95b9fd9cd78145463f93f223f2398210ad7aca8c63c801a3f9ddd44a8e14f8d5

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SacredWare (1).exe
Size 42.8MB
Sample260806-2xte8asdra
SHA256 95b9fd9cd78145463f93f223f2398210ad7aca8c63c801a3f9ddd44a8e14f8d5
MD5 8ec1bd3182fd3585a1e66c066ae4580c
SHA1 96e0a7df9a5a9f9b3fb2df6c117fe6dbe62b54e5
SHA512 0a147a3f13fe2189685e023222deef9c76fc6af5aadc2dc9189093a5474dffc70dc48903c4e237c7ad0d8387d113dbf8c46593b7e43db2a056210ae1e75f18fa
SSDEEP 786432:3LljSYGuJGkolExoYvFsRMGGfXmtK4Aj63xFDmWKU09fjZWJat4XwRPCHt4GNU:BjS/kyGoYvFreE4lFyWC9rZWJBgRCN
TLSH
T153A733A0E6692983FCE242BCE8A2DC7176AE3CF51727C06701D8D1635D876D06E3B52D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 27 IoCs

pid	Process
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5800	tasklist.exe
1168	tasklist.exe
3168	tasklist.exe
4256	tasklist.exe
5732	tasklist.exe
2704	tasklist.exe
4836	tasklist.exe
5040	tasklist.exe
3092	tasklist.exe
3480	tasklist.exe
912	tasklist.exe
4952	tasklist.exe
5344	tasklist.exe
4552	tasklist.exe
4560	tasklist.exe
4160	tasklist.exe
4584	tasklist.exe
2928	tasklist.exe
4204	tasklist.exe
3960	tasklist.exe
5352	tasklist.exe
2080	tasklist.exe
4276	tasklist.exe
4464	tasklist.exe
2140	tasklist.exe
900	tasklist.exe
1896	tasklist.exe
5756	tasklist.exe
3264	tasklist.exe
3984	tasklist.exe
3932	tasklist.exe
2092	tasklist.exe
1452	tasklist.exe
1348	tasklist.exe
4428	tasklist.exe
6024	tasklist.exe
2524	tasklist.exe
2084	tasklist.exe
5388	tasklist.exe
4172	tasklist.exe
2516	tasklist.exe
6124	tasklist.exe
1760	tasklist.exe
2740	tasklist.exe
1028	tasklist.exe
1860	tasklist.exe
4512	tasklist.exe
5740	tasklist.exe
4304	tasklist.exe
1688	tasklist.exe
4968	tasklist.exe
2844	tasklist.exe
900	tasklist.exe
3420	tasklist.exe
4896	tasklist.exe
1868	tasklist.exe
404	tasklist.exe
2744	tasklist.exe
1948	tasklist.exe
5180	tasklist.exe
1460	tasklist.exe
5944	tasklist.exe
5572	tasklist.exe
5940	tasklist.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5528	cmd.exe
5584	cmd.exe
2532	cmd.exe
6044	cmd.exe
2732	cmd.exe
4900	cmd.exe
4924	cmd.exe
4804	cmd.exe
2572	cmd.exe
3340	cmd.exe
2396	cmd.exe
1732	cmd.exe
696	cmd.exe
5172	cmd.exe
4404	cmd.exe
1680	cmd.exe
2268	cmd.exe
4584	cmd.exe
4440	cmd.exe
6084	cmd.exe
4236	cmd.exe
5104	cmd.exe
5636	cmd.exe
5096	cmd.exe
5228	cmd.exe
5100	cmd.exe
1260	cmd.exe
4892	cmd.exe
3412	cmd.exe
5560	cmd.exe
1480	cmd.exe
2392	cmd.exe
6092	cmd.exe
1804	cmd.exe
1088	cmd.exe
1272	cmd.exe
4140	cmd.exe
2576	cmd.exe
5408	cmd.exe
4680	cmd.exe
3380	cmd.exe
1132	cmd.exe
5680	cmd.exe
5048	cmd.exe
5284	cmd.exe
2688	cmd.exe
4696	cmd.exe
1200	cmd.exe
4560	cmd.exe
2912	cmd.exe
4664	cmd.exe
5516	cmd.exe
3876	cmd.exe
4972	cmd.exe
1380	cmd.exe
2328	cmd.exe
4412	cmd.exe
5380	cmd.exe
4168	cmd.exe
3616	cmd.exe
2020	cmd.exe
4800	cmd.exe
988	cmd.exe
3472	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1552	SacredWare (1).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1552	SacredWare (1).exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	tasklist.exe
Token: SeDebugPrivilege	4560	tasklist.exe
Token: SeDebugPrivilege	2080	tasklist.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	4464	tasklist.exe
Token: SeDebugPrivilege	3984	tasklist.exe
Token: SeDebugPrivilege	5196	tasklist.exe
Token: SeDebugPrivilege	3168	tasklist.exe
Token: SeDebugPrivilege	404	tasklist.exe
Token: SeDebugPrivilege	6124	tasklist.exe
Token: SeDebugPrivilege	4552	tasklist.exe
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeDebugPrivilege	2744	tasklist.exe
Token: SeDebugPrivilege	1348	tasklist.exe
Token: SeDebugPrivilege	2140	tasklist.exe
Token: SeDebugPrivilege	3932	tasklist.exe
Token: SeDebugPrivilege	4836	tasklist.exe
Token: SeDebugPrivilege	1948	tasklist.exe
Token: SeDebugPrivilege	4428	tasklist.exe
Token: SeDebugPrivilege	4160	tasklist.exe
Token: SeDebugPrivilege	2084	tasklist.exe
Token: SeDebugPrivilege	5180	tasklist.exe
Token: SeDebugPrivilege	5040	tasklist.exe
Token: SeDebugPrivilege	1760	tasklist.exe
Token: SeDebugPrivilege	2092	tasklist.exe
Token: SeDebugPrivilege	1460	tasklist.exe
Token: SeDebugPrivilege	3092	tasklist.exe
Token: SeDebugPrivilege	1168	tasklist.exe
Token: SeDebugPrivilege	4512	tasklist.exe
Token: SeDebugPrivilege	900	tasklist.exe
Token: SeDebugPrivilege	5944	tasklist.exe
Token: SeDebugPrivilege	4304	tasklist.exe
Token: SeDebugPrivilege	4256	tasklist.exe
Token: SeDebugPrivilege	3480	tasklist.exe
Token: SeDebugPrivilege	1588	tasklist.exe
Token: SeDebugPrivilege	5388	tasklist.exe
Token: SeDebugPrivilege	912	tasklist.exe
Token: SeDebugPrivilege	4968	tasklist.exe
Token: SeDebugPrivilege	5732	tasklist.exe
Token: SeDebugPrivilege	4584	tasklist.exe
Token: SeDebugPrivilege	6024	tasklist.exe
Token: SeDebugPrivilege	2920	tasklist.exe
Token: SeDebugPrivilege	2740	tasklist.exe
Token: SeDebugPrivilege	1028	tasklist.exe
Token: SeDebugPrivilege	4896	tasklist.exe
Token: SeDebugPrivilege	2844	tasklist.exe
Token: SeDebugPrivilege	2928	tasklist.exe
Token: SeDebugPrivilege	1896	tasklist.exe
Token: SeDebugPrivilege	3904	tasklist.exe
Token: SeDebugPrivilege	5740	tasklist.exe
Token: SeDebugPrivilege	5756	tasklist.exe
Token: SeDebugPrivilege	1868	tasklist.exe
Token: SeDebugPrivilege	1452	tasklist.exe
Token: SeDebugPrivilege	900	tasklist.exe
Token: SeDebugPrivilege	5800	tasklist.exe
Token: SeDebugPrivilege	2516	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	4204	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	4952	tasklist.exe
Token: SeDebugPrivilege	2704	tasklist.exe
Token: SeDebugPrivilege	3264	tasklist.exe
Token: SeDebugPrivilege	5344	tasklist.exe
Token: SeDebugPrivilege	5572	tasklist.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe
1552	SacredWare (1).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1552	4368	SacredWare (1).exe	89
PID 1552 wrote to memory of 5096	1552	SacredWare (1).exe	90
PID 5096 wrote to memory of 4720	5096	cmd.exe	92
PID 1552 wrote to memory of 2688	1552	SacredWare (1).exe	94
PID 2688 wrote to memory of 4560	2688	cmd.exe	96
PID 1552 wrote to memory of 4900	1552	SacredWare (1).exe	97
PID 4900 wrote to memory of 2080	4900	cmd.exe	99
PID 1552 wrote to memory of 4972	1552	SacredWare (1).exe	100
PID 4972 wrote to memory of 4276	4972	cmd.exe	102
PID 1552 wrote to memory of 2576	1552	SacredWare (1).exe	103
PID 2576 wrote to memory of 4464	2576	cmd.exe	105
PID 1552 wrote to memory of 5408	1552	SacredWare (1).exe	106
PID 5408 wrote to memory of 3984	5408	cmd.exe	108
PID 1552 wrote to memory of 4236	1552	SacredWare (1).exe	109
PID 4236 wrote to memory of 5196	4236	cmd.exe	111
PID 1552 wrote to memory of 4680	1552	SacredWare (1).exe	112
PID 4680 wrote to memory of 3168	4680	cmd.exe	114
PID 1552 wrote to memory of 4696	1552	SacredWare (1).exe	115
PID 4696 wrote to memory of 404	4696	cmd.exe	117
PID 1552 wrote to memory of 5228	1552	SacredWare (1).exe	119
PID 5228 wrote to memory of 6124	5228	cmd.exe	121
PID 1552 wrote to memory of 3380	1552	SacredWare (1).exe	122
PID 3380 wrote to memory of 4552	3380	cmd.exe	124
PID 1552 wrote to memory of 4924	1552	SacredWare (1).exe	125
PID 4924 wrote to memory of 1860	4924	cmd.exe	127
PID 1552 wrote to memory of 1804	1552	SacredWare (1).exe	128
PID 1804 wrote to memory of 2744	1804	cmd.exe	130
PID 1552 wrote to memory of 1380	1552	SacredWare (1).exe	131
PID 1380 wrote to memory of 1348	1380	cmd.exe	133
PID 1552 wrote to memory of 2328	1552	SacredWare (1).exe	134
PID 2328 wrote to memory of 2140	2328	cmd.exe	136
PID 1552 wrote to memory of 5528	1552	SacredWare (1).exe	137
PID 5528 wrote to memory of 3932	5528	cmd.exe	139
PID 1552 wrote to memory of 4412	1552	SacredWare (1).exe	140
PID 4412 wrote to memory of 4836	4412	cmd.exe	142
PID 1552 wrote to memory of 5104	1552	SacredWare (1).exe	143
PID 5104 wrote to memory of 1948	5104	cmd.exe	145
PID 1552 wrote to memory of 1680	1552	SacredWare (1).exe	146
PID 1680 wrote to memory of 4428	1680	cmd.exe	148
PID 1552 wrote to memory of 2268	1552	SacredWare (1).exe	149
PID 2268 wrote to memory of 4160	2268	cmd.exe	151
PID 1552 wrote to memory of 3472	1552	SacredWare (1).exe	152
PID 3472 wrote to memory of 2084	3472	cmd.exe	154
PID 1552 wrote to memory of 992	1552	SacredWare (1).exe	155
PID 992 wrote to memory of 5180	992	cmd.exe	157
PID 1552 wrote to memory of 1200	1552	SacredWare (1).exe	158
PID 1200 wrote to memory of 5040	1200	cmd.exe	160
PID 1552 wrote to memory of 4720	1552	SacredWare (1).exe	161
PID 4720 wrote to memory of 1760	4720	cmd.exe	163
PID 1552 wrote to memory of 4560	1552	SacredWare (1).exe	164
PID 4560 wrote to memory of 2092	4560	cmd.exe	166
PID 1552 wrote to memory of 2020	1552	SacredWare (1).exe	167
PID 2020 wrote to memory of 1460	2020	cmd.exe	169
PID 1552 wrote to memory of 2396	1552	SacredWare (1).exe	170
PID 2396 wrote to memory of 3092	2396	cmd.exe	172
PID 1552 wrote to memory of 1732	1552	SacredWare (1).exe	173
PID 1732 wrote to memory of 1168	1732	cmd.exe	175
PID 1552 wrote to memory of 2912	1552	SacredWare (1).exe	176
PID 2912 wrote to memory of 4512	2912	cmd.exe	178
PID 1552 wrote to memory of 5100	1552	SacredWare (1).exe	179
PID 5100 wrote to memory of 900	5100	cmd.exe	181
PID 1552 wrote to memory of 1132	1552	SacredWare (1).exe	182
PID 1132 wrote to memory of 5944	1132	cmd.exe	184
PID 1552 wrote to memory of 4664	1552	SacredWare (1).exe	185

C:\Users\Admin\AppData\Local\Temp\SacredWare (1).exe
"C:\Users\Admin\AppData\Local\Temp\SacredWare (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\SacredWare (1).exe
  "C:\Users\Admin\AppData\Local\Temp\SacredWare (1).exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5228
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5528
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4664
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5048
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5560
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1260
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1480
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5516
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5584
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    PID:5536
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1088
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1272
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4892
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:696
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:3876
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4804
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2392
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4140
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2572
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    PID:2092
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4800
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2532
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    PID:2060
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5172
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4404
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5636
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:6084
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5380
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:3340
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:6044
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:3412
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5680
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4168
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2732
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:988
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5284
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      PID:5940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4584
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:3616
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    PID:5860
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:6092
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      PID:5352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4440
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq RobloxPlayerBeta.exe" /NH
      4⤵
      Discovers running processes
      PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\bin\MSVCP140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\bin\MSVCP140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\bin\MSVCP140_2.dll
Size 273KB
SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
MD5 3151333808c2c2339d5f5466df70b7dc
SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
TLSH
T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\bin\Qt6Core.dll
Size 10.0MB
SHA256 37fde8ebd11b474b806a1cf8d4564780dc51afdad3ac3611cd0aa92982f73687
MD5 5f2d765db7a8ca979f745e45efffa55b
SHA1 3697d14d7feb8ace74b505a5aeb66c95a0d7563b
SHA512 57b444aea167d191bd5a6915ede644d563422a47fe5db2c869486b2da85e301673ace017848d82612a617e22946fc771485c1a897375d6c354b751626ebf0ac6
SSDEEP 98304:c27iaV09z8lO8KFdu9CwJsv6twYIJMAFXOIflG/3sUV:c3aaYpKFdu9CwJsv6twPSALlG/3J
TLSH
T16DB6390766FA0102F6FBDA34DAB75252DBB27C466B3196DF025861181D337F09E3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\bin\Qt6Gui.dll
Size 9.1MB
SHA256 96b445dd611f30a3e3b938d981c2b13009d65294f48a8ac5f53dde8037132b53
MD5 509c8a23265cda0f229a44a04deed85d
SHA1 0b80db6222e38838864099ec712fa5fce372e000
SHA512 ca54a1db0854276d3d10bff65aaab1b3384428cd6e10c07ab6ba0567aed4557c1b0c3f4ed30137f080dea88f95aefb6e4cde1b216b3149320857e7ab9e802ce9
SSDEEP 98304:7bjnfkPh1x6Y5Hd7cH0TrP7ezfABVAyzsl:7/kPh1AaHxcH0TrPCz2zk
TLSH
T1D4A68D57A2A911D8C57BD13DCB9B9507EBB2700503669BDB01A4CA162F33BF12ABF311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Svg.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\bin\Qt6Svg.dll
Size 625KB
SHA256 2e412afe2e6219ac12a45641f2ac3365edcd47a9e25b8febf3b66e0dbfd16c1e
MD5 7c363557b66c43e3798e36c6d5172505
SHA1 224ea3f9d9e167dcdcbc7299ac9d08b4a582f115
SHA512 b7bac5f051ad130985eeb6e45a619597516b05733fc46b701b22b2f8761f3bfd854574f97f96b96b972cc40908c3aa96302ccb57664c0d52db0165446ece9010
SSDEEP 6144:4P+93FgWHibBa7Oyi1sFCH4IVARxeHjYX8GDcnbG+8a2NoJeBG8ejJvD8Ky2N3c7:4PSFgZbBa7lnIVogsRyy+83oe7uzpI
TLSH
T1B1D45D57B3A60786D86BD13DCA1B8422EB73700403A2D7EF41758A512F63BE12B7D7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\bin\Qt6Widgets.dll
Size 6.3MB
SHA256 48deb69896f3185c8fe21221262670591ddc0ce9e7f2182be682e9f28208f7a3
MD5 312b0584ed2fb19f75a2d2d362179c30
SHA1 887549a1006aa5ab88c01531a1158752229023d2
SHA512 2d50c36ded4b4713d0f80c6304aa5cbd4630d25d0e04d0f470adea267917879fb328ba05bd77f4f04cf0db8b5b327fd61b956eda9c9e0f25f074265f64abd5a4
SSDEEP 98304:fXUkLxWe0sb8bKTGJd4HWJPD82g+HT5EJ:/UwxWe0sb8bKTGJd4HWJPD8J+zmJ
TLSH
T166666A97A3AA0185C46BD23DCB1B8A17EB72700453629BCF0265CE592F737E21E7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\bin\VCRUNTIME140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\iconengines\qsvgicon.dll
Size 70KB
SHA256 95466615e7c0ddb9097e05d3197c98b6774d1e20bbd8e68bae03a82463a57deb
MD5 82cd821c3e456b54bc5724ab4b1b45d0
SHA1 9bf36416fe4919d2544a49cfb911cfc193f8c02d
SHA512 8ad609e25c3e9d20a7c42530b959d3ac3f64b2deeae714f0a3a85391a3a42ec21af5800f10203cf0923d409859ed6166d7aaa886a99380bc051d5e418ff0eefd
SSDEEP 1536:LAaqA/RCDOhLqWyybvXKmZHyHkbaBsGSmv9q3fQJwmAhnf/c7uX:MaIqFTdSHkbaBsGSmQ3fQJwmAhnf/cI
TLSH
T15A636B5367A41488E87BC63DC357861BEE72B41427A1E7CF13A1C8362F63BC11AB8365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgif.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qgif.dll
Size 46KB
SHA256 57a621e4bb912996c44e1713c48d9cd4e013e69a789cbacfee0212639e377929
MD5 cb7e4a46381db3d50dbe9f4514e623b3
SHA1 99e9504b879b23e288cf686a4254301f7612e3c6
SHA512 580f0d348b715ac7048b88046eae6e5135fdcadc9e68b24c2bbd2e34bf6d4d7d2b728413c5a60467bbe9c6f05e0f9ec9bf0d770e8fcbce38d01729ecd393ab1a
SSDEEP 768:epTlEV6wdBj3NpVt/Mqs0KOIEP7sLzhcocTTn5Yiuiw5ALel:QTlEkw3j3XDB/KW7sLzhc1T57uB
TLSH
T1F8237D47ABA044D8D5238234D9964E2EEBB6B5604B92C7DF4221C62E1F337C13E78779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qicns.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qicns.dll
Size 54KB
SHA256 13c3a004cc764f9745cf2f1c6f8ea01d4b4413d90b5ece38c97114afef7bf394
MD5 29b04351e10f66182dac992a92af3830
SHA1 c9943ae486b073b1ebe18c0e5f0245d627e6e49f
SHA512 8dde66750d57f364ca5390b936b6655338677bba2a403eed84b1ee67be60d2405039b57473d4200074cc60b09c5fa11fdff1bdd7747760a29122f410a78d0790
SSDEEP 768:EUF1FANo/raGE1T0EqGFRY/XPScJxaXl6D7gRahpux5YiuiN5ALczi:EUNf+31/qGFRAXTJ8Xg7gRahpu/7uM2
TLSH
T1DD437C17D3948185E416CAB4D64A463AEB72F4021B92DBDF0161C92D2F733E27EBE394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qico.dll
Size 44KB
SHA256 c672bb6b42e36498d448557b5e6700849bfe91f7d6b850273d572907e50002a8
MD5 5949e5541221b18ed70e7efa52b8dafa
SHA1 186680fc3d8ed4177e47542cdd13c27b39307725
SHA512 e5807e943d786591e99822325b86020e60611db81c8afe781fb274933a23ceb13a2c943a0f11b9387a54aa16ce3f3e7f8d7e77b480d3f149cbc3701461ddcff2
SSDEEP 768:hzYsBkjz96XLC2BQXte8pUBHLXeTN5YiuiqW5ALZ:fBkjz967vQde8pUBHLXeTT7uF
TLSH
T156237C93E2680089E927CA78D8974E36EAB6F1615B52C7CF0265861E1F337C23D7C794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qjpeg.dll
Size 563KB
SHA256 9e23bdf567d90159327b6a891cc07378eb0ba185e8bb89deb5f619c80c958031
MD5 e909be09302cc7839f6a561c68c956e5
SHA1 b5bbb950d900972dc3f8c190e858ffbd5df63feb
SHA512 56a23db611ab16d1c6f77836385b21bddfde636e0436fea90dc5978fce72922a6e0378bc9f6f0a9ef5a9c084c671475171d0af0e0285cdeff4ebba5c400d7d39
SSDEEP 6144:ZsAUcdtHTV9rwV0+dBmGKLepJTerfojZ21J1croyXHWS2g5Fr9SHTl/heVLl757N:GpWSf/LGlTAv
TLSH
T19EC43942F6B51841C7A68878DE1AC966EB91781D03F58AF7B2D1CBD53B1BAE07B35300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qpdf.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qpdf.dll
Size 41KB
SHA256 fd33882ca07ce498573a70f90d7cdfdb4442543b88ad1e3052e923de21e1e7dc
MD5 8abf458dcce9242b8e77f2585888a65e
SHA1 3af93c0e71cb96abfa09ff4d36b543aaf1268800
SHA512 aa2cf8fa19cfacd5ae06c797d7608157b81a812e4781eb25cdb827b624e44b424992737d9680631be04d3e6e3207641800490a00f274f7fb7505f45a11309199
SSDEEP 768:ZdeazWvFU8TZczG76yGTVUq/7gyJwonRUtaLwjyDF5Yiui1lBxr5AL0:DjodTlcUq/7gyJwonRUtaLwj0L7ueb/
TLSH
T1EB137C52DB644495E523DA38D4924E1AD9B2F49047A3DBCFA26A811E1FB73C13D3C3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qsvg.dll
Size 38KB
SHA256 39c8c8e4260976e4b92f0daa1565d7a642381c1ca19a6edb6d1e6720163422fd
MD5 dd872fcd6dfa8fb1ccf2ae12111a0fc4
SHA1 004c0cfa001245b8cdd1bc56eaacc4770ba61966
SHA512 e530529b1c9521922efade07de71ea92093ba745ca985f65aebc82fa1eface4ac052dc0a62556c165a8e0a9dd12a845cb1ae4d3f5856facc76fd06e7b5266003
SSDEEP 768:SiT735G/9CkisnkkgyJwSTIY/5lsg5Yiui35ALx:Sc5G/ZiskkgyJwSTIY/5lsy7uX
TLSH
T17E036B57CB640886E427C678E8468E26E573F5604B5293CF6267822D1F733C23DBC39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtga.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qtga.dll
Size 37KB
SHA256 540b5776e53c7aba2f692ef160c19f4f99f8e4d3ca1ddfdeff7a5a42acb4fc3a
MD5 ae04f6c194b4f6f9ffb6febd16c8279e
SHA1 c2e7a5e72ce28853ece9d767edc49bbd6919e92c
SHA512 7cb0b37b5dd6f28ac9d01be8813239d9eb0e1d35dcf13ee1b557c98c2421ec9c84924c9421582b490ede858f6e1064e2f35f6afbee290f9af0d243ec0a90cb6c
SSDEEP 768:lkK60f5ksBeDRXOW7ofNy95YiuioR5ALr:2+usBsRXOW7ofNyj7ua
TLSH
T1DE038D53DB541C85D42BC674A5839E1ADA72F1608B62D3CF62A8835E0F363C23D7D3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtiff.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qtiff.dll
Size 431KB
SHA256 911e5ff45ccc7aa9faf793eda9c82a1a9569c75e1cf516e1f23bfac5ceeb242d
MD5 50a5634894596998d48d94bff64d3eef
SHA1 7932f36b5442ab61f96a30bc7a133a3e94a8797f
SHA512 3097e09e83edea07441a7f089d5d4e6d6b0521b766763553a6148a16647f890f2fec43f58057b625747d2843417a42abaaf40d282a14fee447896a657b5139ec
SSDEEP 6144:o97j7Gro6M0yQB3WRL1yLBD3KmYxH3OvqEpTEEEEEE6UHucQ3DtRez+TzFVN37wo:A68BYmmG6jQ3DbhWW
TLSH
T1C5949405DED049ABD872813955E7C612F2B3F4453B12CB8B9698B1353F127D029AB2FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwbmp.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qwbmp.dll
Size 35KB
SHA256 c06a3050b4507872ff60dcb1fe4ec5171e979daa8001d30dc16cee74b1668030
MD5 ed10c83e7044272b455ba321b585b8e7
SHA1 d614638bf7260d9e204736afa32589150965b1e6
SHA512 b61b20b552beaacbdc58411a145901d13f5ada42c7c70efc4c867951644792e4d4ec34ce2f707efd0ab4c5d3f6867a4478a786f7f3b09b04b50f81411b28180b
SSDEEP 768:taVooyFmtxsX2xyMKGnOYoJN5Yiuioa5ALY:sLyExsX2xyMKGnOYoJT7uvS
TLSH
T10CF26C63DBA45881E527CAB9E4868E2BDA72F5600B52D3CF1276825E1F323C13D7C395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwebp.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\imageformats\qwebp.dll
Size 549KB
SHA256 c3cae477790b021c4c5fac5aad6ded3574dfd27d25556d319b0bb7af182ea7b9
MD5 2e8c13e23c96886f6af2b113ceb2b28d
SHA1 953ffa6d55c1f679fd3cc2fc99baa4e28c876f5a
SHA512 641218f5ed39ff9e37991c330b0086f6f472a1f9559ad2884571fef28ba4cef07f7a4554ba0903b77628fdc84ebea11d4e617afce318ddccf175e78ae8f3d804
SSDEEP 12288:XWhkkMhPwLrLrLrLWCYNVh5+6Z9mxkn51819:XWhBPLrLrLrLWCYNVhA6Z9mun51819
TLSH
T186C46C8ED99623D8D49BC4B89AFD961BF6A53C1C434095EB17D0B9293B33BC05637B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qminimal.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\platforms\qminimal.dll
Size 60KB
SHA256 b4220c0f5bdc7fadd1db68cf4cf270ed0f28206aa6006e2f38aeeacf2d56f7d3
MD5 ad5804230bac68c388b232c2d12e48ae
SHA1 d8ad0be250f53ad24cc9ffc59e519392cac17e12
SHA512 0493680a0e57807bbf651bbe649646f452c2c19ce4aa3e922f829d6b86dace21695bec1e4ac0f15456ddcf22ce7ae22ad53677b9297fbae5129ec65972a56669
SSDEEP 768:HRkPddegaLP/vo/b13x/vIK7Z8J8PumoSK52wmhRrIPiZ5YiuiT5ALj:HRkbar4T13xXIK3RIPiH7uD
TLSH
T1505319425A360495D83A8B3B80D74E166435F2240B539BCF702B814E7FB9BC2397D6FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoffscreen.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\platforms\qoffscreen.dll
Size 111KB
SHA256 6cef891caf15f82be0e564e5167ea1aafb039f9f9becca6fc18d9967c0475784
MD5 e94aa0132e82cfba9863682fd6c1cad5
SHA1 a2b0ee744b69f05b823d4fb1cc8c6cfb4dd81ddb
SHA512 440eb871b43bcd7c2903778017e4237b3411aa8c34da060c148eebbeb9362db6a6245e58b276d5fa9912ba5bb577204aa6607d844872bd61473996adbec01c9b
SSDEEP 3072:Eh64KOpNdP6DPiIQQEDJMUdWEpJw1Q+QXcN0H:EhbZnmKrJMyWEpJw1Q+Qsg
TLSH
T134B3395226750085D836DB3AC2C74926E736F0140723DFEF615A811A6F6B7D22E7C3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\platforms\qwindows.dll
Size 976KB
SHA256 a6076030a5f0bf1b9254b0999e5260f66b1abd3b51214777e47a7c2e1d7cad81
MD5 bb28abed91f21118c61792871db975ec
SHA1 1e5a9d0f64cc2b5951ff0b7957c67d5bb5bbdab4
SHA512 bdcd9561fc30b41bd136a45af7fbe1cd5df620617825afce732d947186e6adcaee80d522e5fc5065da5e888e925f7157b97de314dd81011c3907589120da8d60
SSDEEP 12288:BdFZEVZQUIghAOuuscwgQyKwLfwQaiTcFG0utFjXdCGepSBqfe4d3:BzK2ghAOuus1b8fwgcA0utv77QfeS
TLSH
T194257E1B67A80255E83AC07ECF5B8712D6B3705903A186DB4161CE1D7F33BE22A3DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qmodernwindowsstyle.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll
Size 223KB
SHA256 e6902591acf14d9a9abb96130eea6a1b5b6ee4dfb3d3908d40135f3dcf085e51
MD5 ac8e60c96932f56ac18437fcd2ea03d8
SHA1 22bb266116a4c8a957af2451b88c0a9a6706f137
SHA512 8d6417a256c43dbc56d87a0fde76e288eb1f1d447d0deacd7703ab32758d117da03657955bd1880c658daeaf69956ea2e46f747d14fae02d17a332a141c19b3e
SSDEEP 6144:/p/d15GJ6UUfX/Bsco23KdRHF0db5GJMypUCQyJwoKe9lvqRquNthTFr:/p/P0J6UUnBsc5
TLSH
T1E7242803729216C6CD67C278C90B4523FAB370544366DAEF4166CEB42F633E2BE3A655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\QtCore.pyd
Size 2.5MB
SHA256 91dd5166110b88a4f4d3acda6fe6c10ed699882dd3602328a59e9f656cc766b1
MD5 477f328e542a3011dda5ec0d05cec056
SHA1 6eb9462d209b082b51799772189217fbfa72493e
SHA512 5dfba0251bef13bfad126e45176d59eaacc64696ef0beed3f2e0d159a984a61bb836d5b3f6a36e3273f4be3ea113021a9e408c5aa1abfc8a68687aabb9cad597
SSDEEP 49152:h2/N8Ur9xjjUrJy7GdQrdMS6VyOzkAk0KmL/8rluepkD6M5hEFFRTX7Wqyh6cnEX:YjUrJy7GdQrdMS6VyOzkAk0KmL/8rlue
TLSH
T107C51753936520C8C0EBE639C61B460EFBF270550762A7EF05788B982F27BD5563DB88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\QtGui.pyd
Size 2.2MB
SHA256 cf5ae37fd119fb29a53f1f2cea1362fdf036d940191be45d83da0f98ce8752b8
MD5 68419c7c16a356368bf5fce460282a7c
SHA1 47bfdd2cba43fc3a36b5b272da1f5a4c1459b30e
SHA512 819ea145012c62a83e8488172a6d2c236c2f69121a7be736d7745a51381ef123cf0b7ab101f2a807771622e2c901e6447c19f50945c558e2ff4d3256bf7cddb0
SSDEEP 49152:BAmjthDOIwQU1Uv6qw7wfKdMg4WBlTPy+HaDQ0wtAK73jiJtj4tVtxfa4NrENax:UhUvDw7wQ
TLSH
T1BCB5E66393652088D0EBD63D842B460EFBF2706113A266DF05794BE87F67BC5593CB88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtSvg.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\QtSvg.pyd
Size 49KB
SHA256 542d023e993274d9a8c54135fba79cbeb0a99934b04bd47ae181413b55581684
MD5 b610b0e76aecbcb8ffac994ed2f840e5
SHA1 986f793b0e2b3ca293ae8d903fc878fd1741f16f
SHA512 0df66a3f3222eeb94936a9a09f8088cfa059a8b73f6102f29896d01706d692993af1894d699dd4b914a0bf725512acb6f229677f3e2270773e8e760c0a2fce42
SSDEEP 768:mUg0JHXCwKTZxr6V2KL5FyVuHe1pUDNiNVhhpOnTQi1jXAAI:rHXCT54jyVuHe1pUCVhncTQi1rV
TLSH
T13133D553A3416088D0E7863CC86B0E1ABAF2F455139A57DF066403EF6F67BC5993EB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\QtWidgets.pyd
Size 4.8MB
SHA256 4f81361816e94e1ae05f178085b22d5b9b19e417713b1966dd481a4017aa3b21
MD5 a1a3f9d449ac15577ac07b9f7e225f5d
SHA1 9bdd0508688c642c74b772fa923a7293339e55c8
SHA512 0748df098a6e40d461e5436d86368666fb6b6ac875dea344404bd0b15813665f186a2c3bd581f004ea5c82d6c759cad75ac6f19f845a43ad0e9285782eb8d96c
SSDEEP 49152:edW8I4zpIoqkn0ZXrJZxzaOhWtbd13LrYxA/NCNNWAl5YKm3VWI3Y7l3eh5vINxB:ec8zIIYxAEe3WpKgOK
TLSH
T13436B3039B5A60C9D5EBD13ACA9B520DFAF230A0072657DF0C6A1B992F73BD0853D794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\PyQt6\sip.cp313-win_amd64.pyd
Size 108KB
SHA256 3f36d67b20f505dde46032f79d5e384ef3ba34faed586ee086f5827867f6bdb0
MD5 83002b8e706b8bda5a2d38673cd016a7
SHA1 cd1bf7eacd4179d3185f1835967576ab1b4b0ffe
SHA512 1d759932cb828abdf503ae653b720356dfde2ad01aa4d13bd5f02ebe67e200f0dbff99ebd32c664a8df4d55f2c822772411f852eec264003fc7841d2ac7534c7
SSDEEP 3072:sMHthrQvtcLk5bEusk2g8tI3d9/xqiETKb3:shaY5bN7vcIZTETKb3
TLSH
T117B3295673D500C9EAA6517C89336517D3B2B0A02B10ABCF01A4C35A2F97EE63EBE751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\base_library.zip
Size 1.3MB
SHA256 d7807df373cd87523a5eb77b3d2cf66d1385d191a97b5da81587ca63a660f84f
MD5 f4b2c959eac563cdc56d6a49d23fffa9
SHA1 69fef048bc763b83352d6214b01fdff6d7deaab3
SHA512 5a93db314c88ce070f9bea9ccd0931807433b0de44adebb71502de7419913f3487ada68a280278d42592078362cb159b145860f0e3d23e5af6021ee6ab5baa45
SSDEEP 12288:v9RbCirjuOBa80201jwCVRDVoioSYBDL+DZtYzGNcT1xwUudjdT/W7WpSi2cPPdT:X3z5SeT1xwdZe7WpS5cPPdxhY6nbL
TLSH
T1CE551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cr.ico

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\cr.ico
Size 66KB
SHA256 ac4908cf37de5ed0badbda56ddf493423c95ee4b20ebba2572c7b301396dca8f
MD5 ef004da26cbce993bbeb704116f30b89
SHA1 9947e1a976eedc2f27d4d8b04e72bbfaa025fd23
SHA512 00c2bf7aab1f7f1dc464a5e94ae5742c7e7f9db475d89cdcc875c24695939751a05bc69f745c6ccdaa02a8bb3d7bc3efb32a69cb9c1123faf55652b2e5a80811
SSDEEP 1536:W2H2kuKfFe37ezkuYdHJCc5VjZPvZXqaLV9VQv7mEEA:HW5oK7ezkOkrPBqECDmM
TLSH
T10B6302EA331152F2CC461431BF360D3E4A9C13427B2EE67085E7DD78B67E98029B5E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\python3.DLL
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43682\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1552-242-0x000001EBBABF0000-0x000001EBBAC00000-memory.dmp

Download

memory/1552-232-0x00007FFE898D0000-0x00007FFE89F1A000-memory.dmp

Download

memory/1552-236-0x00007FFE91390000-0x00007FFE915C9000-memory.dmp

Download

memory/1552-231-0x00007FFE8A850000-0x00007FFE8AD2B000-memory.dmp

Download

memory/1552-215-0x00007FFE93590000-0x00007FFE9381F000-memory.dmp

Download

memory/1552-263-0x000001EBBABF0000-0x000001EBBAC00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads