hive | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe
Size 10KB
Sample260806-1x9xjacd96
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution hive persistence pyinstaller ransomware spyware upx

Malware Config

Signatures

Family: Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive

Detects Go variant of Hive Ransomware 2 IoCs

resource	yara_rule
behavioral3/memory/4576-135-0x0000000000590000-0x00000000007F3000-memory.dmp	hive_go
behavioral3/memory/4576-291-0x0000000000590000-0x00000000007F3000-memory.dmp	hive_go

Downloads MZ/PE file 6 IoCs

flow	pid	Process
78	1876	4363463463464363463463463.exe
78	1876	4363463463464363463463463.exe
5	1876	4363463463464363463463463.exe
7	1876	4363463463464363463463463.exe
8	1876	4363463463464363463463463.exe
26	1876	4363463463464363463463463.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pkexU0YtxaR3.exe	pkexU0YtxaR3.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PKEXU0YTXAR3.EXE	pkexU0YtxaR3.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	qrtb.exe

Executes dropped EXE 9 IoCs

pid	Process
4020	update.exe
2976	PCclear_Eng_mini.exe
4256	pkexU0YtxaR3.exe
420	qrtb.exe
4324	skaikk.exe
4296	CFXBypass.exe
4700	svchost.exe
4576	Hive%20Ransomware.exe
4556	svchost.exe

Loads dropped DLL 59 IoCs

pid	Process
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe
4556	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
77	raw.githubusercontent.com
78	raw.githubusercontent.com

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PKEXU0YTXAR3.EXE	pkexU0YtxaR3.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Discovers running processes 1 TTPs 17 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4664	tasklist.exe
3876	tasklist.exe
3728	tasklist.exe
4544	tasklist.exe
720	tasklist.exe
3652	tasklist.exe
4712	tasklist.exe
3352	tasklist.exe
2748	tasklist.exe
1160	tasklist.exe
3568	tasklist.exe
1700	tasklist.exe
5044	tasklist.exe
2184	tasklist.exe
1176	tasklist.exe
2844	tasklist.exe
4132	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\skaikk.exe	qrtb.exe
File opened for modification	C:\Windows\SysWOW64\skaikk.exe	qrtb.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x000500000000072b-122.dat	upx
behavioral3/memory/4576-135-0x0000000000590000-0x00000000007F3000-memory.dmp	upx
behavioral3/memory/4576-291-0x0000000000590000-0x00000000007F3000-memory.dmp	upx

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral3/files/0x0004000000000729-78.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4336	cmd.exe
4772	cmd.exe
1964	cmd.exe
2916	cmd.exe
2076	cmd.exe
1196	cmd.exe
1620	cmd.exe
1332	cmd.exe
1408	cmd.exe
3908	cmd.exe
2572	cmd.exe
4580	cmd.exe
4588	cmd.exe
1496	cmd.exe
4704	cmd.exe
3508	cmd.exe
5076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skaikk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCclear_Eng_mini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkexU0YtxaR3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrtb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hive%20Ransomware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	skaikk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	skaikk.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop	pkexU0YtxaR3.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\LanguageConfiguration	pkexU0YtxaR3.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	pkexU0YtxaR3.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{625F76EE-DE78-428A-8B2D-96F06F3707A5}	PCclear_Eng_mini.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{625F76EE-DE78-428A-8B2D-96F06F3707A5}\Compatibility Flags = "1024"	PCclear_Eng_mini.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe
4324	skaikk.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	4363463463464363463463463.exe
Token: SeDebugPrivilege	4256	pkexU0YtxaR3.exe
Token: SeBackupPrivilege	4256	pkexU0YtxaR3.exe
Token: SeRestorePrivilege	4256	pkexU0YtxaR3.exe
Token: SeIncBasePriorityPrivilege	420	qrtb.exe
Token: SeDebugPrivilege	4324	skaikk.exe
Token: SeDebugPrivilege	4296	CFXBypass.exe
Token: SeDebugPrivilege	4556	svchost.exe
Token: SeDebugPrivilege	4712	tasklist.exe
Token: SeDebugPrivilege	3352	tasklist.exe
Token: SeDebugPrivilege	2184	tasklist.exe
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	3876	tasklist.exe
Token: SeDebugPrivilege	2748	tasklist.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4020	update.exe
4020	update.exe
2976	PCclear_Eng_mini.exe
2976	PCclear_Eng_mini.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4020	1876	4363463463464363463463463.exe	85
PID 1876 wrote to memory of 2976	1876	4363463463464363463463463.exe	86
PID 1876 wrote to memory of 4256	1876	4363463463464363463463463.exe	89
PID 1876 wrote to memory of 420	1876	4363463463464363463463463.exe	92
PID 420 wrote to memory of 5044	420	qrtb.exe	94
PID 1876 wrote to memory of 4296	1876	4363463463464363463463463.exe	104
PID 1876 wrote to memory of 4700	1876	4363463463464363463463463.exe	105
PID 1876 wrote to memory of 4576	1876	4363463463464363463463463.exe	106
PID 4700 wrote to memory of 4556	4700	svchost.exe	107
PID 4556 wrote to memory of 1964	4556	svchost.exe	108
PID 1964 wrote to memory of 4712	1964	cmd.exe	110
PID 4556 wrote to memory of 4772	4556	svchost.exe	111
PID 4772 wrote to memory of 3352	4772	cmd.exe	113
PID 4556 wrote to memory of 2916	4556	svchost.exe	114
PID 2916 wrote to memory of 2184	2916	cmd.exe	116
PID 4556 wrote to memory of 1408	4556	svchost.exe	117
PID 1408 wrote to memory of 4664	1408	cmd.exe	119
PID 4556 wrote to memory of 3508	4556	svchost.exe	120
PID 3508 wrote to memory of 3876	3508	cmd.exe	122
PID 4556 wrote to memory of 5076	4556	svchost.exe	123
PID 5076 wrote to memory of 2748	5076	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\Files\update.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\update.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4020
- C:\Users\Admin\AppData\Local\Temp\Files\PCclear_Eng_mini.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\PCclear_Eng_mini.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Users\Admin\AppData\Local\Temp\Files\qrtb.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\qrtb.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\Files\qrtb.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5044
- C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1964
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4772
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4588
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:3728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:2076
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:1176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:1196
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:1160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4336
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:1700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:1496
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:2844
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:1620
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:4132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:2572
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:5044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:1332
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:3652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4704
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:3568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:3908
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:4544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4580
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:720
- C:\Users\Admin\AppData\Local\Temp\Files\Hive%20Ransomware.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Hive%20Ransomware.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4576

C:\Windows\SysWOW64\skaikk.exe
C:\Windows\SysWOW64\skaikk.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CFXBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
Size 36KB
SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
TLSH
T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hive%20Ransomware.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Hive%20Ransomware.exe
Size 764KB
SHA256 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
MD5 2f9fc82898d718f2abe99c4a6fa79e69
SHA1 9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
SHA512 19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
SSDEEP 12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH
TLSH
T197F423F804553C05C4A6B3F5CA8F7BCF81C5183A65CAFB48DF1CA92869FA0609525A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCclear_Eng_mini.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\PCclear_Eng_mini.exe
Size 32KB
SHA256 d4c48762f128436fed18b9c714e55bf7360802127efb233ad31ec4b0f7f649b1
MD5 b41541e6a56a4b091855938cefc8b0f0
SHA1 8006b2728d05eab4c5d6dc0bb3b115ddc1e2eaa7
SHA512 a3c2b5dddbb5b8ded63e04672610287458b4bed6ea054e45804e612a2896d92412ef632c621a49b445412d8998a5edc914b055502e22fcfe0e178e5098b64828
SSDEEP 384:ph8qCjcowiUJTIWIC0pc36+6rD5uH3XGJH3R1Dn/EMkudSGqoVU:fMw1JTYhCXXIXvr/JjAGx
TLSH
T1BAE23B07BF870D51E960AD38136FBA768776785B29129B97CB14DE6C043B381C53A38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkexU0YtxaR3.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe
Size 274KB
SHA256 047b9b6f7316914dcd47e5268fd05bb7ad6b8d54a3bc50a873c0cf929d67c49b
MD5 71f57ce76c3dcf764176b99fca830dd3
SHA1 dfbafe7528d5ea4e8721a8dbe75273a87ec5a042
SHA512 4b2ccb6819a6d28651a09146698906d794a965131a158aac839bf95c6148793bad1b5232fbdc6eeb420d103f786a6e400003a9d8a6bcb38a52d31f85d5161d23
SSDEEP 6144:rFc2dmBAWN/ccQEU9eHNLe0M3Fb8tJUEQON7yP1FM2RgYXWtrKkoPoS:rFc2A3ecQEU9eHNL7MqxVI1pDXWwRoS
TLSH
T151540247B0865B8DEED80CF8F6C7992A61834D923B1B3263ECE82147E6B93747541D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qrtb.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\qrtb.exe
Size 40KB
SHA256 6d5fb7159a958a5d5cfe6c3ba960c48de291fbbc9028c0bf63157d335c84467d
MD5 6c345d08e27a12df22e89f906d5760ba
SHA1 ba952bcdff8dd8b24507dabefa5f8a2de520f704
SHA512 55358f5ec120238d7a116b67ac4ed13dd46149e28329cd1e09a38c7d5d4e560c3f058209cea5d889eaec06b0cc8f11e47af74c8c838b8b6b3bc7db48b65d9db4
SSDEEP 768:aGESJlQyjtkugrpUTpAhza2Lc8eV5BVU3:r40tkugrpUtAh/ctV5BVC
TLSH
T1D5032A039A86409DF4020370152A2B7BC67BACB01B56A69FBF40FD796CF61A2FDB5507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
Size 21.7MB
SHA256 86d3d5b15b0a85a25f326efe0c90a6d71363b542e5469409f51ff90d89182021
MD5 e503d59efb63cc76676b5f05132f96de
SHA1 64b8a856d0224b196746e25535c3d0b14c47b8fe
SHA512 9fcf6ad945e88d424a730923c6d2d56182992e81c879564223baaa3e3abfff620bb7d598f359846a60b6662f7f4c0fab788d4ce4a584cce4155b15dfe6caa9c6
SSDEEP 393216:HmZZXkt1aJlbPmYRQK7+E6vCqSQ4AtAVBjP1zqWp8EIeLxmUh/iL1uo2acnX4Mz8:HmXXkfEbrRQ9v3StyAVBr1zuVaxmEihr
TLSH
T1D137333AB8C48367F4E25534C491E2F2367453755F734AEBC6CC6068C6E32C5B8BA5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\update.exe
Size 2.4MB
SHA256 40c7413e9268a77878516d85964d6e79529071e6162ff46152902408fa398b2f
MD5 4349df4f97051d057aa6cfee33f8cd69
SHA1 9765557e4db1491171be585f77da74e09b1a062c
SHA512 d2129f974d818f65d0fa83c2d8f7d2bdf708dcbd1de4fa2be5eddb44e9214f24e1167cec8abf48c960ddb517a581efa758c1dd1addcc2aa23c5043532d517a1a
SSDEEP 49152:+Nm3GA8jL4bjEFShY5tI3SyWq22K4wNWvp55TZ7a9LTYZGn:JWA8jL4bQFShY5u3iAK4IWvP7C
TLSH
T15DC5BF03F7C280F2D95A063911B7673F5E369B114328CAC3DBA0AD659D712E1A63F399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\MSVCP140.dll
Size 439KB
SHA256 c8e7456f4ac9aa65ef3ad61a6daf30efec9737344d173b2d6d2c16e752052a55
MD5 996d01ad6a71761f29a98ec9e9f30007
SHA1 85aae459210739b2d24f24cfa1a42ccfe6478514
SHA512 6b145328a61bae1ab8be7ca9aa07e04eb06924cd2d24a8513b6415dfe112440016e21ce24ba69d8cc0fcadf9de5276b7b7961b9c0a91af4e03a0009521c41013
SSDEEP 12288:gLvZIuv8BgcjA1V+S/ZxInmJ3F9so1viTIoFxVdhUgiW6QR7t5s03Ooc8dHkC2eT:Uvnv8BgcjA1V+QxInmJDt1viTI6xk03N
TLSH
T195A429327B464DF1E58A13B971C6472293F9FC250361E3C3A3EEE0152F666C5A673681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\VCRUNTIME140.dll
Size 81KB
SHA256 9d8d21022ff9d3f6b81a45209662a4f3481edc2befae0c73b83cf942eab8be25
MD5 55c8e69dab59e56951d31350d7a94011
SHA1 b6af2d245ae4d67c38eb1cd31e0c1cffb29b9b2c
SHA512 efb2ac1891724df16268480628eb230b6ee37ed47b56d2e02a260559865cdd48ee340ce445e58f625e0f4d6dbdc5bfb7ce2eeedf564b837cff255ef7d1dc58cd
SSDEEP 1536:ygQmqDRK9IfURwL67cuhH6poqPpep4yW3UecbiEI+/z3SnC:yg+DRGI86L6gshupXUecbiEZ
TLSH
T171839E11B8D48273C16E09B90679F913AA3D9AA10FD15ACB6FE898885F75BC1FF31113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_asyncio.pyd
Size 56KB
SHA256 c60416af400ee4a75b957de9c19f1e50af7287c89bbe0b3d6a3f0c0829daaf4a
MD5 87ec92f3a05fe07a087d5137d218386f
SHA1 840b88107ac72c5752c6db422a54fa3459f5a3b6
SHA512 a0c1501bd19759ffd471edc5b92f48a7d3b69ec9e257e03f74f5ce574776c6d927c58a1f6460455ed096c0e538a673528a16723dfda6303fe831e2ca672bb1ef
SSDEEP 1536:1+fUoUOEILO3wK2mzhE7AjtZZooIhsnqE4IyU:1mb9ETH27AjtZZBIhsnHl
TLSH
T1B8432B01BB1041B3EBD514B471E9976EBC39A0204BA81CF3AEBB88DD2D619D3737A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_bz2.pyd
Size 75KB
SHA256 a9de8848c95518434cb5c2a9cb9d648cba140021e49f2e5212becf13a329b5d0
MD5 387725bc6de235719ae355dfaa81e67c
SHA1 428b74b0bf8acd04eb20dc5a016352042c812c7a
SHA512 bed2d6902f2ddd7dc7c2043c210ce682df75616ca63d163b756559dc7d33e926733f96d5407dc856061fba711ce41de9b01bb7b9db3940fa359c32c40d9f8233
SSDEEP 1536:JhprX47L9xGzMItCX3TeM3VpMS8bEfMSPhgoIh4VO57yAJV:prILGzvtApPMlbEfMSPhJIh4V+X
TLSH
T1FD737E10F1D143B9EE9A207022E9E63BE139E7315750C9F3D7A6A5381F44BE3A63461B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp39-win32.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_cffi_backend.cp39-win32.pyd
Size 152KB
SHA256 e0b4077369feb905a05fa5935b69ca1d444f4e266b7821d6d22fe1a82a6eab8b
MD5 534322673977f23c6989fc5e7b479602
SHA1 35f3f9906cf7f452c6409def55eb69f49c8fc027
SHA512 e8aac3c2c1fdbbc92f5b451c40ce71af99a64e65236404083a1b26177f8b149adeca3a505d33b571b8f411d57ff91b28648a5b5231c4ca364b5a87954bbbc9ca
SSDEEP 3072:rpSZLf4Bb7bN0+dbFRhrONhpuEwlu55pPX3U7fxyTL3qY652vkV:dALfF+dZRhr9lu555X34xyTL6YQ2vu
TLSH
T1B8E37C42A78E5232D4CF18BE525647B36D2F51245BB387D37C4A5CE424246F3AA3F38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_ctypes.pyd
Size 112KB
SHA256 34371eb9b24ba67ce6803d965cf5f0fe88ef4762af648ec2183e5bf21835d876
MD5 aff88d04f5d45e739902084fce6da88a
SHA1 6ce6a89611069deaa7c74fa4fa86882dc21b5801
SHA512 8dd8f90ae1cc0fbc76f0039bc12e1aee7b2718017f4f9b09361001bed7b278b84f20d0fffceda4d5edd8744140cfdf1ca52497645d0480f5d42934f7df9808ba
SSDEEP 3072:R6ZhWhJX871l4U2iGCWTNi/Y6TaYyfQFIhVPAd:R6ZhWhV8hl4UVGCWQ/Y6OY9Hd
TLSH
T149B35B01B645A079EAD210FF9A955D72793F742B4FA514F36AAC39D009B0BE32F39306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_decimal.pyd
Size 224KB
SHA256 21034f441ffdea24ad10dbbce5ba440c2135bb809695dfbeb2d860325135bc61
MD5 680d0a29b8ad9cdb2ddd8d6b59e2fecd
SHA1 8ec37f37622d29d3025bc6007dfb11ff3ec31a07
SHA512 f2a96fb98f2c4ec544b3bc0d289139ecc08b8e53140380d8cfda335d367f6465a7557161a8ca18944d11b2b1fd3a1d1eaaa27ed8c003b0b0b57c5c960846b47b
SSDEEP 6144:msuoKV+WLd1xuFApxHQqr9VDpULt4uq6xx3XMW5ghURiCDy:msuPV/B1xuFApRB9VDpGBhRiUy
TLSH
T18D248B21F643D5BAE4E611B842EF58FEA5BC013083DB84DBB2D10DE5AA909D37379346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_hashlib.pyd
Size 50KB
SHA256 7ad484e99ea33e4eea2cbf09203fb9dbd0c2c325b96e6cf2ffd146156c93bf7a
MD5 fdfa235f58a04d19e1ce923ca0d8ae19
SHA1 4a1178ba7e9a56f8c68dc3391a169222c67237e9
SHA512 0fe187e1019c159c0ee90fbc8eea20e40a28ff05223321d04784e577b60a2c0a3a476fabc71bd81dd08e7a127bb6cb03edf5d604bfdda38516fb2c90148dd118
SSDEEP 768:qDFREPs4F+obFSt14eCGZNwooIhsIgeY5aWDG4yGB:qBREPPjFgGbGZCooIhsIgl5yGB
TLSH
T1B5331A04B94042F1DFF540B4BAE88FF7AB64B91007E4A1E7EBA780F90E614D36679716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_lzma.pyd
Size 157KB
SHA256 ce2ea2c96afd8c0cf97fc55130f835b6625a0772d86b259ea82bbc0b3def75e6
MD5 f6b74ac19fb0601a4e612a8dc0c916e3
SHA1 d4a77386caf7f70e66d5ec4543c8d9de0e4bc39f
SHA512 0b60c51f76eb6872000d92bbec7fdabf687f5096fd12f1456cf26ad6033c22b998aee94842fda800288bef94790608204f97a7ed034544a1377cbf9722c6a826
SSDEEP 3072:YQbrG4x8aGnqtAzLUZCjOHEwif0EKUYjaQWhUuwCpMx6f3YxIuG1WczHf69mNoU6:Y0CSGnqtAzLYUYjaFySf3KSCYOh7/m5m
TLSH
T1C9F34991A942F5E2F2960CB8D2B95FBA59FD0405132491D322CC1BAC91BF7F32976B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_multiprocessing.pyd
Size 25KB
SHA256 f87547427b693640e45b8fc51a2efbaca75e6f915e5516f8ea81ebe010e0f89d
MD5 d165a01fe4f19ba9cb74b9aff5c79d80
SHA1 f78083226d6b37c7c3ecca55a0ab8f2227b5f6ef
SHA512 efa96cee1721ba2f374d31766d720f8bccd34fdec206849cb9ddcf1b149f0a6068ef23aecfa8e2a092d08f3b7db46c0e3e1cf2d891a999265110404f934ce226
SSDEEP 768:q5r1mLjVsyurIqVqH8Zyo/YIIhkt0iWDG4yT:qd1AjVsyusqVqH8Z5YIIhktyyT
TLSH
T190C24B02BF2015B2DBA6047135E19E57EE79B6110BE4C4E32F6BC2850F656C37D3B62A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_overlapped.pyd
Size 37KB
SHA256 dcf4ebaacf2fa99d9310bf21e1f18eb7fb6f4d02f7731b3542403ecab9748ac6
MD5 6ad0656b55a9a4d0544d295b8b54a5e5
SHA1 5b0ba4d95bb325aef33971ebceee0d86fee80df0
SHA512 86ad66151556a9ff882befb8c2fd2e51e846078b3e3b34b1e7bf5e5e43f74bee62e111b0c79f6a0580dc6e27b37d7f26aec91bc6240687e7fd8a70b9601f8b0e
SSDEEP 768:8QRxaR+snvsqf3B445M8IYX76IzLknphEwIhJtlWDG4y8FcH:EvsqvBNh6IzLkjEwIhJtAyeG
TLSH
T1180319C0A61D40A3FBA6057875F06E239A2CB7E01BE0A5EBA7EF825D4D705C37635316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_queue.pyd
Size 24KB
SHA256 fa262ab8fb1caf23abf125e1b9d69c78727be3d8274e13ebe83e71f1058406d3
MD5 9cddd43f5b53ab8993e46b24b68d8424
SHA1 7327ed8baf41f86d122137c511656f98d99ff990
SHA512 9661968a986af5495bb3632e0a658885933ed733d64785627597456a5cef9521359a078f64af78464675698aff8f4b3cf844a56a8adbe4d69d4abe8fba3ca542
SSDEEP 384:7xOd2Ul+TQ16uQVxGjCJC46rs/Hyqnjm5+Jk8AIhqUKICnYPLxDG4y8UU:w2UJ1LmJv6rsvyCZJk8AIhqU+WDG4y4
TLSH
T1D5B26C42FF2055F3D7E504B039B48562AA39B7205FA488D36B1F81012F646D3BD39A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_socket.pyd
Size 68KB
SHA256 5407750d69d74318ec66bd1464558c07c06c6aa9edbc0641cd2dd7533378772b
MD5 a9450642d8832893998bd213d98d509b
SHA1 3ef416ffaa438a2809cdffddd1b2717461ead7d4
SHA512 93027a694800d2d92ba773e8232ee016946ee9b36ba211537619df0508e9f50660b9a292d29dd4e90c2406b29bd3b1f8e4eb2226945b7163b2bd3227d4482323
SSDEEP 1536:2wsZqpUsZJMD9f8+2eJOWnnCtx8AIhVwjAy0:2wsZHEMD9f8LeJOWnCtxFIhVwc
TLSH
T1B7632A01E6116273E7E2007131A59F67BF28A78023E4D9D767A78C9A5A724E3F63D343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_sqlite3.pyd
Size 66KB
SHA256 666ae58d7b4cc937fd545701a28d3a851b0662e4e188585ebe46da2afdeba1d0
MD5 3e99b9f5e359f0836c6540b06399f5f1
SHA1 c2bc0c777626455c19d16ea06a004dd5d83338cc
SHA512 89a9574166748e8cbe80f90c8470367dde8aee2753f5307723a247bdb6ae4e5b07a520271e263df2642545178a32fbd2e54738b16b9e5951c516cc25420821d8
SSDEEP 1536:1cM5aeRi5EgiaVbprWJhFCw0HF+gEo5/ooIhsQlijRD9DmyOS:7lRi5EahKFCw0HF3EoxBIhsQlijf
TLSH
T19D631611EA0164B1F7E90772B6F54BBB682DA83037F441D76BAF94940D706E3B23A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_ssl.pyd
Size 138KB
SHA256 dbceda1c97bfc8f6a0d1d17df6a2d7e1d44c59718cd652e0a5975052b218c590
MD5 620f8f46eed249f7a7881656ad22062d
SHA1 709c772808ff2e894cdf1066c28287e92fc643c5
SHA512 2bc2674603db7e29005b84b5de9cefa98737ebbdab5f5a034856c26099872e6886c8b6a41f2cdb2bb52a84ae1a15ae21b6394e1fe6820ba4fe0c7d88f3b1511a
SSDEEP 3072:9Q5mo84/dO5YvxwqdJnPusRyCjqvwJX+JIh47RkFwWw:9Q5mo8BiVdJnPusRnqvwJuMQ
TLSH
T143D35B04F7406AE6DEDE80B9A1605767AB5D8120F36692D387E378D38E396C3DE34352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_uuid.pyd
Size 19KB
SHA256 f12a7102bcbb9ca5f57d13474f8da916ad42a9a4d8c8b22be24ee3b6916f54e3
MD5 8f3020f3fc4ab65c2cf9191f38749d26
SHA1 61838e10f152fa7d1632fddf7646de4c669e9036
SHA512 8113095d7e344bb163a7759e059db97671636a57fe008d2eb64aded4fe3d7c44403941ac36a520c17bf8cd9a8aab8d8324e138014249b23fad03b10140d7b8e1
SSDEEP 384:ikhBx3PIjBm5eTgoIhHwP6nYPLxDG4y8G8I:dDx38ZTgoIhHwCWDG4y+I
TLSH
T153923A86EF6019B3EB6B05B135F0DA27EA34FB404EA48862774E82451F55782BC3792D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zoneinfo.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_zoneinfo.pyd
Size 38KB
SHA256 ac8485d550a33c95416660d726e0a1c8efe97a33d58ca01854b41c311c978d00
MD5 c734721481c088a699907fcb8762f47c
SHA1 12a488630f42b41da1359746257804c19d8bb9f4
SHA512 8cf9e0fb918c3fe44a8fcf4bc57505bf3e811f2cb7e9d86071a56b955ee0ac043f6c69e3cb6187344f5dfd385dfa0ef3774db0e168e0ee41176f4bb81263ffbf
SSDEEP 768:2qAPGajXfvgSOdDloRLJvFUeONUCX3hrooIhjX/bXutWDG4yku:2pGartOdgFYUC3hrooIhjXDXby5
TLSH
T155034B11AE9369E2EFDF11B432D59B6FAD31A52007D184E3B37659C41E209C3B33A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\base_library.zip
Size 822KB
SHA256 15c4c5b53589aee564d00496ed3a88d21d5cd82f16324b258e9caaa34e3056e5
MD5 c1b3b5cf32b9a0505be9af7bd59f410b
SHA1 2774e124e9dfe88597ecd98b64d5a905a44fda56
SHA512 5f36d50c5eb378cf53f1662bd552e5609459463cd90a1733bace113cd14c3b5bddb76f111e84d4c2a101f730add6bed0071cd375d6b094d3024d2feaa255db64
SSDEEP 24576:YHkqBcuQcosQNRs54PK4ItxVwHEfVEeoZE0v:YHkqBc5cosQNRs54PK4IQD
TLSH
T1530508407AA26ED7FD09F27D412ECA1C4A6A5239DB48D203794FC3983F4B3E01E76959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\libcrypto-1_1.dll
Size 2.1MB
SHA256 3a2dba6098e77e36a9d20c647349a478cb0149020f909665d209f548dfa71377
MD5 aad424a6a0ae6d6e7d4c50a1d96a17fc
SHA1 4336017ae32a48315afe1b10ff14d6159c7923bc
SHA512 aa4b74b7971cb774e4ae847a226cae9d125fadc7cde4f997b7564dff4d71b590dcbc06a7103451b72b2afe3517ab46d3be099c3620c3d591ccbd1839f0e8f94a
SSDEEP 49152:vqtV0Gvc2Sv/g8pwfBq1CPwDv3uFh+FWg:ytVzvlAg82fBq1CPwDv3uFh+
TLSH
T15DA59E02FB971692E9CF827D11EB573F4E3626189328CAD38EA138A5C8755D0363F794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\libffi-7.dll
Size 28KB
SHA256 0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57
MD5 bc20614744ebf4c2b8acd28d1fe54174
SHA1 665c0acc404e13a69800fae94efd69a41bdda901
SHA512 0c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b
SSDEEP 384:l69PtXvz8cLBN3gHhY4AFlfIvDzqig2c2LuRRClfW23JLURlV5uH+6nYPLxDG4yG:l65tXvz2CTIvy2c26A35qYvWDG4yG
TLSH
T139D26C429F0550F2FFCDA93A70A99B3AEE3ABB001BD180E787365A515F44AE1617C14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\libssl-1_1.dll
Size 525KB
SHA256 44a228b3646eb3575abd5cbcb079e018de11ca6b838a29e4391893de69e0cf4b
MD5 697766aba55f44bbd896cbd091a72b55
SHA1 d36492be46ea63ce784e4c1b0103ba21214a76fb
SHA512 206957347540f1356d805bf4a2d062927e190481aadc105c3012e69623149850a846503fca30fc38298f74d7f8f69761fddd0aa7f5e31fedb1fa5e5c9de56e9d
SSDEEP 12288:BoMMi2+5vtmTnJ0byTZK7AbY5R5yTueRpmJU2lvzn:Bu3+9ID9bYQTDTmJU2lvzn
TLSH
T1AAB45C52FB825AE2E8CD857A65AF53BA0F3D67242314C8D34E911975CDB12C2663E3CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

top_level.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\pip-24.1.2.dist-info\top_level.txt
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\pyexpat.pyd
Size 164KB
SHA256 0d8ac2a2b81176a06b0fb8663702428d2cdd5bedeab68b04210bf5cb6b49a475
MD5 3e43bcc2897f193512990e9e9024111b
SHA1 11dec8c9a1c4b45de9c980125eaef462038c1f2a
SHA512 e629f23a9ad1274b57a47b170e598e47f28984dc2aaf4985ded9b217f4288222190eabe5a9fd4b11fa3eadb42040d8a532090544bf46be288b7310966d126aac
SSDEEP 3072:Ivl6CXfDILP8WDLAkuRM6phOFn1vSGixOqjZa8CFIhVhUh6:RCXfULP8WD9fZF1vSGixza8Co
TLSH
T189F33B21B843C07AEAD3003AB6BA0BF3997C4B91076F54F77E50696D89634D33A39356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\python3.dll
Size 57KB
SHA256 34da45b57baec57d1193901d24e9dc9dd23eeccd0776b016072b311df1ff8379
MD5 dd07013785e2bb606293fc3ec6467fcf
SHA1 400a7f393708ccccc44e6348e88af0689afabb45
SHA512 c06a280f89b172f91973954bb461fca1cfb6b0d0c654afe94ae1f801ff18abde36a436959979e98f41ca9dcaec2846f81279aab8701b7941f141367c2a080268
SSDEEP 768:fiaruQdLgvfpzVHBlAUcfc0la6WS6kH/ZFJ1Yu+wNBECaOMyCgUhkb0EjG78AIh0:fidQf+ki8AIhV0syKtC
TLSH
T160436F426954FCA3E7EA2DFF79D19DC964E912CC812684DCA57992C30F5A233AD2730C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\python39.dll
Size 4.2MB
SHA256 c69ce89b0487d86a63b64951207781f8051282afde67b20d3b8374c1a067f611
MD5 2a9c5db70c6906571f2ca3a07521baa2
SHA1 765fa27bbee6a02b20b14b2b78c92a880e6627e5
SHA512 fa4a677eaae2d258ac4f083a4e7009d985523b964ada93f53dc399a88c14970c7be2d2f39a7b38a922b58d134df2ede954554dcd00a4895e4273161867acac53
SSDEEP 49152:eAZ6+QW4qwnqyxt/kJZNfTwnqmbU/IEZsHXMMZn5P6k9iJT1uVavrH2JY:P8XefGqGHEyH8MZUksaMvKJY
TLSH
T16B267D31A9427174E8F524B3A3FF4AB34CE98C59672AD0C3A6C57CC446712E366FA14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\pywin32_system32\pythoncom39.dll
Size 526KB
SHA256 427eb21b7100e453d19f6c9a557beeba7f06097d0d33da78cdb2f970b2f16a96
MD5 266bf47153d9ae3f8fccec73352469c0
SHA1 eaec57989150d326371a178bad5ca67f61c8d15f
SHA512 f110f827c7dac1a1cdcded7ddef804e4ff06768fdbe74e2da1aa7200a63ba9f53040b89094242b6635df37dcdc50768954601d04f9659bf0452833e5b2176d86
SSDEEP 12288:q5zXKM+n1M2wnmZPa+P9ZSv+h9sYyNpd5eo:ALKnde
TLSH
T1F4B46C20B696C770FEAE31BC2E9569BF5397D584237162C385694C565CB38C32F3AB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\pywin32_system32\pywintypes39.dll
Size 106KB
SHA256 98318db0bfaf550d99c9c122b47a97b1dcd2f6cb6eb59730cba0efb49f34af9c
MD5 50e4d0a4043f786f19d917f67c112d83
SHA1 cc88626016bd4facee38ed9adcd7cf1148cb0407
SHA512 c340299da911a2e8d7401853c2442b6380590b7f9f02c31debd666af35797872eab4bfbfa77cfdd1f1c491c3419bc21ccad5dceabfd6600cf4a72e23e28893d1
SSDEEP 3072:xhOCgoiQ8xccyz2TDrp9ua0q/fo4tYPbLNrTJDKdc70fGZi:DgK8Scyz2+a0q/fo4tYPbRnJDKO70
TLSH
T14BB33A20B74389BAEBCA833A199567771665A10487A0D7D3CB539093AC723D79F3E307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\select.pyd
Size 23KB
SHA256 b8da64fa424e5fb2bc8de93d2c0dcb55076cd9345452d3c624b3fcbbbe15644b
MD5 1559cf3605d62c03d6ff2440ea3e175f
SHA1 26faec2bafd8523d1705021d06c56947b58cda1c
SHA512 1891a356ae98a09a7476697b6e7dd0de6b940043910a9aa414e17a523118d76dd0c55ea786d9bd2a77d792bdf95a75b272352eb813d928c429a707a78c09f05c
SSDEEP 384:fjhpMgzg7bVhbw7YjGonqcDYCfPBPW5Wsk8AIhqGWnYPLxDG4y8XYZqE:rhp47JhbUonq+Vpsk8AIhqGWWDG4yJZv
TLSH
T15BB25C056F1034B3EFE40CB030E1AAA7AD35B7200AD4C8E77B4E5A401F656C3BD7A16A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\sqlite3.dll
Size 1.2MB
SHA256 87ccbecec04d63e0bae4b00d4868a21db05252c64aec5d16ada0a9af9a124dab
MD5 e8c567815296192441b9746855c08cec
SHA1 9c8a7b334bcd82a5e8eff6ec3e347e4a523141b5
SHA512 aaa5718eb27a7ff8d973ce3947d5fc9a3a7baf57add27b8971507aa732642eeb31cfac4bfea7bd64c8e7f25979e25f8170fe8eae346b0148b348a13134e3a89f
SSDEEP 24576:u+43Pp+Wq8n9RNmgbkfJaAP5PScQoe+Qbt12g2oJU2n2WvOo1CO08o96mf:E/p+Wj1mgQMAcT1Jdr1896s
TLSH
T154456CE2E98381B1E9E621B143FE2AB71C781219C72494E394E81CD55EA05E3773F7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\unicodedata.pyd
Size 1.1MB
SHA256 1ccf9fa395e963daf8aba5a2acd68c5b13ee04b6b689a601652bcf04e7f25f8a
MD5 bd51c8fbb9bfc437e19cb19042bfeae8
SHA1 8e537acb5a5f421ae4290681ed7d295ac8e86ca2
SHA512 6dd7041ee42dc2f67eef5efb0eb519dfc79cb19293693d9fb6e60e4cff374e3f955f7e09c8d9526fb5e1a3014875bd09a712d397a7068ac0900c6f8b754d8e6d
SSDEEP 12288:5+3VQCb5Pfhnzr0ql9L8kUMmuZ63NKM7IRG5eeIDe6VZyrIBHdQLhfFE+CW5l:5+3jZV0m9suVMMREtIC6Vo4u8W5l
TLSH
T130355909BEC24EE2E88B067940D3117B2F61C1720F1B6B4B76A5532D9C763A74EE653C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\win32\win32api.pyd
Size 101KB
SHA256 d18aac0acc64a5bb670d3dc4d82033a84d1411e0d32ed0c7f1819760f7b25425
MD5 9bd844254690f978884d24a4f2163184
SHA1 f41c8756f38becd7712bd7f5a4b956d1c682b2b1
SHA512 1453d6d233c8390edfcd4e4ccbdcb1c34a153555d0f8cc00d75c98e8e51791213c068227dc545ab7bc8046e3a5fa9df6ca83900ea50b042824286a683826450b
SSDEEP 3072:4FXdS4F97xY5pdqxQHKLRiVhVFhLqN6/2yymj/GqKNaMeP6qO:4FXdS4o9pVhVl/2ybGqKspRO
TLSH
T155A33C82FBD41041C2DB453E27569E37133F50548FE20AD35D70A9CA6869AEF6B3CB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gr4jvqzi.vjp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gr4jvqzi.vjp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1876-2-0x0000000002E20000-0x0000000002E30000-memory.dmp

Download

memory/1876-25-0x0000000002E20000-0x0000000002E30000-memory.dmp

Download

memory/1876-0-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

Download

memory/1876-1-0x0000000005500000-0x000000000559C000-memory.dmp

Download

memory/4256-35-0x000000006EFF0000-0x000000006F000000-memory.dmp

Download

memory/4256-33-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-36-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-37-0x0000000005710000-0x000000000598E000-memory.dmp

Download

memory/4296-71-0x000000001ADD0000-0x000000001ADF2000-memory.dmp

Download

memory/4296-63-0x0000000000290000-0x00000000002A0000-memory.dmp

Download

memory/4576-135-0x0000000000590000-0x00000000007F3000-memory.dmp

Download

memory/4576-291-0x0000000000590000-0x00000000007F3000-memory.dmp

Download