f6590d8e11b
SHA512 81ed2993583304d7d7ec7a6699417661a60f0f36807b6e507896448293c9b225819787c4acb83cbf534d089ad7da461e7e289938bebd078eca65a1bd827aeeb5
SSDEEP 192:+CxGqkbOfnVSu41fMlps6BsS10NXloWL6NIXu3cqgmO:Aq5f3Vpl4xiWWNpJg
TLSH
T1FF522A8BFA5515F9E83682B588334A0EEA797A11135067CF436088EE0C33BC272397D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_modexp.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Math\_modexp.pyd
Size 30KB
SHA256 fc122c8e0a1c236c2a0b20009ed710602545577ba34a9fafed71eb84e56a2e76
MD5 2f44dc08973333126ba3daa977c909b5
SHA1 a06d37536df9482b30541a30e799cb02243d5c9b
SHA512 f3bf133f53cf415742125e7d15e7739190d2a96eb7a4a1e54e426d722d1175c80526240a3ffa127dc7118dfdd54c5c5f567191645a51904aeb01a8388f16a059
SSDEEP 384:2+URkXHWlnSr0BX4pMg1X9RecIdFXgS0qcG1SlXX8pYUM+grFI1ej3vOgodAX:2ZRQHCngpMgC0Ew+P1ejDod
TLSH
T171D25B12D6D801ECDEBBC13CD6F6494BEAB67588230143CF93B089790E739E66639B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Protocol\_scrypt.pyd
Size 12KB
SHA256 00c9b6915dfb9ed91e8d40c78f6b536c5ccdabd2760fcf9501d0522e97e2d600
MD5 d21f9b5765c83bfd97b4b16027ff83f4
SHA1 1965e7c74ad04f1c36e751bc198b1ceebe6dd793
SHA512 f6248fa077cc74a837b1ec6928919068d0b3c111170e7e1e7eb66bae6e6d05b4ab6bad2ff50cca1ec0e349a3be1ba1fca8d947592e8cd768228d574297de81de
SSDEEP 192:h3B6qjvnrrx5yWva2Hbds/P0pxz9l8lcqgO:/6qTVC2akHrMgO
TLSH
T1B342394DFA5049F9F6124279C4334E5AA5BAB60027B17BCF03A4929A1E733C6323D796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_curve25519.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\PublicKey\_curve25519.pyd
Size 19KB
SHA256 265e86937759418ae394671ece28fde8099206cc5f1946cc4f9efcef4b140e8e
MD5 ba2ed47a2f1fa681e953d234339fd1e2
SHA1 4544dedd05b72340502429042756e83f409ec1e7
SHA512 c01e41fe6a4e9559d2d8164e91064808669cdde11ce29ad5330523f68634a6ed47e089f77b075252012c4a11c389ae6ffb40995a5ef91c17ffec329cf91b9e79
SSDEEP 384:tHyxYpBu9OSW0mvO9bhgyQbC13SB3HPPc20eJq8g7:tHrYmvO9HmW3sB0eU7
TLSH
T10A922847FE8502B9CD369438C46656BBF368F6199B71BBCF06D216582C73AE0253CB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_curve448.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\PublicKey\_curve448.pyd
Size 57KB
SHA256 f7a7f91ab11a78d21f948f53c41c3f4b4b778dc3b34c1b2c1d9035b663569757
MD5 adf3e7416da4e481d68246e09f4a7a73
SHA1 b93e88053e7c6f5d84e50fd5698ce8116be60d22
SHA512 eef6d8e5c53c43a3982b2aa92a35ca480b5b9de13cd46bb0d672ff342974f67b3bfaab802ccee10186725478c93e6f242a0d351abcdee4054e597bf4efd1860a
SSDEEP 1536:V/4M6LKlAYBR0pjvfY1z7O0Q055KovA3qb3ut8zANQFa8L1UHCZIrkzTC:l4M6LKlAYBMg1z7O0Q055KovA3qb3ut/
TLSH
T10743B752868554D4C8BBD23EFD7F8943BAA5F4480B4983CFD5A089B01EB9EA175BF700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ec_ws.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\PublicKey\_ec_ws.pyd
Size 737KB
SHA256 93bfb0675b855ef94fe14aa5cb33a41a8b95c737f8774b015a31f32f9f3eac8e
MD5 14bde3698b42114fc95ab3f835744cfb
SHA1 4059d53c597c2a74e86d5aae1b9b0e0cd5928ace
SHA512 ded53960f6d2224b328550d606ca0db967838a97842b823dddf40969f01cd662b5cb8d03a4d80c2d3665b8905baf8e29da40d07dbe17eecc7f6988bc478436d9
SSDEEP 12288:6IOHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:zOHoxJFf1p34hcrn5Go9yQO6
TLSH
T1ABF4F11692C558C4C9BBD33DBD2B8A43BBB2F4484B9A43CFE2B585B05D76D6021BE305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ed25519.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\PublicKey\_ed25519.pyd
Size 23KB
SHA256 1f0d1a616875d430879bd7467296c1632c02b9266001781f7e59aa19b0e66cba
MD5 5d14a0505e324826b387a682e2e5b789
SHA1 58827c9708a4313b93b78bed3eb110f554673c3f
SHA512 57ddbc5fe95ef37298fa98eb65ad2280cdc7f8f0b3d6ec9a2fe8bab657da884c45b0cc2ed42f6cc394efa312d458b80dc688e3b61bb6012d4e122b03202ab4c1
SSDEEP 384:1iR4ZlladW0mvO9bhgyQCCAEZ1n0lF2LfZ1EHLNjdxqlIgM:1zlahmvO9Hj8i2bYBdxEt
TLSH
T1BCB23947BABA12F9DC3B8538C119176AF3A4B215C734B78B06E358052D72AE5913EF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ed448.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\PublicKey\_ed448.pyd
Size 73KB
SHA256 20fe0b35808c110762e5e4302aa8d926bf42211209e6bf8e438e914e42a58c09
MD5 617020ec629cebd633b37d3cefcfdeee
SHA1 e52922eb69df68ee0aac61f6f1553e621d54308d
SHA512 db33dc63d593b48a61a48c6950d7b88aa1deb8c89b57de46c553d99ef051294b0d04781ce20697519bbd72c9feb6579a4748ffc56d98c4d16692b7b38bafc865
SSDEEP 1536:7L8NhQDnXNnN9LMmT4k7QvUQkwSsWB/wVHqoPy7O0J054MovAfqb3lt8gKNQCv8H:7L8NheXNnjLMmT4MQvUQkw1VHqoPy7OC
TLSH
T1B773845592C164D4C8BBD37EFD7F8942B6A6F4480B8A538FD2B085B01E75EA169BF300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 c77f18f1f7a377bc388de0104abf4868d6f0c2ef7ef2b97b34d875cfc3040aac
MD5 fecc7e50926f0ec3286d9cac0bc3938a
SHA1 e12c70ee106d580a9adb0f81b38734d376266607
SHA512 925cdac89dbb66b8b9f69e9beeda001c4735e16fb1a3e3c0ab94648a7b8915f99469b0bf87e3a0d0ddc39d35a8f66680ae22c96eed22af354aed225b761a25c6
SSDEEP 96:dkEOstOzARCvriZUj01tClcbzMoJqUSzXsPc/7azsncZqkSffcX6gi1:dkEXtOzRr+Uj0TsBz178sncwkgcqgi
TLSH
T13322E888FA568CF6E51582B9C9374E4EB175B710972067CF1374CA691E227CB313A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\certifi\cacert.pem
Size 230KB
SHA256 7cef540c6af3bf0a3c7d0070bd3fd7aae34f8aa805b408d1c27a01c8aeb305df
MD5 3ff2cb6c83e4cd529491f71cd24ac916
SHA1 edf51e1bb2c167d25acc9b15077cc3f68909d30f
SHA512 b45a1f506a5ef09dfef6ebbb6e64fe297d19fd70c827cf665adb4d2943786fcafbb4436c7ae0de083bf760f882dbea24f9936c5afc5ca46a6e2f6f7cd9a5f4a9
SSDEEP 6144:0plSRrqADwYCuCRT/QRSRqNb7c4u59hrB:0LSRrHnRWav309n
TLSH
T142347B954F2A9C092C9FE1C1CA9B1357DD3E027A99FEF0F1390A2408D24622A57FDD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\charset_normalizer\md.cp314-win_amd64.pyd
Size 10KB
SHA256 8e3e0a719a4ec835fbd9b3128636a09692fe173f4e01c527653bfdb7bd723808
MD5 5655da6af0eb292f6b14ebd506b218b8
SHA1 c1c00149ac6b56cb0cc17381c5a09bfa3a5c5a16
SHA512 fa5049bcb2e1f71cb0ffb4d3289919897929f5342cb39ba1f19494ed759ecbfe1cb955a412d4599f552d4be83145b2516e0321b2e53a1708954a0164e7a85ef5
SSDEEP 192:O7JGrmoX+sMl/++Ch9p8OBYQ9NgeAwJz6:yJ4m446R59DAe
TLSH
T1A122F85CFE7458AAD9154138C6374E4AB132BB22170277CF9370A06A1FA37E66534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography-48.0.1.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

METADATA

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography-48.0.1.dist-info\METADATA
Size 4KB
SHA256 5b62dcfcaddf62e26f8c28f6055c0aba858eea2a3697a3fc8e7aced427bf8d94
MD5 c0db5ec6ade3b37bcbfd3c8350e04dc6
SHA1 f74c4fc420198c2aaaaf6e088319081d3f515c93
SHA512 dc5820cf8a67ddc33cf71b072fcaedfacf4017585b2f5f2d57c221219b33397145eaee8b369226b87abe170b8a90ef4206e56ffa27ce63185562e4051639c31f
SSDEEP 96:DuPQIUQIhQIKQILbQIRIaMtjaVMvxsxPN1mvJNBMecc2yWvE2fNdR7eLShemR:3cPuP1slU5bmvEq7eLQemR
TLSH
T13F91735F3BD9A9E42BC2868B743EC0465537854D794B759CFBF88314B991B31823E01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RECORD

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography-48.0.1.dist-info\RECORD
Size 17KB
SHA256 9524f19a4b225a04ebcb24dabcef9528360c91d5551aa7f8f8d8417859afae4f
MD5 772a6a973b7409b588b046f1bd19df52
SHA1 6e2328c492622a7a1981e700326cb85ab7c99a2d
SHA512 e22aea47a812a95a4b6e92514464f3f52f1c87769843a5c8bf56b8f7303ea878394b3e892e8c728123346b5edbd64615143a0f358f08a89cbd7f9ca136d45682
SSDEEP 384:UXnp1H1jqWBQV+26WS28KSNhba9j5UNHtHh0:U3dFO+WB
TLSH
T15D82CD1E7E45F00577E09B5ED1FE9622BD4AD9A93273227CFBA057186ADDB40822D033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography-48.0.1.dist-info\WHEEL
Size 96B
SHA256 94650381b57f9cf60ea09b18d3df47d966d528cb86f1eed4ddf05778ed3d6c75
MD5 65ef9fc04b65b93a91bbbd0febf972f9
SHA1 77474c877bc016942215e6eba8bdc39f850df1b6
SHA512 b79cdda6a2dba456d34c0e5e83d770375f7da4dc6b7d0f8ff1fd0bf94dfbb4df7832c65ad0c93499fbf953fce8612ce3751282b4dd87c6e5b6ba0fa50f731e66
TLSH
T12EB01210838004FB90566927C01885183F91C20DD8B32058F8C12140AA0C81C10CCDF9
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography-48.0.1.dist-info\licenses\LICENSE
Size 197B
SHA256 3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb
MD5 8c3617db4fb6fae01f1d253ab91511e4
SHA1 e442040c26cd76d1b946822caf29011a51f75d6d
SHA512 77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998
TLSH
T188D0233EB357631142D1046E171714CFAF07B40418475209F41415F134E390A4B3C5D0
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.APACHE

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography-48.0.1.dist-info\licenses\LICENSE.APACHE
Size 11KB
SHA256 aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe
MD5 4e168cce331e5c827d4c2b68a6200e1b
SHA1 de33ead2bee64352544ce0aa9e410c0c44fdf7d9
SHA512 f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52
SSDEEP 192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
TLSH
T19432623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.BSD

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography-48.0.1.dist-info\licenses\LICENSE.BSD
Size 1KB
SHA256 602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb
MD5 5ae30ba4123bc4f2fa49aa0b0dce887b
SHA1 ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8
SHA512 ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41
TLSH
T14E31655B12844BE34AD2165565A7B9C0B08DC03F3A236E0A3C6EF3485F7B42EC57B051
MD5 SHA1 SHA512 TLSH

Submit Download

cryptography-rust.cyclonedx.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography-48.0.1.dist-info\sboms\cryptography-rust.cyclonedx.json
Size 44KB
SHA256 96a30705de11760925ec7d110b6a2136f4694eca2634668eaf7849d23a1b16cc
MD5 1c93a8526ba372d8a873b8e825715140
SHA1 8db76de717e086aac8895bc6e1b90c213ad2bf98
SHA512 fda5cf812e8af800ecc1149fb276ed319c2e37700c9d5bf7b04a1283b36d6e0e154c92514b8f3e383b63a9829afe10992ff623e6dae8618946e81a1db110c0af
SSDEEP 768:rIEhf9zVJx/ZjVjBttvqDMaXCpiQh4pEFAyzoWE7iSbG81M1MymgVd0gM+SiW5sl:rIEhf9hJx/ZjVjBttvqDMaXCpiQhAgXB
TLSH
T10213BFAFDC588DA30F8165A80D79D081A223804BED85FD4DBF4D426C5F8D46E2ABD6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sbom.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography-48.0.1.dist-info\sboms\sbom.json
Size 1KB
SHA256 1a09d4e90e1573436bac11f64e41caed47daacda7beb1fc4c8f99d7e561b4447
MD5 f987676959f2ea17b53ef1a888455bb3
SHA1 32c4d0307c9269aa1e5d6a080a0c38b7e2a7bb5c
SHA512 d4b0d577aa78f466d39dc98b07b717788c6f10fc62b8e566c37cd0bf3847efaef794f3ccaa3ba6daf9665c3d3c79c1bb9d23426eb10063b5d968258b2f4e8aa9
TLSH
T18F21633BDE401C2B1EB527B4EE794267F560166F51C08C0B737E824C5FB6896A847F2A
MD5 SHA1 SHA512 TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\cryptography\hazmat\bindings\_rust.pyd
Size 9.4MB
SHA256 cbae8065586611b18e9ffba1885af0b3ba9c52b9e79c85ca4a33264c626e159d
MD5 01dc448748085ef1227dc27146faffae
SHA1 776f810f12bf68ee156eed118b093dc74beba249
SHA512 86a21162d43f8e743c15080b8b8bee59198c33717b36a002b3b0eb3bfb421badfb7c4face33fd5a88d8e637e5c890a143691c16428a6ce7a736059c1d218419c
SSDEEP 98304:AkX5yU5serrr6G+PX9MX8OZO8z/CRSgq+IUBm:fX5ys+PX9MX8O88z/hzP
TLSH
T173A67C25BAA950ACC86AC4B8C34756339B7034DA0B747AFF49D486B52F76BE01B3D701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\INSTALLER
Size 2B
SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
MD5 45210da832f9626829457a65e9e7c4d0
SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
MD5 SHA1 SHA512

Submit Download

METADATA

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\METADATA
Size 4KB
SHA256 a3e38b9ee4326289d4864704f30e299ee769e2309ce9f4a75f0de1a50ad0a356
MD5 395966581da45a834d806a0692ce6746
SHA1 1df950968870ceb8a6c0c0f002236727c4790c90
SHA512 c9c73d4a3173c1af8b1bd655e1e81af716a783923b3f4ac85099d1b9df1fe13afada34a4fdedf5c54065d61ddd360cd1814d6051a0354036eeb4dfed39ecaf1d
SSDEEP 96:DIYZtaCc0coeLMrlNzmpp9hoxN4GTqFc+ZFZyDN00x2jZ2SBXZJSwTE:3c0coOMhNKpThoxN4Gee+dC0vJHJSwTE
TLSH
T195A1959337C24653BBC241C765CCC3AA9126D458A69B4085FF698DBC4F51BFD1376234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RECORD

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\RECORD
Size 1KB
SHA256 52a6b8ee0de15cf7fd99625f43b97cd2e3942ac86f16054ea90de48e66f29355
MD5 17eacda1d7065b6ea59eb70f9e8ad4db
SHA1 f516b63df75b3852bbc72b0f8fd629248ca313d7
SHA512 c9e3a200f89b2dc64eb75a5ff83729473827496c105df756fa6f8bd5735e89de2c90e2267bcef44d3b58525c247038c4e5026dc9cbaf786fe9949590e236d52b
TLSH
T12931779B3A45D00B3A5724E1AF98AB7178603A83F257C65ADD354F345BB88CCF264D03
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\WHEEL
Size 91B
SHA256 ff309ddcdd65ebd02bc724dbf2bcc4a0ff53a5b61792a44548d383e4ebb19d3b
MD5 08dd01ac2afdbb287cc668d51c7056c8
SHA1 e7224da97ededfb9d0239cf7cade76ebe3997743
SHA512 917f7621e0d457d149964de3cddf50fe49be13388879f60ed818eaecdf5080864386c9cf2474dc2e514907935983d73dee1967b404f2941edced73856a1d6d1e
TLSH
T1B7B012150A4115F814A0EE134068A1201A70854799956079B14A03446549D1406CDC5E
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\LICENSE
Size 10KB
SHA256 458502e12d97bbf64438606a20044aa85eb05fb0a8a807bb35dbec253fd1fc04
MD5 cf73015ea0156450506e8000d1f7fa37
SHA1 07d2319108d2b21bbd478a2dedaa69e1f66ff494
SHA512 4688a2d2e7a6c9332367595a0a1e7d59d306bd6dfc6473d9894e8472bbcdab00f03f8d1244bc95a540e3167e73320e851294e7485557434aa24690d5fbd1f456
SSDEEP 192:iaW/NVo4UTo1YEHFNnFE6GheQGC2B1CVnhOCoHqxLJbzjwokTGNH3Hv:iJhUk1Hfl9/GHbLNdkTGNH/
TLSH
T10422643F774803770AC20162BB8BA4CBF32E903D379656645059C068236BD6583FB6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

top_level.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI22562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
Size 19B
SHA256 08eddf0fdcb29403625e4acca38a872d5fe6a972f6b02e4914a82dd725804fe0
MD5 a24465f7850ba59507bf86d89165525c
SHA1 4e61f9264de74783b5924249bcfe1b06f178b9ad
SHA512 ecf1f6b777970f5257bddd353305447083008cebd8e5a27c3d1da9c7bdc3f9bf3abd6881265906d6d5e11992653185c04a522f4db5655ff75eedb766f93d5d48
MD5 SHA1 SHA512

Submit Download

_SHA224.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46242\Crypto\Hash\_SHA224.pyd
Size 21KB
SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
MD5 f18df573602776a7449e4452aec66d99
SHA1 28a957f3b1a738a4d10452faf867f484c2ac743c
SHA512 ad6cd03b1ce8a01fe87ecdb403701e44c118a799e39fd36989be9997b9b29c8a4f52765a67d1cdce3bd9eeb2147020fdd898afde52a6f5855f1037e48cfae9e8
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmzIHXqBJ93c3O9zMR7kLMhgZvRv:JP/Ytswv9HXM3c3hkLMKZZv
TLSH
T137A20B19AF3884A4E40E603AB333867B7BF47600D394B7EF8A505B991C263ED563465A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\System32\catroot2\explorer.exe
Size 16.7MB
SHA256 899ffe3c385096d7aaaf0dc71b9594b21c3b9442cc5952d380c56621607e1050
MD5 29072c77dde4af2575bf532ebfb4e0c4
SHA1 a270e05705f0a5515b071e939c66285232f57d0a
SHA512 0925d9a0f285ce6f6ea3a0817393fce3d1bd394fd0ffac96fdf31af90d59b494c5bef03345fa7144f462ce360a765a34eb2b940a0fea366d1ecb8168187a1785
SSDEEP 393216:zZqpoKgRr9ql9nP8bATr6tZq5XeOHsxtEDweFXdRl19:dqpYjqfPOar6tZq5hwt7eJt
TLSH
T19A0733945BC40937E8D2A13C9D72C6A2F2E1F9612B628DBF179117363F737A0443E698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-5608-0x0000016496F30000-0x0000016497433000-memory.dmp

Download

memory/652-8592-0x000002DEA8470000-0x000002DEA8B64000-memory.dmp

Download

memory/1572-11622-0x0000023C01D00000-0x0000023C02203000-memory.dmp

Download

memory/1616-7311-0x00000299CEBA0000-0x00000299CF294000-memory.dmp

Download

memory/1680-13300-0x000001AA32B00000-0x000001AA33003000-memory.dmp

Download

memory/1696-9045-0x0000022E46000000-0x0000022E46503000-memory.dmp

Download

memory/1924-10042-0x00000000029C0000-0x00000000030B4000-memory.dmp

Download

memory/2052-1429-0x000001FDA6E00000-0x000001FDA7303000-memory.dmp

Download

memory/2196-3972-0x0000026236BE0000-0x00000262370E3000-memory.dmp

Download

memory/2228-1793-0x0000019EACE00000-0x0000019EAD303000-memory.dmp

Download

memory/2424-2610-0x0000024C5BB00000-0x0000024C5C003000-memory.dmp

Download

memory/2552-518-0x00000248D2AD0000-0x00000248D31C4000-memory.dmp

Download

memory/2872-12924-0x0000027641F00000-0x0000027642403000-memory.dmp

Download

memory/3636-5246-0x00000281729A0000-0x0000028173094000-memory.dmp

Download

memory/3656-4427-0x000002C8CC500000-0x000002C8CCA03000-memory.dmp

Download

memory/3736-8140-0x0000017604E70000-0x0000017605564000-memory.dmp

Download

memory/3752-6423-0x0000021AFADC0000-0x0000021AFB4B4000-memory.dmp

Download

memory/3772-4870-0x000002B7E97A0000-0x000002B7E9E94000-memory.dmp

Download

memory/3884-5970-0x0000013A2D300000-0x0000013A2D803000-memory.dmp

Download

memory/4020-2973-0x00000194CC200000-0x00000194CC703000-memory.dmp

Download

memory/4152-1065-0x000002027B9E0000-0x000002027C0D4000-memory.dmp

Download

memory/4216-13751-0x000001E19E400000-0x000001E19E903000-memory.dmp

Download

memory/4568-6875-0x00000238F3FA0000-0x00000238F4694000-memory.dmp

Download

memory/4748-7689-0x0000018E766D0000-0x0000018E76DC4000-memory.dmp

Download

memory/4816-3426-0x0000020FA9200000-0x0000020FA9703000-memory.dmp

Download

memory/4916-2155-0x0000022D88070000-0x0000022D88573000-memory.dmp

Download

memory/5128-10856-0x000001916EE80000-0x000001916F574000-memory.dmp

Download

memory/5388-10477-0x000002A8A13C0000-0x000002A8A1AB4000-memory.dmp

Download

memory/5448-11294-0x0000018192110000-0x0000018192804000-memory.dmp

Download

memory/5548-12486-0x0000024BE0600000-0x0000024BE0B03000-memory.dmp

Download

memory/5556-9498-0x0000016A95A80000-0x0000016A95B43000-memory.dmp

Download

memory/6036-9589-0x000001528E470000-0x000001528EB64000-memory.dmp

Download

memory/6080-12035-0x000001D1DF700000-0x000001D1DFC03000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads